A large FMCG company had their brands and business units operating in a federated manner. While this is not uncommon it has created a scenario where shadow IT was occurring, most especially in the digital space, making GRC and execution against an overall IT strategy impossible. Each brand within the group was running its own digital policies (or none at all!) and operating on whatever platform they wanted. More often than not these decisions were not being made by knowledgeable technical staff but by marketing or digital agencies. This created a significant governance concern and posed a significant IT security risk to the group. This situation came to a head when an external incident caused severe damage to one of the brands. This incident had the potential to damage the main holding company’s brand as well as the financial well-being of the entire group.
Shortly after the incident the company began to bear a barrage of hacking attacks on its various websites. Because of this situation there was a need to consolidate all the different brands’ hosting onto a single environment which was governed and monitored by Group IT. In this case, Azure was chosen due to the recommendations of Tangent Solutions. Azure enabled Tangent Solutions to implement a hardened and secure hosting environment and monitor all the websites on a single toolset and perform speedy and advanced disaster recovery if needed. At the time of the consolidation project the Azure data centres had not yet arrived in South Africa and as such the websites were deployed into the data centres in Europe. Through Tangent Solutions’ in depth knowledge of Azure and how to use the cloud to its full capability the remotely hosted websites were able to outperform locally websites in South Africa. The consolidation project did face significant challenges due to the federated nature of the company and engagement with business units was initially difficult. Some of this was caused by resistance to a perceived ‘loss of independence’. Additional complexities arose when engaging with businesses who had implemented websites but did not understand their chosen technologies or had not kept these technologies up to date. The way the company had been operating highlights the risk of having a federated business where Group IT does not thought lead the group on technology and thus resulting in risky shadow IT. The role of a modern Group IT needs to one of a centre of excellence, of governance, thought leadership and business enablement, taking into consideration the need for agility of their internal customers.