DevOps and related trends (cloud-native, digital transformation, etc.) are unquestionably mainstream, but they still come with difficulties. Many organizations are struggling with outdated governance models that slow down digital innovation, while not effectively reducing risk. Plan/build/run, stage-gated checklists, and approval boards are losing favor, but what will replace them? Risk management is still critical. Special guest Charles Betz, Forrester Principal Analyst, joined Dan Beauregard, VP, Cloud & DevOps Evangelist at XebiaLabs, to discuss: • The role of an integrated, end-to-end release pipeline in ensuring auditability and standards compliance • The evolution and automation of change and release management and the decline of the Change Approval Board • Chaos and resilience engineering as the basis for a new governance model

2. Housekeeping
• This webinar is being recorded
• Links to the slides and the recording will be
made available after the presentation
• You can post questions via the GoToWebinar
Control Panel

3. Hundreds of Companies
deliver software with
XebiaLabs
XebiaLabs DevOps Platform
providing intelligence, automation and control
across the entire software delivery process
Shift to
the Cloud
Migrate to
Containers
Connect all
Pipelines
Connect
CI/CD &
ITSM
Improve
Governance
& Security
SCALE DEVOPS ACROSS THE ENTERPRISE

4. 4
Dan Beauregard
VP, Cloud & DevOps Evangelist,
XebiaLabs
Guest Speaker: Charles Betz
Principal Analyst,
Forrester
Presenters

5. Agenda
Challenges with outdated governance models
What will the new governance model look like?
Role of the integrated, end-to-end release pipeline
Conclusions

6. Defining Governance

7. 7© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Digital
Requires New
Approaches COBIT
ITIL
CMMI
PMBoK

8. 8
R&D

9. 9
Operations

10. 10
Industrial
Engineering

11. 11
Complexity and
Emergence

12. Outdated Governance Models

13. 13
Governance
and Policy
. . . the Change Advisory Board shall
meet biweekly . . .
. . . Security engineers shall review all
release packages and complete the
signoff checklist prior to production
release . . .
. . . Infrastructure engineering shall
approve all general and detailed technical
architecture designs prior to
commencement of development . . .

14. 14
Trend:
Stage gated governance
(plan/build/run) is
coming to an end

15. 15
Challenges We See in Our Customer Base
Delays
Visibility Morale Waste
SpeedTooling

16. 16
Audit & Compliance Poll Results

17. What Will the New Governance
Model Look Like?

18. 18
The New
Governance
• Principled
• Dynamic
• Emergent
• Automated

19. autonomy

20. 20© 2019 Forrester. Reproduction Prohibited.
Trend:
Product teams will
become the primary
operating model basis,
including I&O.
Project teams (and
PMOs) will decline.

21. 21© 2019 Forrester. Reproduction Prohibited.
Trend:
Interest in “flatter,” more
collaborative
organizational models
(Holacracy, Teal) will
increase dramatically.
Promise Theory will gain
attention as a unifying
governance framework.

22. 22© 2019 Forrester. Reproduction Prohibited.
Starling Bank “pursues a
principles-based approach to
achieve coherence and coordination
in areas such as cybersecurity,
architecture, and coding.”

23. 23© 2019 Forrester. Reproduction Prohibited.
Zappos: At its core, ‘self-
management’means knowing
exactly what you are responsible for
and having the freedom to meet
those expectations however you
think is best.

24. 24
The New Process
Reference Model
Update with final
version

25. 25
25© 2017 FORRESTER. REPRODUCTION PROHIBITED.
Build
(Develop)
Run (Operate)
EX/CX products
and value streams
Digital platforms and
services (including CD)
Plan
Agile portfolio
and governance
Platform
Component
Coordination
services
Platform
Component
Feature Feature Feature Feature
Governance/VSM

26. 26
Pivot Your Approach
Redefining the balance between control and freedom
PerceptionReality
V.S.

27. 27
The Automated Governance Model
• Involve all stakeholders
from the beginning
• Review and simplify
process
• Remove unnecessary
controls
• Incorporate controls into
pipeline
• Codify and automate as
much as possible
• Continuous
Improvement
• Compliance data
available when you need
it
• Connect and orchestrate
across the entire
DevOps Toolchain
• Automate each step,
collecting data across all
tools
• Create software chain of
custody
Automated
Governance
Model

28. Role of the Integrated, End-to-end
Release Pipeline

29. 29
Dynamic
governance

30. 30
Dynamic
governance case 1:
change credit
rating

31. 31
Dynamic
governance case 2:
support turnback
Dev Ops
Stable Tier 3 Tier 1-2
Unstable All None

32. 32© 2019 Forrester. Reproduction Prohibited.
“Complex systems have EMERGENT
properties”
Dave Rensin, engineering manager
and lead SRE, Google

33. 33© 2019 Forrester. Reproduction Prohibited.
“Operations IS product discovery”
Charles Betz, Principal Analyst,
Forrester Research

34. 34
Prediction:
Chaos
engineering will
become a
recognized
control strategy
for digital system
resilience

35. 35© 2019 Forrester. Reproduction Prohibited.
Resilience engineering

36. …formal change management processes that require
the approval of an external body such as a change
advisory board (CAB) or a senior manager for significant
changes have a negative impact on software delivery
performance.
Survey respondents were 2.6 times more likely to be
low performers if their organization had this kind of
formal approval process in place.
DORA State of DevOps Report 2019

37. 37© 2019 Forrester. Reproduction Prohibited.
Don’t talk to me about ITIL “change
management.”
Talk to me about what you’re trying
to do.
Better records? Reduced risk?
Preventing collisions?
SVP Infrastructure & Operations
US Fortune 50 Retailer

38. 38
Three
Approaches to
Scoring Change
Risk

39. 39
Subjective

40. 40© 2019 Forrester. Reproduction Prohibited.
Objective

41. Analytic

42. 42
ITSM vs CDRA Change Risk Assessment
ITSM CDRA
• User scoring (subjective)
• Inferred from configuration item (e.g. high value
service dependency)
• Track record of similar changes
• Track record of team
• Stability/history of service
• Commit history
• Build history
• Deploy history (e.g. in lower environments)
• Retries
• Static analysis
• Dependency analysis
• Schedule adherence
Both markets increasingly applying AI.
Forrester recommends strong integration of these capabilities.

43. 43
DevOps Tooling Integrations

44. 44
Integrated, end-to-end DevOps toolchain
RELEASE ORCHESTRATION
DEPLOYMENT AUTOMATION
DEVOPS INTELLIGENCE
DEVOPS
DATA HUB
Reporting & Dashboards for:
• Security / Compliance
• Automated Audits
• Value Stream Metrics
• Predictive Analytics

45. 45
Software Chain of Custody
 Like a legal case, software chain of custody tracks everything in your
software delivery pipeline
 Know the who, what, where, and when of each change
Push-button audit reporting
• Automatically produce audit reports
• Remove the pain, improve the
completeness

46. Conclusion

47. 47

48. Questions?
Dan Beauregard
VP, Cloud & DevOps Evangelist,
XebiaLabs
@dbeau72
Charles Betz
Principal Analyst,
Forrester
@CharlesTBetz