Chief Information Officer

Chief Information Officer

The CIO runs the technology the company works on. The CTO runs the technology the company sells. Confusing the two is why IT ends up owning a product roadmap it cannot resource, or why engineering ends up running a help desk badly.

What this department owns

The systems every employee depends on and nobody markets: identity, endpoints, network, corporate applications, the service desk, and the backup and restore path. Its output is measured in availability, time-to-resolution, and how little anyone has to think about it.

• it-operations:service-desk — the front door, and the honest measure of whether any of this works
• it-operations:systems-administration and it-operations:network-administration — the estate
• it-operations:endpoint-management — the most exposed surface, because it leaves the building
• it-operations:identity-lifecycle-administration — execution of joiner-mover-leaver
• it-operations:it-asset-management — what you have, who has it, what it costs
• it-operations:backup-and-recovery — the restore, tested rather than assumed
• it-operations:virtualization-operations — the hypervisor layer the servers actually run on
• it-operations:cloud-administration — the corporate cloud and SaaS estate, distinct from the product's
• it-operations:telephony-and-conferencing — voice, rooms, and the obligations they carry
• it-operations:collaboration-platform-administration — mail, chat, meetings and file sharing, where most of the organization's unstructured data actually lives

The boundaries that cause arguments

State them once, in writing, and the recurring turf disputes stop:

• Security sets policy; IT executes it. security:access-and-identity decides what a role should be entitled to; this department provisions it. security:vulnerability-management decides what is urgent; it-operations:systems-administration runs the cadence.
• Engineering owns the product estate; IT owns the corporate estate. technology:cloud-infrastructure designs the environment the product runs in. Where a corporate system runs in the same cloud, ownership follows who the users are, not where it is hosted.
• Continuity objectives are the business's; the restore is IT's. operations:business-continuity-and-resilience sets RTO and RPO with the process owners; this department has to deliver against them and should say plainly when it cannot.

Build, buy, or outsource

Default to buy for anything that is not a differentiator. Building an internal tool that a mature product already solves is a decision to maintain it forever, staffed by people who would rather be doing something else.

Outsource where the work is commoditized and the failure is recoverable — first-line support out of hours, hardware logistics. Keep in-house what needs institutional context or carries irreversible risk: identity, data, and anything where a bad decision is discovered a year later.

The recovery you have never tested is a plan, not a capability

Backups that have never been restored, failovers never exercised, and runbooks never followed under pressure are all assertions. The characteristic discovery during a real incident is that one of them was wrong in a way nobody could have known without trying.

Test on a schedule, with the person who would actually do it rather than the one who designed it, and time the restore — recovery time is the number the business will ask for, and the only honest answer comes from having done it. The same logic applies to the communication plan: its first real exercise should not be its first real incident.