Corporate Governance for Software Products

Organizations make investments in their people, in their infrastructure, and in their processes to enable them to better serve their customers. From a financial point of view, your goals should be to regularly and consistently create real business value and to provide an appropriate return on investment (ROI). To do this, you must determine how you will execute your strategy by selecting and prioritizing the most valuable initiatives to undertake. You must also monitor these initiatives to ensure that they fulfill their promise, and if not then remediate them appropriately.

An important aspect of lean governance is to ensure that people and teams have the authority to fulfill their responsibilities. Many agile transformations run into trouble when the roles and responsibilities of people are not agreed upon, or when they are not properly supported by senior management. Another important strategy is to empower teams to choose their own way of working (WoW), to self-determine how they will work together, enabling them to tailor their approach to meet the needs of the situation that they face.

There are two aspects to this. First, teams need to work effectively with their stakeholders. Second, teams also need to work effectively with their colleagues. To do this, you must adopt processes and organizational structures that encourage people to collaborate together and to learn from one another.

Although addressing risk at the team-level is a good start, it is not sufficient from an organizational point of view. Many small risks that are acceptable individually can add up to a huge risk for your organization. For example, one team using a new technology platform is an experiment. Fifty teams adopting that new platform at the same time is a significant risk if the platform proves to be problematic. Someone must be looking at risks from a portfolio perspective and guide teams accordingly.

Your organization isn’t just a collection of teams. It is an ecosystem of teams working together, supported by culture, ways of working, organizational structures, and technologies. All aspects of your ecosystem need to be healthy for your organization to thrive.

There are several ways that the DA toolkit promotes this.
First, work is performed in an agile manner that is inherently open and collaborative.
Second, all teams should present accurate and timely information to their stakeholders. For example, enterprise architects can make their work available to everyone, as can your portfolio management team, your data management team.
Third, everyone should be motivated to learn more about your organization, its strategy, its values, and how you intend to work together to achieve the outcomes you’ve set out for yourselves.

Lean governance balances your short-term and long-term needs. Too many organizations have allowed technical debt to grow in recent years, for the skills of their staff to stagnate, and to continue to tolerate traditional strategies that are well past their prime.

Regardless of the size or your organization, the length of time it has been in operation, or the sectors in which you work, someone is keeping an eye on and guiding your overall efforts.

Sadly, many governance strategies prove to be ineffective in practice due to application of traditional strategies and ways of thinking.

Ensure compliance to OWASP Top Ten and best practices.

Implement regular penetration tests for all exposed solutions.

Have a process to track and mitigate all published common vulnerabilities and exposures CVE alerts relevant to your digital products.

Libraries have to check for licenses, support organization. Regular checks for security flaws or published attacks must be implemented. A timely mitigation process must be in place

Potential vulnerabilities should be detected, documented. The mitigation process shall be triggered in accordance with the corporate governance.

All systems shall have adequate traceability and logging features. Logging data shall be archived accordingly with corporate governance and legal constraints.

Auditability is legally mandatory for some systems. An adequate audit solution shall be implemented at corporate level. The architecture trend of distributed systems and services makes an overall solution the sole source of information.

Resilience shall be part of governance to ensure customer satisfaction and survival of the organization.

Transparent and open communication to end users and stakeholders is a must in modern organizations. The communication approach shall be unified at corporate level.

Interfaces to external systems shall be logged and audited in full. This approach is mandatory to verify service level agreements. The data is also necessary if external partners initiate legal cases

Input validation of all interfaces is a mandatory security and quality requirements. Enterprise data is a high-value asset. Care should be taken to guarantee the long-term quality and usability of strategic data. This information is often used over decades.