IT Performance Management.pdf

The Applied Information Economics (AIE) methodology was used in a pilot study for the Department of Veterans Affairs' (VA) Information Security Program (ISP), a $114 million infrastructure initiative. The AIE methodology applies scientific and mathematical methods to the IT decision process, measuring the value of information to improve future decisions. The pilot aimed to determine the best combination of optional investments to reduce losses and the optimal rollout strategy for the Public Key Infrastructure (PKI) investment.

The AIE method identified seven key measurements to inform investment decisions and evaluate the program's effectiveness over time. The results showed that the Information Security Program could reduce expected losses by 75% to 95%, estimated between $1.1 billion and $2.4 billion, and that one optional investment, Intrusion Detection, was not cost-effective, resulting in a $30 million cost avoidance.

The pilot demonstrated a 300:1 payback, with a total cost of less than $100,000, and provided valuable insights for the VA to improve its IT investment decisions. The AIE methodology proved applicable in the federal environment, providing useful performance measures and lessons learned for other federal agencies. Key findings include:

The Information Security Program can reduce expected losses by 75% to 95%
The Intrusion Detection investment is not cost-effective, resulting in a $30 million cost avoidance
The AIE methodology provided a 300:1 payback, with a total cost of less than $100,000
The pilot demonstrated the value of using AIE to inform IT investment decisions in the federal government.