Resource Regions: Central and Eastern Europe

Customers’ raised expectations, government policies, a spike in fuel prices and technology innovation are converging to enable convenient, affordable, safe and environmentally sustainable mobility as a service (MaaS). MaaS solutions help connect the different phases of the door-to-door mobility experience, from planning to booking, payment, navigation and information queries, with seamless integrations across modes of transportation.

MaaS is not new, but it has been plagued by technical interoperability challenges and difficulty in finding the right business models that can push mobility ecosystem stakeholders — transit authorities, car OEMs, payment providers, transport network companies — to collaborate and share data.

Good Practices for MaaS Ecosystem Innovation

IDC research shows that MaaS is reaching an inflection point. Best practices are emerging among public transportation authorities and transportation operators to deliver on the promise of enabling customers to travel in a convenient way, when it suits them and at a reasonable cost.

At the same time, MaaS is enabling transport operators and planners to optimise the use of capital-intensive asset capacity, launch new revenue-generating services and encourage a modal shift to public modes of transport among citizens.

It all starts with the customer. User-centric MaaS apps enable travellers to build their unique mobility profile based on personal preferences, financial profile, physical characteristics and past behaviour. Service providers must recognise, serve and safeguard the individual preferences of each user to deliver truly personalised MaaS offerings.

Cities such as Genoa have deployed mobile-first user apps that provide a single point of access to information and services while on the move.

To book and pay for their journeys directly in the MaaS app, without the need to switch to a transport operator app, stakeholders must share data and define contractual models that benefit the whole ecosystem. In Spain, train operator Renfe has launched a door-to-door booking MaaS solution (the dōcō app) underpinned by a platform that enables actors across the mobility ecosystem to collaborate openly, from micromobility service providers, to ride-sharing apps, to technology manufacturers and payment system providers.

To enable rapid innovation and scale these MaaS data platforms to process, store, integrate and analyse vast swathes of data, transportation ecosystem companies such as Entur in Norway are moving away from monolithic, legacy systems to cloud-native solutions that enable data sharing at scale and agile innovation. 

Once data is aggregated and information is made accessible through platforms, transportation authorities can use it to build a mobility digital twin of the city that can help with traffic forecasting and simulation, traffic/city planning, infrastructure maintenance and asset management, and logistics resource planning. Data sharing can also support the development of new services and businesses. 

Further reading:

IDC PeerScape: Practices to Successfully Implement Mobility as a Service

This is the second blog in IDC’s series focusing on the implications of the EU’s updated Security of Network and Information Systems directive, NIS2. The directive comes into force in January 2023, after which Member States have 21 months to transpose it into their national law – by October 2024.

The broad aim of NIS2 is to engender a high common level of cybersecurity in the EU, across all Member States, in the long term.

The first blog looked at the regional and national entities that are tasked with transposing and implementing the new directive, as well as some of the mechanisms that are being put into place to effect improved cybersecurity across the bloc.

This second instalment looks at which organizations NIS2 will apply to and what will be required of them.

Expanding the Reach

The first NIS directive introduced a clear focus on improving cybersecurity and risk management at critical infrastructure in Europe: energy (electricity, oil, and gas), transportation, drinking water supply and distribution, healthcare, banking and finance, and digital infrastructure (Internet Exchange Points, DNS service providers, and Top-Level Domain (TLD) name registries). These were defined as operators of essential services (OES’s).

The volume and frequency of cyberattacks since the first directive came into force has driven home the message that cybersecurity safeguards and improvements need to be more far-reaching. Industry sectors that may not be viewed as critical may supply components or services to critical infrastructure, from electrical equipment to medical devices. Disruption of food production and distribution or waste management can have a major impact on the function of society. Digital providers such as search engines and online marketplaces are recognized for their universal value.

Consequently, the NIS2 directive extends coverage into all these segments and more. A full list of sectors defined as high criticality or critical is below:

High Criticality Sectors

• Energy.
• Transport.
• Banking.
• Financial market infrastructures.
• Health.
• Drinking water.
• Waste water.
• Digital infrastructure.
• ICT service management (B2B).
• Public administration.
• Space.

Other Critical Sectors

• Postal and courier services.
• Waste management.
• Manufacture, production and distribution of chemicals.
• Food production, processing and distribution.
• Manufacturing (medical devices, computer, electronic and optical products, electrical equipment, motor vehicles, transport equipment).
• Digital providers (online marketplaces, search engines and social networks).
• Research organisations.

Furthermore, it is recognized that it is not only large enterprises that represent a target for cybercriminals or are fundamental to critical services. Consequently, the NIS2 directive also extends the scope to cover midmarket organizations with 250 or more employees and turnover of €10 million or more.

The To-Do List

So, if your organization falls within the sectors covered by NIS2, what requirements are coming your way in the next two years? There are two major aspects to this, detailed in Chapter 4 of the directive, Cybersecurity risk management measures and reporting obligations.

Article 21 of the directive covers the cybersecurity risk management measures and lists the following 10 areas as the minimum recommendation:

• Policies on risk analysis and information system security
• Incident handling
• Business continuity and crisis management
• Supply chain security
• Security in network and information systems acquisition, development and maintenance
• Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
• Basic cyber hygiene practices and cybersecurity training
• Policies and procedures regarding the use of cryptography and, where appropriate, encryption
• HR security, access control policies and asset management
• MFA, continuous authentication, and secure communications where appropriate

It is likely that most entities within critical infrastructure sectors will already have many of these technologies and measures in place, to some degree. The question will be in the level of detail or prescriptiveness that member states go to when transposing this article into their national legislation.

The directive emphasizes that the implementation of these measures should take into account the state-of-the-art, relevant European and international standards, the cost of implementation, the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact. These considerations should be used to determine appropriate or proportional measures.

Article 23 of the directive covers reporting obligations and requires that in the case of any incident that has a significant impact on the provision of their services, essential and important entities notify their CSIRT or competent authority. An early warning should be submitted within 24 hours of the organizations becoming aware of a significant incident, and a more comprehensive incident notification should be submitted within 72 hours.

Further reporting obligations are detailed within the directive and it will be necessary for all organizations covered by NIS2 to familiarize themselves with these obligations once they have been transposed into their national law.

Conclusion

It is early days still for NIS2 and much will depend on the work done over the next 21 months. Nevertheless, the cyberthreats driving this directive will not wait and the benefits from improved cybersecurity measures will outweigh the risks.

Regardless of the final wording of the local versions of the directive, organizations can benefit from getting up to speed with NIS2 and engaging with the existing cybersecurity authorities within their countries to develop their strategies.

November 2022 was a busy month for the European Commission, with two major pieces of legislation passed that aim to bolster the cybersecurity and cyber resilience of Member States and at organisations across the bloc.

The first was the Digital Operational Resilience Act (DORA), which covers the finance sector and companies that provide ICT services and infrastructure to financial sector entities. The second was the long-awaited update of the Security of Network and Information Systems (NIS) directive, known as NIS 2.

The broad aim of NIS 2 is to engender a high common level of cybersecurity in the EU, across all Member States, in the long term.

This is the first in a two-part IDC blog series that will focus on the implications of NIS 2.

The Clock is Ticking

The full text of the NIS 2 directive was published in the official journal of the European Union on December 27, 2022, and enters into force 20 days after that (January 16, 2023). Thereafter, Member States will have 21 months to transpose the directive into their national law (by October 17, 2024). What happens between now and then?

Building the Frame(work)

The next 21 months will be critical for the success of NIS 2 as regional and national bodies get to work on transposing the articles of the directive into their national legislation. Who will be responsible for this part of the process?

The prime mover in this respect will be the NIS Cooperation Group, which was established in 2017 to support the first NIS directive. The Cooperation Group comprises representatives of all the EU Member States, the European Commission and the EU Agency for Cybersecurity (ENISA).

The group will provide guidance to the national authorities of the Member States on transposing and implementing the directive. It will also provide guidance, advice and cooperation on numerous related areas including cybersecurity policy initiatives, capacity building, training and awareness, exchange of information and best practices, and vulnerability disclosure. It will also be responsible for defining standards and technical specifications, as well as maintaining a central register of essential and important entities in each country.

A second key group will be a network of computer security incident response teams (CSIRTs) across all the Member States. At least one CSIRT in each country will be designated as a competent authority for various roles including international cooperation and coordination, threat monitoring and analysis, and the provision of incident response and assistance to essential entities.

The third key entity is the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe). Its task is to support coordinated management of large-scale cybersecurity incidents and crises at an operational level. It will also ensure regular exchange of information among Member States and relevant entities within the union. EU-CyCLONe’s role will really crank up once the directive is in place.

Key responsibilities will include:

• Developing shared situational awareness for large-scale cybersecurity incidents
• Assessing the impact of large-scale cybersecurity incidents and proposing potential mitigation measures
• Coordinating the management of large-scale cybersecurity incidents and supporting decision making at the political level

Between them, these organisations, along with the Member States themselves, will be tasked with ensuring that when NIS 2 comes into force at the national level, it is appropriately transposed into national law and the countries are able to put in place the necessary structures and resources.

Kicking the Tyres

One criticism of the first NIS directive was that it lacked teeth. The EC is striving to establish NIS 2 more firmly throughout the bloc and one measure through which it seeks to do this is peer reviews. These are aimed at assessing at a national level the conformity, progress and readiness of the directive. For example, peer reviews will assess:

• The level of implementation of cybersecurity risk management measures and reporting obligations
• The level of capabilities, including available financial, technical and human resources
• The operational capabilities of the country’s CSIRTs
• The level of implementation of cybersecurity information-sharing arrangements

Peer reviews are to be carried out by designated cybersecurity experts from at least two Member States, at a maximum of once every two years. The experts conducting the reviews are expected to provide reports including recommended improvement on any of the reviewed aspects. Those reports will be submitted to the Cooperation Group and the CSIRTs network where relevant.

Conclusion

These entities and processes should ensure that at a regional and national level the EU and its Member States can develop a higher level of cybersecurity and resilience by adhering to the NIS 2 directive.

The second instalment of this blog series will look at which organisations NIS 2 will apply to and what will be required of them.

“Humanity has a choice: cooperate or perish. It’s either a Climate Solidarity Pact — or a Collective Suicide Pact”.

COP27, held in Sharm El Sheikh, Egypt, in November 2022, began with this sobering opening statement from UN Secretary-General António Guterres. It set the mood for the two-week conference, which fell well short of meeting its targets. According to the Economist, “There is no way Earth can now avoid a temperature rise of more than 1.5°C. There is still hope that the overshoot may not be too big, and may be only temporary, but even these consoling possibilities are becoming ever less likely.”

Governments need to keep investing to tackle climate change, but they now also need to invest to increase our collective resilience. Since COP26 in 2021, not only has the geopolitical environment changed significantly, but the increase in global temperatures, causing wildfires and flooding, has reminded us of the heavy cost of inaction.

While people expect decisive action from their governments, their leaders seem overwhelmed with different priorities and planned investments.

A Real Test of Leadership

This year, 130 developing countries succeeded in their attempt to add the notion of “loss and damages” to the official COP27 agenda. But with COP now over for another year, that looks like the only success in 2022. Even that still needs to be ironed out, however, and it should also be remembered that it only tackles the consequences and not the causes.

Mahmoud Mohieldin, UN Climate Change High Level Champion for Egypt, reminded us that global warming is not only about changing the way we produce and consume energy, but also about the way we produce food. “Transforming food systems could release back the $12 trillion the world spends on the hidden cost of food, from transportation to fertilisers,” he said. “We could also eliminate nearly all of the 8.5% of emissions that come from agriculture.”

There are many reasons why such important matters were not intensively discussed at COP27, but we believe one of them was the lack of global leadership.

If no leader stands out when there is so much to coordinate and activate, the transformation must come from cooperation and greater transparency in the promises made to lower our emissions and our dependence on fossil energies.

COP28: Climate Data for the Common Good

Next year’s COP will come at the same time as the first report since the Paris Agreement of 2015, as the final biennial reports for developed countries will be multilaterally assessed to complete the final IAR cycle during 2023–2024. It’s hard to believe that the direction set in 2015 — to limit global warming to well below 2°C and preferably to 1.5°C — will be reached by then. It’s also hard to think that we will have concrete data to rely on by then.

Some initiatives with data transparency at their core have already been implemented. We think of the Climate Data Steering Committee, the EU’s Corporate Sustainability Reporting Directive and the One Data Hub. By the time these reporting mechanisms are live, there will be more data to track and report, including the loss and damages funds agreed at COP27.

These reports include the same KPIs and data format to follow up on, however. One goal for government executives will be to agree on a data format for each component of climate change, which will need to be transparent for citizens so that they can hold their governments to account.

Philosopher Günther Anders once explained the notion of the Promethean gap, which refers to the incapacity of the human brain to perceive the danger it might encounter. At the beginning of 2022, IDC revealed that the number 2 challenge for governments when attempting to become more sustainable was the lack of IT tools to measure the impact, which was almost as challenging as the lack of funds. If we need concrete data before we take action, it’s time to understand that when it comes to “cooperate or perish” it’s not too late to make the right choice.

This year’s Enlit Europe, which took place between November 29 and December 1 in Frankfurt, attracted almost 18,000 visitors and 1,000 exhibitors from 100 countries — proving once again to be a reference point for the European (if not worldwide) utility sector.

Sessions on flexibility, energy transition, and digitalization, as well as numerous hub sessions, provided a great opportunity for knowledge sharing during the three-day event. Here are our key takeaways from discussions and debates with technology providers and utilities.

• European power DSOs are feeling the pinch due to accelerating demand for electrification and distributed generation. One DSO from the DACH region we talked to said it expects requests for PV connections to increase fourfold this year over 2021 in power terms. A Scandinavian operator said it needed to deploy as much capacity by the end of the decade as it had built over the past century. This was expected, of course, as distribution is where most of the energy system transformation is taking place. But things have now spread to a large and diverse cross-section of the power distribution world and DSOs don’t want to become the bottleneck of the energy transition. Distributors urgently need tools to shed light on the LV level of their grid — for planning, operations, and maintenance purposes — and marketplaces to access and procure flexibility in coordination with fellow DSOs and TSOs.
• Despite the events of the past 10 months, consumers still appear to be an afterthought for most energy suppliers and utilities (and numerous governments) across Europe. With energy and related energy costs top of mind for most customers, it was a great opportunity for companies to create awareness and educate customers on the energy transition, and the critical role they play in making it a reality. But that opportunity has been squandered, with companies failing to deliver on what matters most to customers: high-bill alerts and personalized, meaningful energy efficiency advice. Due to skyrocketing energy prices, energy suppliers are significantly worse off than before in terms of customer satisfaction and net promoter scores. By failing to support customers at a time of need, utilities have failed to change the narrative around them and become trusted energy advisors in the energy transition.
• As the energy transition accelerates, partnering and co-innovation are becoming critical tools to accelerate the development of solutions designed to respond to this acceleration. These are no longer buzzwords on slideware. Co-innovation between utilities and solution providers is happening on the ground and it is slashing time to market by a factor of three on average. There are hardly any strategic product initiatives by established software providers in this space that are not driven in cooperation with a carefully curated group of end users, leveraging design thinking and agile principles. Partnering between the incumbent enterprise and operational software vendors in the utilities space and their specialty counterparts has also accelerated significantly, offering a new procurement paradigm that combines what we call a platform approach to operations with a new wave of best-of-breed.
• The industry mantras of electrification, decarbonization, and energy transition continue to be recited despite the impact of the ongoing energy crisis. While the criticality of climate change can’t be neglected, it appears to some extent that the energy crisis has dampened the urgency for some companies and the industry as a whole to invest in making grids reliable for what’s to come. This is a concern, as some areas are already at risk of bottlenecks, as uptake of EVs, heat pumps, etc. increases. There are numerous European initiatives to foster electrification, such as “Fit for 55,” which will end the sale of new CO₂-emitting cars in Europe by 2035, and “REPowerEU,” which aims to install 50 million heat pumps by 2030. But this begs the question: Where are we going to get all this power from”

The overall impression is that of an industry chugging along, conscious that it can’t do it alone and increasingly reliant on its partners and innovation with other sectors. We have seen pockets of real disruptive innovation, but for the most part the industry feels a bit weary, and understandably so.

Here’s to brighter times when we meet in Paris at next year’s Enlit Europe.

Marc Dowd, Executive Partner from the IDC Executive Advisory service opened the call by thanking everyone for joining and with some of the Analyst Industry report data. Using extensive research IDC predicts that companies which use process mining tools will be 20% more profitable than their peers who do not use these tools. 

Evidence shows that 74% of organizations which start a process mining project are successful with the implementation.

Lessons Learnt

One leader felt that business tend to love business process mining tools or not use them at all. He said that he had used process mining to get ready for new ERP. 

He found that old ERP system is not a good way to figure out actual processes as this was fine where you had an end-to-end process in a single system, but this became more complex outside of this theoretical view. He hopes that these tools will help figure out actual processes.

Another attendee told the team about a BPM deployment they had begun 4 years ago. He was skeptical of the business benefits of these tools. His organisation found that these tools were too labour intensive to use to accurately define processes. 

The eventual outcome was where the business decided to drop BP tools– but use SAP instead to establish same processes, and procedures.

Marc thanked the attendees for their honesty on successes as well as less successful initiatives as a learning point for the others on the call as these lessons were invaluable.

Success with Process Modelling and ERP

Another attendee spoke about how he had used these business modelling tools for 10 years. The process had started with the idea of moving from internal development systems to SAP and the tools they implemented were to clean up processes taking 5 years of work to clean up business processes in a continuous improvement cycle. 

The CIO spoke of how they worked through but didn’t finish before SAP was introduced. Now after the fact, they are still trying to clean up processes which means they have implemented some of these which are sub optimal into their new ERP system. 

Marc asked about which process intel models the attendees had used. SAP Signavio solutions, which states it “can help you quickly empower your organization with business process transformation” had been used to mine SAP processes but people had issues where the process extended outside the SAP system. 

Managing Non-standard Apps and Processes

Marc opened the floor for the leaders to ask each other for help. One asked, how do you measure how custom developed apps and forms are used?

I Keeling, another IDC Executive Partner, explained that there are a number of tools and techniques available, but the fallback can always be basic manual process mapping and optimization and data flows are a good validation that you have captured everything.

BPM uses

Marc asked the audience, whether you need to model all your processes and how to know what should be modelled? 

A participant commented that they were pitched BPM tools to audit their systems as they needed to know how many issues were being handled as exceptions, rather than as normal processes and therefore costing the business money. They then asked, what is value that people get out of these tools?

Another Digital leader replied they had used business process mapping with ERP systems implemented 20 years ago to find out what parts of system/data was actually still being used by the business and remove redundancy to clean up the system.

Another said it was pitched to the board as a tool to help to find value destroyers and optimize.

The Executive Partners from IDC discussed how combining BPM with AI with automation tools could be used to track SLAs and trigger action.

Rolling out BPM

Some of the CIO’s said they have created a Centre of Excellence around processes within their business which had been successful.

I brought her experience as an ex-CIO to the proceedings and spoke about how she has done BPM using a Lean Six Sigma Black Belt to process map with alternative methods. She did not choose a blanket approach but looked for immediate value and savings. 

In both cases, she has used different approaches to look at ‘procure to pay’, ‘order to cash’ as the first key areas as well as with the data flow for GDPR which has given a good grounding in processes optimization. “For peripheral areas, we asked do we need to have all of these processes. Once we can see them, we can evaluate them” she said. 

It took a few years to work through the key processes across other areas, but reduced wait times, improved SLAs and got great results.

Another CIO agreed. He stated, “We focus on key processes – cash in, cash out, or in operations heavy organization. The focus on key processes is save time/money. He felt that if you try to model all processes, you get lost in the detail. They were now trying to use RPA and UI Path, feeling that maybe process modelling will help the automation.

Different Models

One CIO told us that in their experience with companies, one team is modelling, a different team is working to improve the processes. This didn’t work as well as one team working end-to-end.  

It was also felt that using process tools to help with IT governance to help with business cases for new technology allows you to measure demand better, but this had not been used extensively.

Shaping the Future

Marc posed a question to the leaders, “Is process mining a prerequisite for advanced tech like AI, virtual reality, etc?” 

Another leader said that if we can find a model, all apps become connected, we have a full flow of processes, a full landscape, that will be the main model and we will be able to use it rather than spending time on documentation. He felt it would probably be used more to workflow applications and will control many of the systems in the future, in real time.

Marc commented that while many companies want to automate processes and decisions but often, trust in the data is lacking. The closer you are to a process and related data, the less trust you have in the data, something the IDC Advisory team have worked through with a number of clients based on industry reports.

Marc stated that maybe we are the last generation of leaders who make decisions without data before the processes are fully available and data is available at every point as industries move closer to industries such as manufacturing.

More in Depth Knowledge

A rhetorical question was asked by the audience; how are companies high in the S curve doing? What are they doing in terms of process mining?

Marc mentioned that IDC research with vendors indicates that some process tools will soon be able to write code themselves or make suggestions around optimization based on AI in the near future

Questions were also asked about how process automation and task automation fit in with process mining. It was mooted that a “360 degree” Master Class to look at the best practices in leading companies bringing together knowledge from an Advisory, Analyst, CIO, Business and IT leader perspectives could be planned for 2024 if there is appropriate interest from the Digital Leadership Community. 

I and Marc thanked everyone for their attendance and candid “Chatham House rule” protected discussions and the shared value they bring.

Last year we predicted that “70% of CEOs of large European organisations will be incentivised to generate at least 40% of their revenues from digital by 2025, driving more than €4 trillion of gross value added in Europe.”

As we approach 2023, do we expect this to change?

If anything, the trend has accelerated. According to IDC’s Digital Executive Sentiment Survey (October 2022), European organisations now expect more than 50% of their revenues to come from digital business models on average in the next three years.

Listening to C-level executive priorities for the coming year, it’s clear that despite the polycrisis macroeconomic scenario, the C-suite remains optimistic about future digital investments and is increasingly looking at technology as a critical business differentiator to better deliver business outcomes, increase resilience and accelerate revenue growth. According to the chief innovation officer of a transportation company: “For the next six months our priority will be to build capabilities, including bringing people onboard, to help us build digital products.”

This is the dawn of a new digital decade — the digital business era. But even if the “what” is clear, the “how” is somewhat less clear.

There is urgency, particularly in Europe, to connect technology investments and revenue generation. The majority — 61% of European organisations — take a very siloed and disconnected approach to software projects. This results in one-off or reactive software innovation efforts that only occur in response to urgent market or customer demands. More often than not these efforts do not have a positive impact on revenue generation.

To succeed as a digital business, we argue that companies need to leverage a digital business platform. IDC defines this platform as a multilayered enterprisewide technology architecture, integrating different systems and applications, to enable use cases that ensure business competitiveness and innovation. Only 13% of European organisations have such an architecture, according to IDC’s Digital Executive Sentiment Survey, October 2022.

The platform can be segmented into 3 main layers:

• Foundational IT. These are the key tech building blocks forming the foundational tech layer required to deliver digital products and services. This includes 12 main elements: APIs, data systems, automation and orchestration capabilities, OT technologies, microservices, programmable infrastructure, multicloud services, security, AI/ML and other emerging technologies (blockchain, AR, VR, robotics, edge, etc.), integration tools, network and connectivity. Some digital design principles and practices should guide the CIO in implementing the right digital architecture.
• Tech use cases to build business resilience. These are specific digital products that enable the company to remain competitive, responding to the key business challenge of building resilience. This includes use cases that future-proof business, organisational and operations models such as contingency planning for the supply chain and customer churn analysis.
• Tech use cases to accelerate business growth. These use cases to accelerate growth and innovate include ecosystem data monetisation and intelligent M&A modelling.

As organisations build out their digital business platforms, this paves the way for business outcomes such as:

• Expanded target markets through innovative partnerships
• Extended digital use case road maps
• Greater opportunity to diversify the business model
• Greater loyalty/reduced churn with both customers and employees

If you want more information, reach out to Giulia Carosella, Neil Ward-Dutton, Jennifer Thomson, Mark Child, Andrew Buss, Archana Venkatraman or Tom Vavra.