Mike and Iris met to discuss the strategic plan that would be presented at the upcoming company-wide strategic planning workshop. Mike had given Iris the IT Division's list of strategic goals. She had already seen RWW's most recent set of corporate strategic goals. "Mike, I see that you have kept a one-to-one alignment of your goals to the company goals," Iris said. "Do you think it's necessary for InfoSec's goals to have the same arrangement?"

"I've found that by keeping the alignment in place, it helps those higher up to stay focused on what IT will be doing to help them execute their important priorities," Mike replied. "But you'll notice that there are in fact a lot of differences." Mike then pointed to a section of the plan. "Notice here that corporate goal number three is an overall reduction in operating costs as a percentage of revenue," Mike explained. "I have the IT plan element in support still as goal number three, but it now has four parts listed within it. Each of those is a specific IT-related goal to reduce costs.

"Now look at corporate goal one, which really just says we need to increase revenue," Mike continued. "Since RWW doesn't really have any profit centers in the IT parts of the company, I just wrote a short section on how we will assist the revenue-producing parts of the company in doing more of that. Even though the IT goal isn't really very concrete, taking it out may be confusing if someone is trying to identify alignment." Iris nodded.

"So alignment is about making sure that what the lower-level business unit can do supports the higher-level unit's objectives," she said. "Exactly right," Mike said, also nodding. "So do you want the InfoSec goals to be subordinate to the corporate goals or just subordinate to the IT goals?" Iris asked. "Well, I think either approach will come to about the same thing," Mike responded. "But for this cycle, you can work from the draft IT planning goals in this version so long as you keep up the alignment in the numbering. Since you are new at this, that might make it go a little faster."

Discussion

1. Few InfoSec business units can generate revenue. Do you think Iris should word her plans to be in support of IT efforts to support revenue-generating business units, or should she adopt Mike's goal and also seek to support the profit centers of the company directly? Why is the second choice better for Iris and the InfoSec unit?

2. What options will Iris have if she finds an IT strategic objective that she thinks would reduce the security of RWW's information assets?