5 ways to nurture culture change in IT

A cloud services rollout at the Department of Homeland Security requires rethinking IT culture. These five tactics help
558 readers like this.
CIO Managing Your Boss

The U.S. Department of Homeland Security has been talking about moving to the cloud for several years. Multiple operating units across the department have launched individual initiatives, resulting in important progress but also in somewhat disconnected and redundant efforts. Each initiative must separately confront issues around strategy, procurement, security, network architecture, toolsets, and many other things.

To help address this challenge, DHS is developing a cloud services platform that will serve our entire organization. Our “Cloud Factory” project has clear goals: Accelerate velocity, drive innovation, increase security, and deliver mission capabilities more effectively.

It also involves, we’ve learned, a fair amount of cultural pain. Transforming our culture will be necessary in order for us to realize those goals. Here’s how we’re approaching it, and some lessons we’ve learned along the way.

[ For more change management strategies, see our related article, How to beat fear and loathing of IT change. ]

A cloud offering is born

The Cloud Factory, a shared services offering, will help project teams realize the full potential of the cloud through automation and integration. Our goal is to provide a common cloud platform with the ability to host any DHS system or application; flexibility to adapt to individual missions; a tech stack compliant with federal mandates; and a common DevSecOps tools suite.

We spent months researching commercial and open source tools and platforms, ultimately deciding to leverage several best-in-class tools, and engineer an integration framework so they work together, in our environment. This affords us some degree of future-proofing: If one capability is no longer best of breed, we can swap it for another. We also get to be agnostic to cloud service providers and software components, as much as possible.

We hope to have our first release launched soon, and we believe it will deliver significant benefits ranging from faster development to more robust security. However, as with any project of this scale, there are those in IT who are excited by this progress, and others who are more hesitant.

When developer wishes meet operations skepticism

Our development community, for example, is starving for this change. They can’t get it fast enough. And business owners and mission operators want the speed, flexibility, and innovation that cloud and DevOps promise.

But in many cases, folks with operational responsibilities – infrastructure ops, security ops, security compliance, and others – are more wary: The cloud services project fundamentally changes major processes they control, and in many cases, impacts their roles and responsibilities. This is where the real effort has been to win hearts and minds.

When people talk about digital transformation and why it’s often hard, it’s not just because cloud and DevOps require difficult changes. It’s not just about the changing dynamic between business, development, and operations. It’s not just because human capital and skill set shortages present continuous challenges. It’s all of the above – at the same time. And everything happens faster and faster every day.

5 culture change tactics

Keeping that difficult reality in mind, here are five things we are trying to support the cultural transformation necessary for success at DHS:

Change is OK. We need to foster the mindset that it’s OK to change, that it’s necessary to change, that it’s good to change, and that we’re going to continually drive change. Enabling people to think in those terms is incredibly powerful and important.

“We need to foster the mindset that it’s necessary to change, it’s good to change, and we’re going to continually drive change.”

Take risks. I spend a lot of my time encouraging people to try something new, to innovate, and take good risks. If we fail because we took a risk trying to improve something, that should be encouraged and rewarded. Fear of failure and fear of taking risks drives a lot of counterproductive behaviors.

Hire wisely. Attracting and retaining the right talent is absolutely critical. This isn’t novel, but in the federal government, it’s harder. Our one advantage is our mission: We must tap into the passion that people have for the critical work we do every day. We’re trying to make DHS a better place in order to make the world a better place – getting people to buy into that is very powerful.

Make aesthetic improvements. We just renovated our office to make it more open, light, and modern. We also got standing desks – one of the many things modern workplaces are encouraging these days. This may seem relatively unimportant, but it is hard to attract and retain the best people in soul-crushing Cubicle Land. We also believe this encourages more collaboration and cross-team discussion, which in turn drives innovation.

Tap the community. We’re trying to encourage a more robust public/private partnership. We are driving engagement with the venture capital community, tech startups, and leading technology companies – to identify opportunities to leverage their technology, but also to expose people to that way of thinking.

Planning, building, and working to launch Cloud Factory has been a valuable exercise in driving digital and cultural transformation. I think the key to our success will be a strong focus on not only what we’re trying to accomplish, but also why, to get people motivated and engaged. We are encouraging people to challenge the status quo, and most of all – to jump in and take the journey with us.

Michael Hermus is the Chief Technology Officer (CTO) at the Department of Homeland Security (DHS), working within the Office of the Chief Information Officer (OCIO). He assumed this position on June 15, 2015.


Michael - This is a great article, but is short on details and facts to the point that there are no details and facts. Here is the first thing that you must do:

Open up a shared GIT service with shared code projects. Migrate teams to speak code-speak - the language of IT. Take your confidential databases and replicate them into testing sources so that any DevOps build is tested against actual data. Do not abstract to virtualization, at least not right away. Take baby steps to production and isolate your production operations along mission critical boundaries. A lot more detail needs to be determined and explained.

I urge you to take risks, reduce the silo mentality and most of all begin the long path of inverting your command structure.


Ed VanVliet