IDENTITY AND ACCESS MANAGEMENT PROJECT QUALITY ASSURANCE REPORT #1

IDENTITY AND ACCESS MANAGEMENT PROJECT QUALITY ASSURANCE REPORT #1 APRIL 30, 2017

May 9, 2017 Heidi Geathers, Deputy Chief Information Officer Washington Technology Solutions 1500 Jefferson Building Olympia WA 98504-1501 RE: Identity and Access Project Quality Assurance Report #1 April 30, 2017 Dear Ms. Geathers: Sightline, LLC was contracted by Washington Technology Solutions (WaTech) to provide Quality Assurance (QA) services to the Identity and Access (IAM) Project. Sightline s assessment of the IAM Project is based on the professional experience and judgment of its consulting team. This report was prepared independent of project participants and stakeholders. Thank you for the opportunity to provide QA services to the IAM Project. Please let me know if you have any questions or comments. Regards, Kathleen Nolte, Principal Sightline, LLC cc: Ginny Schenck, Enterprise Project Office Manager Blackhawke Marshall, Project Manager Kathy Pickens-Rucker, OCIO Consultant 855 TROSPER RD. SW, #108-147, TUMWATER, WA 98512 360.264.7715 SIGHTLINELLC.COM

EXECUTIVE SUMMARY Identity and Access Project The Identity and Access (IAM) project, Phase 2, is well under way. The project is positioned for a successful deployment of the technology as a pilot, although there is little framework provided for documenting the pilot processes in a way that positions the team for future phases. The primary risk to a successful implementation at this time is that project staff time is being diverted to other projects in the cloud enablement program, increasing project schedule risks. There has been some confusion regarding the scope of the pilot and whether it includes all the work necessary to bring in other customer agencies. The team is working with project sponsors to develop a common understanding of what work is to be included in Phase 2 and what work will be addressed through the Cloud Enablement program in the future. At a minimum, the team is planning to document business process changes and develop templates, etc. to document the learning from the pilot. These project assets will be used in future work to implement IAM at other customer agencies, but it is unclear whether this work is considered part of Phase 2. New Recommendation #1 Clarify which customer-facing artifacts are expected to be delivered from Phase 2 of the IAM Project. The IAM project is implementing a business process change related to hiring new employees. The change, originally approved in the initial decision package, creates an Active Directory (AD) account automatically when a new employee is hired. This requires that the hiring authority and HR staff create an HRMS account prior to an employee beginning work. Currently this account needs to be created within the first few weeks of employment rather than before the person s first day of work. This change will also require a manual workaround for AD accounts that are needed for non-employees, such as contracted workers who require access to the state s computing environment. There has been little communication to the customers regarding this business change and it has not been vetted through a formal communication process. Ensuring WaTech has an approved plan and communication strategy regarding the HRMS change will be critical in gaining customer approval. New Recommendation #2 Determine a strategy for implementing the HRMS changes and develop corresponding communications and instructions for customers to complete the revised business process. The project organization, staffing, and project management framework is appropriate to the current phase. Project funding is limited and will need to be monitored closely. The schedule is aggressive, staff resources are limited, and project staff are being deployed to other projects, in addition to IAM. Protecting the project resources for the next two months and ensuring that IAM work has the highest priority will ensure that the team is ready to onboard other customers at the beginning of the next biennium. New Recommendation #3 Protect project staff resources during the remaining two months to focus on completing the IAM implementation. Page 1

I. BACKGROUND Identity and Access Project The Identity and Access (IAM) project is designed to establish a consistent, statewide means of identifying Washington State employees so that agencies and individuals can easily and securely access needed resources wherever and whenever needed. Integrated identity management is foundational for state agencies wishing to adopt cloud-based applications and services within a secure enterprise environment. The IAM project was first proposed in 2012 with the goals of reducing the cost and time to deploy enterprise applications, and to rethink the design and structure of the state s enterprise identity store. Since then, agency demand for cloud services has increased dramatically. Neither the state s technology community nor end users want to manage multiple accounts and passwords across different applications. Identity sprawl and shadow IT is a significant security risk to agencies and to the state. IAM s initial focus on modernizing the identity store continues to be valid, but now has the added dimension of providing a single identity and password for secure, seamless access to applications both on-premises and in the cloud by state employees and the public. Washington Technology Solutions (WaTech) provides state agencies secure access to shared information, email addresses and telephone numbers, and allows access to applications. These services are made possible through the use of Enterprise Active Directory (EAD). The EAD environment has grown significantly over time, and has become highly complex as it has been modified over time to meet the individual needs of 32 agencies. As a result, it has become a fragile environment and difficult to maintain. In addition, there is no uniform approach to adding, updating and deleting identities. This has created a significant manual administration effort and decreased the security and accountability of the identity data stored. The legislature authorized the IAM project in the 2015-17 biennial budget. The IAM project establishes a new enterprise identity management service that will enable state agencies to seamlessly use cloud services. The IAM project incorporates two major phases: Phase 1 Planning (July 2015 June 2016) Complete Phase 2 Implementation and WaTech Pilot (July 2016 June 2017) Phase 1 of the project was established in January 2016. During this initial phase, the EAD Steering Committee was reestablished to provide guidance and input into project activities, a preliminary design was completed, a gap analysis was completed, and a recommended approach was established. The goals of IAM Phase 2 are to: Begin a pilot in the production environment within WaTech in order to validate the service and document needed process changes for use in future agency implementations. Partner with early adopter agencies and EAD governance groups to prepare their agencies and develop informal use cases for production implementation of IAM features. Upgrade WaTech s current synchronization software and Active Directory Federation Service (ADFS). Page 2

Identity and Access Project Implement Hybrid Identity between WaTech s local hosted EAD and the cloud-based Azure Active Directory (AAD). Remediate and standardize AD attributes to make the EAD a valid, authoritative source for employee identity data for enterprise applications and cloud service implementation. Enhance the EAD structure of the directory service for cloud implementation, high availability and cross-agency collaboration. II. QUALITY ASSURANCE RISK DASHBOARD The QA Risk Dashboard provides an assessment of project risk areas that have the greatest potential for impacting or delaying the project in accordance with the OCIO Policy 132 Project Quality Assurance and Standard 132.30 Minimum Project Quality Assurance Activities. Assessment Areas Overall Project Health Governance Risk Level YELLOW DR Quality Assurance Risk Dashboard Summary Comments The IAM project is progressing towards a June 30 Phase 2 completion date, although some project dates are scheduled through August 2017. Tasks to implement the solution are well under way. Technical staff are working on multiple projects, however, which could make it difficult for them to complete all the technical work needed to complete the WaTech implementation of IAM by the end of the biennium. It is unclear whether business-related change management tasks are under way. The team may not have sufficient resources to develop templates, etc. for use in future implementations. The project team and sponsors are working together to develop a shared understanding of the goals of Phase 2. The executive sponsor is experienced in technology and system implementations, although she is relatively new to state government. A project steering committee was recently established. It includes the appropriate stakeholders. Many of the same individuals are also members of the Cloud Enablement Program steering committee. This provides useful interaction given how closely entwined the various projects are. The project has a project sponsor and technical sponsor who are capable and well positioned to direct the work and remove roadblocks that may arise. The current project manager has extensive project experience and is moving the project forward as appropriate. Page 3

Identity and Access Project Assessment Areas Minimized Scope Time Cost Quality Human Resource Risk Level YELLOW YELLOW YELLOW Comments The technical implementation of IAM within the WaTech environment appears to be well defined, and well understood among project staff. The project s communication with external stakeholders has been limited so the value of this implementation as a pilot may be limited. It is unclear whether there is a common understanding of work needed to document the procedures and processes used in IAM implementation and translating those to templates and guidance for future implementations. Performance measures are documented in some project artifacts, but it is unclear whether these remain current. Measurable metrics have yet to be established. A high-level project work plan is in place and updated with input from technical staff on a regular basis. Based on the current schedule, IAM Phase 2 tasks will conclude in August 2017. Although most work is to be completed within this biennium, some milestones do not. These dates should be synced up with the investment plan prior to final submission. The funding provided to the project appears to be sufficient for the staffing and infrastructure needed to complete the project. The funding authorized by the Legislature, however, is not sufficient to provide licenses for all WaTech staff. The impact of this is expected to be small and the project manager is working with the budget office to develop a plan to cover the cost of the additional licenses. The project recently revised its testing approach to ensure that all testing would be accomplished outside the production environment. A change to one component in April caused some issues that needed to be backed out and redeployed. The testing approach appears to be appropriate. The planned organizational structure (as defined in the project charter) identifies appropriate technical staffing resources for the project. These same team members, however, are also being deployed to other Cloud Enablement projects, which is increasing risks to the IAM project delivery. The team may need additional resources to complete needed external stakeholder work and to develop model processes, templates, etc. Page 4

Identity and Access Project Assessment Areas Stakeholder Communications Integration Risk Procurement / Vendor Standard Infrastructure Risk Level YELLOW Comments The team is also working with the WaTech Human Resources department to work through process changes related to the Human Resources System (HRMS). The project has reengaged the Enterprise Active Directory (EAD) Steering Committee, comprised of CIOs from other state agencies. The state agency technology community has not been recently engaged in discussions about the value to the agencies of upgraded identity management. Developing a clear understanding of agency needs and potential impacts to agencies of a new approach to identity management could have implications for the goals for and output from the IAM pilot being conducted in Phase 2. The team is preparing a road show to increase customer communications. The Phase 2 Project Plan outlines the project s communications strategy. The strategy outlined is robust as it pertains to the technical stakeholders. It may be helpful to incorporate the team s communication strategy for working with the business owners (who will need to understand the impacts of IAM on their business processes) and external agencies. The IAM cloud solution requires several tools to be integrated in order to provide an entire solution. The importance of some of the foundational tools such as IAM is not widely understood by customers. WaTech can increase this knowledge by developing strong communications that educate customers about the needs and uses of each of the tools. The project has laid out a structured and sound approach to risk management in the Phase 2 Project Plan. According to that document, risk identification and management is a shared responsibility of all team members. This approach includes a structured approach to identifying risks, maintenance of a risk log so that all team members have access and input into risk management, and processes for escalating risks. It is unclear whether the team is adhering to these defined processes. The Project Plan defines a procurement management strategy that is appropriate to the size and complexity of this project. The project manager is responsible for overseeing all IAM Phase 2 procurement and vendor management activities. The IAM cloud solution is new to WaTech so staff are learning new tools resulting in some increased risk. As the solution matures, risks related to newer technology should decrease. Page 5

Identity and Access Project Assessment Areas Formal Methodology = Risk is the same = Risk is decreasing = Risk is increasing Risk Level Comments The project is being implemented in a hybrid Agile approach. Multiple work streams are occurring simultaneously and they are making use of some agile processes, although each work stream is being addressed in a waterfall lifecycle approach. The team is continuing to work with internal customers and the executive steering committee to define their minimum viable product. Some more standard agile artifacts and tools are not currently being used, such as creation of a defined project backlog, use of burn up and burn down charts, established product owner role, etc. Assessment area is at LOW risk for impacting scope, schedule or budget Assessment area is at MODERATE risk for impacting scope, schedule or budget Assessment area is at HIGH risk for impacting scope, schedule or budget Page 6

Identity and Access Project III. PROJECT PROGRESS FOR THE MONTH OF APRIL 2017 The IAM project is progressing well towards implementation of a fully functioning identify and access management module. WaTech has engaged experienced, professional technical staff for this project. The agency has also established an Enterprise Project Office (EPO) to assist technical staff in planning and implementing projects. As the state s central service agency for technology, WaTech has an enterprise-wide view, and is responsible for setting technology policy for the state and access to technology leaders at all state agencies. Project Implementation Initiation and planning Project initiation work is well under way and will provide a solid framework for the work ahead. A to be high level design is complete and guiding the development of IAM solution. The original Phase 2 project manager drafted a detailed project charter and project plan that, together, provide a common understanding of the project scope, organization, budget and roles and responsibilities. The project manager left shortly after Phase 2 started, and a new project manager has been appointed. It is unclear whether the previously drafted project documents will continue to guide work under the new project manager. The project management plan has been drafted and provides a more detailed discussion of the strategies, plans and tools that will be deployed in the project. It addresses the project s approach to communications, change management, risk and issue management, defect management and quality assurance. This is a well-crafted draft document and is a useful tool to ensure all project team members and other key stakeholders have a common understanding of the specific approaches the project team will use to successfully deliver the expected products. The team is in the process of completing the planning and initial activities. An investment plan has been drafted and will be finalized once the Readiness Assessment is in place. Some of the planning materials are at a high level but given the progress made to date, and the short timeline left for finishing this phase of the project, they are appropriate. Execution Phase 2 includes the integration of several applications and tools necessary to set the foundation for the Cloud Enablement Program. Enterprise Active Directory (EAD) provides an identity store for access and authorization. Human Resources System (HRMS) - provides the state s current identity store. Microsoft Identify Manager (MIM) provides identity and access management lifecycle management. Azure Active Directory (AAD) Premium provides a bridge between the cloud-based EAD and on-premises authentication applications. Other tools including domain controllers, databases and migration tools. Progress is occurring on all of the work streams and the team is confident it can meet implementation dates in order to migrate WaTech employees into the IAM Cloud environment by Page 7

Identity and Access Project the end of June. Using WaTech as the pilot will allow the team to learn and apply lessons during the migration process. It will also allow them to determine processes that will support customer agencies that migrate during the next biennium. There has been some confusion regarding the scope of the pilot and whether it includes all the work necessary to bring in other customer agencies. The team is working with project sponsors to develop a common understanding of what work is to be included in Phase 2 and what work will be addressed through the Cloud Enablement program in the future. At a minimum, the team is planning to document business process changes and develop templates, etc. to document the learning from the pilot. These project assets will be used in future work to implement IAM at other customer agencies, but it is unclear whether this work is considered part of Phase 2. New Recommendation #1 Clarify which customer-facing artifacts are expected to be delivered from Phase 2 of the IAM Project. Organizational Change (OCM) The OCM strategy and plan are not yet developed. Assuming the migration to the new environment is well executed, WaTech employees should notice very little change. Business processes should remain the same at the employee level. However, one enterprise-wide business process change is planned that will impact all hiring authorities and human resource (HR) business staff. The project is implementing a change in how new employees and exiting employees are managed in HRMS. Currently a new employee is hired and one of the first steps is to set up an Active Directory (AD) account so that the new employee can access email the first day of employment. The AD account is not linked to other employee records that are stored in the HRMS. This lack of connection between the AD and HRMS accounts has caused several issues. First, the employee name may not match between the two databases making it unclear whether an employee is the same person. The AD account may not contain the employee s legal name so duplicate accounts can occur. The current process requires manual intervention to create the AD account separately and to inactivate the account when an employee leaves. The new process will create the AD account automatically when a new employee is hired and entered into HRMS. This will require that the hiring authority and HR staff create an HRMS account prior to an employee beginning work. Currently this account needs to be created within the first few weeks of employment rather than before the person s first day of work. This change will also require a manual workaround for AD accounts that are needed for non-employees, such as contracted workers who require access to the state s computing environment. There has been little communication to the customers regarding this change and it has not been vetted through a formal communication process. Ensuring WaTech has an approved plan and communication strategy regarding the HRMS change will be critical in gaining customer approval. Developing a clear understanding of agency needs and potential impacts to agencies of a new approach to identity management could have implications for the goals for, and output from, the IAM project. New Recommendation #2 Determine a strategy for implementing the HRMS changes and develop corresponding communications and instructions for customers to complete the revised business process. Page 8

Communications Identity and Access Project The state agency technology community has not been recently engaged in discussions about the value to the agencies of upgraded identity management, although the project is now developing a road show for increasing communications to the agencies. Agencies are most interested in implementing packages that will increase efficiencies and cost savings. Identity management in and of itself, does not immediately improve efficiencies as it is a foundational component that customers do not see directly. Without a clear sense of benefits and an understanding of the need for the foundational pieces being put in place now, customers may grow frustrated and impatient that they cannot move faster in implementing Cloud applications such as Office 365. The road shows should help WaTech communicate needs, timelines and benefits to agency customers. Project Controls Project controls are informally managed. For example, formal status reports have not been completed since October 2016. Although status is documented in email or meeting minutes, it does not provide a high level of transparency to project stakeholders. Formalizing a status reporting process and posting them as required on the OCIO website may provide a higher level of confidence to stakeholders that the project is making sufficient progress. Project Schedule Phase 2 of the IAM project began on July 1, 2016 and is largely expected to complete by June 30, 2017, with some remaining training and closeout tasks completing in the next biennium. This is an aggressive schedule and presents a low to moderate risk to the project. Much of the work is overlapping so it is important that the team identify and monitor key dependencies. The team has made significant progress on the implementation of the new Identity solution and upgrades to existing services. The EPO has dedicated a project management resource to the team to develop and maintain a project work plan for the IAM project. The team meets weekly to review project status. This will continue to be important to ensure sufficient staff resources remain available to complete tasks according to the project schedule. Project Staffing Given the timeline remaining to implement the IAM solution, any delays would likely impact the team s ability to complete the work on schedule. Staff resources are limited and project staff are being deployed to other projects, in addition to IAM. The project manager and project sponsors have identified this as a significant risk to the current schedule. The project has mitigated this risk somewhat by working on multiple work streams simultaneously. The project schedule is actively monitored through weekly status meetings so that potential delays can be identified and addressed early. Protecting the project resources for the next two months and ensuring that IAM work has the highest priority will ensure that the team is ready to onboard other customers at the beginning of the next biennium. This is important as other agencies have expressed a sense of urgency in moving to other solutions that are only available in the Cloud (e.g., Office 365). New Recommendation #3 Protect project staff resources during the remaining two months to focus on completing the IAM implementation. Page 9

IV. Identity and Access Project PROJECT INITIAL TIMELINE AND MILESTONES The chart below reflects key project tasks and activities that are either under way or concluding in the current month. It is not intended to provide an exhaustive list of all project activities currently under way. Milestones, Start and Finish dates have been updated to reflect the Master Schedule and are subject to change as the Master Schedule is revised. Milestone Update Governance Policies Security Design Review Requirements Gathering and Associated Documentation MFA Requirement Determination As Built Final Design Planned Start Date Planned Finish Date 1/24/2017 7/25/2017 9/2/2016 7/14/2017 1/4/2017 4/26/2017 5/16/2017 6/16/2017 10/26/2017 7/21/2017 QA Assessment EAD policies are progressing well. HRMS and OCIO policy changes are not complete. Security Design Review is in progress. This task is nearing completion. A work session is planned to ensure all impacted policies and procedures have been addressed. In Progress. Implement MIM 10/7/2016 7/21/2017 Task is in progress. Synchronize HRMS into MIM Metaverse 1/24/2017 5/2/2017 User Self-Service 1/6/2017 5/16/2017 Privileged Account (PAM) Group Azure Active Directory (AAD) Configure Hybrid Identity between EAD and AAD 1/6/2017 7/21/2017 3/14/2017 5/3/2017 1/6/2017 6/13/2017 2/22/2017 6/13/2017 Work is under way. Remaining work includes documenting the design. Task is under way but slightly delayed. Task is nearing completion. Task is dependent on obtaining sufficient Azure licenses. In Progress but slightly delayed. In Progress but slightly delayed. In Progress. In progress but dependent on Azure licenses. Training 3/14/2017 7/5/2017 The training plan is under development. Project Close 2/21/2017 8/8/2017 Documentation is under development. Grayed out tasks are complete Page 10

Identity and Access Project Findings and Recommendation Summary Findings Recommendations Date Comments 1 There is a lack of clarity about the scope of Phase 2. 2 The team is implementing a change to HRMS that has not been fully vetted with decision makers or communicated to agency customers. 3 Project staff resources are being drawn off to other projects. Clarify which customer-facing artifacts are expected to be delivered from Phase 2 of the IAM Project. Determine a strategy for implementing the HRMS changes and develop corresponding communications and instructions for customers to complete the revised business process. Protect project staff resources during the remaining two months to focus on completing the IAM implementation. 4/30/2017 Recommendation offered. 4/30/2017 Recommendation offered. 4/30/2017 Recommendation offered. Page 1