Digital Product Value Stream Management

Architecture Blueprint
(Focus: Product-Lead Orgs, Cloud Native Ops)
Industry lens: Generic
Version: 1.0 RC
Release: Tokyo
Updated: January 2023
Owner: Ian Leu, Enterprise Architecture
Feedback: [email protected]

Common Service Data Model / CSDM 4.0

(Digital product lifecycle portfolio, with an end-end unified product model)
Design/Planning Build Service Portfolio Management (Operations & Servicing)
Business Capability Business Application Information Portfolio Technology Portfolio Logical & Physical Building Blocks Microservices Portfolio API Portfolio Configuration Portfolio
Portfolio Portfolio Interfaces (UPM-X) (UPM-X) Sold Products Service Catalog & Items Service Portfolios Technical & Business Vendor/Outsourced Service Risk IT & OT
Manage
Service Offerings Services Service Mapping,
Technical & Customer Devices/
Equipment Models, Assets Cloud Production Sites Data Centers Endpoints
Business Environments
Accounts & Consumers Service-aware Install Technical & Business Service Committments Actual Service Perform. Service Cost & Technology Inventory
Foundational Organization Hierarchy, Locations, Buildings and Department, Business Build Core Cloud Native Services
Processes Product Models DevOps Config Lightstep Base Items Services (Expected SLAs) (NPS, CLV, SLOs, SLIs, EBs) (Configuration Items)
Users & Employees Spaces Units & Companies Apps: Operations
Platform Data

Monitor Ideation Priotitization & Funding Planning & Tracking Build Testing Deployment & Operation Servicing Monitor

Application Risk Customer Service Managament & BizOps

IT Risk/Vendor Risk & Compliance Management Business Model Canvas
Strategic Portfolio Management Outcomes & Business Value
Managers Management Customer Relationship Contract Lifecycle & Digital Commerce
Design Thinking Canvases Cloud Native Application(s) Mgmt. (e.g. Salesforce, e-Signature (e.g. (e.g. Salesforce,
Information (e.g. Miro) Strategic Enterprise Roadmap Supported languages: Elixir, php, Microsoft, Oracle) DocuSign, AdobeSign) Adobe, SAP)
Risks
Technology JavaScript, Erlang, Ruby, Swift, C++, Ingest Metrics,
Value Proposition Canvas CTO/CDO/ Product Strategy C#, Go, Python, Node.js, Java, etc. Traces,
Diagramming Map Goals Framework/Hierachy Intiatives Investment Funding Enterprise Roadmap Planning
Head Of Transformation Owners Microservices & Digital Experience Mgmt. Contact Center Telephony
(Enterprise Principles)
(e.g. Ins-pi Designer, Lucidchart) Supported open source telemetry Service Meshes (e.g. Adobe, Optimizely, (e.g. Amazon Connect,
OpenTelemetry
Business Capability Innovation & Ideas standards: OpenTelemetry,
Collector Salesforce, Oracle) NICE, Genesys, 3CLogic)
Enterprise OpenTracing & OpenCensus.
Capability
Architects Enterprise Archtiecture Mgmt. Portfolio Delivery Roadmap (Backlog)
Strategic Portfolio Management Customer Consistent Omni-Channel Service & User
Technology (e.g. Bizzdesign, LeanIX, Ins-pi) Portfolio / Program / Agile Release Train / Product / Unified Backlog Experience Analytics (Engagement Messengers,
Maps Project Mgmt. Office Lightstep Observability
Chief/Head Metrics: MTTD, MTTR, SLOs, Error Service Portals, Mobile Apps, Messaging, Virtual
Application Portfolio Management Internal, Customer & Partner Projects Epics
Inventory Sync Of EA DevOps Budget, Uptime, etc. Agents and/or Walk-Up Service Desks
Matrics: nr. active projects, planned cost + benefit, cost estimate at completion, actual cost + benefits, etc. Metrics: time to market, velocity, cumulative flow, lead time, etc. x

Business Capability Portfolio Approved & Funded Demands Developers Change Intelligence Metrics: NPS, CLV, Session Duration, Page Views,
CDO/CTO Business Demands
OT & IT Visibility Relationship Churn Probability, Product Usage, Product Interest.
(Servers, Databases, etc.) Technology &
Business Application Portfolio Features
Service Map Demands Managers Distributed Tracing
Customer
Inventory Sync Stories Cases
Information Portfolio Infra. & App Monitoring Employee Consistent Omni-Channel Service
Technology Head Of
(Service Portals, Mobile Apps, Messaging, Virtual
Operations Information Discovery & Information Risk Stories
Information Agents and/or Walk-Up Service Desks)
Classification Objects Technology Risk Portfolio
Sync Changes Service Mgmt.
(e.g. BigID, OneTrust) Stories Alerts
Incident Escalation
Incidents & Requests

Automated Demands Stories

Technology
Sync
Software Models
& Lifecycles Ideas Change
Service Operations
Software Asset Management Service Mesh & PacketMetrics:Analyzers
NPS, Nr. of Incidents, SLAs, SLOs, Error Budgets, Self-Service Success Rate.
(e.g. Istio, linkerd, consul, tcpdump)
Bugs & defects
Service-Contextual GBS Universal Request
Technology Technology Stack Alerts & Remediation Playbooks
Communities
Asset Mgmt. Software Models Product Product Product Director Automated Investigation
Software Asset Management & Lifecycles
Customers (Idea Portal) Employees Scrum
Owner
Scrum Scrum Product Scrum Product Scrum Human-
& Suppliers Master Master Owner Master Owner Master Owner Master Owner Incident Management
(e.g. SNOW, Flexera) Performance Analytics Centric
All Industries Sales, General and Manager Manager Manager
Alignment Planner Workspace Event Management, Metrics &
Administration (SG&A)
Team A
Business Impact Mitigation Delightful
Customers Team B Team C Team D Team E
Project Lead Project Lead Project Lead
Log Analytics (AIOps) Workforce Optimization
Team Team Team Team Team Team Team Team Team Team (Outage/Service Degradation Services
Cloud Readiness Employees Member Member Member Member Member Member Member Member Member Member (Employee Shift Scheduling & Announcements & Planning)
Assessments Consumers Team Member Team Member Team Member
Cloud Insight Skill Coaching)
Contractors Site Reliability Operations
Subsidiaries Team Team Team Team Team Root Cause Analysis &
Member Member Member Member Member Team Member Team Member Team Member Postmortems
Outsourced Staff
Agency DevOps/ Cloud Native Operations (Problem Management)
New Hires Application Team Member Team Member Team Member
Reseller Developers ServiceNow Agile Azure Boards Dist. Jira Dist. Instances Rally Dist. Instances Digital.ai Agility Dist.
Alumni Development Instances (optional) (optional) (optional) Instances (optional)
Suppliers/Vendors Traditional Project Management
Work Orchestration IT/GBS
Managers & Insights (Hybrid Operations) DevOps/ Site Network Security Customer
Partner Application Reliability Operations Operations Service Contact
Partner Developers Engineers Center(s) Center(s) Teams Center
Banking Subsidiaries Cross-Domain
Multisource Collaboration
Institutional Internal Agencys Risk Management (360° Enterprise Risk Monitoring) Change Alert
Customer IT Sevice Management Visibility Identification, Major Incident Management
Compliance Change Reconciliation (War Room)
Retail Customer Insurance Project Risks Environment, Social & Managers Multimodal Change API Mgmt. & Resolution
Work Information Security Risks Technology Risks Business Continuity Risks Regulatory Risks Vendor Risks
Problems Orchestration Critical Incident
Items & (people, cost, deadlines, etc.) Governance (ESG) (Change Management)
Agency Insured Problem Build Major Incident
(Consumer) Managers Progress Escalation Critical Incident
Customer Demands Change
Manager Agency Defects & Bugs DevOps Insight Dashboard Execution (DevOps Change Velocity & Insights) Critical Incident
Metrics: deployment frequency, lead time, mean time to resolve, change failure rate, etc. Communication
Fonds Manager Reseller Automated/Registered Prod Change
Cloud Center of DevOps/Application Developers Managers
GBS/IT Push Critical Incident
Incidents Excellence Notifications
Wealth Manager Service Automated Change Traceability Automated Change Registration Operational Risk Mitigation
Telco, Media &
Desk
Technology Communication &
Healthcare & Life Resolution Orchestration
Consumer Plans Repos Pipelines Software Quality Summary
Sciences
Lines Of Code Code Smells Secuirty Hotspots
Agency Platform Collaboration
Patient Maintainability Rating Duplications % Vulnerabilites
Work Items Commits Builds Test Summaries Artifact Versions Reliability Rating$ Bugs Secuirty Ratings
Notify
Healthcare Agent Reseller Coverage %
Vulnerabilities and
Partner security incidents OpenFrame
Clinician
Continous Integration/Continous Development (e.g. Azure DevOps, GitLab, GitHub, Jenkins, Containers, Microservices & Service Code Quality Mgmt. &
Practicioner Public Sector Cloud Provisioning & ServiceNow Voice
Bitbucket, Split.IO, Spinnaker, JUnit, Jfrog Artifactory, Concourse CI, CircleCI, Bamboo, Spinnaker, Meshes/Proxies (e.g. Kubernetes, Docker, Istio, Nginx, Chaos Engineering (e.g. DevOps Config Security Operations Lightstep Observability
Metrics

Traces

Governance
Nurse Citizen TeamCity, Tasktop, Digital.ai, Cloudbees, Sauce Labs, Chef, Selenium, Tricentis, IBM UrbanCode) Kong Ingress, AWS App Mesh, Hashicorp, envoy) SonarQube, Gremlin)
Bot-bot Integrations

Manufacturing Energy & Utilities

(Supply Chain) CISO Dashboard Pipeline Risk Mitigation (DevSecOps)
On-call notifications & collaboration channels
Institutional Endpoint Security Managed Security Service Threat Intelligence Identity Governance & Admin.
IT Asset Management OT & IT Visibility (e.g. CrowdStrike Falcon, Microsoft Proactive Metrics: critical overdue vuls., vuls on external facing assets/exploits available, etc. Integrated Risk Management IGA Risks
Supplier Customer Platforms (e.g. Fireeye HX, CrowdStrike (e.g. Clear Skye, SailPoint, Telephony, Collaboration & Notifications
SCCM, HCL BigFix, Tanium Patch) Responsive Metrics: new, open & closed incidents, incident backlog growth, etc. (Inherent & Residual)
(e.g. Fireeye, Google Chronicle) Falcon Insight, Recorded Future) OneIdentity) (e.g. MS Teams, Slack, PagerDuty, Zoom, Twilio
Logistics Retail Customer Container Vulnerability
Vulnerable Software CMDB Correlation V & Patching SI SI Risk events
API (SMS, WhatsApp, Facebook Messenger +
Production/ Response (e.g. Palo SI Voice), Trello, Genesys, NICE, 3CLogic, Nexmo)
Agency Vulnerability V
Manufacturing Proactive 1st Line Of Defense Alto Prisma, Sysdig) SREs/ DevOps Devs/ Responsive 1st Line Of Defense SI Access Management
Customer Managers IT Operations/ Application (e.g. Microsoft, Okta, Ping)
G

Customer Manager Compliance Vulnerabilities & Vulnerable CIs Cloud Security Patching Teams Owners Security Incident Response
Cloud Security
Managers (reactively discovered + zero-days) V (e.g. Azure Security Center, Playbooks Notification, Advanced Analytics
Reseller Reseller Security Operations & Reporting
Palo Alto Prisma Cloud) Collaboration & Notifications Clouds
Integrated Risk Management Solution Management Managers MITRE ATT&CK guided incident SI Events,
(e.g. ServiceNow App Push, Event Management (e.g. Microsoft Graph Logs,
Supply Chain (Inherent & Residual) Policy Configuration Compliance mapping & mitigation Metrics Operations (not servicing)
Configuration Compl. Twilio API) Business Contextualization & Sec. API, MS Sentinel)
exceptions App. Vulnerability Mgmt. & CIs
C (e.g. Tenable.io, QualysGuard, Threat Intelligence Enrichment Prioritization Containers
Application Security Testing & Software Tanium Comply) Automated Scanning,
Business Contextualization & Cointainment & Orchestration (e.g. Kubernetes)
Composition Analysis (e.g. Veracode, V
Patch Orchestration SI Data Loss Prevention
Customer Service Management Qualys WAS, Microfocus Fortify-on-Demand) Prioritization V Managed Security Service
Contextual Security Major Incident Mgmt. (e.g. Symantec,
Platforms (e.g. Mandiant Proofpoint, Netskope) Clouds
Ideas V
Vulnerability Mgmt. (e.g. Tenable.io, V V ASM, IBM Security Guardium) Automated/Registered Change (e.g. Amazon Web Services, MS Azure, Google
Customer Cases SI SI SI
SI
Tenable.sc, QualysGuard, Rapid7 InsightVM,
SI Cloud, IBM Cloud, Alibaba Cloud, OpenStack)
or Interactions Voice Solution Intelligence Operational Technology
MS Azure Defender for IoT + TVM) Vulnerability Intelligence (e.g. Security Service Edge Security Security Information & Event Mgmt. Endpoint Security (e.g. Crowdstrike Falcon Network Firewalls
Channel (e.g. Microsoft Research Center, Red Hat (e.g. Tenable.ot, Dragos WAS, Multimodal Change
Accenture iDfense, Cisco Kenna.VI, (e.g. Zscaler, Netskope, Awareness (e.g. IBM QRadar, Splunk Ent., LogRhythm Insight, MS Defender, Trend Micro, VMware (e.g. Palo Alto Networks, Observability, Logging & Monitoring
Feedback V = Vulnerabilities Security Data, Rapid7 InsightVM DW) Nozomi Fortify-on-Demand, Armis) (Change Management)
Voice Of Customer & Social SI = Security Incidents Recorded Future VI, Flashpoint VI.) McAfee Enterprise) (e.g. Cofense) Ent., Micro Focus ArcSight ESM) Carbon Black, SentinelOne Singularity) Fortinet, Check Point) (e.g. Prometheus, fluentd, ELK, Jaeger, Grafana,
Follow-up C = Compliance posture
Media Datadog, Instana, Dynatrace, Sumo Logic,
(e.g. Qualtrics, Medallia) Sentry, VMWare Wavefront, NewRelic, Splunk,
Honeycomb, Zabbix)
Multi-Cloud Platform Engineering (Cloud Provisioning & Governance)
Contact Center Voice Cloud User Portal & APIs
Cloud Center of DevOps/Application Secrets (e.g. Cyberark, Cloud Insight Endpoint Mgmt.
(e.g. Amazon Connect,
Genesys, NICE, 3CLogic) Excellence Developers Hashicorp Vault, BeyondTrust) Approvals (e.g. Microsoft Intune, VMware Workspace One)
Site Reliability Vulnerability Machine-
Customer Customer Engineers Managers Multimodal Change Driven
Clouds ServiceNow Agent Client Collector
Contact Center Experience (Change Management)
Automated/ Cloud Provider API (e.g. Amazon Web Services, MS Azure, (built on Sensu Framework) Insights
Unified Cloud Action Catalog Automated Provisioning Registered Google Cloud, IBM Cloud, VMWare)
Legend Automated Discovery Visibility
& Library (APIs & Portal) (& Approvals) Change
Live OSQuery + (Windows, Linux & macOS servers)
Automated
Playbook
DevOps Strategic Portfolio Cloud (Configuration + Tag) Cloud Migration & Infrastructure As Code Checks Monitoring
(ITSM Professional) Management Day-2 Operations
Governance, Compliance & Remediation Rightsizing (e.g. Terraform, Ansible, Cloudify, AWS Cloudformation, Azure
Resource Manager Templates, Google Deployment Manager) Log Analytics
Cloud Migration (Linux & Windows)
CSDM/CMDB/Platform OT & IT Operations Projects
Management
Live CI data & Investigation
FinOps (Cloud Insight)
Cost Optimization Metrics: (multi-cloud) current and trending cloud spend + savings
(rightsizing, business hours, terminate) Clouds Security Incident Response
Security Operations IT Asset Management Cloud Metadata
Savings Automation
(e.g. Amazon Web Services,
Product Investment Funding Clouds
Cloud Spend Workspace Microsoft Azure, Google Cloud)
Owners Cost Spend Multimodal Change Analysis &
(e.g. Amazon Web Services,
Customer Service Cloud (normalized billing & pricing data) Cloud Metadata (Change Management) Fixes ServiceNow Robotic Process
Enterprise Risk Management Microsoft Azure, Google Cloud) Metadata
Management Automation (RPA)
Operational Cost Risk Cloud Visibility
Cloud Center of Registered Change
IT Service Management (CIs with tags, low resource use, max
Lighstep Excellence Cloud Metadata
(ITSM Standard) utilization, owner change, etc.)
Non-API Accessible/
Policy driven governance & automation Stearable Applications
Finance/ On-premise Hyperscalers Utilization Metadata Cloud Cost Simulator
Peripheral Ecosystems Procurement (e.g. VMWare) (incl. bring your own license - BYOL)
Site Reliability DevOps/Application
Owners Service Cost IT Financial Management
Engineers Reporting (e.g. Apptio, Proven Optics)
Credits
Aurora Gaimon Groeles, Dennis Kujpers, Magnus Nilsson, Automated Risk Management (DevOps Accelerator)
Yoav Boaz, Tolga Tutel, Richard Hunt Continous Integration/Continous KRIs: Net loss, Nr. of Highest Risks & Failed Controls, Regulatory Compliance Score, etc. Risk Workspace
DevOps Config Validate config Compliance
Development (e.g. Azure DevOps, Configuration Data Control Objectives Policies Regulations
DevOps/Application (Continuous Validation) change Compliance Management
Jenkins, Gitlab, Github) Managers
Developers
Keys Policy as Code Engine Check for policy
Controls
Return compliance status (Run policies against config change) exception
Infrastructure As Code Risk
Roles/Department: Configuration Data Risks Risk Statements Risk Frameworks
Site Reliability Cloud Center of (e.g. Terraform, Ansible) IT Risk/Vendor Management
Policy exception request
Engineers Excellence Managers
Information Flow: