EDUCAUSE | CIO

Vendors and Contracts: Making Connections

rowe — Fri, 16 May 2008 09:18:12 -0500

One of the challenges of IT leadership is working with vendors and the associated contracts, agreements and licenses common to the operation of an IT department. I'm trying to figure out how and when I learned to handle this part of my operation. I'd like to give my staff the benefit of attending classes and professional development that would improve their skills in this area (maybe an Executive MBA in IS Leadership that our university offers emba.oakland.edu). I'm seeking options that offer opportunities to develop skills in handling vendor relationships. I thought an occasional blog posting on this topic would help explore the nature of the environment and the skills required of IT leaders.

Making Connections

A challenge for vendors is making the connection with the decision-maker who can confirm a potential sale. A challenge for IT leaders is selecting the right products for purchase in their departments, which requires a lot of attention to the technology market. These purchases must align with university directions, purchasing procedures and a general expectation for ethical conduct.

When I moved into a leadership role, it was amazing to me how fast the word spread through the vendor community. Within a short period of time, I was flooded with telephone calls, more calls than I could ever hope to return. Vendors would leave voice messages and my voice mail was always full. Vendor messages would display more and more frustration at my lack of response. At one point a vendor did get through to me, and expressed his anger and frustration. I was frustrated in return: "Did I ever ASK you to contact ME?"

At one point I kept a ticker of how many vendor calls I received, and when it was over 125 in one week, I realized I couldn’t manage connecting this way. I changed my voice-mail message to say that "Vendors should contact the purchasing department; I do not return unsolicited vendor calls." I have about 300 e-mail filters which allow me to sort the advertisements into "review" and "trash"; I only look at e-mail ads for products that I am currently following. Fortunately my university has a "no solicitation" policy which supports my actions, and vendors are always welcome to contact our purchasing department.

Over time, vendors have tried a variety of sales tactics that are sometimes irritating and sometimes entertaining. Some of my favorite connection opening lines follow, now often arriving by email but sometimes by phone message (when they ignore my voice-mail message):

"I want to follow-up on the material you asked for at our booth at the last conference." Interesting, when I didn't stop at the booth and have no interest in the product. Sometimes the conference is one I didn't even attend.
"I'm taking over the account for Sam, and Sam left notes about the project he was working on for you." I wasn’t working with Sam on anything.
"I'd like to get your opinion on this product." I do understand that you don't really want my opinion; you want to see if I want to buy.
"I've already shown this to your Registrar and he really wants this product." Oh, great, so you are trying to circumvent our publicly mandated bid purchase process!
"I saw the post on the CIO list, and I know that we should contact you by list rules, but I have such a good solution for you that I thought you'd really like to know about it." Geez! This is the biggest source of complaints I receive from CIOs on the list.

So how does a vendor make a successful connection with me?

I go to conferences with strong vendor floors with a list of vendors that I want to visit. The national Educause conference is a favorite. Having quality staff at a strong vendor display is important. I need to interact with vendor representatives who can answer technical questions and sales questions. I'm clear about our bid purchasing process.
When I contact a vendor to request follow-up or product materials, or when I ask for follow-up materials at the conference, I'd like those materials within the next 6 weeks. I especially like it when you can immediately point me to the relevant materials on the vendor web site.
When I need to find the right person to talk to, the vendor should have a process that enables me to find the right sales contact. A failure I experienced with a major hardware vendor: I tried the web site, got a contact number, called and was referred around for over 8 weeks. Never got to a person who could give me a sales demo or tell me how to buy the product.
Please don't offer me tickets to any sporting event or attendance at any golf-outing! As an employee of a public university, I avoid these vendors unless I absolutely have to talk to them, and then only with my purchasing director present.

My role as a CIO requires that I learn how to make good connections with vendors. We've created an internal document that provides our staff guidelines on making connections. As I mentor staff, I ask questions that pay attention to those four bullets: Did you go to the vendor floor? What products were exciting? Is the vendor responsive to your requests for materials? Can you easily contact people who can get us information? Are you spending time with vendors where no sale is possible? (why?) This seems to be helpful in their understanding of making vendor connections.

Identity Management ...

rowe — Mon, 18 Dec 2006 08:09:37 -0600

Identity Management assembles several streams of activity around identifying members of the university community and provisioning services for those community members. Universities need methods for discovering new members of the community and making sure those members have access to the services that the individual members need. Identity management can be used create a single-authentication environment, moving to a single sign-on environment, and then sharing that authentication among several universities in a federation. When used for service provisioning, access to private or limited resources can be controlled through identity management strategies.

A growing aspect of Identity Management is the creation of access and traffic logs. These logs allow us to differentiate the activities of those authorized community members from activities that are not authorized, particularly those originating from those outside the community. We can trace and answer “what happened.” Compliance requirements (e-evidence or HIPAA, for example) may require retention of logs for extended periods of time.

I like to think that university networks and systems operate within a set of ethical principles. Our networks are open highways where communities are free to travel. There may be limited entrance and exit ramps, particularly to special services (like interstate highways). Cars are licensed to travel wherever the driver chooses, but travel is not monitored or permanently recorded in a log. Some destinations are not easily accessible or have limited access; there are locked gates and perimeter walls.

If a law is broken, evidence is gathered and an investigation is pursued. The investigation is undertaken carefully by specific individuals authorized to handle such an endeavor. These individuals are knowledgeable in the laws that apply to gathering evidence, sharing details and protection of the innocent. Evidence about an individual is not gathered or tracked in advance of an investigation, suspected criminal activity, or an actual crime.

If our networks are the highway and our systems are the destinations, many institutions want to promote free and easy entrance ramps. Once on the highway, you are now free to move around the Internet!

It can sound so good up front to say “We’ll have logs of your Internet travels.” Then, if something goes wrong, we’ll be able to IDENTIFY who did this deed. But the risks to personal privacy and electronic freedom are huge.

I will admit to having traveled through some pretty dark alleys in my Internet voyages. If someone was looking at my track record alone, they may be startled at the places I’ve been. What is missing is “why”? Why did I go to that porn site (investigating a complaint of harassment from Student Affairs)? Why did I go to that racially-biased hate site that spoke of bombing (to prepare for the Public Administration class I sometimes teach)? The “whys” behind my activities are nowhere documented. The presence of my identity in a log is not evidence or proof of wrong-doing on my part.

And I will only be able to defend my actions once someone has reviewed the log of my travels and tells me that they have questions. How will I know when the log of my personal activities is being reviewed? Will a notification to me be required? Who will have the right to review the log? Who will make the decision? Under what circumstances are logs released? To whom?

Perhaps we should build our identity environments modeled on credit reporting agencies. Retained logs need to be available and viewable to those whose identities appear in the logs. Should the owner of the identity be notified when a log containing their identity is released? If the log is retained, can I, as the owner of the identity, add my own annotations?

Our internal IT organization has maintained that we use logs to trend and not police, unless we have an official legal request, authorized by the university General Counsel, to gather evidence. We do not retain personally identifiable information in logs for an extended period (not longer than 30 days). Our log retention issues are helped by not needing compliance with HIPAA. Is "knowing what someone is doing or has done" a component of identity management?

As an IT professional, I am uncomfortable with the idea of tracking everyone’s activity on our networks. I am fully comfortable with protecting destinations, our systems and data, from unauthorized travelers (keeping the keys to the gate). I find the environment similar to surveillance cameras. We have a reasonable expectation of privacy as we travel the Internet. I would be a big fan of posted signs: “Surveillance monitoring present on this network.”

The network director at Oakland University, Brian Paige, reminds me that we need to consider the changing landscape of social perception and laws. What is legal or socially acceptable now may not be legal or socially acceptable in the future (or vice versa). Logs can be kept for long periods of time. What is the purpose of evaluating old logs? Have we fully identified justifiable reasons for retaining old logs and applying new standards to the old data?

The word “trust” is often used in the building of an Identity Management environment. We are trying to give access to those we trust, and as a result, build trusted communities who use trusted resources and trusted networks. That works in reverse, too; we need to build Identity Management structures that are trusted infrastructures. Key to building trust is to announce what data we are gathering, state publicly how data are used, and then use that data only in accordance with that public statement. That trusted environment includes logging, monitoring and other tracking activities.

(Acknowledgement to Brian Paige for his contributions and willingness to engage in this discussion).

CIO Constituent Group Meeting

rowe — Mon, 09 Oct 2006 10:03:18 -0500

The CIO Constituent Group is meeting today, starting at 1 PM. We've had several requests for posting notes and we'll post news on several forums.