By Peter Deane, Microsoft  Enterprise Architect

Executive summary

‘Consumerisation of IT’ is a term used to describe growing trend in which organisations are increasingly allowing their staff to select and use their own devices for work purposes. Those in favour see it as a way of  liberating their employees, increasing creativity and loyalty, and as a tactic for restoring work/life balance and enabling the recruitment of the brightest new talent. Opponents, however, believe it leads to inconsistency, manageability issues and information security risks. The truth is somewhere in the middle: many employees at all levels enjoy being able to use state-of-the-art consumer tools including slates and smartphones rather than traditional business devices, and they deliver clear opportunities for improving collaboration. But strong governance and recognition of the potential knock-on effects are needed to ensure that benefits are not lost in a chaotic environment where IT leaders have lost control of their estate.

When two worlds collide: consumer and business

The consumerisation of IT is a trend that has gathered momentum in recent years and refers to the ways in which the consumer sector and business sector are converging. It is used as an umbrella term covering many things, including allowing employees to buy or bring to the workplace devices of their choice. This will sometimes replace being given designated computers or other devices, but it can also supplement the traditional model. The IT consumerisation tag can also be used to refer to the way in which some companies (or individuals) use consumer software and services such as Facebook and Twitter to accomplish business tasks.

This paper focuses largely on the first aspect as allowing staff to select their own devices is a highly visible change that can lead to clashing opinions, ranging from those who consider their consumer devices vastly preferable to those who regard consumerisation as a dangerous trend that can lead to disorder and compromise security.

This article examines a recent Microsoft White Paper in which the authors propose a structured approach to tackling the challenges created by an influx of consumer devices in the enterprise, and adds knowledge gained from Microsoft Enterprise Strategy consulting engagements with customers who are experiencing these challenges. The White Paper, Strategies for Embracing Consumerisation, explores ways of reaping the benefits of the trend while maintaining data security, establishing new roles for IT, and empowering employees.

For IT to be able to embrace consumerisation, risks to the enterprise and its data must be minimised by assessing and understanding user needs and device types. Also, IT should work with the business to define their goals and agree what represents value. This may simply be an improvement in user satisfaction but even that must be defined, benchmarked and measured.

The boundaries between professional and personal lives are being redefined. Users no longer work only within their offices, but often check email late at night and update personal web pages during the day. Users are demanding freedom and IT needs to figure out ways in which to help them maintain a balance between work and personal time.

Demographic changes are also fascinating. According to research (2), 45 per cent of millennial workers say they use social networks at work, regardless of employer policy. Older members of this category (aged 23 to 27) spend 6.8 hours per week on email while younger members spend just 4.2 hours, preferring IM and SMS. Chinese people in this category spend up to 34 hours per week on these real-time tools compared to workers in India, Europe and America who average 11 hours.

The consumerisation of IT in action

Computing power is now available across a wide range of devices with the office PC accompanied by laptops, slates and smartphones. These are now often powerful enough to be able to run office applications and, as more services become browser-based, raw computing power is often less important than bandwidth.

For many workers, consumer devices can allow them to do their jobs more efficiently and the highly managed IT infrastructure can seem a restrictive environment by comparison.

Many members of the workforce prefer to use their own device at work and pressurise IT for support. The challenge for IT is to be able to embrace consumerisation where it is appropriate while at the same time minimising risks. Often these devices were not designed for enterprise use and management controls are needed by most organisations. Companies should evaluate how to ensure their employees can be productive wherever they are, while still protecting data, maintaining compliance, and enabling adequate PC and device management. This puts the onus on IT to balance the competing needs of empowered users with a strong governance regime.

Examples of opportunities and challenges can be found in healthcare. Hospitals are major creators of personal data, and medical staff need access to this data wherever they are on the hospital site. This need is often answered by mobile data carts and there is increasing pressure on IT to enable medical staff to use more mobile devices. However, privacy and security requirements set specific challenges and highlight the risk that mobile devices may provide access to data about patients.

Another example can be found in law firms where highly motivated individuals are attracted by the intuitive nature of touch-screen devices which are usually easy to use, instant-on and lightweight. Yet lawyer-client privilege is sacrosanct and loss of reputation, or worse still a lawsuit, would make the benefits of a consumer device pale into insignificance. Consider how you tackle these issues first before moving sensitive data onto insecure devices or providing access to secure networks without device checks.

Factors for success

There are several factors to address if consumer devices are to be successfully deployed:

• Assess your users. The first phase assesses what consumer-grade applications and devices your employees are using at work today. It will also be helpful to create a profile of your end-users and the typical scenarios they encounter. Depending on the individual user’s impact on the business and their needs, you may have different levels of tolerance. The recent Smart Workforce Segmentation Helps You Better Identify and Meet Worker Needs Study, conducted by Forrester Consulting on behalf of Microsoft in February 2011, can be used to evaluate how other midsize-to-large organisations are distributing technologies, what drives these decisions, and how they affect the business. One note of caution: for many enterprises this may be the first time they have tackled the job of understanding their inventory, never mind documenting scenarios and profiles, so don’t underestimate the effort required. Even an enterprise with 6,000 users can have over 1,000 applications in its portfolio.
• Understand content and information sensitivity. Content varies in information sensitivity. Air Commodore Tony Boyle expresses this nicely (3) when he suggests that often we need to build security around an airport model (where all-comers are welcome but access to areas is strictly limited by role and credentials) rather than castles where every form of defence is in place but the default position is complex  and expensive to maintain. For example, some users may deal with confidential legal issues, whereas others may deal with information that is intended for a public readership. Similarly, some information, such as sales contracts, is highly sensitive while other data, such as marketing brochures, can be shared using consumer technologies such as Windows Live® SkyDrive® without risk.
• Recognise device types and application needs. Individual devices are not good for all tasks and one size does not fit all. Devices without keyboards may be inadequate for data creation and PCs generally provide the best environment for data creation and manipulation tasks. The challenge is to match work profiles with the right device.
• Define the criteria for a successful solution. Consider what benefits there will be, and how these benefits will be measured. Plan to protect sensitive data, allow data access and sharing, provide tools for application delivery and access, and deliver a centrally managed environment through technologies such as cloud-based applications and services and desktop virtualisation.
• Update your organisational policies. Your policies should reflect your solution, requiring collaboration beyond IT. Areas such as data classification will require legal counsel and finance departments will need to tackle the tax issues of benefits in kind and issuing cash allowances when users select their own devices or bring their own devices to work. Occasionally, the consumerisation initiative is driven by the HR department which has an interest in providing a modern, dynamic environment to attract the best talent in the industry.
• Provide implementation and development resources. Ensure you provide sufficient assistance to support and develop the delivery of applications and data across multiple platforms. This will affect the likely costs and timescales for the successful implementation of a consumerisation project. Be aware that adopting a consumerisation strategy or implementing a ‘bring your own’ device model will not cost the enterprise less. Invariably it will cost more and increase complexity and risk. If the only driver is cost reduction, you are almost certainly making a bad move.
• Pilot your solution and plan for continuous improvements Use highly motivated volunteers who are keen to create a consumerisation strategy. Do not expect to pilot just a single device because it is unlikely to suit all users. The first iteration of the programme will probably not be perfect so ensure that the programme drives business value. It should not just be a way for particular users to get “cool stuff”. Roll out the programme to all employees or to those you have identified as most likely to benefit. You will need a benefit realisation programme to identify the positive impact on the business of proliferating consumer devices and applications, linking benefits to business improvements and strategic goals.

Conclusion

The consumerisation of IT is a very real trend that is being adopted by many organisations, particularly those going through a period of change. Positive outcomes may include employees who are more engaged, productive and creative and a powerful aid to recruitment. However, it should not be viewed as a cost-saving exercise and, like any change management programme, strict governance and measurements must be put in place to gauge success. By noting best practice in this relatively new aspect of IT and people management, organisations stand to improve their chances of success.

Next steps

The consumerisation of IT is a powerful and far-reaching trend that requires long-term strategic thinking. That thinking should be done by CIOs and also by other business executives, as a broad consumerisation project will have a significant impact on many stakeholders and will potentially affect attitudes, working patterns and processes.

To help you succeed, the Microsoft Enterprise Strategy practice can provide an engagement based on Microsoft’s experience of working with customers undergoing IT consumerisation programmes. This engagement can review and deliver strategic plans as required and a financial business case designed to accelerate and support effective decision making and the alignment of stakeholder requirements.

For further information, visit: www.microsoft.com/services/strategy

References:

(1) Strategies for Embracing Consumerisation

http://download.microsoft.com/download/E/F/5/EF5F8B95-5E27-4CDB-860F-F982E5B714B0/Strategies%20for%20Embracing%20Consumerization.pdf

(2) Jumping the boundaries of corporate IT: Accenture global research on Millennials’ use of technology

http://nstore.accenture.com/technology/millennials/global_millennial_generation_research.pdf

(3) AFCEA-UK London Newsletter http://afcea.org.uk/london/AFCEA_London_Newsletter_Dec_2009.pdf