Michigan's CISO-as-a-service initiative is so popular the state might spin it off
April 23, 2018
Top state IT officials shared with a conference audience that their pilot program could be promised a longer life through the creation of a nonprofit.
A look at one state's technology office reveals how things have changed in state government IT and what new challenges await.
Colin Wood is the managing editor of StateScoop. Before that, he was a staff writer for Government Technology magazine. Before that, he taught Engl...
After three years of implementing a strategic plan for state IT, New Jersey's Office of Information Technology says it has resolved several challenges to varying degrees, but like similar agencies in other states, it's finding that some of the problems aren't over — they've just changed.
The issues facing Chief Technology Officer Dave Weinstein's organization are typical in state IT, but his approaches aren't always typical.
In 2013, officials wrote an IT strategic plan for 2014-2016 that said the office was struggling with maintaining worker morale, competing with the private sector and exerting its power over other areas in New Jersey government unwilling to comply with a newly centralized IT authority. And all of this was to be done with limited resources for the foreseeable future.
The plan lists three main weaknesses, and the first is a description of the rest of the organization's unwillingness to accept the IT office's authority in overseeing enterprise-wide technology operations:
Breadth of assigned missions and responsibilities often is not matched by willingness in parts of State government to accept OIT’s governance authority in statutes, executive orders and directives. Past failed efforts to win compliance suggest that OIT may lack the ability to influence events in ways necessary for success.
New Jersey's technology department was given authority over all IT in the state following a statute signed by Democratic Gov. Jon Corzine in 2007. But each agency built up its own technology department, due to a combination of the state not exercising its authority and other agencies not complying when it did. That created a position where OIT now operates from "a position of bureaucratic weakness," Weinstein said.
It's a common problem. Doug Robinson, executive director of the National Association of State Chief Information Officers, said that according to his latest numbers, 90 percent of state chief information officers cite cultural resistance to change as the main barrier to building an enterprise IT organization.
"Agencies are used to having an autonomous environment," Robinson said. "They're used to running their own shop. That is clearly not the direction the world has been going in the last ten years. As we talk about the owner-operator model of state IT, that has given way to an enterprise, optimized approach."
In New Jersey, there's been a struggle with using a command-and-control model, Robinson said, because agencies need to be incentive if they are to cooperate in the long-term. Telling people what to do 'because I said so' creates tension that will ultimately reach breaking point, he said.
When Weinstein was transitioned from chief information security officer to CTO in January, his role was also elevated into the governor's cabinet. That was a clear signal to the rest of the organization, Weinstein said, that OIT intended to begin enforcing the authority it technically had these last few years.
"We've pivoted pretty radically from that weakness to a position of strength in which we are actually establishing and enforcing policy, we are taking responsibility for providing and maintaining the IT infrastructure for all the state agencies," he said. "That's been culturally probably the biggest seed change that has affected the state's IT enterprise over the past six months."
It's good for the state that this is changing, Weinstein said, because enterprise IT can ultimately reduce redundancy, costs and risk.
A good economy isn't good for everyone
The department's second challenge in 2013 was decreased morale among workers and trouble retaining them:
As with many State agencies, staff morale has been hurt by the constraint on resources resulting from the Great Recession and increased attrition.
Morale is hard to measure, but Weinstein said he believes it's on the rise in his state now.
"Obviously, the economic conditions have shifted a lot since that report was published. That has positive and negative implications on the workforce," he said.
A stronger economy provides government more money and more opportunity to pursue projects and support its workers. But a stronger economy also gives state government's most talented workers other job options, and many of them do leave when the economy improves after a downturn.
"During periods of recession, oftentimes state governments get exposed to a talent pool that they otherwise would not be exposed to," Weinstein explained. "I'm happy to say that within New Jersey we've managed to retain some of our best talent, while having to deal with high levels of attrition due to an aging workforce."
Retaining employees takes money that state government doesn't have. According to a NASCIO report published in September, 96 percent of survey respondents said that salary was the number one factor for retaining staff in IT security. The same report found 59 percent of respondents cited a lack of qualified candidates as a major challenge. Not only can government not afford the talent it needs, but it can't find it either.
"And that's not going to change," Robinson said. "There's not going to be any dramatic compensation increases coming down the pike with anything. The latest fiscal data is showing than 2017 is going to be very austere. States are expecting much lower revenue. Increases are only around two percent and spending is projected to be lower than previous years. Six months into the fiscal year, 24 states have already reported general fund revenue shortfalls."
States that will be hit hardest in their workforces by a growing economy are those in areas with healthy private-sector job markets. Government workers in Austin or San Francisco, for example, have a lot more options to find work outside of government than those in smaller job markets.
It's not all bad though, Weinstein said. More money means they can invest in training, give their employees new career paths and invest in new technologies. They also made "changes in management that many of the staff are pleased with," he said.
Unable to match the private sector with dollars, government often advertises its mission, instead — creating social change on a grand scale. This sometimes enables government workers to be exposed to a volume and variety of projects that they would not see until many years later in their careers in the private sector, Weinstein said.
Some states, like Maine, target veterans, Robinson said, because many veterans have "the call to duty service ethic," a desirable quality in an employee.
Raise your hand if you have enough money
In 2013, New Jersey's technology office didn't have enough money to launch all its projects. The report said:
Limited funding resources make new initiatives difficult to finance and implement.
Not having enough money might be the top driver of innovation in state and local government the past decade. IT budget cuts and reduced workforces forced government to examine its operations and why they were wasteful. It brought new technologies and fresh ideas to an industry renowned for being stale.
"I depart a little bit from the standard position of state CIOs here, because I think we have plenty of money to do what we need to do," Weinstein said. "We don't have necessarily money sitting around to play with, but I've yet to really feel hindered by the lack of fiscal resources that we have."
New Jersey operates on a chargeback model, which creates a larger operational budget and drives more investment in the cloud, Robinson explained. Budgets might not be as big as they used to be, but new accounting models and technologies change the dynamic. Continued financial constraints will drive more cloud adoption and more cross-state collaborations, Robinson predicted.
Having enough money means being careful with whatever money you do have, Weinstein explained.
"One of the key concepts I've been socializing since coming into this role is that our organization as the enterprise provider must operate like a business, otherwise we'll cease to be successful with the resources we have," he said. "I think where states get into trouble is that when they go down a path that ultimately doesn't bear fruit and a particular service is not utilized at a high enough rate, therefore they can't recover their costs and to move in another direction at that point is difficult."
New Jersey's solution was to build new services that focus on business development. Like a commercial service provider, Weinstein said, the state analyzes its marketplace for demand and tries to be as efficient as possible.
Things have improved the last few years for New Jersey IT, but it's not over. The next challenge, Weinstein said, is a portfolio of 351 legacy applications, mostly hosted on mainframes and written in dead languages like COBOL, with an average age of 16 years.