What’s sad and surprising about architecture is how seldom anything good comes of it.

Or, for that matter, how seldom anything at all comes of it.

I have no statistics, only experience … personal and anecdotal … and that experience says most attempts to institute an enterprise technical architecture management (ETAM) function die on the vine.

And of those that don’t die, most turn into bureaucracies — ivory-tower white-paper factories that demonstrate the brilliance of their authors much more than they promote effective technology implementations.

What goes wrong?

It starts, I think, with the goal of most ETAM implementations. They take the classic consulting approach: Document current state, design desired future state, document the gaps, and develop a plan to close them.

This is, to all appearances, perfectly logical. And familiar.

It’s also perfectly waterfall, complete with waterfall’s crushing shortcoming: By the time you reach the finish line, not only has the finish line moved somewhere else entirely but you aren’t even playing the same game anymore.

By the time you’re able to start implementing the ideal future state you’ve designed it’s already lost relevance.

Finish implementing it? If you have a good pair of binoculars you can see the continuously evolving ideal future state accelerating into the distance, the rate with which you can close the gap paling in comparison to the rate with which the gap grows in magnitude.

And that doesn’t take into account the additional delays that result from the corporate project governance process. After all, architecture-driven projects have to flow through it right along with all the others, competing for staff, budget and capital with everything else that might provide important business value.

So tear out the goal. ETAM’s purpose isn’t to get the enterprise to its ideal future state because it can’t ever get the enterprise to its ideal future state.

Agile ETAM sets a different goal: To shape events so that the enterprise is constantly migrating to a better architectural state.

Don’t sneeze at better. Better is better than not getting any better. Far better.

Which is why, for the past several years, I’ve been developing an agile approach to enterprise technical architecture management.

Not enterprise technical architecture management in support of Agile, which is a different matter, although Agile ETAM does support Agile development quite nicely.

Agile ETAM is, in fact, doubly agile. It (1) improves the enterprise technical architecture iteratively and incrementally, and (2) implements an ETAM function within IT iteratively and incrementally as well.

It starts with a foundation, as most architectures do that are intended to support enduring structures and not tents or movie sets. In this case the foundation consists of:

  • A sketch of the business architecture and strategy IT has to support (a sketch is generally sufficient for IT’s needs).
  • Current-state issues (for example, here).
  • Design goals — a consolidated view of what support for the business strategy and architecture plus remediation of current state issues looks like.
  • Design principles — what “good” means.

The design principles are the stable core of it. Business strategies may come and go, but IT’s decision to (for example) adopt an ERP-centric application and information layer instead of a federated architecture will inform project design decisions throughout.

As will the principle it leads to: “Use the module that comes with the ERP suite when it’s close enough, and when it isn’t, buy when we can and build when we have to.”

Many enterprises adopt the principle of never upgrading to stay current, only when new capabilities that will provide direct business value warrant it.

It’s almost always a mistake, because once you’ve skipped a couple of releases, getting current is almost as painful as converting to a different product entirely. Regardless, one of your principles should be about release currency, and just in case this isn’t clear, “we’ll make case-by-case decisions” is the opposite of operating from a stable core principle.

Once you’ve established a core set of design principles — maybe a dozen of them — you’re in a position to influence things, because from this point forward every project team has the design principles to use as a touchstone against which to gauge its design decisions.

The rules here are simple:

  1. Every project has to make design decisions consistent with the design principles.
  2. Every project has to leave the technical architecture more consistent with them than it was when the project started.

Is this all there is to Agile ETAM? Of course not.

It’s akin to Agile development methodologies, which start by building the smallest irreducible core of a system and then add on to it.

This is ETAM’s smallest irreducible core.

Dear Bob …

I’m the first line of defense when it comes to information technology here, here being a 30-person non-profit. I know you normally advise companies a hundred times our size or bigger, but I’m still hoping you can help me out.

What I’m looking for are … I know, not best practices, I’ve been paying attention … but some tested, reliable practices I can put into place here to keep the joint running, to coin a phrase.

Any suggestions?

– Stretched thin

Stretch …

Not a comprehensive list by any means. These should get you started:

  • Anti-virus/anti-malware: Choose one. Not a free one either. Install on every machine. Uninstalling to improve performance is a firing offense, because really, no business needs employees that stupid.
  • License management: In my admittedly limited experience, employees in small offices tend to be more cavalier about license legitimacy than those in large enterprises, those who work in non-profits even more so.

Impress on everyone that being smaller, or an organization that does good works won’t help a bit if there’s an audit. And besides, for many software categories non-profits qualify for very large discounts, so if someone needs a piece of software there’s rarely even a financial case for using an illegitimate copy of something.

  • Password reset: Set passwords to expire after no more than 60 days. Passwords should cover the basics — at least 8 characters long with at least two alphas and two numeric.

Yes, everyone will complain. Empathize, but hold your ground.

And while you’re talking to everyone about passwords, you might as well suggest they have a few different ones for different types of on-line life. The experts say they’re supposed to have a different password for every website they log into, but since that isn’t going to happen, having (for example) one for financial sites, a second for social media and a third for news will provide at least a layer of additional protection.

  • Phishing attacks: Educate everyone to recognize these, and in particular to avoid clicking on links within emails if they aren’t certain of the source.

Phishing attacks are the single most common way passwords are stolen, so this is critical.

And don’t be shy. Most people like to learn a few things so they feel more sophisticated about a topic, so long as you don’t overdo it.

So show them how to find out what’s in a link, and how to spot a URL that looks legitimate but isn’t (example: www.yourbankname.phonyphisher.com/lotsanonsensetohidethings).

They’ll feel good about knowing a bit more, and you’ll be a bit safer.

  • Installing free software: In a small office like yours I’m guessing you don’t lock down everyone’s system, and that’s okay. The best advice I have here is to caution everyone to be careful about what sites and software they download. Remind them to Google the name of any software they’re thinking of downloading — to do some research first to see if there are reports that a particular program isn’t safe.

In particular (and I’m carrying a grudge here), if a site offering free software tries to install a downloader first “to make installing software more convenient,” never (sorry, NEVER) trust that site. It’s easy to get fooled, by the way. I ended up with Mezaa a couple of months ago by missing that this was happening. It’s a nasty piece of malware I ended up with just by trying to upgrade a program I’d been using for some time.

Mezaa is what you might call flashmob software: When it comes in it immediately invites all of its friends to join it.

Don’t get me wrong. I’ve downloaded and used plenty of free software over the years that I’ve found immensely valuable and helpful. What you’re trying to do is to help everyone tell the difference between safe and unsafe free.

  • Protecting sensitive information: If it’s sensitive and someone is copying it to a jump drive, they should encrypt/protect it first.

MS Office has this as a built-in option; everyone should learn how to use it. Or, most jump drives now come with on-board encryption — all you have to do is enable it.

One complicating factor is that some countries have made it illegal to bring encrypted files through customs. Travelers should check the rules.

  • Last one: If a user becomes frustrated with their computer, it is not okay to throw it out the window. There might be an innocent pedestrian below — always check before hurling something heavy.

That’s what occurs to me. KJR subscribers … what did I miss?