Winning buy-in among academics and students to the IT discipline and governance required to foster research collaboration and access while protecting intellectual property and information security has been one of Carolyn Brown's great achievements at Durham University. That, plus the small matter of a £40m, four-year total IT transformation that is successfully retooling an insecure, complex and dilapidated infrastructure as one fit for today and tomorrow.

When did you start your current role?
26 November 2012.

What is your reporting line?

Do you meet with and discuss business strategy with the CEO every week?
The CIO shares an open office with the exec, including the CEO, and we discuss business strategy as needed.

Are you a member of the board of directors?

What other executive boards do you sit on?
University Senate and information security steering group.

Does your organisation have a CDO?

What non-technology responsibilities do you have in the organisation?
Transformational change throughout the business. This includes business process improvement across the corporate functions (HR, finance, student administration, etc) and information security (covering sensitive data, commercial data and intellectual property). HR and finance are key areas of improvement at present, and the IT leadership team has worked closely with HR to develop a framework of behavioural competencies that is being rolled out across the University. The transformational change manager reports to the CIO.

How many employees does your organisation have?

Does your organisation carry out significant trade in the EU?

How many users does your department supply services to?

How do you ensure that you have a good understanding of your business and how your customers use your business's products?
It's always a two-way street: listening and explaining. The IT team has a strong engagement model at all levels, ensuring flow of information into IT and from IT to our customers. The model shares:

• strategic information through three IT business partners for research, education and professional services
• strategic operational information and issue escalation through three faculty academic IT leads
• tactical and day-to-day service through three area support managers

The CIO participates in the IT engagement group that meets regularly. Its remit is to ensure that engagement with staff, students and prospective students meets the needs of those parties and of the IT teams (since we cannot operate in a vacuum).

All students and staff are encouraged to engage with the IT teams in various ways, including Facebook, Twitter and termly meetings of the IT user group (which are open to all). This group also gives an opportunity to showcase IT's capabilities.

Our approach to requirements capture and understanding involves focus groups, questionnaires and customers as much as possible. This is particularly important as we try to develop and provide innovative means of collaboration for both research and education. Often it is the IT team that suggests to academics how today's students are likely to engage in their learning – for example, expecting immediate, frequent interaction with both their peers and academic staff, and expecting services to be ‘always on’. This involves us in working as closely as possible with Durham Students' Union and actively seeking to employ our own graduates as interns and in full-time permanent roles.

We have this year set up a prioritisation process for corporate systems that encourages different parties to work together on their own priorities in an area (for example, student experience or reporting) and then to work with the IT team to develop a prioritised programme of work to deliver the systems and tools most needed. This provides a unique forum for people in different parts of the organisation to share their views and needs; it can be eye-opening.   

The IT service catalogue is in the process of being redeveloped, which in itself gives an opportunity for engagement with our customers about their needs and how they want to understand our products.

In addition the CIO keeps informed through active attendance at meetings of Senate, regular one-to-one meetings with exec and council members, following key business disruptors and enablers online, and in relevant periodicals, and involvement in national committees and communities.

Durham University technology strategy and agenda

Is your organisation being disrupted by the internet, mobility or technology-oriented start-ups?

Are you empowered by your organisation to disrupt from the inside?

Describe a disruptive measure you’ve led or played a major part in
Increasingly the UK government funds PhD students to study at different institutions during their PhD. As a result, Durham now has six doctoral training centres in various disciplines where research and teaching are shared with other Universities and industrial partners. It is likely this number will increase.

When requested to equip a new learning environment for one of these doctoral training centres by providing dozens of desktops, I proposed instead that we consider how students actually work and want to work, now that we have pervasive Wi-Fi (coverage has gone from 5% in 2013 to 96% today) and most research students use mobile devices. This led to a completely different plan – the IT team licensed and deployed the necessary technology and won agreement on the governance needed to deliver cloud-based shared workspaces for the doctoral training centres, setting a standard that is in most cases being adopted by our partner institutions. We expect to extend these tools more widely to support both collaborative research and learning across multiple universities and industrial partners.

Overcoming initial resistance and engaging with Microsoft to establish a licensing model, the IT team found a way to deliver at no additional cost cloud services that enable students to share information and documents with partner institutions. The services made available in September 2014 include document sharing, presence awareness, instant messaging and audio and video conferencing, which can include sharing lectures and seminars.

Information governance is vital here, as different commercial organisations (eg two pharmaceutical companies) might have PhD students working on the same research programme and it is vital that sensitive data should not be visible inappropriately. The university also needs to protect its own intellectual property and ensure there is no inadvertent publication of patentable material. The IT team established governance appropriate to such sharing of information and each doctoral training centre has adopted this. It was not trivial to win buy-in to the necessary discipline, but we minimised the admin and helped academics and administrative staff and students to understand why it is vital to protect their research data appropriately. Had we not provided these services, it is likely the university and our partners would have been exposed to risk of inappropriate data being publicly available or exposed on Dropbox, for example.

The IT team provide training in the tools and awareness required to protect research materials. These doctoral training centres show the way our teaching is likely to develop and give the university a means of experimentation in different ways of collaborative research. A need has been demonstrated for similar tools for far wider research collaboration for many academics, and we have an ongoing programme to deliver these tools and inform people about their use.

What major transformation project has been recently completed or is under way at your organisation?
We are 18 months into a four-year £40m transformation of IT known as the New World Programme or NWP. I won board approval for NWP in April 2013. While much of the work and spend is on infrastructure, which was insecure, complex and dilapidated, the bigger transformation is around our people and processes, and how we are building an effective partnership with our customers (academics, administrators and students).

We secured £10m in North East Local Enterprise Partnership funding for the programme and have created jobs and developed infrastructure as planned, securing the funding incrementally. NWP affects not only our organisation but the North East as a whole. The proposal estimated that 400 jobs depended on the programme going ahead; 28 new jobs have been created in the IT department but the impact is far wider, both in the university and across the region.

The transformation of processes, ways of working and ways of communicating affects every single person in the IT team. While much of this change has gone well, there have been and remain huge challenges. To transform a service organisation involves transforming how our customers see us and engage with us. Our customers are particularly diverse and independent, with most academics seeing themselves as largely autonomous of the university and resenting any central ‘interference’. There is still a long way to go; there are triumphs one week and disasters the next, but I am confident we are going in the right direction as fast as is possible.

There is a danger of ‘initiative fatigue’: our plans from the start covered four years and some people, naturally, are impatient to see final results. While statistics show improvements, it takes a sustained period of improvement before people really believe in any change. It is the accumulation of anecdotal evidence that I see as CIO that assures me things are progressing well on the whole: the thanks and appreciation (including an award) given to IT teams by academics, the trust in our business analysts to improve ways of working, the improvements in morale that are often commented on (despite the inevitable pain of reorganisation and redundancies), the improved handling of major incidents (including a flawless weekend take-down and restart of our whole datacentre necessitated by a major equipment failure – something that we could certainly not have done a year ago).

In the past year the key project of NWP created a new operating model for IT support. This builds on strengths (deep local knowledge), counteracts weakness (a severe lack of management skills and performance monitoring) and increases resilience. 

A key aspect is that rather than teams of up to seven people supporting a given academic department, teams of six to eight people support a part of the campus. Keeping teams small enables inexperienced managers to succeed, with additional support from detailed, weekly reporting of how people spend their time. This close monitoring highlights problems, training needs and resourcing needs. The larger teams enable people to share knowledge and cover for each other as needed, and to rotate among teams. Other universities have expressed an interest in learning how we achieved this, as it is common for academic departments to be hostile to any form of centralisation or perceived loss of control.

The change was significant – in this, the largest of six re-organisations in the year, more than 50 people in second-line support were put at risk of redundancy, assessed for a wide range of skills and redeployed in completely different teams. In the public sector such a reorganisation is a significant task, but it was completed from proposal to final structure in less than three months. The assessment included technical knowledge but had a significant focus on attitude and ways of working including teamwork, awareness of risk and cost and above all the need to take responsibility. It is still early days but we are delivering a better service already (at lower cost) and the next year will build on this.

This particular re-organisation, done while keeping the lights on with no additional staff, was the biggest deliverable of the transformation programme of the team last year. Other significant changes include:

• Creation of a team of business analysts reporting to the transformational change manager. This enables a focus on process improvement in all projects, large and small.
• Stronger use of ITIL processes, including training for 100% of team  eg, the number of planned changes increased by over 80%, with 98% of changes successful as a result of more stringent change process; the average age of incidents was reduced from 86 days to 20, with a smaller team handling significant more incidents by using problem management and close supervision; and asset management has improved, helped by transferring all IT purchasing to the IT department, in itself a significant cultural change that was one of the hardest we have undertaken in this transformation (a recent survey found that Durham now leads its peers in the level of control over IT purchasing by departments, and a consequent reduction in shadow IT.
• Moving the service desk into the library, putting it at the heart of the student experience and increasing hours of support. This has been an extremely popular move.
• Improved communications internally within IT (weekly achievements newsletter, monthly team briefing, regular ‘five-minute update’, quarterly ‘town hall’ meetings for all, move to an open plan office for almost all the team).
• Improved communication and relationships with our customers through the improved engagement model and as a result of better delivered services.
• Disbanding of the analogue telecoms team, saving 80K a year and enabling people instead to do more beneficial work in administration, reception or support.

In addition to the organisational changes, the first year of NWP has planned and delivered significant technology changes, with extensive deployment planned for the next two years. In 2013-14:

• Wireless coverage across the university went from 5% to 96%.
• We have designed a resilient network to replace a 25-year-old fragmented and non-resilient network, and started the project to replace it.
• We have wound down our analogue telephony systems to a minimum, enabling us to redeploy three FTEs and making savings.

We have also designed and are tendering for three datacentres, one of them high-performance computing. This included a substantial increase in the university’s power supply, involving a £1.6m investment. Extensive analysis and debate went into whether we could buy cloud services rather than host our own datacentre, but the uniqueness of our HPC services, the cost impact of our obligation to pay VAT and the lack of appropriately equipped local providers made outsourcing infeasible. Our architecture is designed with hybrid cloud in mind.

We have an ongoing programme of technology simplification across the university, reducing the complexity innate in the old IT fiefdom in each academic department. Starting from 14 Active Directories, diverse platforms, multiple email systems and 24 datacentres, we are well on the way to our target of one email system, an appropriate number of Active Directories with one single version of the truth for identity, to be aligned with the information stored via another of our transformational programmes, the roll-out of a new HR and payroll system. Simplification also targets printing  98 MFDs networked and provided with secure ‘print on demand’, allowing us to remove 374 printers in 2014, significantly reducing cost and our carbon footprint.

Security, resilience and access control have improved significantly but much remains to be done. In this first year improvements include: 
• Migration of backup systems. Over one weekend the whole administrative datacentre was physically relocated and backup systems for the first time physically separated from the primary systems. 
• Building of a response team that has handled major security issues (from Heartbleed to a DDoS to Shellshock) with negligible business interruption. 
• Provision of a new VPN service and of two-factor authentication where needed.

We are also deploying a suite of services for collaboration, to support education and research. The doctoral training centres and the roll-out of services such as Lync and Sharepoint are key strands in this in 2014/15. In 2015/16 this will extend to mobile access to our virtual learning environment, which is much requested by staff and students. We are engaging closely with students and academics to build on this to develop the best, modern means of learning that we can. Mobility and ‘access anywhere’ are key aspects that require us to have the right technology in place; this is progressing to plan, although winning hearts and minds is not always smooth. The reward is to see how seeding an idea transforms how people do their job: for me, this is the most exciting part of our programme.

What impact will the above transformation have on your organisation?
We secured £10m in North East Local Enterprise Partnership funding for this programme and have created jobs and developed infrastructure as planned, securing the funding incrementally. Thus NWP affects not only our organisation but the North East as a whole.

Everything we do aims at providing better IT support at a lower cost and focused on proactive provision of creative solutions and services. The more routine we can make day-to-day support, the more we can devote time and creativity to really enhancing the use of technology at Durham. The substantial financial benefits already achieved by reducing diversity also reduces risk substantially – for example, as more and more servers and storage are moved to our centrally managed datacentres where they have backups, environmental controls, regular patching and secure power supplies. Dozens of servers and 90TB of data have been centralised this year (many servers being virtualised in the process), while hundreds of people now use an up-to-date managed desktop; in the past there were many different environments, making support harder. The new print services eliminated the printing of over 300,000 pages – a significant saving on paper, ink, power, carbon and student cash; nor do we have to recycle binloads of wasted printout in the library any more.

The collaboration project in NWP focused on delivering the tools and governance to enable research and education and starting with doctoral training centres, shows how well the IT team can do when it has some headroom to think of the future. It has started with the basics but as we move on to the next stages - learning interventions based on activity or unified communications across the campus or the ability to build networks with our alumni – we shall see the benefits of refocusing the whole IT organisation.  

By (slowly) increasing our skills in business analysis and project management, we increase the success rate of IT projects and help the university to be more efficient. It is early days but this will over time make a fundamental difference to the effectiveness of the whole university. More mature project delivery and service management help us meet the university’s needs – for example, we are contributing to a better website, improved network performance on huge datasets, a new HPC datacentre, and better strategic planning across the organisation.  

All of this is bread and butter in IT, although it is not easy, especially in a working environment with great local autonomy and little central control. What makes it stand out is that we have focused not only on doing new things but on doing them in a different way: rewarding innovation and going the extra mile, sharing good ideas, valuing customer-focus and teamwork as much as technical expertise. We have focused on people as much as on technology, and we have tried to work by developing the existing people rather than replacing them.

How has your leadership style contributed to the outcomes of the transformation project?
Without trust we cannot empower our teams to do extraordinary things. My strong belief in integrity and openness helps win that trust. I try to understand the ambitions, talents and weaknesses of all the individuals in my team (160 at present), which enables me to develop them and give them opportunities they might not always consider. The open, non-hierarchical culture I foster means that people come forward with solutions and proposals who might otherwise not have been heard – everyone in the team, at whatever level, knows they can ask for time with me to share their ideas or worries.

I have substantial influence with the University executive and council, achieved through competence – by being practical, clear and convincing and by delivering on my promises. This noticeable influence, combined with rapid, decisive delivery from day one, has helped the whole IT team believe that they can be successful together. Improved morale has led to better service and a better use of innovation. I make every effort to ensure that each member of the IT team sees themselves as contributing to what we do as part of a team and believes that what we do matters to the university. I aim to keep teamwork and customer service at the heart of everything I do, and my firm belief in those fundamentals helps inspire the team and build its confidence.  

Durham is not a mature organisation and so a hands-on style is often needed. There is a need to lead, persuade, educate and inspire many individuals across the organisation, not just those in IT. Universities retain staff well, which means most people I work with know only one way of doing things; clear explanation and building trust is therefore vital. The university is accustomed to moving slowly, and has sometimes been shocked by the speed of my activities (a major re-organisation in five weeks, for example). Seeing such rapid, decisive activities succeed has shown the university and the IT team just how much is possible.

What key technologies do you consider enable transformation?
Nothing can be transformed without communication, and delivery depends on project management and business analysis. Actual technology isn't part of transformation except sometimes as the seed, where a true disruption arises; change is through people and people change when they buy into something and understand how they can achieve it.

Are you increasing the number of cloud applications or infrastructure in use at your organisation?

What is your information and data analytics vision for the organisation?
Durham operates at both ends of the spectrum, doing research using big data analytics yet in need of basic management reporting. I want us to do both well. To support analytics, the IT team primarily assists with the technology and infrastructure, as the academics and our partners determine the direction.

Management reporting (as in many universities and, indeed, many organisations) is weak. My vision is to clean the master data and provide clear, straightforward reports, to show what can be done with clean data reported on in a simple way. I have created a new team responsible for data and reporting services and we are piloting a new approach to reporting for the admissions team.

A key challenge is a uniform approach to CRM for admissions, providing a single view of a prospective student's contact with the university and an appropriate journey for the student from expressing an interest to arriving to study to becoming an alumnus. Better reporting in other areas will depend on a better understanding of our data and more consistent management of the input data: a classic information challenge.

Analytics on students has been successful in other universities  looking at various electronically stored data to assess how well they are doing and whether problems may be brewing. Until Durham captures more data electronically we shall not be able to do this, but clear benefits have been shown and when we have a consistent body of data, this will be part of our vision.

How is mobile and social networking impacting operations and customer experience?
For students, social networking is increasingly key to how they learn and fundamental to all their other activities. Some academics embrace this and others find it a challenge  the IT team helps them with this. Planned projects include mobile access to our virtual learning environment and better integration with the students' preferred social networks rather than building our own social network.

Our work on collaboration methods, secure remote access, mobile access, application virtualisation and so on will over time provide the seamless, mobile experience our students expect with the security and robustness the university demands.

Describe your strategic vision towards shadow IT and BYOD. How do you influence and engage executives and employees around choice?
I want to stamp out pointless shadow IT and diversity but to encourage partnership with my customers wherever there is a true need to do things in a different way, or to learn new ways to do things. With executive support, this is largely how we operate in Durham today.

BYOD has been the fundamental approach in universities since computing became consumerised – or even before. We in IT work with this by providing good advice, by providing flexible, secure working environments where any device (appropriately secured and authenticated) can be used, by promoting the use of managed desktop environments and by supporting the UK government policy of standard frameworks for purchasing IT equipment while allowing any variation that is justified by an actual need. This isn't easy, but the university IT department has decades of experience supporting diverse devices.

Shadow IT will always exist. The talk of CDOs and CMOs shows the current trend in IT spend out of the IT department. My vision  enacted in our support reorganisations  is for the central IT operational team to support all but the most specialist systems, embracing and learning to support any diversity that is needed. Even specialist systems often run on standard equipment, so support need not be a black art when you have a smart team.

Engaging at the executive level about choice has been straightforward in Durham. There is a strong push to reduce risk by increasing professional IT support, increasing standardisation and ensuring that security is managed by trained IT staff. We also want everyone to be empowered to do the best work they can. In general, given this executive backing, we are able to make exceptions while ensuring most people take advice of central IT.

Every IT purchase (even of a PC) must be approved by a senior member of the IT team, so we engage around choice ever week. Usually this is straightforward and people readily accept an equivalent piece of equipment. Where there is a true need for variation  eg for GPS on an iPad taking aerial photographs  the IT team supports the purchase, securing and deployment to the best of our ability. Often the requestor is competent to do most of this themselves. The challenge comes when someone wants a particular item without reasonable justification; unless the purchasing process is circumvented, the IT team can refuse the purchase, but we prefer to be able to explain why.

All kinds of devices are supported for students but we reserve the right to say something is too out of the ordinary for us to be able to help. Often there is an enthusiast who will help anyway, and our collaborative approach to support makes it easier for the support teams to ask each other questions. The 2014 intake of students connected 45,000 devices to the network last term, and almost a third of these were iPhones. This illustrates the fact that despite our open policy on BYOD, there is a great consistency in device and, if anything, there is convergence over recent years in the devices students own.

What strategic technology deals have been struck and with whom?
• IBM  memo of understanding regarding collaboration on big data. IBM provides the technology for our two largest HPC installations, one of which was renewed in 2014.
• Core  HR and payroll application.
• Wi-Fi  Pervasive/Aruba (2,600 WAPs installed last year).
• Converis  research management and reporting system.

Who are your main suppliers?
IBM, Dell, Viglen, Vodafone, BT, JANET, Oracle, Microsoft.

Durham University IT security and budget

Has your organisation detected a cyber intrusion in the last 12 months?

Has cyber-security risen up your management agenda?

Does your organisation understand the potential cyber-security threats it faces?

Has this led to an increase in your security budget?

What is the IT budget?
£13m plus £18m capital for projects.

How much is the IT operational spend compared to the revenue as a percentage?

What is the strategic aim of the CIO and IT operations for the next financial year?
Adapt to meet emerging business needs to support research and teaching while ensuring the new operating model continues to improve IT service delivery, restructure the information services team and successfully deliver key projects.

Are you finding it difficult to recruit the talent you need to drive transformation?

Has recruitment and retention risen up your agenda as a CIO?

Are you looking for recruits in the EU to fill the skills shortage you have?

Does your IT organisation operate an apprenticeship scheme?

Durham University technology department

How would you describe your leadership style?
People-focused, high-integrity, open, collaborative, energetic, empowering, intellectually rigorous, caring.

Explain how you’ve supported and developed your senior leadership team to support your overall objectives and vision
The senior IT leadership team meets weekly for either 90 minutes or two hours. This investment of time has been key to building a shared vision and ensuring the team depend on each other and share their views and challenges openly. My role is to chair that meeting, agree the agenda and empower each of my senior managers to take an active part in setting direction. We have some painful and difficult discussions as a result, especially when we are disappointed in our own performance, but we deliver the better for it.

We use a single template for setting performance goals and we share those goals with each other, so everybody knows their colleagues' agendas and can support them. The key goals are strategic and business-focused, while each senior manager has their part in common goals  to develop their people, their part of the service catalogue and their relationships with key stakeholders. I meet fortnightly for quality one-to-one time with each of my reports to discuss their progress, challenges and concerns and offer coaching. I have helped several of them to free significant periods of planning time alone or in small groups, where they can focus on key deliverables away from day-to-day distractions. I can often resolve resourcing issues by reprioritising resource or suggesting different ways to achieve their goals.

I support almost all requests for training, including creating new courses working with HR, and we have established a strong tradition throughout the team of mentoring, for which we work with both internal and external partners. My senior leads have close relationships with their senior customers, whom I encourage to act as coaches and mentors where appropriate, sometimes to cover specific skills and sometimes as general 'moral support'.

How many employees are in your IT team?

What is the split between in-house/outsourced staff?
100% in house.

Does your team include key skilled workers from the EU?