# Introduction trategy without tactics is the slowest path to victory. Tactics without strategy is the sound before defeat. (Sun Tzu) Planning and deploying IT-resources is one of the most important tasks of management today. The majority of business processes are supported by information technology. The accessibility of IT-services as well as their reliability and security usually only represent the tip of the iceberg. A variety of other topics, such as access control, security vulnerabilities, interfaces, service portfolio, IT budget, hardware architecture, monitoring and outsourcing are also of great importance to the IT-department and the management level. To avoid chaos businesse a strategy ("what to do") and a tactic ("how to do it") is needed. A major challenge certainly is to develop these strategies and tactics, if the IT never has been planned but only reacted to momentary demand. This "laissez faire" behavior usually leads to IT-landscapes that are very inhomogeneous and complicated to manage, and usually leaves the company largely dependent on the ITarchitects of these systems. For this reason best practices have been developed in recent years, on how to deal with the topic of IT, mainly to deal with the complexity of IT in large companies. However small and medium-sized enterprises will not fare better in this area, with the impeding factor of limited resources for information technology, which is reflected not only at the investment level but also at the employee level. With this premise the following research shall be investigated: Is it possible to model an approach using these best practices for large corporations for SMEs that yield useful results? To validate the results of this study it was finally put in practice for a specific SME, a growing medium sized company with about 300 employees and co-workers. Author ? ?: Technical University of Graz. e-mails: georg.egger@tugraz.at, martin.ebner@tugraz.at II. # Research Design The following steps to reach a conclusion have been used: IT-Governance and IT-Service Management as the three best practices being deployed in large companies with height ened ITawareness. # i. Enterprise Architecture (EA) Enterprise Architecture describes the system overlapping view of the complete IT-Landscape regarding all layers of implemented technologies including the business architecture. This is one way of describing EA, since John Zachman created an article on EA and presented a matrix oriented framework in 1997 (16). In the meantime over 50 frameworks exist to deploy Enterprise Architecture Managment (EAM) as there are numerous definitions of Enterprise Architecture itself. Only recently the TOGAF framework from the Open Group is emerging to be the standard framework implemented by companies (13). Figure 1 displays the components of EA. Enterprise Architecture Management describes the transition from a current to a desired state. The Open group identifies two methods for implementing EA (13,187): " Baseline first", if the individual departments in the company had great autonomy or "Target first", if the target state is commonly agreed upon. In the first case the current EA will be analyzed and a plan to transition to a future EA developed, in the latter case the desired EA will be planned and measures to reach that goal from the current situation must be planned. Every enterprise has an Enterprise Architecture whether it is has been planned or has just grown and evolved over the time. Figure 1: Enterprise Architecture (7,12) ii. IT-Governance (ITG) Similar to EA there are different definitions of ITG. Steve Romero formulated a very concise statement: "IT-Governance consists of processes and relations that lead to a reasonable decision making in the area of IT." (11,6) It is important not to mistake IT-Governance with IT-Management. IT-Management deals with the processes and optimisation of current tasks and services in the IT-Landscape while ITG has its focus in the future and is more of a strategic instrument. The primary goal at hand ist to align the IT with business processes. The IT-Governance Institute puts the stakeholders in the center of processes as a driver for the desired results. Weill and Ross identified three critical questions for IT Governance (15,(10)(11): ? Which decisions must be governed? ? Who takes responsibility for governing these decisions? ? How are these decision being governed? Furthermore, each company has to deal with 5 related decisions (15,(10)(11): ? IT-Principles: Define the role of IT in the company. ? IT-Architecture (IT-EA): Define integration and standardisation needs. ? IT-Infrastructure: Identify shared and enabling services. ? Business and application demands: Specify the business demands for bought or internally developed IT-applications. ? IT-Investment und Prioritisation: Choose which initiatives will be funded and how much will be spent. Regardless of the framework that will be used to put IT-Governance into action, the most important task is to clarify the three critical questions, if those responsibilities and areas of decision making are not clarified IT Governance cannot take place. The most popular framework is COBIT, due to its emphasis on characteristic numbers and the Sarbanes-Oxley Act in the United States COBIT is often being used for control mechanisms (6). iii. IT-Service-Management (ITSM) IT-Service-Management focuses on defining, implementing and managing IT-Services to fulfil business goals and customer demands (1,1). In recent years there has been a shift from solely providing the technical expertise for IT-Services, even within a company the coworkers can be regarded as customers. This customer oriented approach requires additional skillsets and understanding for the customers needs. ITSM is a term that actually stems from IT-System-Managment and was developed by a British agency because measures needed to be employed to cut the blatant cost of IT in the government. ITIL (the IT Infrastructure Library) was born and published as recommended guideline. While there are several frameworks for dealing with ITSM, ITIL is the predominant framework in use, even in the North American region, where ITIL was not common in the beginning. A study showed that 92% of 197 companies implemented ITIL v3, 5% ITIL V2 (5,28). While there are many terms and approaches to effectively manage services the importance of Service level agreements (SLAs) cannot be stressed enough. SLAs (or internal versions called operational level agreements) provide clarity how services are being delivered and maintained and eliminate wrong expectations and assumptions for both the customer and provider of a specific service. # b) Classifying best practices For the three discussed best practices, there exist several frameworks with a different focus. In the area of EA a huge variety of frameworks exist, and mostly custom solutions of these frameworks are being used. The situation is similar in ITG, however COBIT has the edge on employed frameworks. Still, custom solutions comprise the major contributor for ITG. In ITSM the situation is very different, ITIL is clearly de facto standard for ITSM. With every new release each of the respective frameworks strive to expand functionality, unfortunately sometimes it is unclear when to use which framework or when to even find a solution on ones own. A general observation is, that it is wise to research each framework for its core functionality, while ITIL now provides control numbers in its newer version trying to cover ITG for a large part it might be better to use COBIT instead, depending on the companies needs. Because of the popularity of frameworks people tend to replace the corresponding term of the best practice with a framework. However ITG is not COBIT, ITG is the strategy, COBIT represents the tactical component to implement that strategy. Figure 2 Enterprise Architecture deals with the big picture, the strategy that should generate benefits for the enterprise in the future and also includes the System-Architecture and Business-Architecture in contrast to ITG and ITSM. This best practice can be regarded as purely strategic and has the broadest viewpoint of the business needs. An overlap can exist with IT-Governance within the Application-Architecture domain. If both methods are implemented the orientation of EAM is to be preferred over ITG. The primary domain of IT-Governance is not within the operational area. ITG creates guidelines for the future and focuses on how IT Services can facilitate business processes and hence has a strong strategic element. The tactical component primarily consists of tailoring the IT-Services according to the business needs. (It should be noted that the framework COBIT has a well documented operational area). IT-Service management takes its place foremost in the operational domain. The focus into the future exists, but is very short in comparison to the other best practices. ITSM purpose is the optimal deliverance of IT-Services. In this layer, it is not questioned if the service itself supports business processes in an optimal way. The core concern is if the service itself is deployed in the best feasible way. ITSM hence should be categorized as tactical. # III. # Large Companies vs SME In the German-speaking European area SME do not have more than 249 employees and an annual turnover of less than 50 Million Euro (3,4). In the American region, the classification is similar however the industry branch is taken into consideration as another factor. This way a company with 1500 employees can still be regarded as SME because it is considered small or medium in the specific business area (14, 1-4). In most SME the IT is a critical factor for business success, parallel to large companies. However, the inhibiting factor of limited resources is not only relevant at the investment level but also at the number of employees in the IT-Department. Putting best practices at work is always coupled with manpower, commitment from the executive level and last but not least cost. In consequence, the question of applying best practices should first be asked with the expected benefits in mind. In small and medium enterprises the IT-Landscape often has just grown over the years with ad hoc demands, which usually leads to a very inhomogeneous landscape especially concerning interfaces between applications. # IV. # Model for Implementation Considering the classification from figure 2 the following concept for deploying the discussed best practices has been developed. A three-layered Deming cycle (Plan, Do, Check, Act) (2) as shown in figure 3 represents long term to short-term implementation of EA, ITG and ITSM. This figure only represents a guideline. If one of the best practices will not be implemented it is highly recommended to skip it but still follow the order from the outer to inner circle. ITSM with ITIL is already implemented in a Deming circle by its concept, COBIT has a similar approach. With Enterprise Architecture a PDCA-Cycle makes perfect sense. If the business demands change, the IT-Landscape most probably is not set up for these changes and actions need to be taken to remedy the situation. As mentioned before, the difficulty not only lies in deciding which of the three best practices to deploy but also in the level of granularity. Unfortunately there is no universal recipe guaranteed to succeed for each SME, because companies and their IT-Landscapes vary to a great degree. However, we will discuss a general approach that can be adapted to individual needs. At first, methods are needed to aid decision making of whether implementing a best practice or not instead of relying on instinct. The following sections show decisions based on the example of the company we will refer to as Nova. V. # Methods to Decide on Implementation a) EA There is very little literature on Enterprise Architecture in SME but a practical decision matrix for the question of implementing EA has been introduced by Keuntje & Barkow (8,336). # Figure 4: EAM Decision matrix Nova The matrix yields points from 1 (does not apply) to 3 (applies). If a high value is reached it is questionable that EA will yield benefits compared to time and effort spent on implementation. Regardless of company size the following statement can be reached: " The relevance of EAM for a company is mostly determined by the dynamic and change rate of the company and its surrounding environment and the importance of the production factor information, rather than by size and complexity." (8,336) In the instance of Nova a value of 7/15 had been reached. The company has plans to increase its staff significantly, explore new areas of business and change communication with its external partners. The hardware of the IT-Infrastructure is outdated and not sufficient for the growing number of users and services. Hence in case of Nova the decision has been made to implement EA. # b) ITG The question if IT-Governance will benefit the enterprise can be answered with a tool from the COBIT framework, the ITG maturity model. (6,48) This circumstance relates to maturity degree 1 and leaves significant room for improvement. If a company has already reached a degree 3 or even 4 an implementation of ITG is to be questioned, as these degrees of maturity indicate that IT is already is being managed well. In case of Nova the maturity degree of 1 was deemed insufficient and the implementation of ITG recommended. # c) ITSM To determine the question whether to implement ITSM or not the question matrix shown in figure 6 had been developed. This matrix was built with the quality of service motto in mind, if a result over 10 points can be achieved an implementation should be discussed. One should keep in mind that the number of services coupled with the amount of customers using them obviously makes a huge impact on decision making. However, it is hard to generalize since vital services that only a small customer base use can have tremendous impact on the enterprise business. # Implementing EAM The business strategy defines the business architecture. The IT-Strategy drives the IT Business architecture which consists of the different services and the system architecture these service are being deployed on. Defining the business strategy on paper is the first task, The matrix in figure 4 yielded 7 out of 15 points, a relatively low value so it was decided to realize EA in the company. For the implementation it was decided not to use any existing framework. For example TOGAF itself boasts several hundred pages manual and the effort and time factor was considered too costly. In addition many basic principles had not yet been clearly written down in the concrete case of Nova and it was chosen to model a generic approach to formulate the basic cornerstones of the desired Enterprise Architecture. The concept model from Keller (Figure 7) was used as a starting point to define the necessary basic building blocks and steps required to plan a future EA. Instead of an application landscape a service landscape had been implemented: if it is not already written down in a concise matter. Describing the business architecture which is created from the strategy seemed a bit taxing at first but can easily be accomplished by a process map. Generating a process map already can indicate main and supporting processes and helps to generate a quick understanding of the tasks that achieve the business goals (Figure 8). Processes that are important and IT-dependant can already be identified, in addition processes planned in the near future can already be implemented in this map. The IT itself had been identified as a supporting process. However, the IT enables all other supporting processes to aid the main processes and has, therefore, a special relevance. To define the IT-Strategy from the business strategy is the next step and while it may look like a straight forward task, it proved quite taxing to derive a meaningful IT-Strategy that was not too generic. In search of ways to incorporate the business strategy a matrix used by the Consulting Group Gartner was identified and put into use. This matrix shown in figure 9 can now pro-vide clues, open questions were clarified in a discussion with the management. As a result, an IT Strategy that was concise and meaningful had been formulated for Nova. The next step in developing an EA was to take a look at the existing IT-Infrastructure. In case of Nova a semiprofessional solution had been implemented with shortcomings in availability, backup, and resources. All services had been implemented on a single server. The IT-Enterprise-Architecture itself consists of the following identified building blocks: There are two ways to plan a new or modified IT-Infrastructure, analyse the current situation then plan a transition or determine the needs of the desired IT-EA and trace backward. In case of Nova it had already been known beforehand that several new services had been planned for the new business period. Hence it was decided to start examining the Service-Portfolio. The Service-Portfolio-Management is a standard IT-Process since its relevant in any company to a minimalistic or intricate degree. Managing and planning the Portfolio represent core processes of ITG and ITSM. However, according to "form follows function" to really plan an efficient Enterprise-Architecture, this process will be brought forward into EAM since it makes no sense planning an EA without knowledge of the actual implementations. The Service Portfolio was categorized into two sections, "internal" and "external". The internal services were categorized again in "same platform", "external to internal (make or buy decisions)", "new service", and "to be canceled". The new Service-Portfolio revealed the actual demands on the Software-and Hardware-layer and it was easy to look at the existing EA and especially plan the necessary hardware layer. This was simply done by examining the status quo vs. the new demands of the IT-EA. Each component was analysed for the physical machine and compared to the requirements of the new EA to accommodate the Service-Portfolio. Eventually a new EA was planned that was redundant, upgradeable and scalable in form of a high availability cluster hosting virtual machines. In case of Nova this professional solution was necessary because four new services had been planned and five services had to be moved from external providers to an in house solution. During research a very apt Framework OBASHI (10) had been identified to display dependencies across exactly those layers which had been analysed before. Figure 12 displays a planned business process across layers which basically represents the IT-Architecture of an EA. This illustration provides insight in the flow of information across those layers and very quickly reveals dependencies. It is an excellent tool to plan new services, which has been adapted by adding the layer "service" to clearly identify the applications purpose and aid in a service oriented approach. At least once or twice a year revisions should be held to determine the state of the EA. Has the environment the company is navigating through changed and have new goals and areas been planned? In this case, most likely the EA is not up to the task of supporting these new goals and needs to be revised. # VII. # Implementing ITG A strong motivator for implementing ITG in the concrete case is the current level of maturity. Before IT-Governance can be tackled in any enterprise the following three questions should be answered: ? Which decisions need to be governed? ? Who takes responsibility to govern these decisions? ? How are these decisions being governed? To answer these questions a matrix from Weill & Ross shall be used (Figure 13). Horizontally the areas of decision making are listed, vertically stereotypes of archetypes are listed. The black markers represent the current state and the green markers represent the desired state. Federal decisions involve high-level executives, IT and business units, feudal leaves the decision making exclusively to business units. Nova's IT-Strategy had been formulated with the help of the CIO, CEO and General-Management this represents a federal decision making process, which should provide good basis to align IT with business. The IT-Architecture is the equivalent of the ITEnterprise-Architecture which falls into ITMonarchy. It makes sense to leave the technical decisions in this department. The same applies to the IT-Infrastructure. The main reason for this is that business and application requirements are to be decided on a federal level, where IT is playing a rather subordinate role. It is essential that the IT-Department can make decisions about the appropriate applications/services based on the specifications and can subsequently adapt the IT-Infrastructure. If these specifications are agreed on by the stakeholders, the technical core competence of the implementation procedure should ideally remain with IT-Department. This includes the prerequisite that these specifications must meet the requirements of the stakeholders. In the case of IT-Investments, the previous approach was generally to decide on a federal level. In the future, the management level should make this decision as a duopoly with the IT-Department. Since there is no official IT-Budget in the company, and the subsequent need to justify IT-Investments, it is advisable to combine both the technical justification from the IT point of view and the business-oriented justification. Of course, this only applies to investments within a certain magnitude. This classification creates clarity on how to decide in the relevant domains. After clarifying the decision-making and responsibilities the next step was to implement ITG-Processes. For Nova COBIT was chosen and presented to the CEO. It was decided to only implement very few processes to ensure success in realisation. AP005 had already been covered in Enterprise Architecture Management. Manage suppliers is probably an important process for many SME due to outsourcing possibilities. Managing Service Agreements (SLAs) is often a neglected area, however, it clarifies expectations of how services are being delivered, even internally. This process is coupled with AP005 as well. The same goes for AP013 which purpose is to identify security risks and incidents and EDM03 which should mitigate those security risks amongst other risks. BAI03 helps to find a formula on how existing solutions should be improved or new ones can be found. For each of these processes a diagram had been developed on a very flat hierarchy. Key performance indicators had been identified for each process, which should be reviewed once a year, to determine if they are meaningful and relevant or if more or other data are needed. None of the "deliver and support" processes from COBIT had been chosen, already at this point it was apparent that these belong to ITSM and in case of an ITSM implementation ITIL would be chosen instead. Furthermore for Nova as an SME a RACI model for each process had been neglected due to the flatter hierarchy in an SME. # VIII. # Implementing ITSM Managing quality of service is also important for small and medium enterprises. This is reflected in the amount of research published on ITSM in SMEs. Compared to EAM or ITG there are quite a lot of articles and studies dealing with ITSM in small and medium enterprises. The most widely used framework for ITSM with over 90% implementation is ITIL (5,28). For Nova the "Classic ITIL lite" constellation suggested by AXELOS is recommended as a starting point (4). In Nova's case, the question whether to implement ITSM or not had already been decided in the IT-Governance process. An excerpt from the IT-Strategy: "The services need to be as simple and reliable as possible for our employees so they do not chose anarchistic solutions by themselves." To achieve this goal IT-Service Management was deemed vital by the executive level. Figure 15 shows the implementation for Nova. The "Service asset management and configuration" process according to the original template are not to be implemented here in the beginning. The current and future situation is more than manageable in regard to this aspect. Instead, the processes "Event management" and "Access management" shall be added to the catalogue of processes which will be implemented. The Service Desk is not a process but a component, however an essential component for the "Service operation" area. "Change management" is assigned to the "Service Transition" area. The service desk in the center needs an efficient tool to handle the processes and this tool will most likely be a ticket system. Ticket systems often generate rejection in the IT-Department until their value is discovered. To classify problems from constant reoccurring incidents and to measure the number of requests, a ticket system can document and clarify which steps have been taken to resolve problems. The focus for an SME should be generating meaningful numbers from this system, to see where a lot of incidents happen and which problems need to be addressed by change management rather than to measure the efficiency of employees solving tickets. Categorising tickets will help in analysing data and decision making on facts rather than trusting gut feeling. In Nova's case, each ticket was assigned to its service category and then further on labeled as either incident, problem, change or request. Figure 16 shows the blue print for the process" Event management" and reflects the necessary detail level which was chosen for Nova. # IX. # Conclusion The problem of taxing complex best practices along with their respective frameworks can only be tackled by customisation. The abbreviated roadmap shown for Nova can certainly be used as a starting point for other SMEs, but each enterprise is different and has different requirements for its IT-Needs. In the case at hand, the biggest benefit was derived from Enterprise Architecture Management. Clarifying strategies, building a business process map and writing down a derived IT-Strategy led to a better understand of the companies mission and its future demands on IT. When mixing best practices the method of classifying into tactical, strategical and operational proved very helpful. Most best practices overlap in certain areas, especially the revised versions of frameworks tap into other areas that had not been their core competency before. The example of Nova shows the considerations that have been made at which point to implement which building block and take the best part of each framework for the needs of the enterprise. EAM has been built from scratch since the available frameworks are way too complex. ITG has been implemented with very few COBIT processes alongside clarifying decision making in IT. ITSM has been also implemented with only a few ITIL processes tailored to the enterprise's needs. The result of this study shows, that the most important thing for SMEs is to stick to the vital points and not get sidetracked by too much detail. Only processes with great benefit should be implemented at first. If these benefits come through then governing IT in small and medium enterprises instead of just managing it can become reality. If a PDCA cycle is used than each iteration will fine-tune the results to an optimized result. ![displays a classification of the best practices. The attributes taken into consideration are strategic, tactical, operational and the time span involved.](image-2.png "") 2![Figure 2: EAM, ITG, ITSM](image-3.png "Figure 2 :") 3![Figure 3: Concept for implementation](image-4.png "Figure 3 :") 5![Figure 5: COBIT 5 maturity model (6, 48) Detailed information on the maturity model can be found in the COBIT 5 manual, in case of NovaNova the following situation applies: The "governance" of IT depends on the initiative and experience of the IT-team with limited input from the rest of the organization. Performance indicators are usually limited to technical figures within the IT-function itself. (6, 48) This circumstance relates to maturity degree 1 and leaves significant room for improvement. If a company has](image-5.png "Figure 5 :") 6![Figure 6: ITSM Decision matrix Nova VI.](image-6.png "Figure 6 :") 7![Figure 7: EA Concept (on the basis of (7, 24))](image-7.png "Figure 7 :") 8![Figure 8: Process map Nova (Source: Nova)](image-8.png "Figure 8 :") 9![Figure 9: IT Strategieentwicklung Gartner,(9, 17) ](image-9.png "Figure 9 :") 10![Figure 10: IT-Enterprise-Architecture building blocks](image-10.png "Figure 10 :") 11![Figure 11: IT-System-Architecture components](image-11.png "Figure 11 :") 12![Figure 12: Example OBAS(S) HI (based on (10))](image-12.png "Figure 12 :") 13![Figure 13: IT Governance Matrix Nova (based on (15, 11))](image-13.png "Figure 13 :") 14![Figure 14: Planned COBIT Prozesse](image-14.png "Figure 14 :") 15![Figure 15: ITIL lite for Nova (4, 89))](image-15.png "Figure 15 :") 16![Figure 16: Event management Nova based on (12, 70))](image-16.png "Figure 16 :") © 2019 Global Journals © 2019 Global JournalsModern IT-Infrastructure and IT-Managment in Small and Medium Enterprises * SConger MWinniford LErickson-Harris Service management in operations, AMCIS 2008 * The deming cycle (pdca) concept as a tool for the transition to the innovative path of the continuous quality improvement in production processes of the agroindustrial sector MNDudin OOSmirnova NVVysotskaya EEFrolova NGVilkova European Research Studies Journal 2017 * Empfehlung der Kommission vom 6. Mai 2003 betreffend die Definition der Kleinstunternehmen sowie der kleinen und mittleren Unternehmen 2003 Amtsblatt der Europäischen Union Europäische Union * ITIL Lite -A Road Map to Full or Partial ITIL Implementation, Stationery Office MFry 2012. 2012 Norwich * CHurley DMainville A review of the results from the 8th annual itsm industry survey which was conducted january to april 2013. slideshare.net 2013 * Isaca RollingIsaca Meadows 2012 * WKeller It-Unternehmensarchitektur Von der Geschäftsstrategie zur optimalen IT-Unterstützung German Edition 5 2012 dpunkt.verlag. 3 ed. * JHKeuntje RBarkow Enterprise-Architecture-Management in der Praxis: Wandel, Komplexität und IT-Kosten im Unternehmen beherrschen, Symposion 2010 * Six building blocks for creating real it strategies RMack NFrey 2002 Gartner Consulting Group Tech. Rep. R-17-3607 * OBASHI, Obashi business-it relations * CoObashi Uk 2017 * IT Governance isn't one thing, it's everything. An executive view of governance SRomero 2011 * RSteinberg AOrr ITIL Service Operation, Stationery Office 2011. 2011 * The Open Group, TOGAF R Version 9.1, The Open Group 2013 * The Definition of Small Business Management, Demand Media OVitez 2013 743 * IT Governance-How Top Performers Manage IT Decision Rights for Superior Results PWeill JWRoss 2004 Harvard Business Press Boston, Massachusetts 1 ed. * Enterprise architecture: The issue of the century, Database Programming and Design magazine JZachman 1997