IT‑IS‑Networking
Technology › Enterprise Architecture & Governance

Architecture Governance

Review boards, charters and the design of decision-making bodies — including one written so its chair could be outvoted.

Also known as Architecture Review Board, ARB, Enterprise Security Committee, ESC

Left to right is time. Each row is one of the 10 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Chaired the City of Jacksonville’s Enterprise Security Committee from 2009 to 2012, which functioned as the enterprise architecture review board, and authored its charter. The committee predated the City’s Chief Security Officer post, so through those years security policy, procedures and technology governance were set in this body rather than by a dedicated security executive — which is why an architecture review board carried the security mandate at all.

It was designed as an eight-member body: six independent, non-executive managers selected for depth in enterprise design, security, standards and architecture, plus the customer relationship manager, chaired by the Technology Officer. Decisions carried by majority vote, with the membership sized so ties could not occur and independent contributors held equal weight.

The charter was written so its chair could be outvoted. A review board whose chair always wins is not a review board — it is an approval queue, and nobody outside the room honors it.

Beneath the committee sat a full governance stack: senior management above, the ESC setting direction, an Enterprise Security Plan below that, and system architecture, policies and system-specific security plans at the base, so any control at the bottom traced upward to a decision somebody owned. The committee set risk appetite and the thresholds for accepting, avoiding and mitigating risk, and reviewed and approved the security business case and its funding — which is what gave its standards force in an estate where nothing could be mandated.

Alongside the ESC sat a second body, and it is the one where architecture decisions were actually worked: the Architecture Technology Governance Committee, which ran from 2008 to 2021 and outlasted the security committee by nine years. It was succeeded in November 2021 by the Architecture Review Board, the first of these bodies to carry capital planning as well as architecture — and the first with a budget attached, which is the difference between a review board and an advisory group. It carried leadership and technical representation from every domain that had to live with the outcome — network, servers, storage and database, data center, helpdesk and desktop engineering, mobility and security, application development, business analysis and quality assurance.

Governance that only involves architects produces standards architects like. Putting the operations and delivery teams in the room is what made the patterns supportable.

Raising architects is part of the same discipline: setting technical direction across a distributed team, running a working design review practice, and moving engineers into senior and lead roles.

Applied in

  • Enterprise Architecture Practice Build2024–2026An architecture practice of up to fourteen, built and run to a design review gate and a weekly rhythm — so engagements were delivered against one design language rather than individual preference.
  • Architecture by Influence2010–2024A CIO's instruction — manage by influence rather than by headcount — and the fourteen years of practice built on it, in an estate where nothing could be mandated anyway.
  • Architecture Review BoardFrom November 2021The successor governance body, and the first with a budget attached — a five-to-ten year capital plan rather than a rolling list of purchases.
  • Enterprise AI Readiness Assessment2022–2024Two years of technology review and systems analysis on where AI could fit a consolidated city-county government — and, as often, where it could not yet be defended.
  • The Utility Relationship: Twenty-Five Years, Two EmployersOctober 1999 – January 2024Subject-matter expert to the same municipal utility from October 1999 to January 2024 — first as its consultant, then as the City's counterpart to it, because JEA is an authority under the city charter.
  • Proving Products Before Recommending Them2010–2024A standing part of the architecture function rather than an occasional exercise — pilot against the estate's own conditions, then hand it over with the operators trained.
  • The Capital Project Evaluation MatrixMethod authored March 2008 · the quadrant workbook created 18 March 2009 · last recorded use 17 May 2023The weighted scoring instrument behind the City's technology capital funding — and the single workbook built in March 2009 that was still deciding a security product purchase fourteen years later.
  • The Virtual Desktop Position2011–2023A decade of evaluation whose deliverable was a refusal — two platforms piloted and closed by change order, and an objection that held for eight years.
  • Requirements or Findings: When Architecture Gets Called2007–2022The same function with the same authority produces requirements on one capital program and findings on another — and the only variable is whether the project called it before or after the build.
  • Architecture Technology Governance Committee2008–2021The second governance body, and the one where architecture decisions were actually worked — with the operations and delivery teams in the room rather than only architects.
  • Enterprise Business Intelligence Platform and Capability2012–2016Architecture authority over the City's analytics platform, held deliberately apart from the group that built the reports — with the capability hired and taught to a published standard.
  • Comprehensive Performance Management — JaxOps, JaxAnalytics, JaxScore2013–2016The division's flagship analytics program in three layers, ending in a public dashboard — where disclosed numbers constrain the model underneath rather than the presentation on top.
  • Student Capstone Security Engagement and College Partnerships2009–2014A student team given scoped authorization to penetration test the live city estate — and a written response to their findings, taken to a second revision, rather than a thank-you note.
  • Enterprise Change Management Standard1999–2012A change process designed for a utility in 1999, carried into the City as its enterprise standard, and handed to operations in 2012 — after which it outlasted both commercial platforms bought to run it.
  • Enterprise Security Committee and Governance Program2009–2012The city's enterprise architecture review board, chaired and chartered — and, in the years before the City had a Chief Security Officer, the body where security policy was set.

Career

Documents

  • Enterprise Security Committee Charter2010The charter for the body that served as the city's enterprise architecture review board — written so its chair could be outvoted. Revision 5.0.

Attested by

  • TOGAF2015 · Not renewedThe Open Group Architecture Framework — the formal vocabulary for work already being done at the City of Jacksonville.

See also

Also searched as

  • TOGAF
  • architecture decision record
  • ADR
  • reference architecture
  • architecture repository
  • target state
  • vendor risk
  • third-party risk
  • procurement governance
  • RFP
  • solicitation
  • sole source