IoT Governance Governance Framework - Deloitte

Deloitte IoT GovernanceAspects and key components of IoTGovernance1,2As previously mentioned, the IoTframework should cover the threemain areas of data, infrastructure, andarchitecture. However, which aspects ofthese should be of higher concern to anyIoT governance framework?First is the applications associated withcollecting, analyzing and monitoring thedata provided by the IoT devices. At a highlevel, these applications should be wellgoverned to protect the data acquired andprocessed by them. It should also providecontrols for accessing this data, such asrole-based access, for example.Second is the platform; all platformsrelated to data management, applicationintegration, and IoT device managementshould have a well-defined framework asto how to register/de-register IoT devices,how to collect data, how and where topublish this data, and how to interact withupper and lower layers of the IoT referencearchitecture.Third is the communication. This refers toall communication between devices at thephysical end up to the consumption of thecollected data. The IoT framework shouldtap into the protocols of transportingthis data across all layers and take intoconsideration any regulatory requirements(local and international), with the GeneralData Protection Regulation (GDPR) as anexample.Fourth is the IoT device itself. At this level,the IoT framework should tap into thesecurity of the device, the monitoring ofthe device, intrusion detection, booting,remote control and firmware management,08and interoperability with multiple vendors’devices.Across all these areas and aspects ofIoT governance, fundamental pillarsare required to execute an effectivegovernance framework. In addition, it isimportant to realize the importance of IoTgovernance in reaching the aspired digitalmaturity level. The Deloitte Digital MaturityModel (DMM) is the first industry-standarddigital maturity assessment tool developedin partnership with the TM forum with keycontributions from other industry andsubject matter experts.First, the IoT governance frameworkshould foster and support digitalinnovation; IoT adoption is still in the earlystages of large-scale adoption and needsan effective IT governance approach toeffectively harness its benefits. By that, wemean that a mix of agile and classical ITgovernance models should evolve to bettercope with the fast changing and real-timenature of the IoT ecosystem.Second, balancing the risk and compliancein the IoT framework is essential to be ableto move along the curve of digital maturity.Among the Deloitte 4 dimensions of digitalmaturity, IoT will affect three of them(Strategy and Culture, Technology, andOperations).In the Strategy and Culturedimension, the framework shouldtap into forcing a clear adoption ofthe right tools and systems to runthe IoT ecosystem. A well-defined IoTstrategy should be part of the overalldigital strategy of any organization.The right balance of IoT investment isof paramount importance as any IoTgovernance framework will prove uselessif the investment strategy is not welldefined.In the Technology dimension, thegovernance framework should ensureinteroperability across the differentlayers of the IoT reference architecture,and this can be very specific to theorganization’s needs and should alignwith the communication standards andprotocols (like periodic log transmissions,detection of anomalies, etc.) of otherdigital ecosystems at the organization.As part of the technology dimension,there should be a clear data lifecyclemanagement for all data sets generatedby the IoT ecosystem, given its specificityand frequency.In the Operations dimension, thegovernance framework should set therules for an integrated digital servicemanagement, workflow integrationmanagement, and a well-defined servicecatalogue with other IT systems. Themost important aspect of the Operationsdimension is the real-time insightsand data analytics; as mentioned, thespecificity and frequency of the IoT dataimplies a high level of correlation controlpoints, time-related rules to account fordata loss, and data-trust checkpointsfor data sources. Finally, a well-definedautomation scheme of all relevantresources in the IoT ecosystem is crucialfor any successful IoT governanceframework.

Deloitte IoT GovernanceFundamental Pillars of IoT GovernanceFigure 2: IoT Governance Pillars mapped to the Dimensions of the Deloitte Digital Maturity Framework12TechnologyUnderpins the success of digital strategyby helping to create, process, store, secureand exchange data to meet the needs ofcustomers at low cost and low overheads.3OperationsExecuting and evolving processes andtasks by utilizing digital technologiesto drive strategic management andenhance business efficiency andeffectiveness.Strategy & CultureFocuses on how the businesstransforms or operates to increase itscompetitive advantage through digitalinitiatives, which are embedded withinthe overall strategy, alongside theorganizational culture.CustomersProviding an experience where customers view theorganization as their digital partner using their preferredchannels of interaction to control their connected futureon and offline.Third is the need for a distributed andbalanced authority over all matters relatedto the IoT system. The distributed natureof IoT systems implies a distributedresponsibility and accountability matrixin the organization. The amount ofdata generated by this system implies abalanced authority over those data sets.The aspects of IoT governance are notfar from those of digital governance, infact, IoT governance should be part ofany digital governance framework anyorganization wishes to purse.Governance is a theoretical set ofrules, actions, and processes used tostabilize institutions, organizations andcommunities and to ensure a persistentand stable outcome from the membersof those entities.09

Deloitte Process analysisRoles and responsibilities of IoT Governancestakeholders2, 3IoT architectThe IoT architect defines an end-toend IoT solution architecture. The IoTarchitect is responsible for defining theIoT platform strategy and the integrationof all solution components based onthe IoT platform. The IoT architect alsoestablishes standards and guidelinesfor the development, deployment, andmanagement of the IoT solution.Figure 3: IoT Governance roles and responsibilitiesData scientistIoT architectIoT developerSecurity architectThe security architect supports the IoTarchitect in defining the security solutionsby analyzing data, infrastructure, andapplication security requirements.Moreover, the security architect designs,plans, and implements secure codingpractices and security testing methodology,and performs security audits.IoT developer (in case of IoTdevelopment)An IoT developer is responsible for thedevelopment and implementation of allrelated IoT applications/tools for datacollection and data analytics.IoT tester (in case of IoT development)The IoT tester is responsible for testing thedeveloped solutions including the overallsolution in addition to security tests.Data analystData analysts define plans and strategiesrelated to data collection, models,mapping, and reporting.10IoT testerDevice SMESecurity architectDevice SMEThe SME finalizes device/productspecifications based on data collectionrequirements and the IoT solutionarchitecture. The device SME also helpsin choosing the right devices/products forthe IoT solution and works with the IoTarchitect and infrastructure architect to setup communication networks that connectIoT devices/products. The device SME isalso a key participant in finalizing devicemanagement policies and principles,including device/product physical securityand cybersecurity.

Deloitte Process analysisImplementing the IoT GovernanceFrameworkThe real question that follows theformulation of any framework is how toimplement this framework. Moreover, themost important question is, does a typicalIT governance framework implementationsuffice for IoT governance implementation?The straight answer to this question willbe no, and the reasoning behind this isthe nature of the IoT ecosystem and theneed for agile and adaptive governancemethodology. The implementation of anIoT governance framework can be dividedinto four major steps:First, collect your organization’s IoTecosystem requirements. This involvesdeciding which controls should be in placeto direct investments in IoT systems, andwhat the organizational goals and KPIsare that need to be tracked in relation toIoT projects. The values of the IoT strategyshould be defined and the relative controlsset in the IoT governance framework.Figure 4: Steps to implement IoTGovernance framework14IoTGovernance32Second, design the IoT governanceframework. This involves setting thegovernance groups (their number andmandate), keeping in mind the need fora distributed responsibilities schema tocope with the scattered nature of theIoT ecosystem. The next step would bemaking sure that the framework coversall areas and aspects related to IoTgovernance. After that, there should bea scenario analysis for the use cases forthe controls and checkpoints definedin the governance. The final step in thisphase would be creating a repository forall attributes related to this governanceframework for future reference and review.Third, implement and operate the IoTgovernance framework. After the IoTgovernance framework has been approvedby the organization and communicatedto the relative stakeholders, theimplementation phase takes place. At thisstage, the focus will be on the following: Setting up the needed governancebodies if they do not exist already Building and enriching the neededculture and shift in priorities associatedwith implementing the IoT governanceframework Implementing the processes, controls,and associated roles and mechanismto support the work of the governancebodies Implementing the change managementprocesses that currently exist at theorganization Integrating the IoT governanceframework with the organizationtechnology/digital governance frameworkFourth, evolve and maintain the IoTgovernance framework to cope withthe nature of the IoT ecosystem. Thiswill take into consideration changes inthe IT organization operating model,the progressive cultural shift in the ITdepartment to adapt to IoT, and thechange in the organizational goals andstrategies.1Collect IoT ecosystem requirements Understand the organization’s IoT strategy Decide on the controls of IoT investment IoT projects KPIs2Design IoT Governance framework Set the Governance groups Ensure all aspects of IoT governance are covered in the framework Scenario analysis and use cases verification Create a repository of all attributes related to the Governance framework3Implement and operate IoT Governance framework Setup the relative governance bodies Build the proper culture Implement the defined processes, controls, and associated roles Implement the change management process4Maintain and evolve IT Governance framework Monitor change in the organizational goals and strategies Adjust the IT operating models to cope with the needed changes Build the cultural shift needed to continuously evolve the IoT governance framework11

Deloitte IoT GovernanceIoT Center of Excellence4A dedicated IoT center of excellence (CoE)will form an essential element to enforcegovernance within an organization andensure that the enterprise is movingtowards a common goal. A CoE can helpnavigate the various business and technicalcomplexities that may face an organization.Therefore, the function of a CoE can varyaccording to the needs and nature ofan organization. The functions could bedefined by what is practically achievable orfunctionally desirable.An IoT CoE must be aligned to the goals ofthe organization, and where it is driven bystrong leadership, a clear vision and thenecessary tools to work with the relevantstakeholders. It could be the driver ofenforcement and ensure that a levelplaying field is set across the organization.To ensure governance, the CoE couldenforce the adoption of a referencearchitecture that meets the differentorganizational needs. The CoE could beentrusted to define the technologicalstandards for all IoT projects and initiativesacross the organization. It could alsopromote the adoption of best practicesand develop a strategy to manage theIoT platform and device vendors. In largeorganizations, it could help facilitatecommunication and coordination betweenvarious stakeholders, including businessand IT. With visibility on all IoT projects,it could be the single point of contact toensure that the appropriate experts, skillsand resources are being deployed to12An IoT governance framework shouldensure data integrity and data securityfor information shared by all IoT devicesin the enterprise network.achieve the stated objectives. To ensurealignment to organizational/project goals,the CoE could also be entrusted to reviewdeliverables to ensure alignment to thelarger goals of the organization.Critical success actors: The establishment of a CoE that is alignedto the aspirations of the organization. The goals and objectives are clearlydefined as a CoE can performmultiple functions depending on theorganization’s needs and goals. A clearly defined strategic roadmap andKPIs to measure the performance of theCoE to ensure its alignment with statedobjectives. The CoE must also have the appropriateleadership and operational skillsets toensure optimum success and delivery. It is agile enough to adapt to any changein circumstances and be able to evolve.A CoE could perform any of the followingfunctions within an organization to ensuregovernance from an IoT perspective: Review project technology andarchitecture decisions Assist the business department withbudgets and business cases Drive ideation aligned to businessstakeholders Advise businesses on IoT opportunitiesand emerging trends Establish IoT requirements andcontribute to the development of IoTstrategy Recommend technologies, vendors andarchitectures Drive and participate in IoT securityassessments Disseminate knowledge and bestpractices across the organization whererelevant Create technology demonstrators Facilitate IT/operational technology (OT)integration

Deloitte IoT GovernanceIoT Governance challenges related tofuture trendsThe first challenge facing the futuregovernance of IoT is the increasing numberof different connected devices; thisrequires a great deal of complex solutionsto accommodate the heterogeneousconnection of devices along with the size ofthe connection, where the implementationof protocols and algorithms of all deviceshas to be efficient. Data protection andanonymity is another factor threateningsecurity that must be addressed in orderto keep users’ data secure.Below are the major trends expected topresent challenges for IoT governance:Data governanceBig data platforms are usually madefor supporting the demands of largescale storage and for performing theinvestigation which is required to extractthe full advantages of IoT. This is the newIoT trend that we are facing and will seein the near future on a largescale. Theheterogeneous nature of these platformsand devices will raise major challenges foradopters and implementers as well.Security breachesAs the IoT ecosystem spans differentlayers, the ability to protect each layerfrom intrusions and hacking becomes acomplex process. The fact that the numberof physical devices is increasing in largenumbers, puts tremendous pressure onorganizations and regulators to protectthese devices, both physically and digitally.As mentioned, data protection is a majorissue when questioning IoT adoptionby citizens and governments. Theheterogeneous nature of IoT devices,IoT platforms, and data generated fromthese devices requires standardizedcommunication and data aggregationlayers.A dedicated IoT centerof excellence (CoE) willform an essential elementto enforce governancewithin an organizationand ensure that theenterprise is movingtowards a common goal.Privacy rightsWearable devices are being used by thehealthcare sector, and will see steadydevelopment. However, can you imagineall these medical devices using Cloud andstoring their images for intelligent systems?This will raise the question of dataprivacy among citizens and governmentregulators.13

Deloitte IoT GovernanceConclusionIoT is changing rapidly and becomingincreasingly complex. While its existenceis a clear disruptor, its widespread andcomplex nature requires good governance.An IoT implementation involves multiplecomponents and stakeholders as well asthe coming together of multiple internaland external entities related to theorganization. The governance of IoT hasto be approached in a multi-dimensionalfashion by looking at different aspects,such as the various layers and componentsinvolved in IoT, the pillars of governance,the roles and responsibilities, and thevarious ways in which such governancecan be implemented and how IoT is likelyto change even more in the future. Aholistic approach of this nature will helporganizations and nations maximize theirbenefits while minimizing the risks of IoTimplementation.References1. Dayal, “IoT Ecosystem Components: The Complete Connectivity Layer”, May 28, 20182. Gantait, Patra, Mukherjee, “Defining your IoT governance practices”, Jan. 19, 20183. Serbanati, Rotondi, Vermesan, Baldini, “IoT governance, Privacy and Security Issues”, Nov. 14,20144. Jones, Wallin “How an IoT Center of Excellence Can Help CIOs Deliver Better IoT Solutions”, July27, 20175. Newman, Peter “THE INTERNET OF THINGS 2020: Here’s what over 400 IoT decision-makerssay about the future of enterprise connectivity and how IoT companies can use it to growrevenue”, March 6, 20206. IBM “Defining your IoT governance practices”, January 19, 201814

Deloitte IoT GovernanceAuthorsBhavesh MorarPartner – ConsultingDubaibhamorar@deloitte.comYousef BarkawiePartner – ConsultingDubaiybarkawie@deloitte.comRajesh BalakrishnanSenior Manager – ConsultingAbu Dhabirabalakrishnan@deloitte.comMohammad KhasawnehManager – ConsultingDubaimkhasawneh@deloitte.comJassim BangaraManager – ConsultingAbu Dhabijbangara@deloitte.comHussam Abu BakerConsultant – ConsultingAbu Dhabihabubaker@deloitte.com15

This publication has been written in general terms and therefore cannot be relied on to cover specificsituations; application of the principles set out will depend upon the particular circumstances involvedand we recommend that you obtain professional advice before acting or refraining from acting on any ofthe contents of this publication.Deloitte & Touche (M.E.) LLP (“DME”) is the affiliate for the territories of the Middle East and Cyprus ofDeloitte NSE LLP (“NSE”), a UK limited liability partnership and member firm of Deloitte Touche TohmatsuLimited, a UK private company limited by guarantee (“DTTL”).Deloitte refers to one or more of DTTL, its global network of member firms, and their related entities.DTTL (also referred to as “Deloitte Global”) and each of its member firms are legally separate andindependent entities. DTTL, NSE and DME do not provide services to clients. Please see www.deloitte.com/about to learn more.Deloitte is a leading global provider of audit and assurance, consulting, financial advisory, risk advisory,tax and

IoT, discuss how IoT operations can be governed and what is needed, including the roles and responsibilities involved in IoT governance, and describe a proposed governance framework implementation as well as the future challenges facing IoT governance. This paper is intended to showcase how IoT governance can be implemented.