3 Big Questions
Question No 2 - How much is Enterprise Technical Debt?
By now you have a listing comprehensive enough to answer question 1.
The next step in the process is go through an assign each entry a risk status based on manufacturer end of life (EOL) policies and other factors such as expiry of maintenance or known cyber security risks. A handy short cut to finding out these EOL dates is to go to the endoflife.date website which lists all the most popular ones.
Unfortunately, a likely issue is the sheer quantity of entries; many of which are clearly not critical to company operations. Pareto's law can come to the rescue here: apply filtering to drop out low impact items, leaving the most significant in view.
Be wary of selecting just by size, occasionally very small items can be crucial.
Hopefully the list is more compact now. Next task is to work out which qualify as ETD risks.
Nearly all technology suppliers publish life cycles for their products. Usually, they take the form of a stepped retirement plan, each step withdraws an existing level of coverage and support until it disappears altogether.
So what can you do if your list has hundreds of lines and each has a different end of life retirement plan?
The answer is to decide on a set of End of Life criteria for your organisation and use these assign each entry a pass or fail. Apply these to each of the critical applications and you will be able to get a clear picture of the ETD landscape for your organisation.
These conditions can be set out in an internal Technical standard, which is written to be unambiguous and approved by leadership. This will be helpful in combating challenges that inevitably follow this exercise as internal staff often dispute the results.
