Who makes the decisions?
Agree on responsibilities, priorities and provider boundaries. Keep the rules and decisions connected to the work.
Ask: Who approves, who carries it out and who checks it?
Programs / Technology Review and Planning
Technology review and planning.
Understand what needs attention, decide what comes next and give the work an owner.
Start with a review of the work your technology needs to support. RDA connects the findings to the way your organization works, the people responsible and the money available.
Guide + programs and practices: under 10 minutes
ManagementPriorities and responsibility
SoftwareApplications and information
NetworkInfrastructure and continuityDaily support connected to the longer-term plan.
01 / Start with the work
What needs to keep working?
Talk with the people using the systems. Find out where work slows down and what happens when a key person or service is unavailable. Include the applications, information, equipment and providers they depend on.
Check what is actually in place. Who owns it? Who supports it? What has been tested? What is coming up for renewal or replacement? Give missing answers an owner and a next action.
A backup is something you have. A successful restore that staff can use tells you whether it did the job.
02 / The RDA method
Agree on the work.
Then carry it through.
Technology Portfolio Governance (TPG) connects needs, options, risk, cost and available capacity before work is authorized. Your organization keeps its approval and funding authority.
- 1Intake
Need and owner
- 2Assess
Options, risk and cost
- 3Authorize
Scope, funding and approval
- 4Deliver
Implement, test and accept
- 5Operate
Support and results
- 6Review
Improve, renew or retire
Review brings results and changing needs back into the next decision.
Programs establish requirements and responsibilities. Practices apply expertise within that scope. The RDA Program Framework connects decisions to instructions, training, evidence and review. The Service Matrix relates the work across Management, Software and Network.
03 / Security review
Six areas to work through.
NIST's Cybersecurity Framework 2.0 provides the government reference. These are RDA's practical questions for its six functions. They work together; they are not a sequence or a score.
Look for a recent record, example or test. Treat anything you cannot confirm as unknown and assign the follow-up.
What does the work depend on?
Know the systems, information, people and providers involved. Record the gaps and risks that need attention.
Ask: What is missing an owner or a current record?
Are the safeguards in use?
Check access, account protection, updates, information handling and staff instructions against the agreed requirements.
Ask: Can we show that the agreed safeguards are working?
Who notices something wrong?
Agree on what needs monitoring, who reviews alerts and how staff report concerns.
Ask: Does each report or alert reach someone responsible?
Who takes the next action?
Set response roles, contacts and escalation. Practice how staff and providers coordinate and record decisions.
Ask: Who leads when more than one provider is involved?
Can staff use the restored service?
Agree on recovery priorities, protect backups and test restoration with the people who rely on the service.
Ask: When did we last demonstrate a usable recovery?
04 / Why RDA
We work with or as your IT staff.
An embedded, outsourced IT department.
ManagementPriorities and responsibilitySoftwareApplications and informationNetworkInfrastructure and continuityDaily support connected to the longer-term plan.
Your staff need someone who understands their work and follows through. Management needs to know what requires attention, what it will cost and when a decision is needed. We bring that work together.
We can take on the IT function or work alongside the people you have. We get to know your staff, systems and providers and help maintain the knowledge and records needed to keep the work moving.
Technology Portfolio Governance (TPG) helps us work with you on what should be done and when. The program framework gives agreed work a way to get done, checked and maintained. Support, security, projects, replacement and the budget stay connected.
Recommendations start with your needs, with no allegiance to a particular vendor or solution. You should be able to see what we are responsible for, what has improved and what decision comes next.
05 / What the plan shows
Enough information to act.
For each priority, we would want the service and need, the reason it matters, the owner, the options and cost, the next action, the acceptance test and the review date.
- 1First 90 days
Confirm the starting point, agree on priorities and test a manageable piece of work.
- 2This year
Prepare the decisions that need funding, coordination or staff time.
- 3Longer term
Look ahead at renewals, replacement and changes in the organization.
Dates follow the authorized scope, funding and capacity. Review the plan as the work changes.
The plan should show what changed, what remains unresolved and what decision is needed. A completed project still needs someone responsible for the service it leaves behind.
Foundation and government reference
RDA's Technology Portfolio Governance (TPG) package, Program Framework v1.0 and Service Matrix provide the foundation. The security review uses the six functions of the NIST Cybersecurity Framework 2.0 as its government reference. The explanations and diagrams on this page are RDA's own.
NIST also provides an editable Organizational Profile spreadsheet for comparing current conditions with intended outcomes and identifying gaps.
Applicable obligations and technical requirements are confirmed for the organization during assessment. This overview does not establish compliance or local approval.