1Information and telecommunications development strategy of KEGOC until 2019 Table of contents 1. 2. Introduction Analysis of the Current Status of the Company's IT Architecture 3 4 2.1 Business Architecture of the Company 4 2.2 Architecture of Applications in the Company 7 2.3 Data Architecture 11 2.4 Technology Architecture 12 2.5 Information Security Architecture 17 2.6 Management of IT Processes and Services 18 2.7 Overview of the Existing Model of IT Governance 20 2.8 ITS in the Peer Companies 22 3. Strategic Goals and Key Business Drivers of the Company 24 3.1 Strategic Goals of the Company 24 3.2 Key Business Drivers and Their Prioritizing 25 4. 5. 6. The List of Business Requirements for ITS Results of a Comprehensive Analysis of the Current State of Company's ITS Target IT Architecture of the Company 26 28 29 6.1 Business Architecture of the Company 30 6.2 Application Architecture 32 6.3 Data Architecture 35 6.4 Technology Architecture 37 6.5 Information Security Architecture 38 6.6 Principles of the Company's ITS Development 40 6.7 Operating Model of ITS Management 42 7. The Main Tasks of ITS Development Strategy 48 7.1 Enhancement of IT Management Function; 48 7.2 Improvement of Automatic Control in Operational Processes; 50 7.3 Improvement of Automatic Control in Support Processes; 56 7.4 Development of ITS infrastructure 62 7.5 Improvement of Maturity Level in Information Security Process 67 8. Plan of IT Initiatives Implementation 70 8.1 Prioritizing of IT Initiatives; 70 8.2 Mutual Influence of IT Initiatives 72 8.3 Plan of IT Strategy Implementation 73 9. Risk Register for IT Strategy Implementation Appendix No. 1: Terms and Abbreviations Appendix No. 2: Interrelation of IT Objectives with the Company's Strategic Goals Appendix No. 3: Portfolio of IT Strategic Projects with regard to their Classification 74 75 77 78 1. Introduction Kazakhstan Electricity Grid Operating Company (KEGOC) (hereinafter referred to as the "Company") was established in accordance with the Decree of the Government of the Republic of Kazakhstan dated 28 September 1996 No. 1188 "On some measures to restructure power system management in Kazakhstan". The Company is a System Operator of the Unified Power System of the Republic of Kazakhstan, and aims to provide reliable operation and efficient development of the Unified Power System (UPS) of Kazakhstan in accordance with current technical, economic, environmental requirements, standards of occupational health and health. KEGOC's mission is to reach the level of its globally recognised peers and become the centre of the expertise including in information technology and telecommunications. This document: "Information and telecommunications development strategy of KEGOC until 2019" (hereinafter referred to as the "Strategy") is designed to determine the main areas of development of the information and telecommunications system (ITS) in the Company's in the medium term until 2019. The terms and abbreviations in this Strategy are used in accordance with Appendix 1. Terms and abbreviations. This Strategy covers the period from 2014 to 2019 and all units in the Executive Administration (hereinafter referred to as "EA") and Company's branches, subsidiaries and related companies. This document is based on international best practices and experiences in the field of information and telecommunication technologies, including the following documents: KEGOC's long-term development strategy until 2025; KEGOC's innovation and technology strategy. Power industry law in Kazakhstan No. 588-II dated 9 July 2004; Decree No. 300 of the Government of Kazakhstan dated 29 March 2013 "On approval of the rules for provision of services by the system operator, and for organization and operation of the market of system and auxiliary services." Expectations of the sole shareholder of KEGOC for 2014. Samruk-Kazyna's IT policy International IT standards: CobIT, ITIL, ISO, IEC and the knowledge base of PwC. 2. Analysis of the Current Status of the Company's IT Architecture 2.1 Business Architecture of the Company Core Operations of the Company According to Decree No. 300 of the Government of Kazakhstan dated 29 March 2013 "On approval of the rules for provision of services by the system operator, and for organization and operation of the market of system and ancillary services" the Company's range of operations includes: PwC render to the wholesale electricity market participants the contract-based electricity transmission services across the national power grid; service the grid and ensure its operational availability; render to the wholesale electricity market participants the contract-based technical dispatch control services through centralised operational dispatch control of the operational modes of Kazakhstan UPS including preparation of the actual energy balance reports and daily electricity production-consumption schedule; ensure reliable operation of Kazakhstan UPS; render to the wholesale electricity market participants the services of maintaining electric power reserve and balancing of generation and consumption of electricity; render to the wholesale electricity market participants the services of physical settlement of energy imbalances; render services of further financial settlement of energy imbalances in accordance with the laws of Kazakhstan; buy electricity from the wholesale electricity market participants for the purpose of the ancillary services as needed to ensure availability of the required volume and structure of operating reserves of electrical power; to control active and reactive power and enable the black start of the grid; manage the operation of the real time electricity balancing market, and the market of system and ancillary services; interact with power systems of neighbouring states in on the matters of management and stability of parallel (synchronous) operation of the systems; provide technical and methodological guidance for establishment of a unified information system, automated commercial metering system, interconnected relay protection and emergency control automatics for all participants of the wholesale electricity market; ensure equal access conditions to the national power grid for all wholesale electricity market participants; provide the wholesale electricity market participants in Kazakhstan with information that is not constituting commercial and other secrets protected by law; coordinate the repair dates for the primary equipment at power plants, substations, transmission lines, for the relay protection devices and emergency control automatics, process management systems and ensure their availability; participate in scheduling of hydroelectric power plants operation considering their water-economic balances and modes of operation of the power system of Kazakhstan; prepare long-term forecast of electric energy balances; purchase and sell electricity to cover the auxiliary technological and industrial consumption; to guarantee the contractual values of power flows with the energy systems of the neighbouring countries, and imbalances not covered by the balancing energy market to maintain the standard frequency of electric current in the power system of Kazakhstan. 4 Organizational Scale of the Company The Company operates in three regional energy zones of Kazakhstan: Zone North, which includes the East Kazakhstan, Pavlodar, Akmola, Karaganda, North Kazakhstan, Kostanai, Aktobe provinces and the city of Astana. Zone South, which includes Almaty, Zhambyl, Kyzylorda, South Kazakhstan provinces, the city of Almaty and Baikonur region. Zone West includes Atyrau, West Kazakhstan, and Mangistau provinces. Structure of the Company is as follows: nine intersystem electric network branches (hereinafter referred to as the "MES branches") covering all three regional energy zones of Kazakhstan and 74 electrical substations (hereinafter referred to as the "SS") with 33699.65 MVA of installed transformer capacity; the National Dispatch Centre of the System Operator (hereinafter referred to as NDC SO) - the branch of the Company which has the operational authority over all MES branches; Energoinform JSC is the subsidiary of the Company; it provides operational support of information and telecommunications system. Business Processes of the Company The basis of the business processes architecture is the business operations of the Company, which can be divided into three categories: Management Processes Operational processes Supporting processes These business processes are considered as potential areas for automation and further optimization. Management Processes This a set of business processes to define strategic goals, plan operations, control and manage the core operations of the Company, its internal relationships within the Company and external relationships with the third parties. These include: Strategic management; Corporate governance; Planning, budgeting and monitoring; Pricing and stakeholders relationship management; Study and selection of new technologies; Risk management, internal control and audit; Operational Processes These business processes form the value chain and consist of the following categories: Electricity transmission; Technical dispatch control; Management of electricity production and consumption balancing; Management of generating capacity reserve; Capital construction; Science and education; Purchase and sale of system and ancillary services and electricity. Four major business process: "Electricity transmission", "Technical dispatch control", "Management of electricity production and consumption balancing" and "Management of generating capacity reserve" generate the most of the Company's revenue. Supporting Processes The supporting business processes includes: PwC Contracts, procurement and logistics; Legal support; Human resource management; Finance and accounting; Occupational health, health and environmental protection; Management of administrative and office venues; IT support. 5 The architecture of the business processes of the Company is given below: Management Processes Figure 2.2.2 Business Architecture Strategic management Corporate governance Electricity transmission Planning, budgeting and monitoring Pricing and stakeholders relationship management Technical dispatch control Provision of access to NPG Study and selection of new technologies Management of electricity production and consumption balancing Risk management, internal control and audit Management of generating capacity reserve Acceptance of energy to NPG Operational processes Supply energy from NPG Development of NPG Prevention, isolation and elimination of technical process failures Development and issue of operational mode guidance Maintenance of the parallel operation with power systems of the neighbouring states Operation of the relay protection and emergency automation Operation, maintenance and repair of NPG Preparation of daily schedules Physical settlement of imbalances Calculation of losses, preparation of actual and forecast balances Termination of services Science and education Supporting Processes Research and development Contracts, procurement and logistics Knowledge Management Purchase and sale of system and ancillary services and electricity. Rationalisation Activity Legal support Human resource management Sale of system services and purchase of ancillary services Finance and accounting Mega-processes (zero level processes) PwC Purchase and sale of electricity to compensate for interstate trade balance of electricity flows IT support Capital construction Development of detail design and estimate documentation Occupational safety, health and environmental protection Projects management Management of administrative and office venues First-level processes 6 2.2 Architecture of Applications in the Company Based on the business architecture the Company uses a variety of information systems that are partially or fully automate its core and financial operations. Information Systems for Management Processes For these Management business processes the Company uses information systems described in the table below: Table 2.2.1 Applications of the Management Processes Business Process Software (SW) Product Strategic management Prognoz IS System Class Automated balanced scorecard system Microsoft Office Office software Corporate governance Microsoft Office Office software Planning, budgeting and monitoring Oracle E-business Suite 11 Oracle Hyperion Pricing and stakeholders relationship management Automated management reporting system Microsoft Office Microsoft Office Risk management, internal control and audit Automated systems for budgeting and planning SAP Business Objects Microsoft Office Study and selection of new technologies Enterprise resource planning system (ERP) Oracle EAM AuditModern Office software Office software Office software Automated asset management system (AAMS) Automated system to support internal audit operations Business processes associated with "Risk Management" and "Strategic Management" processes of the Company have the potential to increase the level of automation. Information Systems for the Operational Processes The core processes are automated in the Company using the following applications: Business Process Electricity transmission Management of electricity production and consumption balancing PwC Software (SW) Product System Class Digital Map SW Geographic Information System (GIS) Diagnostika+ SW Diagnostic system of power plants Sicam PAS, Sicam PAS Automated substation process management system (ASPMS) SINAUT Spectrum SCADA / EMS OIS Automated dispatch control system (ADCS) Commercial metering system (CMR) Commercial metering system (CMS) Balancing electricity market system (BEMS) BEMS automated systems RASTR SW package Dispatcher training simulator software package Microsoft Office Office software SINAUT Spectrum Automated dispatch control system (SCADA/EMS) OIS Automated dispatch control system (ADCS) Commercial metering system (CMR) Commercial metering system (CMS) Balancing electricity market system (BEMS) BEMS automated systems 7 Business Process Technical dispatch control Management of generating capacity reserve Capital construction Science and education Purchase and sale of system and ancillary services and electricity Software (SW) Product System Class Microsoft Office Office software SINAUT Spectrum Automated dispatch control system (SCADA/EMS) OIS Automated dispatch control system (ADCS) Commercial metering system (CMR) Commercial metering system (CMS) Balancing electricity market system (BEMS) BEMS automated systems ARPAW SW package, KRAR SW package Automated systems for calculation of relay protection settings (CRPS) "MUSTANG" SW package, "RASTR" SW package, "DOKAR" SW package Software systems for calculation of power system operation modes "Phoenix" SW package, "TVR 12" SW package Dispatcher training simulator software packages Microsoft Office Office software OIS Automated dispatch control system (ADCS) SINAUT Spectrum Automated dispatch control system (SCADA/EMS) EAM Automated asset management system (AAMS) Microsoft Office Office software Corporate web portal Knowledge base "Idea-Innovation" IT portal Idea management system Oracle E-Business Suite 11 ERP SCADA/EMS-class systems, which are used to automate the core processes such as "Electricity Transmission", "Technical dispatch control", "Management of electricity production and consumption balancing", "Management of generating capacity reserve", have a number of technical limitations, namely: The systems are not able to collect and process the data from electricity market participants and the Company's substations using the obsolete technologies of telemetric data transmission; Requirements of SCADA / EMS to adequate amount of telemetric data limit the use of load flow calculation functions and assessment of the status, which is why the subsystem of the dispatcher training simulator is not functioning; Limited access to the system; Impossibility to integrate the system with other technological systems (CMR, BEMS); Insufficient "depth" of the archive subsystem to perform forecast calculations. Operation of the system is possible only based on a SPARC server platform and Solaris 8 operating system, which is not supported by the manufacturer now. Impossibility to export data into the formats supported by office software. Additionally, there is potential to automate the through processes, such as "Calculation of loss, preparation of actual and forecast balances". The business process is carried out manually. As part of this process, the Company also use a system of CMS type, which has a number of technical limitations. To address these limitations the Company initiated a project to replace the current system. As part of the "Capital Construction" processes the following processes: planning and approval of the investment program, accounting of the actual project costs have been automated using EAM and ERP type systems ('Project Costing' module), however there is potential for automation of the project management function. The automation of the "Operation, maintenance and repairs" process is nearing completion in EAM (Automated asset management system) information system. Commercial operation of the EAM system is scheduled for the first quarter of 2014. The "Science and education" process has been automated using corporate web portal and "Idea-Innovation" IT web portal, which is a proprietary design of the Company. Currently these web portals are being integrated under the "Creation and development of the Company's intranet portal" project (see section 3.8 Analysis of the current ITS development projects and plans). PwC 8 Information Systems for the Supporting Processes For these business processes, the Company uses information systems described in the table below Table 2.2.2 Applications of the Supporting Processes Business Process Finance and accounting Human resource management Contracts, procurement and logistics Management of administrative and office venues IT support Occupational health, health and environmental protection Legal support Software (SW) Product System Class Oracle E-Business Suite 11 ERP Lotus Notes Document Management System (DMS) Oracle E-Business Suite 11 ERP Lotus Notes Document Management System (DMS) Microsoft Office Office software Oracle E-Business Suite 11 ERP Lotus Notes Document Management System (DMS) Lotus Notes Document Management System (DMS) Microsoft System Center 2012 Service Desk Lotus Notes Document Management System (DMS) Safety training course SW The training system Microsoft Office Office software Lotus Notes Document Management System (DMS) Paragraph IS - LOTUS Notes Document Management System (DMS) As part of the "Human Resource Management", there is a need to automate the following sub-processes: planning and administration of the employee training process (elaboration of training programmes for each employee); monitoring of training programmes follow-up; record-keeping and analysis of training results. The "Occupational health, health and environmental protection" process has the potential for automation in the following sub-processes: PwC planning of technical (safety) control actions monitoring and control of the action results reporting on results of the completed actions 9 Management Processes Figure 2.2.2 Application Architecture Strategic management Corporate governance Planning, budgeting and monitoring MRS (SAP Business Objects) ERP Hyperion BSC (Prognoz IS) Pricing and stakeholders relationship management Electricity transmission Provision of access to NPG Study and selection of new technologies Risk management, internal control and audit Audit Modern EXCEL ERP Management of generating capacity reserve Management of electricity production and consumption balancing Technical dispatch control RASTR SW Acceptance of energy to NPG Supply energy from NPG Development of NPG Operational processes MUSTANG SW pckg ASPMS (Sicam PAS, Sicam SAS) DOKAR SW pckg Operation of the relay protection and emergency automation Operation, maintenance and repair of NPG RASTR SW pckg Development and issue of operational mode guidance Maintenance of the parallel operation with power systems of the neighbouring states Tranining simulators ("TVR 12", "Phoenix") OIS SCADA / EMS (SINAUT Spectrum) Prevention, isolation and elimination of technical process failures ARPAW KRAR Diagnostika+ SW GIS (Digital Map SW) EXCEL OIS Preparation of daily schedules BEMS Physical settlement of imbalances SCADA / EMS (SINAUT Spectrum) OIS Calculation of losses, preparation of actual and forecast balances EXCEL CMS BEMS Termination of services SCADA / EMS (SINAUT Spectrum) OIS Science and education Research and development Knowledge Management Rationalisation activity Supporting Processes Corporate web portal Contracts, procurement and logistics Executive administration Branches Purchase and sale of system and ancillary services and electricity. IT web portal Human resource management Finance and MRS (SAP accounting Business Objects) Sale of system services and purchase of ancillary services Purchase and sale of electricity to compensate for interstate trade of electricity ERP (Oracle E-business balance Suite 11) flows Management of administrative and office venues DMS (LOTUS NOTES) Suite 11) Projects management ERP (EAM) Occupational safety, health and environmental protection MS System Center 2012 ERPMIS (Oracle E-business High automation level PwC IT support Capital construction Development of detail design and estimate documentation Safety training course SW EXCEL Legal support Paragraph IS Average automation level 10 2.3 Data Architecture Data architecture of the Company is a collection of different information flows from the core operations systems and automated financial and economic operations systems. For the purpose of management and financial reporting, the Company accumulates and consolidates information from 9 MES branches and 74 substations. For the most part the data is transferred automatically. In some cases, the existing information systems used by the Company do not meet the requirements of the business due to technical limitations of the software. Current data architecture of the Company has the following shortages: 1) Redundancy and duplication of data, including data about the objects of accounting and network modelling; 2) Lack of integration between information systems; 3) Lack of a common information space with a single and unified reference data; 4) Manual processes that require automation; Below is the data architecture with the following types of data (see Figure 2.3.1): core operations data; financial and administrative data. Figure 2.3.1 Data Architecture SAP Balanced Scorecard (BSC) Executive administration Flat files (.xls, .txt, .doc, Diagnostika+ etc.) BEMS RASTR OIS SCADA / EMS ERP Oracle Hyperion ERP Oracle Hyperion DMS MUSTANG DOKAR Flat files (.xls, .txt, .doc, etc.) Flat files (.xls, .txt, .doc, etc.) SW GIS BEMS CMR Simulators Branches and affiliates DMS OIS SCADA / EMS RASTR GIS BEMS CMR Flat files (.xls, .txt, .doc, Flat files (.xls, .txt, .doc, etc.) etc.) Diagnostika+ SW OIS TES, substations SCADA Diagnostika+ SW ERP ASPMS GIS Core operations data Automatic data transfer PwC CMR Flat files (.xls, .txt, .doc, etc.) financial and administrative data Non-automatic data transfer Duplication of data streams 11 2.4 Technology Architecture To ensure reliable operation of the National Power Grid the Company applied sophisticated technological solution for both IT and telecommunications. Technical infrastructure of the Company is designed as a centralized control structure. However, hardware and software component of these designs do not fully meet the current needs of business, namely, the throughput capacity of the existing data channels (corporate data network) is low with high levels of wear-and-tear of: personal computers fleet; Server hardware; Active network equipment 2.4.1 Corporate Data Network (CDN) CDN of the Company consists of the following three segments: Logical Architecture of the Company's CDN; Backbone channels; Local area networks (LANs) of the branches. Logical Architecture of the Company's CDN Logical Architecture of the Company's CDN consists of three levels: Executive administration; MES branches; Substations. The units of the Company's logical architecture communicate using the following technologies: leased communication channels; PLC channels; Radio Relay Communication (RRC) or microwave channels; FOCL; Satellite communication channels (as a backup) Backbone Channels Now, the utilisation and loading of the backbone communication channels is high; this trend in future may lead to reduced reliability of NPG operations. The Company uses the following communication technologies: PwC Fibre-optic communication lines owned by the Company representing 6% of all backbone links. These links have a wide bandwidth (up to 10 Gbps) and are limited only by the capacity of the switching equipment. Fibre optic lines are constructed as a component of the electricity transmission lines and protected by the ground wire. As a result, these lines do not depend on the external conditions (weather, noise, etc.). Extent of the fibre optic lines owned by the Company is 2329 km; Relay lines (RRC) represent 31% of all backbone links. This kind of communication technology is based on the multiple relay of radio signals. The Company has two types of connections: point-to-point and point-to-multipoint. The throughput capacity of such link is 32 to 256 Kbps depending on the environmental conditions (weather, terrain, interference, etc.). These links do not satisfy the needs of the Company because they do not provide sufficient bandwidth for optimal performance of business (2 Mbps) and they are dependent on external conditions such as weather, interference, etc. These channels are mainly used for substation - MES communication. The current level of utilisation of these data channels is 100%. PLC channels (PLC). This type of communication technology uses power lines as a medium for data transmission. The throughput capacity of such link is 14 to 28 KBps depending on the environmental conditions (weather, terrain, interference, etc.). PLC communication channels share is 43% of all communication channels in the Company. The throughput capacity of such link is 14 to 28 Kbps depending on the environmental conditions (weather, terrain, interference, etc.). These links do not satisfy the needs of the Company because they do not provide sufficient bandwidth for optimal performance of business (2 Mbps) and they are dependent on external conditions such as weather, interference, etc. These channels are mainly used for substation - MES communication. The current level of utilization of these data channels is also 100%. Leased Links of the Third-Party Communication Providers This kind of communication is primarily used for data transfer between the head office (EA) and the branches and between branches and substations if covered by the provider. 128 kbps to 2048 kBps at the level of substation, TES-MES, RDC; 2048 kBps to 4096 kBps at the level of MES, RDC - Executive Administration, NDC SO. The share of the leased channels is 20% 12 of all communication channels in the Company. Twenty percent (20%) of all communication channels (leased communication channels - bandwidth - 2Mbps) partially meet the needs as they provide the bandwidth necessary for optimum business performance (2 Mbps), but for the moment their usage is 100% and they will not meet Company's needs if the data flow is increased. These communication channels are mainly used for communication between Executive Administration and MES branches. The current level of utilisation of these data channels is 93%. Satellite communication channels (as a backup) Satellite equipment necessary to connect to CDN is installed in the head office (EA), all MES branches and substations. The Master station is installed in the EA, the standby master station is installed in Almatinskiye MES branch. The satellite communication is based on the outdated SKY WAN technology, which is based on Frame-Relay technology. This technology does not meet the current needs of the Company in terms of throughput capacity (32-256 KBps) and its dependence on operation of the master station. The company was partially purchased new satellite equipment (master station) that uses modern technology SKY EDGE (IP MPLS). Until the spring of 2013 the Company leased frequencies for satellite communications from Eutelsat provider, starting from the spring of 2013 the Company leases frequency bands from Kazsat 2. The required minimum throughput capacity is 2 MBps: 19% of the channel is necessary for internal traffic (ldap, icmp, ftp); 16% of the channel is necessary for applications (ERP, web, Solomon); 8% of the channel is necessary for technological systems (SCADA, telemetry, OIS); 35% of the channel is necessary for mail services; 7% of the channel is necessary for Internet services; 8% of the channel is necessary for voice transmission; The basic technology of the corporate data network is MPLS. This technology enables the integration of different type of traffic with guaranteed quality of service. It also provides the possibility to build the networks for different purposes and interaction protocols. On the physical level, the core of the CDN is based on fibre optic technology. Cisco Catalyst 6506 are used as the backbone switches. The distribution level of the corporate data network is based on Cisco Catalyst 6506 Series switches. For the most part the Company's facilities are connected to the backbone using dedicated fibre optic cables. Some facilities are connected using leased dedicated frequency in the DWDM network of Kazakhtelecom provider. The "last mile" in all cases is provided using Energoinform's resources. All communication channels are redundant. Logical Architecture of the Company's CDN Logical architecture of the network is based on VPN technology. For informational interaction there is a possibility of flexible and easy creation of virtual private networks supporting TCP/IP routing protocol at the boundary of the network and switched traffic within the network. Currently the centralized network management covers the branches that are connected to CDN. The network is administered by the employees (administrators) of Energoinform trained in operation and administration of the network equipment. The Company has a service contract for the network equipment with the equipment supplier - Cisco. For efficient management of the network the Company uses specialized software of the centralized administration of network devices by Cisco. Local area networks (LANs) of the branches Local Area Networks (LANs) in the branches and substations are based on Ethernet technology using various physical communication lines (fibre-to-fibre, twisted pair (5e and higher), radio) and switching equipment by Cisco) (routers, switches, hubs, and radio access facilities) and others. Local networks of the branches built using CDN resources provide an opportunity for virtual private networks. 2.4.2 Server hardware Dell, Hewlett-Packard, Fujitsu brands, represents server hardware of the Company. The total number of servers is 298 units (see Table 2.4.2.1). The administration management of server hardware is decentralized in each MES branch, thus support is provided by local IT administrators. It is also worth noting that in all MES branches the number of servers with life in service of 5+ years is 64% (see Figure 2.4.2.1). PwC 13 Figure 2.4.2.1 Current Level of Depreciation of Server Hardware Depreciation of Server Hardware 5+ years 3-5 years less than 3 years 16% 19% 20% 55% 64% 23% Executive administration MES branches List of server hardware is presented in Table 2.4.2.1 Table 2.4 .2.1 Server Hardware in the Company MES branch Executive Administration (EA) and National Dispatch Centre of the System Operator (NDC SO) Almatinskiye MES Severnye MES Zapadnye MES Vostochnye MES Tsentralnye MES Akmolinskiye MES Sarbaiskiye MES Aktyubinskiye MES Yuzhnye MES Total Total number of server hardware Physical Servers Virtual Servers Total number of server hardware administrator s Average number of server hardware per one administrator 138 43 95 8 17.5 18 (46) 20 (57) 9 ( 38 ) 25 ( 44 ) 16 ( 16 ) 7 ( 31 ) 18 (46) 21 ( 43 ) 26 ( 56 ) 298 ( 377) 38 53 14 33 13 28 41 38 51 352 8 4 9 11 3 3 5 5 5 148 2 2 2 3 1 3 3 4 2 30 23 28.5 11.5 14 16 10.3 17 10.75 28 16.6 * Data is provided by Energoinform In order to optimize IT costs the Company uses VMWare virtualization platform. Now, this technology can reduce the load on the hardware. The load of the server hardware in the MES branches ranges from 2% to 55%. Current virtualization level of the server hardware fleet is depicted below: PwC 14 Figure 2.4.2.2 Current Server Hardware Virtualization Level in the Executive Administration Virtualization of Server Hardware Physical Servers Virtual Servers 33% 68% 67% 32% Executive administration MES branches Server Room The Executive Administration office has a specialized space to accommodate critical server and network equipment, as well as telephone exchanges. The size of this space can accommodate all server hardware that is crucial for operation of all information systems of the Company. The server and network hardware is located in specialized racks (cabinets). The room is equipped with air-conditioning, fire extinguishing, CCTV and fire alarm systems. To ensure a continuous power supply of equipment in the server room, there are sources of the guaranteed (uninterruptible) power supply. The power supplies can provide uninterrupted power supply for at least 3 hours of equipment operation (battery life). Workstations Fleet The fleet of the workstations Company has a high degree of wear and tear. Except for the head office (Executive Administration), virtually all over the Company the most of the personal computers has a high degree of depreciation (see Table 2.4.2.2) Table 2.4 .2.2 Depreciation Status of the Workstations Branch Total number of personal computers EA 470 The share of personal computers to the depreciation of> 90% 23% National Dispatch Centre of the System Operator (NDC SO) 129 60% Akmolinskiye MES Aktyubinskiye MES 242 155 62% 59% Almatinskiye MES 285 68% Vostochnye MES 250 69% Zapadnye MES Sarbaiskiye MES 122 289 47% 67% Severnye MES 287 56% Tsentralnye MES 213 63% Yuzhnye MES Representative office 284 13 65% 61% Source: * Data is provided by Energoinform PwC 15 Figure 2.4 .2.3 Current Depreciation Level of the Workstations by Year Depreciation of Workstations 5+ years 1% 3-5 years less than 3 years 6% 31% 77% 63% 22% Executive administration MES branches In order to update the equipment, the Company buys new workstations. However, the procurement of IT equipment in most cases is not standardized and not unified. PwC 16 2.5 2.5.1 Information Security Architecture Information Security Management Information security management in the Company is the function of the separate structural unit - the Security Service. With regard to the information security, this structural unit is responsible for the following functions: development of regulatory and administrative documentation and requirements for information security; liaison between business units and TITMO/DIT Energoinform in terms of determining the needs for information security; monitoring of compliance with the information security requirements. As part of the information security function, the Company takes into account the following main areas: Information Security Management Technical support of information security; Monitoring and responding to information security incidents. As part of the management of information security, the Company developed the following documents governing the IS function: Methods of assessing information security risks in KEGOC Access control rules in KEGOC Password policy in KEGOC Anti-virus management rules in KEGOC Information security rules for e-mail operations in KEGOC. Currently the Company has plans to introduce Information Security Management System (ISMS) for the financial and economic unit. IS certification audit is scheduled in 2014. 2.5.2 Technical Support of the Information Security Function The IS technical support is a function of Energoinform. This function is the process of providing information security using software and hardware mechanisms to protect information assets of the Company. The main information security actions in the Company now are: anti-virus protection of corporate data network in the Company and the branches using McAfee's software system for server hardware and Eset Node for workstations to protect them against malware. demilitarized zone (DMZ), to improve the information security of corporate networks and resources of the Company that have access to the Internet. DMZ is implemented based on Cisco Catalyst 6506 hardware and software system of packet filters (firewalls). information security of the networks in the structural units of the Company is based on the packet traffic filtering. Traffic filtering is implemented based on Cisco Catalyst 6506 hardware and software system. Application of this technology together with VPN technology has a positive impact on information security in various segments of CDN and the Company as a whole. 2.5.3 Monitoring and Responding to Information Security Incidents. Monitoring and responding to security incidents is the function of the Information Technologies Department (ITD) of Energoinform and it is implemented as a hardware and software system that performs the following functions: Centralized collection, storage and analysis of security logs; Detection of incidents in real time; Prioritizing incidents; Automating the process of monitoring of incidents correction; Creating reports on regulatory compliance and audit. This system covers server and active network equipment within the Executive Administration and MES branches. PwC 17 2.6 Management of IT Processes and Services Review of existing IT processes in the Company The Company is constantly improving its IT processes. In particular, under "AUSMS 1" and "AUSMS 2" projects the Company developed and approved a list of documents regulating the IT activities in the financial and economic unit. For some items: Service Desk and Change Management, the IT processes of the Company has quite a high level of maturity. However, the analysis of the current IT processes maturity in the Company for most other areas shows that in comparison with the sector peers the IT processes have the potential for further improvement. Figure 2.6.2 shows the current level of maturity of IT processes in the Company compared to its sector peers. Figure 2.6.2 Assessment of the IT Processes Maturity in the Company Using CobIT Methodology. IT Processes PO1 Define a Strategic IT Plan DS1 Define and Manage Service Level PO2 Define the Information Architecture DS2 Manage External Providers PO3 Determine the Technological Direction DS3 Manage Performance and Capacity PO4 Define the IT Organization and Relationships DS4 Ensure Service Continuity PO5 Manage the IT Investments DS5 Ensure Systems Security PO6 Communicate Management Aims and Directions DS6 Identify and Attribute Costs PO7 Manage Human Resources DS7 Educate and Train Users PO8 Manage Quality DS8 Assist and Advice IT Customers (Service Desk) PO9 Assess Risks DS9 Manage Configurations PO10 Manage Projects DS10 Manage Problems and Incidents AI1 Identify and Select Automation Solutions DS11 Manage Data AI2 Acquire and Maintain Application Software DS12 Manage Facilities AI3 Acquire and Maintain Technology Architecture DS13 Manage Operations AI4 Document and Maintain Procedures ME1 Monitor and Assess IT Performance AI5 Acquire IT Resources MЕ2 Monitor and Assess Internal Controls AI6 Manage Changes MЕ3 Ensure Regulatory Compliance ME4 ME3 5,00 4,50 ME2 4,00 ME1 3,50 DS13 3,00 2,50 DS12 2,00 1,50 DS11 1,00 DS10 0,50 0,00 DS9 PO1 PO2 PO3 PO4 PO5 PO6 PO7 PO8 PO9 PO10 DS8 AI1 DS7 AI2 DS6 AI3 DS5 DS4 DS3 AI4 AI5 DS2 DS1 AI7 AI6 Текущий уровень ИТ Current maturity of зрелости IT Processes процессов Уровеньofзрелости ИТ процессов Maturity IT Processes in global sector peers в мировых энергетических компаниях AI7 Implement and Accredit Systems and Changes MЕ4 Provide IT Governance Provision of IT Services. The Telecommunications and Information Technology Management Office (TITMO) coordinate the IT services in the Company; all IT functions are outsourced. The day-to-day support and development of the ITS is the function of Energoinform, the subsidiary of the Company. TITMO, in turn, is involved in the planning, monitoring and coordination of the ITS development projects. There is a list of IT services agreed upon and approved by the business units of the Company and Energoinform. Energoinform provides the following services to the Company: maintenance of the telecommunications equipment of the National Power Grid (NPG); maintenance of the operational systems in the equipment of the NPG; maintenance of the information and communication systems in the equipment of the NPG; software support for the equipment of the NPG; technical consulting services in the field of information and communications system. PwC 18 The list of other IT services procured by the Company is given in Table 2.6.2 Table 2.6.2 List of IT services Company Name List of services Amount (tenge per year, including VAT) Kazakhtelecom KazTransCom Lease of communication channels Lease of communication channels 86 778 61248 1 046 97600 DARIN TEL 9 847 17605 Kar-Tel Satellite communications for emergency field teams Uninterrupted satellite communication system TURAY Stable communication in Kazakhstan Worldwide roaming Interface with the GSM systems Mobile phone services GSM Kazakhstan Corporate mobile phone services 2 459 9980 TransTelecom Lease of the Ethernet backbone data transmission within the city limits (from 18 167 81541 the Company’s head office to Isker business centre) Lease of communication channel for IP VPN in Astana Lease of Astana-Petropavlovsk digital channel Lease of communication channel for IP VPN in Astana 1 799 99970 Source: data is provided by the Company for 2013 PwC 19 2.7 Overview of the Existing Model of IT Governance The existing ITS Governance model is a set of IT functions according to the reference model of IT Governance (PwC IT Governance). According to the reference model in the Figure below, TITMO fully or partially fulfils the following functions: With regard to IT Management: IT Management, Business Relationships Management, Suppliers Management, and Service Level Management With regard to IT Administration: IT Finance Management and IT Procurement All other functions are fully or partially fulfilled by Energoinform. Planning and technologies Strategy and planning Planning Architecture management IT Management Business relationships management Suppliers management Service level management Change management Quality, security, regulations compliance Administration IT standards and policies Regulations compliance management Quality management Risk management Security management IT administration IT finance management IT staff management IT resource management IT acquisition Operating activity and user support Software support Data management Infrastructure management Configuration management Security User servicing Development and testing Operations Software development The function is fully implemented Testing The function is partially implemented The function is missing According to the Regulations on the TITMO, it fulfils the following functions: provide methodological assistance to KEGOC's structural units with regard to hardware-software packages, communication and periphery devices, and information systems used in KEGOC; participate in development of technical requirements for ITS; participate in development and implementation of KEGOC's long-term development strategies within its area of responsibility; cooperate with KEGOC's structural units to work out and coordinate information technology strategy (hereafter referred to as the "IT strategy"); implement and monitor the programme of Information and Telecommunication System (ITS) development in KEGOC in accordance with KEGOC's IT Strategy. However, quality implementation of the tasks is difficult due to insufficient number of the TITMO personnel. For instance, according to Gartner survey, the percentage of IT specialists of the total number of employees in the global energy companies is 4%. It shows that the number of the IT specialists in the Company is insufficient. Considering the plans of the Company's management to sell the shares of Energoinform subsidiary, this issue may become critical for the Company. PwC 20 Figure 2.7.1 Percentage of ITS specialists of the total number of Company employees 4,5% 4,0% 4,0% 3,5% 3,0% 2,5% 2,0% 1,5% 1,0% 0,5% 0,4% 0,0% KEGOC Industry average *Not including ITS specialists in Energoinform One of the main disadvantages is that the Company does not have an ITS Committee, which would make decisions in the sphere of ITS strategic management. The Company's ITS projects are initiated by various business units without adequate involvement of IT specialists. This happens because the Company does not have an IT Project Office. Eventually, this may result in some IT projects that will not meet the Company's strategic goals. It is important to mention that there is no Chief Information Officer to represent the interests of IT Service on the Management Board level. According to PwC survey of the peer companies, in more than half of such companies the CIO report directly to the CEO. Then there is Chief Financial Officer (CFO) and Chief Operations Officer (COO) (see Figure 2.7.1). Figure 2.7.2 Direct Reporting of CIO in Peer Companies General Director 51,00% Managing Director - Economics 19,00% Managing Director - Operations 11,00% Others 19,00% 0% 10% 20% 30% 40% 50% 60% Source: PwC survey PwC 21 2.8 ITS in the Peer Companies An analysis of utility companies worldwide shows that the main driver in the achievement of the strategic goals associated with the NPG reliable operation is the development of corporate highly reliable telecommunication lines. At present, utility companies tend to replace the outdated analogue communication equipment with the state-ofthe-art digital FOCL in order to improve the efficiency of the Company's operations and the reliability of electrical networks. For instance, today most of the large companies in the USA totally refused to use analogue communication facilities. The example of using communication channels by the Federal Grid Company of Unified Energy System in the Russian Federation (FGC UES), which has similar operation environment, shows that the total length of the backbone and distribution FOCL of the largest power grid company in Russia was over 33,500 km in 2011, including: 18,500 km – constructed by the company; 8,500 km – resources that the company gets for the right to use its power lines corridors; 6,500 km – resources that the company trade or lease from the third party organisations. The experience of constructing communication lines under concessionary agreements with other telecommunication companies is also exemplary. For instance, in 2010, FGC UES commissioned the FOCL line from Chelyabinsk to Khabarovsk, which was constructed jointly with Rostelecom. In this project an optical ground wire (OPGW) was used for the OHTL construction. Successful implementation of the project allowed Rostelecom to connect dozens of cities in Ural, Siberia and the Far East regions to the backbone network, and FGC UES to connect over 100 power industry facilities with digital communication lines in order to ensure the operation of automated dispatch, process and corporate management systems. Other ITS Development Projects Utility companies tend to introduce the following automated informational systems: Safety management system; Suppliers management system; Project management system; Mobile and on-site facilities monitoring system; Electricity demand forecasting system. The description of these systems can be found in Table 2.8.1 Table 2.8.1 Description of Automated Information Systems System types Description Security management systems; Designed to: enhance the security at power facilities including anti-terror security and public safety; reduce emergency risks; integrate security systems with the control automation facilities; integrate safety engineering tools (video cameras, perimeter alarm devices, access control management systems, etc.) into an integrated information environment, and provide various levels of access to authorised personnel (facility, region and central). Suppliers management systems The systems are focused on optimization of business processes and reduction of aggregate costs for material and technical supplies and service procurement, and designed to: establish a strategy and forecast the efficiency of relationships with suppliers via conventional and electronic communication; automate the logistic chain; find optimal partners that would best fit the company's business requirements; perform on-line monitoring and assessment of suppliers' performance. Project management systems Designed to: automate the project management processes, and analyse and assess the project implementation opportunities; plan the projects; coordinate implementation of the projects, programmes and project portfolios; ensure optimal distribution and management of project resources; provide project implementation reports with reference to the initial schedule; integrate with the financial flows and human resources management systems. Mobile and on-site monitoring systems PwC facilities The systems include hardware-software packages for monitoring of mobile (motor and specialised vehicles, line crew personnel on foot) and on-site facilities (OHTL towers, buildings and other). The monitored facilities are equipped with navigation devices using GPS/GLONASS satellite systems. They are monitored on the dispatch panel with the help of a software which provides the following data about the facilities: 22 System types Description location of the facilities on a real-time basis on the map; speed and direction of travel of the mobile facilities; history record of their movement and status changes; The systems shall improve the efficiency of the Company's resource management in case of emergencies of natural or man-caused character. Electricity systems demand forecasting Designed to forecast the electricity demand and the network loading. The systems shall calculate the future amount of electricity consumption based on the statistical data on electricity generation and consumption, short-term and long-term forecasts of the region development. Results of the comparative analysis of ITS expenses in the Company and in other global utilities in 2012 conducted by the APQC international survey organization are shown in the figure below: Figure 2.8.1 Comparative Analysis of the Company's ITS Expenses to Revenues in 2012 Comparative analysis of ITS expenses to revenues of the Company 3,50% 3,00% 2,50% 2,00% 1,80% 1,50% Energoinform 3,30% KEGOC 1,00% 1,40% 0,50% 0,80% 0,70% 0,00% KEGOC Low efficient IT services Median High efficient IT services Source: APQC analysis According to APQC data, the approximate amount of ITS expenses in the utility companies worldwide was 1.4% of the total income of the companies. However, IT service could be considered highly efficient when this ratio is at 0.7%. Moreover, IT service with low efficiency is at 3.3%. As for KEGOC, this ratio does not exceed 2.6%, indicating the adequate level of IT investments efficiency. PwC 23 3. Strategic Goals and Key Business Drivers of the Company 3.1 Strategic Goals of the Company According to the Long-Term Development Strategy until 2025, KEGOC shall become a world-class energy company and the regional centre of expertise in the power industry. Company’s mission is to ensure reliable operation and efficient development of Kazakhstan Unified Power System (UPS) in accordance with up-to-date technical, economic, environmental and occupational health and safety requirements. These vision and mission of the Company can be implemented through achievement of the key strategic goals set for the Company's Management: 1. Ensure the reliable operation of the Kazakhstan National Power Grid in accordance with the public needs; 2. Develop the NPG for the benefit of the Company's business in accordance with the economic needs of Kazakhstan; 3. Enhance the efficiency of the Company's operations; 4. Increase the shareholder value of the Company; 5. Improve and enhance the efficiency of the electricity market in Kazakhstan; 6. Promote corporate governance and ensure sustainability; 7. Achieve stable partner relationships with the utility companies of neighbouring countries. In order to achieve each of the strategic goals, the strategic initiatives were determined under the long-term development strategy. The complete list of the strategic goals and targets is shown in the figure below. Mission of KEGOC Ensure reliable operation and effective development of Kazakhstan Unified Power System (UPS) in accordance with up-to-date technical, economic, environmental and occupational health and safety requirements Vision of KEGOC By 2025, KEGOC will become a world-class company and the regional centre of expertise in the power industry Strategic goals of the KEGOC long-term development strategy Ensure reliable operation of the Kazakhstan National Power Grid in accordance with the state needs Develop NPG for the benefit of the Company's business in accordance with the economic needs of Kazakhstan Enhance the efficiency of the Company's operations Ensure the increase in the shareholder value of the Company Improve and enhance the efficiency of the electricity market in Kazakhstan Promote corporate governance and ensure sustainability Achieve stable partnership relationships with the utility companies of neighbouring countries Strategic initiatives of the KEGOC long-term development strategy Quality performance of its functions by the System Operator Quality operation and maintenance of the existing assets in order to ensure reliable operation of NPG Upgrade of the electricity transmission network Construction of the electricity transmission lines to cover the transmission capacity needs of NPG Innovations development and introduction Improvement of the efficiency of operating activity Improvement of the efficiency of administration activity Optimization of the level of electricity transmission losses Net profit growth Improvement of the customer servicing level Supporting the tariff policy and electricity legislation improvement Improvement and enhancement of the efficiency of the electricity market in Kazakhstan Maintenance of shareholders rights and development of stakeholder relationships Maintenance of parallel operation with power systems of neighbouring states Professional development of personnel Enhancement of personnel loyalty Maintenance of occupational safety Promotion of the efficient electricity market relations with the neighbouring countries Minimisation of the environmental impact of the Company’s operations Source - KEGOC's long-term development strategy until 2025 PwC 24 3.2 Key Business Drivers and Their Prioritizing Key business drivers of the Company include: Reliable operation of the National Power Grid; NPG and Company development; Increase in the shareholder value of the Company. These business drivers reflect the strategic goals and initiatives of the Company's Management. Figure 3.2.1 Company's Strategic Goals Cascading by Business Drivers Strategic goals of the KEGOC long-term development strategy Ensure reliable operation of the Kazakhstan National Power Grid in accordance with the state needs Achieve stable partner relationships with the utility companies of neighbouring countries. Improve and enhance the efficiency of the electricity market in Kazakhstan Develop the Company and NPG Increase the shareholder value of the Company; Enhance the efficiency of the Company's operations Promote corporate governance and ensure sustainability Increase the shareholder value of the Company lower Priority higher Reliable operation of NPG Develop NPG for the benefit of the Company's business in accordance with the economic needs of Kazakhstan Reliable operation of NPG is a key factor of the Kazakhstan's economic operation Kazakhstan NPG development (including innovations development) is one of the underlying criteria for the Kazakhstan's economic development Increase in the shareholder value of the Company is one of the most important requirements of the Sole Shareholder In descending order, the "Reliable operation of the NPG" is a business driver of the highest priority. This business driver is the core driver for the functioning of the Kazakhstan economics. According to the requirements of the Sole Shareholder Samruk-Kazyna Sovereign Wealth Fund, the next on the list of business driver is the "Increase in the shareholder value of the Company". The "NPG and Company development" business driver also has a significant impact on the Company development. PwC 25 4. The List of Business Requirements for ITS Business requirements for ITS depend on the current operational activities of the Company. The existing IT architecture does not fully satisfy the current and future needs of the Company. In this regard, IT unit sets a number of the most critical IT targets, which were initiated by the structural units of the Company to improve IT services maturity (including through the up-to-date IT infrastructure) and automation of the business process, namely: Improvement of the data transmission rate and quality in CDN; Upgrade of the server hardware and personal computers; Upgrade of SCADA/EMS; Upgrade of commercial metering system; Introduction of the process of business continuity assurance in case of an emergency situation; Automation of personnel training process; Optimization of the management and financial reporting process. The priorities of the business requirements for ITS are shown in the figure below: Figure 4.1. Priority of the Requirements for ITS Requirement of Business to ITS lower higher Upgrading of automated dispatch control system (ADCS) Upgrade of commercial metering system Improvement of the data transmission rate and quality in CDN Automation of monitoring process and electricity losses analysis Introduction of business continuity assurance in ITS business in case of emergency situations Automation of energy consumption and power balances planning Automating the process of electronic document management system Automation of technical control and occupational safety Optimization of IT management model Optimisation of IT assets management process Increasing of the level of information security Automating the process of report generation Automating of the process of risk management and balanced scorecard Development and extension of OeBS features Infrastructure development for Information and telecommunications system Such prioritizing of business requirements results from the assessment of the impact of each of these requirements on three key business drivers of the Company. The list of the requirements for ITS with account of business drivers is given in the table below: PwC 26 Table 4.4.1. Level of ITS Requirements Impact on the Key Business Drivers Requirements for ITS Key business drivers of KEGOC Reliable operation of the National Power Grid Company and NPG Increase in the shareholder value of the development Company Upgrading of automated dispatch control system (ADCS); Upgrade of commercial metering system Improvement of the data transmission rate and quality in CDN Automation of monitoring process and electricity losses analysis Introduction of the process of business continuity assurance in case of an emergency situation Automation of energy consumption and power balances planning Introduction of Document Management System in KEGOC Branches and its Integration with the DMS of the head office Automation of technical control (safety )and occupational health Optimization of ITS Management Model Optimization of the licensing and software update process Increasing of the level of information security Optimization of the management and financial reporting process Automating of the process of risk management and the development of a balanced scorecard Development and extension of OeBS features Development of ITS infrastructure PwC 27 5. Results of a Comprehensive Analysis of the Current State of Company's ITS Based on the ITS comprehensive analysis we can see key strong and weak points as well as development opportunities and threats for the information and telecommunication system of the Company. (see Table 5.1). Table 5.1 Results of SWOT Analysis PwC 28 6. Target IT Architecture of the Company IT Mission of the Company is to develop and enhance the security of ITS to achieve the strategic goals of the Company. IT Vision of the Company is to be a highly efficient business partner who suggests innovative solutions and follows best practices in the sphere of IT and telecommunications. Successful achievement of the strategic IT goals and IT initiatives will contribute to the achievement of the strategic goals and business drivers of the Company. Under the present strategy based on the analysis of the key impact factors (GAP analysis of the current and target state, requirements of the shareholder and structural units of the Company, comparative analysis of ITS and peer companies, etc.) a target IT architecture was determined with the following models: Business architecture; Application architecture; Data architecture; Technology architecture; Security architecture. PwC 29 6.1 Business Architecture of the Company According to the approved business strategy, the current operations of the Company will be completed with the following business processes: Financial settlement of electricity imbalances. Purchase and sale of renewable energy. The process of "Financial settlement of electricity imbalances" will continue the process of transition to an electricity balancing market. By 2016, the Company plans to bring the electricity balancing market from the simulation mode to the full-scale operation. Within these targets, energy market participants will have a service of the financial settlement of hourly imbalances in the Unified Power System of Kazakhstan. The next process of "Purchase and sale of renewable energy" will be introduced in accordance with Kazakhstan Law No. 127-V dated 04 July 2013 ‘On changes and amendments to some legal acts of the Republic of Kazakhstan relating to renewable energy support’. This process will include the guaranteed and centralized electricity purchase from all renewable energy resources (who have chosen such support scheme) in accordance with the fixed rates. Within these targets, the Company established a separate legal entity. The Financial Settlement Centre for Support to Renewable Energy Sources LLP shall be a financial settlement centre in accordance with the Kazakhstan Government Resolution No. 1281 dated 29 November 2013. The target business architecture of the Company is shown in the Figure 6.1.1: PwC 30 Management Processes Figure 6.1.1 Target Business Architecture Strategic management Corporate governance Electricity transmission Planning, budgeting and monitoring Pricing and stakeholders relationship management Technical dispatch control Provision of access to NPG Study and selection of new technologies Management of electricity production and consumption balancing Risk management, internal control and audit Management of generating capacity reserve Acceptance of energy to NPG Supply energy from NPG Development of NPG Prevention, isolation and elimination of technical process failures Maintenance of the parallel operation with power systems of the neighbouring states Operation, maintenance and repair of NPG Operational Processes Development and issue of operational mode guidance Operation of the relay protection and emergency automation Preparation of daily schedules Physical settlement of imbalances Calculation of losses, preparation of actual and forecast balances Financial settlement of electricity imbalances Termination of services Science and education Supporting Processes Research and develop ment Knowledge Management Contracts, procurement and logistics Rationalisation activity Legal support Purchase and sale of system and ancillary services and electricity Sale of system services and purchase of ancillary services Human resource management Finance and accounting Existing processes PwC Purchase and sale of electricity to compensate for interstate trade balance of electricity flows IT support Purchase and sale of renewable energy Capital construction Development of detail design and estimate documentation Occupational safety, health and environmental protection Projects management Management of administrative and office venues New processes 31 6.2 Application Architecture Application Management in the Management Processes For the Company's Management to make adequate management decisions, the Company will implement the following IT projects as part of the Management Processes: Introduction of a corporate Data Warehouse (DWH) Business Intelligence system. This project will be a part of the IT initiative on implementation of the Enterprise Application Integration System (hereafter referred to as EAIS). Development of Automated Balanced Scorecard System; Automation of the Risk Management System; The results of these initiatives will include: immediate access to reliable information about the key performance indicators of the Company; improved automation level of planning, tariff making and strategic management processes. support of the Company's strategic goal to enhance the efficiency of operations and improve the corporate governance; tools for the immediate management decision making; improved risk management transparency in the Company through introduction of an automated Risk Management System (RMS). Application Management in the Operational Processes The automation level of the operational processes will be achieved through the following IT initiatives: Two projects will be implemented within the IT EAIS initiative: introduction of an enterprise service bus (EAIS ESB) and development of a unified master data management system (EAIS MDM); Upgrade of the ADCS (SCADA/EMS); Upgrade of the commercial metering system; Automation of the loss calculation process; Automation of the electricity and capacity balance forecasting process; Automation of the project management process; The results of these projects and initiatives will include: PwC improved automation level of the operational processes in the EA, NDC SO, and MES branches; optimized labour costs through improvement of the integration level and the data exchange between the Company's systems; optimized costs for the information systems integration support; improved transparency of data exchange within the existing and newly introduced business-processes; reduced costs through optimization of the personnel performance and decommissioning of the OIS in the head office and branches; increased profitability of the Company through improvement of the automation level of the loss calculation system (through introduction of an automated loss calculation system); improved level of electricity and capacity balance forecasting process automation (through introduction of an automated balance forecasting system); improved level of commercial metering accuracy and connection of the CMS of energy market participants to the CMS of the Company; improved efficiency of decision-making process relating to the Company's project management, and optimized costs for implementation of the Company's projects (through introduction of an automated project management system). 32 Application Management in the Supporting Processes Improvement of the automation of the Supporting Processes will contribute to the implementation of the following IT initiatives: Automation of personnel training process; Introduction of document management system in KEGOC branches and its integration with the DMS of the head office; Automation of the technical control (safety) process; Development and extension of ERP features; The results of these initiatives implementation will include: centralized storage of the training documents; automation of the planning, administration, and monitoring of the personnel training process (development of the training programme for each employee) through introduction of the automated training process management system; optimized personnel training through the use of specially developed media-tutorials; substantial reduction of hard-copy document flow and improved efficiency of cooperation between the head office (EA) and the branches of the Company; improved efficiency of the transaction documents and contracts processing through integration of DMS and ERP; automation of the technical control reporting process through introduction of the automated technical control system; strengthened controls in the technical control and occupational health process, which shell reduce the risk of injuries and emergencies in operations; optimized labour costs within the technical control process; improved level of automation of the Treasury Department activities; efficient cash flow management and better transparency of their application as required by SamrukKazyna; Based on the business requirements and the analysis of the business processes automation, a target architecture of the Company's applications was developed (see. Figure 6.3). PwC 33 Figure 6.2.1 The Proposed Target IT Architecture Has High Level of Automation Management Processes Strategic management Corporate governance Planning, budgeting and monitoring BSC Pricing and stakeholders relationship management Study and selection of new technologies Risk management, internal control and audit Hyperion BI MRS Electricity transmission Provision of access to NPG BI ERP Technical dispatch control RMS MIS Management of electricity production and consumption balancing Auditor activity automation system Management of generating capacity reserve ADCS Acceptance of energy to NPG Supply energy from NPG Operational processes Operation of the relay protection and emergency automation Operation, maintenance and repair of NPG ADCS Development and issue of operational mode guidance Maintenance of the parallel operation with power systems of the neighbouring states Systems for mode calculation Development of NPG Prevention, isolation and elimination of technical process failures CRPS ASPMS GIS Simulators EFDS ABFS (EFCC Subsystem ССО) ADCS Preparation of daily schedules BEMS, CMS, ABFS (DLS subsystem) Physical settlement of imbalances BEMS, ABFS (DLS subsystem) ADCS Calculation of losses, preparation of actual and forecast balances EXCEL CMS ALCS ABFS (ECP subsystem) BEMS Financial settlement of electricity imbalances BEMS CMS Termination of services ADCS Science and education Research and developmen t Knowledge Management Supporting Processes APMS Executive administration Contracts, procurement and logistics Purchase and sale of system and ancillary services and electricity Rationalisation activity Sale of system services and purchase of ancillary services Purchase and sale of electricity to compensate for interstate trade balance of electricity flows Purchase and sale of renewable energy Capital construction Development of detail design and estimate documentation ERP, BEMS, CMS, ABFS Corporate web portal Human resource management Finance and BI accounting ATPMS MRS Management of administrative and office venues Projects management APMS IT support Occupational safety, health and environmental protection Legal support DMS Service Desk ERP Branches Training IS Automated technical control system Paragraph IS DMS High automation level PwC Average automation level 34 6.3 Data Architecture The key objective will be to establish the integrated information environment in the Company. This objective will be achieved through introduction of the Enterprise Application Integration System (EAIS). The target data architecture will be based on the transition to the Service Oriented Architecture. The EAIS will include three main components: Enterprise Service Bus (ESB), which will be primarily aimed at the synchronisation of the data from various systems in order to avoid their duplication, and also at the assurance of integrity of the Company's business processes for which several information systems are used; unified master Data Management System (MDM). The primary objective of the MDM system is to get the "Single Version of the Truth". The information must be unique and complete as much as possible, so that it could be relied on and used in all business operations and IT systems; Corporate Data Warehouse (DWH). The primary objective of the DWH is to arrange the great massive of data in one hardware-software package. Based on the data models DWH will process, store and provide immediate access to the on-line and historical data in a special way. The role of the DWH will be to provide multidimensional data analysis, forecasts and statistics based on the approved master data. In order to optimize the costs for DWH data processing and analysis, the existing Business Intelligence type analytical system will be used. The target data architecture will provide the following functionality: make adequate management decisions; ensure integrity of the Company's business processes; ensure the information is not duplicated in various IT systems; make immediate management decisions through improvement of the quality (timeliness, accuracy) of the information of all Company's processes; enhance the flexibility of the management reporting settings; optimize labour efforts with regard to reports preparation by the Company's personnel The figure below shows the target model of data exchange between the Company's facilities (substations and TES), branches and Executive Administration. PwC 35 Figure 6.3.1 Target Data Architecture Data mart RMS BSC MRS EAIS (DWH Data Warehouse sub-system) EAIS (ETL&MDM Data Cleaning sub-systems) Executive administration EAIS (ESB Enterprise Service Bus) Systems for mode calculation ADCS ABFS CMS BEMS ALCS GIS BEMS ALCS GIS EFDS AAMS(ERP) ERP Hyperion AAMS ERP Hyperion AAMS( ERP) ERP DMS Simulators Branches and affiliates Systems for mode calculation ABFS ADCS DMS EFDS CMS Simulators TES, substations ADCS CMS ASPMS NDC SO processes GIS EFDS Core operations data DMS Financial and administrative data Automated data transmission via Enterprise Service Bus (ESB) PwC 36 6.4 Technology Architecture Target Model of Technology Architecture The key to the Company's successful performance is efficiency and reliability of the information and telecommunication system. The basis for implementation of the goals set in the ITS Development Strategy will be the creation of the technology architecture that would meet the present-day and future business needs and will have the following characteristics: reliable and easy operation of information systems (ERP, ADCS and other systems); highly fault-tolerant and reliable CDN with optic rings; efficient joint work of various groups of users and information exchange; reliable and accessible critical information resources; provision of basic IT services of adequate scope and quality. The creation of such technology architecture will serve as a basis for ITS development as well as for the establishment of a smart adaptive power system, which is required by the Company's innovation and technology development strategy. The target technology architecture of the Company is shown in the figure below. Figure 6.4.1 Target Model of IT Infrastructure – firewall Corporate Data Warehouse The existing telecommunication channels are replaced with FOCL in those places where construction and rehabilitation of OHTLs is performed – router Accounti ng system data base – switch Document flow data base ` ` ` ` Users Users – server Data Centre Executive administration The existing telecommunication channels are replaced with FOCL in those places where construction and rehabilitation of OHTLs is performed Internet Own CDN ` ` ` ` ` ` ` ` Users Users Cloud DB * backup network appliance ` ` ` ` Service Desk EnergoInform The existing telecommunication channels are replaced with FOCL in those places where construction and rehabilitation of OHTLs is performed * backup network appliance *** Substation communication channels (e.g. radio relay lines) remain in those places where the construction of a FOCL line is not feasible * Backup process will apply to key net nodes ** Demilitarized zone **** The DB for which transfer to the Data Centre is inefficient and which stay on the companies' sites ** DMZ ** DMZ `` ` ` ... Users `` ` ` ... Users Operational system data base **** Local DB MES PwC Substation 37 6.5 Information Security Architecture The purpose of the Information Security System will be to prevent the threat of any action or inaction to the Company's information resources causing damage to the Company. The damage can include the illegal use, misrepresentation, loss or restricted access to the information. The information assets, personnel of the Company and data will be the objects of protection by the Information Security System. The information assets will include the information systems and equipment that are involved in the Company's data processing and storage (servers, workstations, network equipment, data warehouses, back-up systems, office equipment, etc.). Company's personnel includes the Company's employees who are involved in the data collection, processing, and storage, and the employees who are responsible for the operability of the Company's information systems. The data includes the information, which is used to ensure the operating activity of the Company and stored in the electronic databases or in hard copies. The main purposes of the Information Security System will be to ensure continuity, integrity and privacy of the Company's information resources. Continuity is the property of the information resources according to which the systems and the infrastructure shall ensure availability of the requested services (e.g. information) within the specific time and with required quality; Integrity is the property of the information resources according to which the systems and the infrastructure shall ensure the data protection against unauthorized alteration during data processing, storage, transmission, and etc.; Privacy is the property of the information resources according to which the systems and the infrastructure shall ensure the data protection against unauthorised access during data processing, storage, transmission, etc. The architecture of the target information security of the Company is shown in the figure below. Figure 6.5.1 Information Security Architecture Business requirements Continuity Guidelines, policies and standards Privacy Assets structure Technical security architecture Processes and operating practices Technical specifications Human resource and organisation management Monitoring and compliance Integrity PwC 38 The analysis of the current development level of information systems and information security in the Company shows that the following special conditions are required for the Company's Information Security System implementation: The planned high level of centralization of the information systems and other key information resources of the Company. It is proposed that the major part of the Company's information systems will be based on the servers located in the main Data Centre of the Company. These information systems will be accessible via local networks of the branches and the corporate data network. These systems will be the main geographically distributed information resources of the Company; Relatively high level of geographical distribution of the Company's information resources. The users of the information resources will be located in the Executive Administration and in MES branches as well. High pace of informatization in the Company (introduction and development of information systems and development of IT infrastructure). The ISMS operation will be based on the best international recommendations and standards in the sphere of information security management. Such approach will include implementation of all procedures for IS management and maintenance, coordination and regulation of the procedures, their proper and efficient implementation. The information security management approach will be based on two major principles: Process approach to security management. According to the process approach, management process is a set of interrelated continuous operations. The process approach is focused on the achievement of the set targets as well as on the resources utilised for this purpose; Use of PDCA model as the basis for all information security management procedures. The PDCA model includes four steps that shall be sequential in each process. The information security approach is shown in the chart below: Figure 6.5.2 Functions of the Information Security in the Company PwC 39 6.6 Principles of the Company's ITS Development General Principles of ITS Development To determine the principles of ITS development we should take into account the following: Current status of application, data, and process architectures; Current status of IT management and IT organisation and future development plans; Current status and plans of development and use of applications and data; Principles of the Company's business strategy; Current status and development prospects of the telecommunication and IT infrastructure in Kazakhstan. Based on the analysis of the above listed aspects the following Company's ITS development principles were determined: Conformance with the business requirements. According to this principle, the ITS parameters shall be determined based on the requirements of the Company's business units. Ubiquity. According to this principle, the ITS shall cover all branches, substations of the Company. This principle is important because the ITS is critical for the Company's operations; Reliability. According to this principle, the ITS shall ensure high level of reliability with regard to the access to the Company's information resources; Scalability. According to this principle, the IT solutions used by the Company shall have the capacity of significant extension in performance, capacity, scope, etc. This principle is determined by the Company's plans to enhance the automation level; Economic Feasibility. According to this principle, all IT solutions that are used shall be economically feasible. For example, when new process solutions are utilised instead of the existing ones a feasibility study shall be made first. This principle is required because the amount investments in ITS development are expensive; Use of the state-of-the-art technology solutions. According to this principle, the latest technology solutions shall be used for the Company's ITS. This principle is important because the Company's ITS is created as a long-term asset; Standardization. According to this principle, the Company shall develop and further utilise standard technology solution. The existing non-standard designs shall gradually be replaced with the standard ones. The use of any new non-standard design shall not be allowed. This principle will help to enhance the ITS reliability, and improve quality and reduce the costs for its maintenance. Centralized control. According to this principle, The Company's ITS shall utilise the solution that support the centralized monitoring and control. Integrated Information Environment. According to this principle, a single management environment shall be created in the Company in order to have a whole picture of the situation in real time, minimize the human factor, facilitate data exchange between employees and ensure accumulation of corporate knowledge. This principle is important to enhance the business transparency and investment attractiveness as well as to directly reduce labour efforts for data entering into the systems and to avoid data duplication. Principles of Application Architecture Development In addition to general ITS development principles the Company will rely on the following principles relating to the application architecture: Use of integrated solution. Use of the minimum number of various applications and cover the maximum number of processes with one application when automating business processes and operations management processes. Use of modern methodologies for computer software development. Software producers shall ensure high quality of software development using modern methodologies (RUP, Agile Development). Prior to the acceptance testing of new releases of software they shall pass full range of testing (unit, functional, regression, load and stress) by the software manufacturer. It is not recommended to use the operational environment for the internal and acceptance testing. The observance of this principle will allow improving the quality of projects implementation. PwC 40 User training by software producers. The software producers shall provide software programme operation training for users, product administrators and IT administrators, and provide any required materials (user guides, administrator guides, run-books, etc.). This principle will help to enhance the end-user satisfaction with the system. Software support by the developer. In order to ensure the trouble-free operation of the software it is recommended to sign user support contracts. The level of support shall be defined in an SLA. This principle will allow enhancing the quality of software support. Principles of Data Architecture Development One of the key principles of data architecture development, which shall complement the general principles of the Company's ITS development, is described below. Unified system of classification, codification and MDM. The unified classification of the management objects for the systems operation will provide unambiguous consolidation and grouping of data, and uniformity of various retrievals. This principle will help the Company to perform efficient data management as well as data exchange between the used systems. Principles of Technology Architecture Development In addition to general ITS development principles the Company will rely on the following principles relating to the technology architecture: Standardization of the Company's IT infrastructure components According to this principle, development and implementation of corporate standards shall become one of the key strategic initiatives of the Company's information technologies development. The advantages of using standard configurations for the components of IT infrastructure include: reduced cost of service for the IT infrastructure components; reduced costs for purchase of the IT infrastructure components; integration of various components of IT infrastructure; improved quality of service for the IT infrastructure components; First of all the following corporate standards of IT infrastructure and serving shall be developed as a basis for development of the IT MDM system in the Company: Corporate standard for server and network hardware; Corporate standard for hardware and software for end-users; Corporate standard for Data Centre arrangement. Target model of IT infrastructure shall include the corporate standard for hardware and software for end users. This standard is important in order to facilitate the administration of users' workstations, standardize and typify software and hardware, and to improve information security. This standard shall be a part of the information security management system and formally determine the policy of software use that shall minimize the risk of illegal and unauthorised software use. The good practice in choosing hardware for the end-user workstations is to standardise the server and network equipment (see above). The following requirements shall apply to the end user software: The software of the Company shall only be used for the Company's business purposes; The software used in the Company shall be officially and legally purchased. It is prohibited to use any counterfeit software; The shareware or trial software can only be used for testing purposes and shall not be used on permanent basis; The software shall only be installed by the personnel of the Energoinform IT Department; the software installation by other employees shall be prohibited; The Company shall regularly check and monitor the status of the end user software. The possibility of commercialisation of IT infrastructure (additional income). According to this principle, the technology used in the Company (e.g. telecommunications) shall have the possibility to provide services for the third-party users on a commercial basis, as required. This principle will allow the Company covering some part of the costs for creation and support of IT infrastructure. These services will be rendered by Energoinform subsidiary. PwC 41 6.7 Operating Model of ITS Management In order to create an efficient target IT infrastructure aimed at the achievement of the Company's strategic goals, the following tasks relating to the operating model of IT management shall be performed: Improve IT management structure; Establish IT Project Office; Improve IT process maturity level; These measures will create opportunities for the efficient interaction between the business and IT. Improvement of IT management structure. According to the strategic goal of the Company to improve the corporate governance practices, it is important to ensure the transparency of IT related decision making. This goal will be achieved through interaction and communication between managers, business-users and IT personnel of the Company and Energoinform. For this purpose, an IT Management Committee will be established. The membership of this Committee will must include: Chair of the Committee. Representatives of core operations departments, as well as financial and administration support departments. Managers and key personnel of Telecommunication and Information Technologies Department (TITD) and EnergoInform JSC. Figure 6.7.1. Structure of IT Management Model Company's IT Management IT Business Management Board, managers of business units Sponsors for strategic IT projects, Owners of business processes ITS Management Committee Operational Committee under the ITS Management Committee Head of TITD, Senior Manager for IT, IT Managers in Energoinform Head of TITD, Senior Manager for IT, IT Managers in Energoinform ITS Project Office Project team Project team - Technical Committee under the ITS Management Committee Head of TITD, Senior Manager for IT, IT Managers and Specialists in Energoinform ... Project team Determination of the Company's IT Development Strategy, determination of IT investment priorities, analysis of key IT proposals. Management of strategic IT projects, selection of key IT proposals Management of IT infrastructure, IT services, and IT processes development 1 PwC 42 In addition to the IT Management Committee establishment, the existing organization of telecommunication and information technologies management will be transformed. According to the target operating model of IT management, a Telecommunication and Information Technologies Department (TITD) will be established. According to the target model, the role of IT unit in the Company will be enhanced. To create an efficient IT service, TITD will introduce new IT functions in the Company. These functions will be uniformly allocated between the TITD and Energoinform personnel (see Figure below). To effectively implement the ITS development strategy, highly professional IT specialists will be gathered under the TITD. Planning and technologies Strategy and planning Planning Architecture management IT Management Business relationships management Suppliers management Service level management Change management Quality, security, regulations compliance Administration IT standards and policies Regulations compliance management Quality management Risk management Security management IT administration IT finance management IT staff management IT resource management IT acquisition Operating activity and user support Software support Operations Data management Infrastructure management Configuration management Security User servicing Development and testing Software development Testing TITD functions TITD and Energoinform functions Energoinform functions New Project Office for implementation of integrated IT projects. Quantity and complexity of IT projects implemented by the Company and Energoinform under the ITS development strategy will grow. However, timeliness, quality and budget constraints of such projects always depend on the competency of the project team. It is especially true when it is required to implement several simultaneous projects i.e. project package management. To cover the existing and future needs an IT Project Office will be established in the Company. To implement a specific IT project, both Company's and Energoinform's specialists will be temporarily transferred to the Project Office. If the project is integrated and requires specific expertise, additional specialists from the Company's business units will be engaged as well as outsource service providers. The main function of the IT Project Office will be to manage and monitor the IT projects implementation. Additionally, the Project Office will: Provide the managers of structural units with project management guidance; Develop and maintain an adequate and standard project management process; Develop manuals for training programmes or prepare specifications for an outsourced company; Support the centralized office from where the employees are engaged in the project implementation; Select and support the project management software to be used by personnel; Monitor and control the project package; Approve programme leaders who can manage the interrelated projects, such as infrastructure development, information systems introduction, etc.; Allocate resources (budget, personnel, etc.). Improvement of IT process maturity level The maturity level of IT processes has a serious impact on the IT performance as well as on the IT strategy implementation. In this connection, the TITD of the Company and Energoinform will need to improve the existing IT processes to reach the level of global utility companies through: Development of regulations and models of key IT processes for the entire Company. Determination of the areas of responsibility, controls and metrics for each process, which would provide for efficiency monitoring and reporting to the Management. Automation of key IT processes to improve the business users’ satisfaction with the IT services. PwC 43 Regular IT audits and systematization of possible improvements. Training of the Company's TITD personnel to build an efficient IT Service based on ITIL and CobIT standards. The target level of IT processes maturity for 2019 is shown in the figure below. PO1 Define a Strategic IT Plan Define the Information PO2 Architecture PO3 Determine the Technological PO4 Define theDirection IT Organization andIT PO5 Manage the Investments PO6 Communicate Management Aims and PO7 Manage Human Resources PO8 Manage Quality PO9 Assess Risks PO10 Manage Projects AI1 Identify and Select Automation AI2 Acquire Solutions and Maintain Application AI3 Acquire Software and Maintain Technology Architecture AI4 Document and Maintain Procedures AI5 Acquire IT Resources AI6 Manage Changes AI7 Implement and Accredit Systems and Changes DS1 Define and Manage Service Level DS2 Manage External Providers DS3 Manage Performance and Capacity DS4 Ensure Service Continuity DS5 Ensure Systems Security DS6 Identify and Attribute Costs DS7 Educate and Train Users DS8 Assist and Advice IT Customers (Service Desk) DS9 Manage Configurations DS10 Manage Problems and Incidents DS11 Manage Data DS12 Manage Facilities DS13 Manage Operations ME1 Monitor and Assess IT Performance MЕ2 Monitor and Assess Internal Controls MЕ3 Ensure Regulatory Compliance MЕ4 Provide IT Governance MЕ3 PO1 MЕ44,50 MЕ2 PO2 PO3 PO4 4,00 3,50 ME1 PO5 3,00 DS13 PO6 2,50 DS12 PO7 2,00 1,50 DS11 PO8 1,00 0,50 DS10 PO9 0,00 DS9 PO10 DS8 AI1 DS7 AI2 DS6 AI3 DS5 AI4 DS4 AI5 DS3 DS2 DS1 AI7 AI6 Current level of IT process maturity Level of IT process maturity by 2017 Level of IT process maturity by 2019 Table 6.7.1 Description of the Target Processes Status Index Process Target Process description maturity rate Planning and Organization Domain Processes PO01 Define a Strategic IT Plan 4 The strategic IT planning is based on the developed policy. A structured approach is used for strategic IT planning; this approach is documented and available to all employees. IT planning is substantiated and ensures reasonable planning. The implementation of this process is communicated to the affected managers. When new software or technology is procured, the IT financial, engineering and human resource development strategies is taken into account. Strategic planning issues is discussed at the meetings of the top management. PO02 Define the Information Architecture 3.5 The development and implementation of the information architecture is fully supported by formalised methods and approaches. The efficiency of the architecture development is reported, the progress of its implementation is measured. Auxiliary automated tools is widely used. Key indicators have been defined and a system of their evaluation has been developed. The development of the information architecture is a pre-emptive process and is focused on analysing the future needs of the business. The data administration group actively participates in the development of applications to ensure compatibility. The automated data warehouse has been created; more complicated data models is introduced in order to ensure more efficient use of the data base content. The information systems and the decision support systems for the Company's Management make an effective use of the existing information. PO03 Determine the Technological Direction 4 The planning process provides proper quality and comply with the strategic IT development plan. A certain and documented plan of the technological infrastructure development is in place, and communicated to the affected parties. The chosen direction of technology development includes understanding of the company's plans for leadership in technology application with due account of the risks and own development strategy. Main suppliers are selected so that the long-term technology development plans would comply with the company's technological development direction. A formalized training programme is in place, personnel is aware of its duties and responsibilities. PO04 Define the IT Organization and Relationships 4 The IT service has been created, documented, its establishment has been communicated to the company's personnel; the IT service operates in accordance with the IT strategy. Internal control system has been defined Relationships with other parties have been formalized. The IT service is a self-contained system. The duties of the IT personnel and the duties of the users have been determined. Competencies and skills required from the key IT personnel have been determined. The determined relationships between end-users and third parties have been formalized. PO05 Manage the IT Investments 4 The processes for selection of the IT investment options and budgeting are substantiated and take into account the key business aspects and technologies. The investment options selection procedure and the investment policy have been determined, documented, and communicated to the personnel. The IT budget complies with the strategic IT and business development plans. The processes used for budgeting and selection of IT investment options are formalised, documented, and communicated to the affected parties. The budgets and the selected IT investment options are schemes are formally approved. The IT personnel has the required experience and qualifications to plan the IT budget and develop relevant recommendations on the investment options. PO07 Manage Human Resources 3.5 Development and promotion of the IT personnel management plan fall under the responsibility of a specific employee (or a group) that has the required experience and qualifications. The process of development and promotion of IT personnel management plan is able to adjust to changes. The company has standard criteria in order to reveal any deviations from the plan specifically addressing the issues of the labour quantity and turnover. Salary trends and performance level are monitored and compared with the relevant ratios in the peer companies and industry's best practices. IT labour management PwC 44 Index Process Target maturity rate Process description is proactive with due consideration of the career development issues. PO08 Manage Quality 4 A specific process for quality assurance is in place and communicated by the Company's Management to all the affected parties within the company; the process involves the Management of end IT users. Quality assurance training programme is developed for every level within the company. Key requirements to the quality is determined. General tools and practices are developed for quality control. Quality satisfaction surveys are planned and periodically conducted. PO09 Assess and Manage IT Risks 4 Risk assessment and management are the standard procedures. The IT managers are informed of the deviations in the risk management process. The company's top management is responsible for the risk management. Risk assessment and mitigation are done under the individual projects and regularly under the overall IT activities. The managers are provided with recommendations regarding changes in the corporate environment and IT environment that can have a significant impact on the risks. Every revealed risk has a formal risk owner; and the top management and IT service managers define the acceptable, in their opinion, risk levels. IT service managers developed standardized measures for assessment of risks and risk to reward ratios. Risk management database is created. The managers of IT service develop the risk mitigation strategies. PO10 Manage Projects 4 The process and the methodology of the IT projects management are in place in the company and communicated to the personnel. Terms of reference for the IT projects are determined with due account of the existing engineering and business objectives. The top management of the company and IT service start participating in the process of IT projects management. A project management unit is created under the IT service; the duties and responsibilities of operators are defined. The IT projects are monitored; the stages of their implementation, schedules, and procedures for assessment of the work progress and budget allocation are approved and from time to time adjusted. The quality control procedures and the works required after the system introduction are determined. Project management is evolving to package project management. Acquisition and Implementation Domain Processes AI1 Identify and Select Automation Solutions 3.5 There is a strict and structured approach to IT solutions selection. This approach requires considering the alternative options with due account of business or user requirements, engineering and economic capabilities, risk and other factors assessment. The process of IT solutions selection is used under some projects based on such factors as decisions taken by the project participants, amount of time allocated by the management, and the importance and priority of the initial business requirement. To determine the requirements and select IT solutions the structured approaches are used. AI2 Acquire and Maintain Applications 4 There is a strict, defined and user-friendly process of software application acquisition and support. This process complies with the IT and corporate strategy. The documented processes are used for various applications and projects. The support services are planned, regulated and coordinated. AI3 Acquire and Maintain Technology Architecture 4 The process of acquisition and maintenance of the technology infrastructure has reached the level when it is successfully and consistently observed and designed for multiple application. IT infrastructure provides adequate support to business applications. The process is well organized and proactive. The costs and time spent to achieve the desired level of extension, flexibility, and integration are optimized. AI4 Enable Operation Use 3.5 There is a well-defined, accepted and recognized concept for preparation of the user documents, operation manuals and training materials. The procedures are stored and maintained in the library and every employee has access to them. The documents and procedures updates are made following the relevant requests. The procedures are accessible also in an off-line mode, and their implementation is ensured in case of an emergency. There is a process that prescribes that update procedures and training materials are an integral part of the modification project implementation. Automated tools are used more and more to develop and communicate procedures. There is a plan for users training. AI5 Procure Resources 3.5 IT acquisitions are fully integrated into the corporate-wide logistic system. IT standards for IT resource acquisition are used for all supplies. Assessment of contract and supplies management is adequate to the economic justifications of IT acquisitions. Reports on IT acquisitions are available. The management is informed about the deviations from the policies and procedures for IT acquisitions. The strategic relationship management is further developed. The IT managers disseminate the processes of deliveries and procurement contracts management to all procurements and monitor the performance indicators. AI6 Manage Changes 4 A formalized process of change management is defined, including change classification, ranging, emergency procedures, change authorization, and issue management. Some temporary solutions may be used, which may override the processes. Analysis of the IT infrastructure changing impact on corporate operations is formalized and support the scheduled releases of new applications and technologies. AI7 Install Accredit Solutions Changes 4 The procedures are formalized and provide for the practical use of a test environment and formalized acceptance. In practice, this formalized approach applies to all material changes made to the systems. The process of user satisfaction assessment is standardized and can be measured, and the measured parameters can be effectively reviewed and analysed. This process is automated from time to time depending on the project. The testing system PwC and IT and and 45 Index Process Target maturity rate Process description adequately imitates the actual operating conditions. When implementing major projects, stress tests are conducted for the new systems, and regression tests are conducted for the existing systems. Delivery and Support Domain Processes DS1 Define Manage Level DS2 and Service 3.5 Responsibilities are clearly allocated. The process of development of service level agreements is underway; moreover, checkpoints are determined to assess the user satisfaction. Services and service levels are defined, documented and approved in accordance with the standard process. Weak points were revealed in the service levels. There is a clear connection between the achievement of the target service level and the financing. The service levels are approved. Manage External Providers 4 There are documented procedures for the management of third party services procurement with the clearly outlined processes that provide for proper familiarization and negotiation with service providers. After a contract is drawn up, all relations with the third party organization are regulated solely by the contract. The contract describes in detail the nature of the rendered services including operating, legal, and control requirements. Persons responsible for supervision of the service rendered by third party organizations are appointed. Contract terms and conditions are based on the standard models. Business risks associated with the contracts are assessed and relevant reports are prepared. DS3 Manage Performance and Capacity 3.5 Performance and capacity requirements are defined for the systems life cycles. Requirements for the service level are defined as well as metrics that can be used for the efficiency assessment. The requirements to the efficiency of a specific process can be modelled and forecasted. The reports on the efficiency statistics are prepared. DS4 Ensure Service Continuity 4 Accountability is clearly defined and persons responsible for planning and monitoring of the service continuity are appointed. The service continuity plan is documented and depends on the system importance and the accounting of the negative impact on the business. Periodic reporting on the inspections of the service continuity is in place. The management makes consistent reviews of the issues relating to the service continuity. The use of the components of high efficiency and redundancy of the system is starting to take place. The list of critical systems and components is maintained. DS5 Ensure Systems Security 3.5 Key directions of ensuring physical security of information assets are defined. DS6 Identify and Attribute Costs 3.5 The model of IT service costs is defined and documented. The interrelation between the IT costs and provided services is defined. The required level of understanding of the costs for information services is achieved. The business is provided with the data on the IT costs. DS7 Educate and Train Users 4 The personnel training and education programmes are clearly formulated and communicated. The training needs of employees and managers are defined and documented. The personnel training and education processes are standardized and documented. Budgets, resources, facilities, and trainers involved in the training process are defined. The employees undertake official training courses, such as corporate culture, general issues and practical actions to ensure system security. For the most personnel training and education processes the routine control is performed. Analysis of the problems associated with personnel training and education is performed. DS8 Assist and Advice IT Customers 4 The necessity to create a user support service and an incident management process is realized and recognized. Procedures are standardized and documented. Training is conducted on an informal level. A database is developed based on frequently asked questions with answers to these questions; recommendation are developed for users. Questions and problems are recorded manually; ongoing monitoring is performed in individual cases. Situations when a request or an incident is not addressed are possible. Users have clear instructions when and how to report a problem or an incident. DS9 Manage Configurations 4 Procedures and methodologies are documented, standardized and communicated. The physical presence of components is checked. Changes in hardware and software are monitored automatically. The configuration data is used in the interrelated processes. DS10 Manage Problems Incidents 4 The process of problems management is recognized at all organization levels. Responsible persons and process owners are clearly defined. Required methods and procedures are documented and communicated to personnel; assessment of their efficiency is conducted. The majority of the emerging problems are revealed and recorded, and appropriate reports are prepared and corrective actions are taken thereon. The required background and skills are obtained and accumulated, and further transferred to a higher level, where they are reviewed as an asset and a main factor contributing to the achievement of the IT goals. Problem management is closely connected with such allied processes as incident, change, accessibility and configuration management, and assists the IT service users in data, equipment and operations management. Goals and indicators comply with the guidelines on the problem management process. 4 The necessity of data management is recognized and accepted by the entire company. Data management responsibilities are defined. Owners and parties responsible for information integrity and security are appointed. The data management procedures are formalized within the IT unit; some automated facilities are used for equipment reservation/restoration and decommissioning. Data management monitoring is conducted. Key efficiency indicators are defined. 3.5 The company recognizes and accepts the necessity to control the environment where computer facilities are located. Monitoring of the environmental parameters, preventive maintenance and physical security are the budget items. The access restriction measures apply to computing resources, and the access is provided to the employees with the special and DS11 Manage Data DS12 Manage Facilities PwC 46 Index Process Target maturity rate Process description access level only. Visitors are registered in the logbook and accompanied at the sites. The premises containing the equipment do not have any indication of their purpose. Civil authorities watch that health and safety rules are observed. Risks are insured, some minor efforts are made to optimize the insurance costs. DS13 Manage Operations 3.5 The company recognizes and accepts the necessity to manage computer operations. Resources are allocated. The repeated functions have been formally defined, standardized, documented and communicated. The events and task performance results are recorded. The automated facilities for package task schedule management and other tools are used in order to reduce the chance of operator interference. Monitoring of the introduction of new types of works is introduced. Formalized policy for reduction of non-scheduled events has been developed. Monitoring and Evaluation Domain Processes ME1 PwC Monitor and Assess IT Performance 3.5 The documented standard monitoring processes are approved by the management and communicated to the personnel. The personnel training and education programmes relating to the monitoring performance are implemented. A formalized database of performance indicators for previous periods is created. The assessment is still performed under individual IT processes and projects. IT processes and service levels monitoring tools are defined. The indicators to assess the IT service contribution to the company's overall performance are defined and based on conventional financial and operational criteria. Efficiency indicators typical for IT as well as non-financial, strategic, user satisfaction indicators and service levels are defined. The methodology of efficiency assessment is defined. 47 7. The Main Tasks of ITS Development Strategy Successful achievement of strategic business objectives by the Company will be closely connected with implementation of the following IT tasks arranged into five major trends: Enhancement of IT management function; Improvement of automatic control in operational processes; Improvement of automatic control in supporting processes; Enhancement of ITS infrastructure; Improvement of maturity level in information security process. 7.1 7.1.1 Enhancement of IT Management Function; Optimization of ITS Management Model ITS management model will be optimized to ensure implementation of ITS development strategy. Information and telecommunication system management Committee will be established to define the development strategy for IT Company, define investment priorities in IT and analysis key IT suggestions. The Committee will include members of the Management Board, Heads of business units (owners of business processes). It will be represented by the Head of Department of Telecommunication and Information Technologies, CIO and IT Heads from Energoinform JSC. The exact list of Committee members will be defined in the Regulations on ITS Management Committee. In addition, the Committee will include Operational Council and Technical Council. Operational Council will function as a managing body for IT strategic projects, defining key IT suggestions. Responsibilities of the Technical Council will include management of IT infrastructure, IT services and IT processes development. Creation of the Committee on ITS management will optimize time for decision-making in ITS area and will ensure the dialogue platform between business and IT support function. 7.1.2 Refinement of IT Services and Maturity Level of IT Processes Refinement of IT services and maturity level of IT processes in the Company will be implemented based on the international CobIT (Control Objectives for Information and Related Technology) and ITIL (IT Infrastructure Library) standards. This task requires standardization and harmonization of IT policies and procedures in the Company. One of the solution to achieve the objective is elaboration of IT policies and procedures using internal resources or engaging outside consultants. The final objective of this initiative is to achieve the targeted situation in managing IT services and processes. The Company will audit information technologies annually pursuant to the methodology elaborated by SWF Samruk-Kazyna JSC to monitor the dynamics of enhancement of IT processes maturity level. Service level detection and management (SLA, OLA), business continuity and crash recovery assurance as well as IT corporate management are the top-priority processes under implementation of this initiative. The process of purchase and maintenance of IT infrastructure equipment is at least priority oriented. Enhancement of maturity level of this process will ensure transition to the planning of purchase and support of the IT infrastructure. Equipment purchase process and the process of technological support for corporate applications and equipment will be standardized and harmonized. The efficient process of management of service and equipment vendors will be implemented additionally (vendor management). Hence, ITS infrastructure purchase and maintenance costs will be optimized. Projects optimizing the costs of auxiliary equipment and transition of server infrastructure to virtual access technologies will be implemented to optimize IT costs as a whole. Refinement of IT services and maturity level of IT processes in the Company will bring the following advantages: cost optimization in terms of purchase and maintenance of IT infrastructure equipment; optimization of the Company IT processes; efficient use of IT resources in the Company; efficient IT management model in the Company; PwC 48 7.1.3 possibility for preventive IT risk management in the Company; Implementation of Software Assets Management Process Optimization of licensing and updating of software will be based on Software Asset Management Methodology (SAM). SAM methodology is addressed to optimize and protect software assets management processes in the Company, via: accounting of all software being on the balance sheet of the Company; accounting of the use of all available software; accounting of software licenses; accounting of documents evidencing licenses availability SAM methodology will consider the requirements of ISO 19 770 and will include the following processes: management of inventory of server equipment, PCs and installed software; software change control through audit trail of the implemented changes; verification of the installed software for authorization, compliance with the quality of the purchased licenses and licensing requirements; check of the completeness and availability of the documents evidencing licenses availability; elaboration and implementation of controls for circulation of copies and originals of the software; elaboration of policies and procedures for software assets management; contracts management and vendor relationship management; budgeting software options and budgetary control; management of IT service quality level agreements; software security management trough efficient software access management; Optimization of software licensing and upgrading in the Company will entail the following advantages: licensed clean title of software assets; information security upgrade and objective control in the software use; common database of software assets with hard and integrated information; use of concise internal corporate policies and standards for software assets management; error-free control of software procurement with economically sound and timely budget planning; enhancement of cost effectiveness and efficiency of the used software and early repayment of financial investments; PwC 49 7.2 Improvement of Automatic Control in Operational Processes; Improvement of automatic control in operational business processes will enable us to enhance the efficiency of the Company activity in planning and forecasting energy consumption, power balances and building of daily load schedules, technical dispatching and physical imbalances settlement etc. Automation of core processes will provide for implementation of the following IT initiatives: Automation of energy consumption and power balances planning; Upgrading of automated dispatch control system (ADCS); Automation of monitoring, analysis and calculation of electricity losses from the electric network; Upgrading of commercial metering system (CMS) Automation of technical control and occupational health; 7.2.1 Automation of energy consumption and power balances planning Automation of energy consumption and power balances planning (forecasting) is required for more precise determination of electricity generation and consumption, power balances and potential power flows in the midand short-term and initiation of projects for NPG development in accordance with the requirements of the economy of the Republic of Kazakhstan. Such information will provide the grounds for high-quality forecasts of the Company revenues and expenditures based on the operating activity. Currently these processes are performed manually in the Company. Information system created to automate these processes will comprise sub-systems and external data sources. Software system will comprise sub-systems as follows: Daily load schedules and power balance Energy consumption planning Condition and configuration of equipment for energy facilities In addition, information systems will be connected to software system through integrated bus as follows: CMS - collection of actual data of energy consumption for the previous periods; SCADA - monitoring of operating energy consumption and physical and financial imbalances settlement (after the simulation mode is over) Daily load schedules and power balance First implementation stage will form the structure of indicators (parameters) which have to be processed by the system. Parameters will comprise consumption and its components, power flows, plants and equipment load, weather factors and other data. The quantity of the parameters to be processed can be sufficiently great, thus they will be classified in a certain manner convenient for work making the hierarchy (tree) out of groups and parameters. Classification can be as follows: Conceptual classification (components of consumption and power balances, power flows, weather data, plants information, etc.). Personal classification when each user creates its own group with the wanted set of parameters; Territorial and administrative classification of parameters. Composition and structure of parameters will significantly depend on the peculiarities of planning technology at the introduction facility. The major functions of sub-system will be: Elaboration of structure and classification of parameters; Downloading and analysis of actual data; Statistic, correlation and regression analysis; Parameters forecasting; Power balances calculation. Sub-system will form parameters with the various types of values - immediate, averaged, and integral. For instance, consumption can be based on SCADA data (immediate and averaged consumption value) and CMS (integral value). This will provide the possibility to compare definite values obtained from different sources and verify data, if necessary. Energy consumption planning Subsystem will work out analytical tasks, forecasting and planning of energy consumption, power balance for energy systems and utilities. Calculations with regard to balance planning will be performed in accordance with the certain calculation methodology comprising methods, procedures, calculation technology, methods and means of data processing required for the whole planning process. The major stages of methodology implementation: PwC 50 1. Preparation of initial information for analysis and planning. Elaboration of the structure for the interrelated balance components. Elaboration of targeted data model for consumption and balances. Featured data classification. Setting up and adaptation of software for information loading from the data sources (SCADA, CMS, flat files). Loading of historical data of balance components for several years. Featured data balancing, identification of unreliable values. Replacement of unreliable values by the simulated parameters. Statistic data analysis based on regression and dispersion analysis. Setting up mathematical models for implementation of forecast and planning functions and accounting of restrictions. Selection and setting up forecast mathematical models for balance components. Series of calculations to evaluate forecast accuracy in retrospective mode based on the actual data. Essential updating of forecast models. Calculation of forecast values of balance components. Preparation of planned values. Forecasting of basic components of energy consumption based on statistic algorithms. Updating of forecast values in terms of effecting factors. Due diligence and updating of calculations using special software interfaces. Calculation of forecast balance as a whole. Calculation variants: Calculation of forecasts based on certain components of consumption balance with subsequent summation. Calculation of forecasts based on the aggregated factor with the subsequent breakdown into the components of consumption balance; Accounting of limits and restrictions (operating capacity, network constraints). Loading of accepted forecast values into the planned parameters. Calculations data exchange with other management levels. Actual data and planning results exchange between entities and management levels. Condition and configuration of equipment This subsystem will solve the tasks of data processing for configuration and condition of equipment, storage of data pertaining to history of repair work, compilation of analytical reports, and calculation of power balances. Primary functions of the sub-system will be: Enter and update configuration and ratings data from energy facilities and basic electrical, thermal mechanical, hydro-technical equipment at power plants, substations and OHTL. Create and update of energy facilities and equipment structure (hierarchy). Link equipment to energy facilities; Link measurable parameter to energy facilities and equipment; Enter and update actual and plan condition of energy facilities and equipment fixing the repair type, power reduction due to repair works, estimated time of putting into operation the equipment, recording of time for entry of data and users; Consolidate status reports for equipment for the definite time and definite period; Calculate actual and plan components of power balance with regard to power plant and energy system as a whole; Compile consolidated tables for daily schedules using data contained in the software system and other external IT systems; Update equipment status data based on maintenance orders from Orders Software System. Subsystem will be implemented through web technologies and thus will be used distantly. Automation of energy consumption and power balance planning will contribute to the achievement of the following results: efficient use of investments for NPG development; efficient planning of repair outages at energy facilities of the country; high performance forecast of power balance that will entail the increase of Company revenue; viable managerial decisions. 7.2.2 Upgrade of ADCS (SCADA/EMS) To achieve key business objective - ensuring reliability of Kazakhstan NPG - the Company has the following tasks: Minimize losses when transmitting electricity via distribution networks; mitigate risk connected with electricity undersupply in emergency mode; reduce costs for liquidation of extraordinary situations and their consequences; PwC 51 ensure stable quality of supplied electricity; maintain and prolong primary equipment life; reduce costs for equipment repair works, technical upgrade and rehabilitation of facilities; reduce costs for operating staff at substations. The above tasks call for efficient work involving a great volume of technological information finally requiring the centralized network management using Automated Dispatch Control Systems (ADCS). Currently ADCS shall provide for: Integrated automation of operational dispatch and dispatch technological management of operation and development of electric networks; obtaining a reliable current technological information essential to manage Company activities as a whole and using both ADCS subsystems and subsystems of corporate information systems; automation of emergency prevention activities Currently SINAUT Spectrum not fully meet the above requirements of Company business. Particularly, the major drawbacks of current ADCS system are the following: Functional restrictions: Impossibility to collect and process the data from energy market entities/facilities and substations of the Company using the obsolete technologies of telemetric information communication; Telemetric restrictions; Impossibility to calculate load flow and evaluation of network status; Impossibility to simulate electric modes in the networks using dispatch training simulator; Insufficient specification of archive subsystem depth to perform forecast calculations. Technical restrictions: Limited access (number of connections) to the system; Lack of cross-platform capacity due to severe linkage to hardware and software systems that are out of production or not serviced by the manufacturer. Impossibility to integrate the system with other technological systems of the Company; Impossibility to export data into the formats supported by office software system. Annual costs for routine maintenance of current software and hardware ADCS system amount to about KZT 90 million. ADCS server equipment is completely depreciated. As a result, the number of incidents related to ADCS hardware increases, which is confirmed by defect reports and 176 incidents in electronic ADCS logs. Due to lack of functions, the time for deflection and liquidation of emergency and time for restoration of electricity transmission in the networks is increased. For the period from 2009 to 2013, there were 161 incidents due to electricity under supply. Total hours for power restoration are 3,247. Total electricity under supply was 9,068 MW/h. Whereas the consumers of the Company are the largest organizations of the country ensuring economic welfare, each undersupply hour entails direct economic losses for both the Company and its consumers. As an example, we will analyse the situation with TemirzholEnergo Company supplying electricity to railway sector of the Republic of Kazakhstan. One idle hour of 130 wagonages within the operating zone of Yuzhnye and Almatinskiye MES will make KZT 5,540,000 as penalties for KEGOC and each subsequent hour will be calculated exponentially. The Company wishing to reduce potential risks in ensuring the operation reliability of Kazakhstan NPG will implement the ADCS upgrading initiative through implementation of the new product. The new ADCS system will be the hierarchical man-machine system providing for collection, conversion, transfer, processing and reflection of information on the status and mode of energy system and, based on the collected information, shaping, transfer and implementation of control commands in real time mode to perform functions of reliable electricity supply with the quality acceptable to the consumers. ADCS will collect and analyse data from all energy market facilities and participants as well as from not rehabilitated substations using obsolete technologies of data communication. In addition, it will perform the requirements that are missing in the current SCADA/EMS system. This system will be based on Common Information Model (CIM) for energy system in accordance with IEC standards. The new ADCS will be modular architecture based and integrated to exchange data including integrated bus (CSIA - Enterprise Service Bus subsystem) with other operating systems of the Company: CMS, BEM, AAMS systems for calculation of energy system modes, etc. In the long term, this ADCS will be used as a main component for designing of the Common System of Automated Technological Management of dispatch and technological, production, and technical activity of the Company (SATM). This system will extensively support all processes of collection, processing and use of technological PwC 52 information (information on the operational modes in electric networks, status of grid facilities and their equipment, status of controlling means and systems). The initiative on ADCS (SCADA/EMS) rehabilitation will, apart from solution of the above tasks, promote the implementation of the strategic task of the long-term development strategy of the company directed at enhancement of efficiency in operational activity and will give the advantages as follows: enhancement of reliability and quality of Company responsibilities as a System Operator of UPS due to implementation of the new ADCS; enhancement of efficiency of operational activity; enhancement of automatic control in operational and dispatching management processes; reduction of operational expenditures through decommissioning of OIS system and integration with other Company system. 7.2.3 Upgrade of commercial metering system One of the strategic tasks of the long-term development strategy of the Company is enhancement of efficiency of operational activity of the Company. CMS upgrading initiative will be implemented under this strategic task. Upgrading of CMS will include upgrading of telecommunication equipment, data collection and transfer unit, meters, server equipment and software. Software will be client-server architecture based and will comprise the following components: collection point server ensuring collection and movement of commercial metering data into the data base; database server which stores and processes information; WEB servers for transfer of information to AWS. Users interface will be built based on the WEB technologies. CMS upgrading will enable the Company to remove the following shortcomings of the current system, particularly: enhancement of network operation reliability and accuracy of electricity figures determination owing to replacement of obsolete data collection and communication units and metering devices; integration of CMS of energy market participants with CMS of the Company by increasing storage capacity; possibility to collect data from the state-of-the-art meters; real-time connection to meters and direct access to meters to request the necessary information, corrections and meters parametrization; enhancement of users mobility owing to using the client-based browser; automation of data communication to BEM system; permanent control of data accuracy; 7.2.4 Automation of electricity losses calculation The initiative on automation of losses calculation will be implemented to assist in achievement of the strategic task of the Company on enhancement of operating activity performance. The necessity of such initiative is preconditioned by high financial outlays in the Company for electricity transmission losses (over 30 % of the aggregated Company expenses - over 2.5 billion kWh per year) Currently losses are calculated manually since CMS is not featured to collect data from all metering devices of all energy market participants. Their infrastructure requires installation of modern CMS ensuring data communication with CMS of the Company. The automated loss calculation system (hereinafter referred to as ALCS) will be launched in the Company to promote automated losses calculation and monitoring in the Company. This system will be integrated with CMS and ADCS systems. Functions of the system will allow for the following calculations: Monthly-based calculation of actual losses; Calculation of operational losses; Losses calculation in network elements; Power balances calculation. Monthly Calculation of Actual Losses; ALCS will calculate losses in the end of the month. The system will provide for manual data entry in accordance with the monthly acts signed with consumers (possible to enclose the copies of acts) for end-points of the network connected to CMS of the Company. Manual data entry will be envisaged for monthly actual volumes of electricity PwC 53 transmitted via Kazakhstan grid specifying consumers and amount of auxiliary consumption. Data will be stored in the central database with archive for 5 years. Calculation of Operational Losses; ALCS will calculate operational losses at intervals depending on the frequency of data collection by CMS. For frontier network points which are not connected to CMS, ALCS provides for automatic calculation of approximate values of consumption based on the statistic data coming from the actual consumption for the previous periods (for the previous month, for the similar period in the last year). Specific losses value will be calculated by ALCS based on automatic calculation of approximate values of electricity volumes transmitted via Company grids. In addition, it will specify consumers and electricity consumption for economic needs based on the statistic data for the previous periods (for the previous month, for the similar period in the last year). Losses Calculation in Network Elements; ALCS will, based of CMS and ADCS data, calculate actual monthly losses broken down into the following components: economic needs, reactor losses, standby losses, load losses in lines and transformers. Substation Balances Calculation ALCS will automatically build substations electricity balance on monthly results. For lines that are not connected to CMS, the system will provide for manual data entry. ALCS will also calculate an admissible value of imbalance and figure the deviation of actual values from the admissible ones. ALCS initiative will enable the Company to: Perform the centralized monitoring and recording of electricity losses in operational mode; Enhance accuracy and transparency of losses management; Perform the profound analysis of losses structure in different sections and thus timely define the losses centres. The above advantages of ALCS will provide for timely detection of factors significantly affecting the losses and adoption of corresponding measures minimizing the losses. 7.2.5 Automation of technical control (safety) and occupational health One of the task of the long-term Company development strategy is the assurance of occupational health. Currently there is an untimely performance of some correction and preventive measures of technical control in the Company by the persons responsible for such measures. Thus, there is a greater risk to have human losses and emergencies at the production facilities. Implementation of occupational health assurance task as well as enhancement of efficiency of technical control and occupational health will be promoted through introduction of the initiative focused on automation of this process. The following alternative scenarios for implementation of this initiative were determined: Ready-made solution; DMS based implementation; partial automation of technical control process through corporate mail and standard software. Analysis of each alternative scenario is given below: Ready-made solution Description Automated Technical Control System will be web-based. Advantages Automation of the whole technical control process and implementation of all required functions; Strengthening of control over implementation of the necessary actions; Relatively longer terms of implementation as compared to the implementation on DMS base. Reporting transparency Disadvantages Score High cost of ownership Training of personnel DCM based implementation Description Advantages Disadvantages Valuation DMS copying up to substation and TES level. Relatively low cost of Longer terms of project Adjustment and possible modification of DMS implementation as compared to implementation depending on for automation of the technical control process. the terms of DMS copying in purchase of ready-made solution. branches, TES and substations. Reporting transparency PwC 54 Description Advantages Disadvantages Valuation Training of personnel Possible incomplete covering of Company requirements regarding the functions of the system. Partial automation of technical control process through corporate mail and standard software Description Advantages Disadvantages Tasks reminding process at substations and Low cost of implementation as Absence of internal control when TESs will be automated through corporate compared to possible alternatives. using MS Excel mail. Data will be compiled in the branch and Low cost of ownership as compared Partial automation of the process Executive Administration by ftp-servers, batto possible alternatives. files and MS Excel macros. The shorter terms of implementation as compared to the possible alternatives Score Based on the analysis, we have chosen a scenario for implementation of this initiative through introduction of the ready-made solution. The initiative will be implemented through introduction of the ready-made web based software with client-server architecture. Client software will be installed at substations, TES, MES and EA. Automated technical control and occupational health system will meet the requirements as follows: planning of technical control and occupational health measures; documenting of procedures and measures of technical control and occupational health by all participants of this process; monitoring and control of these measures performance; notification of responsible persons of the unfulfilled tasks; authentication of procedures and documents; automatic compilation of data on the work performed in branches and EA and post-performance reports; Implementation of this IT initiative will bring the Company the following advantages: PwC mitigation of operational emergency risk by decreasing the number of unfulfilled measures; more transparency and strengthening of control during technical control and occupational health process; cutting down the human factor in ensuring NPG reliability. 55 7.3 Improvement of Automatic Control in Support Processes; 7.3.1 Introduction of Document Management System in KEGOC Branches and its Integration with the DMS of the Executive Administration The strategic goals of the Company are to enhance the operational efficiency and improve the corporate management system. These strategic goals and strategic task for enhancement of administrative and economic activity will provide for implementation of the initiative on modification and extension of the functions of DMS. This initiative will include the following: Coping of DMS in the Company's branches; Integration of DMS and ERP; remote access to DMS for heads from EA and Branches to enhance tasks performance and reduce labour input; In branches, the initiative will be implemented through copying. DMS will connect to Executive Administration of the Company for data synchronization. DMS implementation through copying will optimize costs and speed up the implementation thanks to the lessons learned at the pilot stages. DMS will provide for centralized storage of the elaborated templates and standards of the documents. Besides, it will allow for implementation of tasks execution control and document progress tracking in Executive Administration and in the branches of the Company. Thus, document management process in the Company will be fully transparent. Implementation of this initiative will bring the Company the following advantages: significant reduction of document circulation; immediate access to the necessary documents in EA and in the Company's branches; more efficient cooperation in units both in EA and in the Company's branches. For instance, there will be a faster approval of documents under various business processes of the Company, cutting of time for searching of the necessary documents. In addition, there will be a new option of parallel work in a document. Integration of DMS with ERP system will ensure intensification of transaction documents and contracts processing owing to archive of source documentation in DMS. In the outlook to meet the requirements of the external regulator (National archive of the Republic of Kazakhstan) and external auditor and to speed up document searching process, the Company will consider the introduction of electronic archive on DMS base. Prior to implement the DMS initiative in the Company's branches and before integration with DMS of the Executive Administration it is notable to study the use of cloud technology option. Implementation of the project through IT infrastructure outsourcing has the following advantages: saving of funds for IT personnel upkeep and purchase of server equipment; control of resource utilities; reliability of operation owing to distributed processing independently from specific hardware. 7.3.2 Automation of personnel training process Strategic IT initiative on automation of Company personnel training process will be implemented to follow up the strategic initiatives of the Company to intensify the efficiency of administrative and economic activity and raising of personnel qualifications. Automation of this process is essential for development of the Company due to research intensity of the sector and a huge staff. This initiative will provide for automation of the following processes: PwC centralized storage of the training documents; planning and administration of the employee training process (elaboration of training programmes for each employee); training of the personnel through the use of specially developed media-tutorials; 56 qualification tests of the personnel; monitoring of training programmes follow-up; record-keeping and analysis of training results. To effectively implement the above tasks the automatic integration with human relations module will be done. The special task under this initiative will be the technical upgrade of the Company Training Centre situated in Borovoye village (Akmolinskaya oblast). This initiative will include the following: technical equipment of training rooms (including equipment of the occupational health room), for instruction of the employees comprising the operational unit of the Company (training simulators, computer classrooms, software, etc.); covering the whole territory of the Training centre with wireless Internet access; connection of the Training Centre to CDN of the Company. Additionally, the electronic library will be implemented under this initiative. It will be the digitalized archive of technical libraries of the Company. Electronic library will be accessed through internal corporate portal of the Company. Inventory of the paper copies of the books in technical libraries of the Executive Administration and branches of the Company will be performed. Inventory will help in compilation of the books catalogue that are to be digitalized. Creation of electronic books will be performed through scanning. To facilitate electronic library implementation the functions of the internal corporate portal will be upgraded to keep records of electronic books and separated in spheres. Additionally, to prevent the distribution of intellectual property of the Company the functions of books protection from copying to local carriers will be implemented in the corporate portal. Electronic books can be read only in the corporate portal. Implementation of the IT initiative will entail the following results: enhancement of operating efficiency, motivation and loyalty of the Company employees; standardization, optimization and increase of transparency of training process for personnel of the Company; mitigation of skills concentration risk at certain employees and possible loss of skills. 7.3.3 Development of Automated Balanced Scorecard System One of the tasks of the long-term development strategy of the Company is the enhancement of efficiency of administrative and economic activity. The Company implemented the Balanced Scorecard System (hereinafter referred to as BSC) under this task. This system will be further automated. At the moment of elaboration of this Strategy there was defined an initiative in development of the automated BSC. This initiative will be performed upon implementation of the corporate data bank of the Company. This initiative will provide for integration of automated BSC with DWH (EAIS - DWH subsystem) Implementation of this initiative is necessary for: increase of flexibility in reports preparation; decrease of cost of ownership; Development of automated BSC will entail as follows: reduction of labour contribution due to automation of data collection and consolidation process with regard to strategic goals of the Company and other key performance indicators (KPI) at different levels; formation of the centralized information source based on key balanced indicators (hereinafter referred to as KBI) and KPI of the Company and formation of the efficient and transparent instrument calculating and monitoring of KBI and KPI; speed-up of decision-making process by Top-Management of the Company; 7.3.4 Introduction of a corporate system of applications integration and Business Intelligence analytical system Implementation of the initiative on Corporate System of Applications Integration (EAIS) and Analytical System of Business Intelligence Class includes the following projects: PwC Implementation of integrated bus (EAIS - Enterprise Service Bus subsystem); 57 Implementation of the Common Master Data Management System (EAIS - Master Data Management System subsystem). Introduction of a corporate Data Warehouse (EAIS - subsystem and analytical system of Business Intelligence class) hereinafter BI). The following alternative scenarios for implementation of this initiative under the last project were determined: Implementation of DWH and full-fledged software product of BI class; implementation of the alternative product for reporting; Analysis of each alternative scenario is given below: Implementation of DWH and full-fledged software product of BI class; Description Advantages Disadvantages Implementation of Corporate Data Possibility of building the dynamic reports High requirements to the Warehouse and and, thus, ability to analyse the influence competence of the System Analytical system of BI class to optimize of various factors on the activity of the Integrator due to complexity of the the reporting process. Company and forecast the Company project Implementation of ETL solutions to development trends. High cost of ownership optimize data Increase of flexibility in reports preparation; Relatively low cost of ownership Possibility to introduce other DWH based analytical systems. Load relief from the transactional databases. Analytical process covering greater time horizon. Score Implementation of the Alternative Product for Reporting Description Introduction of the software product for building of the reports based on the existing distributed databases. Advantages Low cost of implementation Disadvantages Score High cost of ownership due to necessary periodic upgrading of reporting forms and operational expenses for integrated platforms Lower level of dimensional scaling and flexibility of reports building Impossibility to build dynamic reports Exposure to transmission capacity of communication channels Greater dependence on the integrator; Heavy load on transactional databases. Analytical process is limited by a short time horizon for data storage; Having analysed the situation the implementation scenario for this project was chosen; it will be the introduction of the Corporate data warehouse and full-fledged software product of BI class. Project on Implementation of the Integrated Bus The analysis of the current situation with the ITS in the Company showed that a number of the miscellaneous information systems and the lower level of integration between these systems entailed duplication of data entry and significant increase of labour contribution. Moreover, such situation leads to decrease of quality of data important for managerial decisions. The Company integrated several information systems (e.g. Oracle e-Business Suite and Oracle Hyperion). However, there is no a common environment for data exchange between information systems. To solve the above problems there will be a special project on introduction of the integrated service bus. Integrated bus will be a software and hardware system allowing us to integrate a great number of information systems and applications and to set the server based interconnection between them. Implementation of integrated bus will mean the transition to building of IT infrastructure based on service-oriented architecture (Service Oriented Architecture, SOA). Integrated bus will integrate the main operational and information systems as well as ERP system at the Executive Administration level. The detailed schematic picture of integration is given in Section 6.3.6.3 Implementation of the integrated bus will lead to the following: PwC 58 Optimization of business-processes of the Company which use several information systems; optimized costs for the information systems integration support; formation of the common controlling unit responsible for updating and submission of data from various information systems; improvement of data exchange transparency within the existing and newly introduced businessprocesses; Project on Implementation of the Common Master Data Management System One of the key tasks under formation of the common information area is unification and standardization of Company data using Master Data Management System (RD). Implementation and arrangement of the centralized recording of the reference information and distribution of this information to all information systems of the Company will contribute to improvement of data quality necessary to make managerial decisions. This project provides for integration of RD management system with other information systems. RD will form a set of common reference books and classifiers of the Company. The peculiarity of RD management system is that it will be used in various documents relating to different business processes. The main objectives for implementation of RD management system are as follows: identification and unique character. Unique identification of data allowing us to make references from other RD elements; structuring for creation of information files necessary to store numerous elements. Implementation of RD management system will reduce the likelihood of erroneous and incorrect actions and improve transparency of work and quality of managerial information. Project for introduction of a corporate Data Warehouse (DWH) and Business Intelligence system. Within the Company's strategic tasks for enhancement of administration and economic operations efficiency, enhancement of operating activity efficiency and growth of net income, the Company will implement full BI product introduction initiative. The system will be used for data collection, storage, compilation, analysis and submission during taking decisions by the Company's management. Implementation of the initiative also implies introduction of DWH. DWH will contain data from financial and operational systems of the Company's Executive administration and branches in structured, unified and aggregated form. Data will be aggregated, standardised and structured using ETL solutions. Introduction of BI system over DWH will enable to use the following opportunities: faster and more accurate preparation of reports; preparation of non-standard reports by users without involvement of IT specialists and as consequence, more flexible preparation of reports; Analysis of influence of different factors on the Company's operations and forecast of its development trends; more profound analytics owing to covering historical sources for more time horizon; enhancement of decision making process efficiency; load reduction in transactional system database; possibility to deploy other analytical systems based on DWH in the Company. Deployment of BI system will ensure efficiency of the following functions performance in the part of the Company's strategic development: PwC set goals attainability assessment; assessment of resources use efficiency; assessment of operating, investment and financial operations efficiency; business modelling and assessment of investment projects; cost management, tax planning and investment planning. 59 7.3.5 Automation of the Risk Management System One of the tasks within the Company's strategic goals regarding development of corporate governance practice to the level of leading world companies and sustainable development is to improve the risk management system (RMS). Currently, RMS development by external consultants is at the stage of completion. The following stage of RMS improvement is its automation. RMS automation will enable it to build integrated system for information and tool support to risk identification and classification processes, definition of their importance, definition of measures for their management and risk prevention. Another important aspect is to prepare reports on risk current status and risk change dynamics for prompt submission of reports to the Company's management. Introduction of automated decision on risk management will result in the following: enhancement of risk management transparency in the Company; introduction of corporate governance practice; option to raise shareholder value through improvement of the entity management system 7.3.6 Development and Extension of ERP System Features The following alternative scenarios for implementation of this initiative were determined: Acquisition of separate ERP module; improvement of ERP system after integration with DMS. Analysis of each alternative scenario is given below: Option 'Acquisition of separate ERP module' Description Advantages Disadvantages Introduction of additional module to automatize More flexible system in case of change to cash flow planning process. Integration with Samruk-Kazyna reporting form Samruk-Kazyna web-portal Reduction of labour efforts owing to automated integration with SamrukKazyna web-portal Score Option 'Improvement of ERP System after Integration with DMS' Description Advantages Disadvantages Preparation of reports in accordance with Samruk- Low cost and short term of introduction Dependency on Kazyna requirements based on the data regarding implementation of IT Availability of own developers for payments stored in ERP. DMS and ERP integration initiative for DMS and improvement of ERP Oracle in part of download of acceptance certificates will ERP integration be made to generate these data Risk of failure to meet obligations on the deadlines fixed by Samruk-Kazyna (1 March 2014) Score Based on the analysis, we have chosen a scenario for implementation of this initiative through acquisition of separate ERP module. Currently, working group for improvement of treasury operations functions in Samruk-Kazyna (hereinafter referred to as the Fund) One of set tasks for the group is introduction of centralised treasury system components. In this connection, the Company will acquire a separate ERP module to automatize cash flow planning process as required by the Fund. Cash flow planning will be performed weekly; in turn, this will facilitate enhancement of cash flow transparency. Introduction of additional module under the Fund financing plan will lead to the following advantages: efficient cash flow management; assurance of transparency to the Fund as well as the Company's management (monitoring of payment planning, incomes, expenses etc.); strengthening of control over cash flows and enhancement of efficiency of reserve funds use. Additional ERP system module under the financing plan will efficiently update data on cash flows, thereby having made qualitative forecast regarding future payments and mitigated the Company's risks. PwC 60 7.3.7 Automation of the Project Management Process One of the tasks within the Company's strategic goals regarding development of corporate governance practice to the level of leading world companies and sustainable development is to automatize project management process. The project management process automation initiative will be implemented to facilitate achievement of the Company's strategic goal regarding development of corporate governance practice and sustainable development. This initiative also correlates with the expectations of Samruk-Kazyna as the Company's sole shareholder. Within the Company's operations, project management methodological framework will be improved in accordance with the best world practices PMBOK and ISO 21500 at the initiation of projects and programmes. Further step will be project management process automation based on ERP system with regard to the existing EAM system features. The project management process automation will grant the Company the following advantages: optimisation of costs for implementation of projects due to control over expenditure of funds; mitigation of risk of failure to meet the project deadlines and programmes; PwC option of distributed performance of tasks specific to project management: scheduling, resource levelling, reporting on separate projects, organisation itself and project portfolio. 61 7.4 7.4.1 Development of ITS infrastructure Improvement of the data transmission rate and quality in CDN Functioning and further development of Corporate data network (CDN) is mainly determined by the requirements of business units for access to information resources in the purposes of operational management of the Company. Therefore proposed project solutions will take into account the possibility of further growth both numerous information systems and quantity of users of the existing and newly deployed applied information systems, as well as scope of tasks to be solved and necessity of their functionality extension (see principle of scalability). Corporate data network (CDN) will be meant to: allocate single information space for the Company's personnel; ensure access to the Company's information systems; provide communication service (telephone, radio communication); provide access of user groups to I/O network appliances (printing and plotting devices, and magnetic tape libraries). Key alternative scenarios of this initiative implementation are as follows: Laying of FOCL only at OHTLs being built; Laying of FOCL only at OHTLs being built and installation of radio relay communication; FOCL within the Company; Installation of radio relay communication at backbone OHTL. Analysis of each alternative scenario is given below: Option 'Laying of FOCL only at OHTLs being built' Description Advantages Disadvantages OPGW is provided for all backbone Synergy from two projects for NPG Low level of CDN transmission capacity OHTLs covered by the National Power rehabilitation and CDN upgrading at separate network segments (not Grid Rehabilitation Project and OHTLs covered by the National Power Grid (capital and operational expenditures) being built. All the other lines remain Relatively low costs (as compared to Rehabilitation Project) unchanged. Relatively high capital expenditures for third option) laying of FOCL (as compared to option Independence on external conditions Satellite equipment will be upgraded in 4) CDN prominent segment (FOCL) MES and at substations for proper Dependency of CDN separate segment Long period of FOCL operation functioning of backup communication (RRC) on external factors (weather, channel. relief, disturbances etc.) Maximum timelines for project Also the Company will acquire active implementation network equipment required to Low transmission capacity at directions support new CDN transmission not covered by upgrading plan capacity Score Option 'Laying of FOCL only at OHTLs being built and installation of radio relay communication'; Description Advantages OPGW is provided for all backbone Reduction of costs for laying and OHTLs covered by the National Power maintenance of FOCL Grid Rehabilitation Project and OHTLs Sufficient transmission capacity at all being built. the Company's power centres Relatively low costs (as compared to Installation of radio relay laying of FOCL within the Company) communication at other backbone Independence on external conditions directions not covered by the CDN prominent segment (FOCL) upgrading Longer period of operation (as compared to other communication Satellite equipment will be upgraded in channels) MES and at substations for proper functioning of backup communication channel. Also the Company will acquire active network equipment required to support new CDN transmission capacity Disadvantages Score Additional costs for acquisition and maintenance of radio relay communication Relatively high capital expenditures for laying of FOCL and acquisition and maintenance of radio relay communication (as compared to option 2) Long period for project implementation Dependency of CDN separate segment (RRC) on external factors (weather, relief, disturbances etc.) Significant operational costs for maintenance of radio relay communication (transponder which shall be connected to electricity and UPS is required every 30 km) Vulnerability due to radio signal capture Option 'FOCL within the Company'; PwC 62 Description Advantages Disadvantages FOCL will be built in ground wire at all the High transmission capacity High capital expenditures existing transmission lines. All other High reliability Additional financial expenditures communication channels will be withdrawn for dismantling and assembling of Long period of all the CDN operation from operation as far as FOCL is built lines Dependency on external conditions Long period for project (weather, relief, disturbances etc.) Also the Company will acquire active network implementation equipment required to support new CDN transmission capacity Score Option 'Installation of radio relay communication at backbone directions' Description Advantages Disadvantages Radio relay communication is built at sections Low level of capital expenditures Dependency of CDN on external of scarce transmission capacity factors (weather, relief, Rational arrangement of disturbances etc.) communication in hard-to-reach Satellite equipment will be upgraded in MES The highest operational costs for places and at substations for proper functioning of maintenance of radio relay Sufficient transmission capacity for backup communication channel communication (transponder, the Company's functioning electricity and UPS are required Fast period for project Also the Company will acquire active network every 30 km) implementation equipment required to support new CDN Vulnerability due to radio signal transmission capacity capture Insufficient transmission capacity in the long term Shorter period of operation as compared to FOCL Limitation in allocation and withdrawal of frequency resource by authorised agency in the Republic of Kazakhstan. Score During 2016-2019, construction of fibre cable communication line will be considered at the following sections: Severny RDC (Ekibastuz) - 220 kV Ekibastuzskaya SS, 220 kV Ekibastuzskaya - EGRES-1, EGRES-1 1150 kV Ekibastuzskaya, Ossakarovka– KarGRES-2, KarGRES-2 – N.Gorod, N.Gorod – CRDC (Karagandy), KarGRES-2 – Kayrakty, Kayrakty– 500 kV Agadyr. The above-mentioned lines will provide traffic of different assignment between the Company's facilities at specified directions: substations-RDC, TES-RDC, and RDC-NDC of SO. The main goal of construction in these directions is to provide 'optical' ring towards Taking into account total volume of data flow, big volume of traffic will be provided when introducing information systems in the following directions: substation, TES, URS - RDC not less than 20 MBps, RDC - NDC SO - not less than 140 MBps. These indicators of communication channel capacity include baseline speed of communication of the following data: dispatch and technology data, SCADA data, CMS data, ACS data, emergency automation data, pre-emergency data, LAN traffic, remote control, video monitoring, RP and EA signals, conferencing/ video conferencing. Moreover, additional volume of data communication is required when introducing various modern applications: diagram of connection and parameters of substation equipment functioning mode; condition of primary equipment from substations facilities and monitoring subsystems; from facilities and subsystems for alarm event and process recording; localisation of faults on transmission lines; from substation power quality devices; Document Management System (DMS); Condition of substation engineering systems etc. Speed of proposed flows of communicated data was estimated in accordance with the regulatory documents of Federal Grid Company in Russia: 1. Rules of design, construction and operation of fibre optic communication lines on overhead transmission lines -110 kV and above, working document 153-34.0-48.518-98 (Clause 2.3.14): 155/622 MBps transmission system (SDH technology) is recommended to be used on backbone and intersystem FOCL-OHTL; 8- 34 MBps (PDH) - on zone (internal) FOCL -OHTL. Comparison of total costs for construction of backbone cable communication line with total costs for lease of KazakhTelecom communication channels demonstrated expediency of FCOL construction: Total costs (NPV) for construction and operation of FOCL for the next 30 years come up to KZT 1589 million. Total costs (NPV) for lease of communication channels for the next 30 years come up to KZT 1422 million. Incurred cost of difference between two versions of network operation is KZT 167 million for 30 years. The following assumptions were accepted when estimating economic effect: potential gains were not taken into account from FOCL lease; PwC 63 Average discounting rate was determined as 14 % for similar projects; When calculating effect on corporate income tax base, depreciation rates of the Tax Code of RK were taken into account; With respect to analysis of historical data (2010-2013) communication channel lease service will not be subject to inflation; Network equipment required for FOCL functioning will not be subject to inflation. In order to provide required transmission capacity, all facilities constructed and covered by the National Power Grid Rehabilitation Project) will be supplied with OPGW. This initiative will facilitate reduction of costs for laying of FOCL because of joint actions for OHTL construction/upgrading. New radio relay communication will be installed at all other power centres where communication channels should be extended. In this respect, in purpose of more efficient investment in IT assets, it should be noted that it would be more expedient to lay FOCL (without regard to landscape) up to 15 km as 'the last mile'. Backup communication channel will remain satellite communication channel to provide dual path. Satellite communication channel will be also upgraded. SKY WAN will be changed to SKY EDGE. This technology has the following advantages: improvement of communication quality and reliability die to use of IP MPLS instead of outdated and unsupported FRAME REALAY technology. maintenance of the current equipment (old equipment is not manufactured and maintained any more due to the fact that operational costs for maintenance of old equipment will grow exponentially) traffic unloading at master station due to use of hubless technology (to connect two stations, connection with master station is unrequired as distinct from SKY WAN), for example: currently, any connection vie satellite communication channel between two substations shall be made through master station in Astana; this, in turn, overloads communication channel in Astana. Use of hubless technology allows performing satellite connection between two substations directly without master station. While introduction of FOCL and formation of optical rings, the following communication channels will be withdrawn from operation: PLC channels, radio relay communication and leased communication channels of thirdparty providers These measures will facilitate establishment of reliable IT infrastructure meeting the Company's current and future requirements. 7.4.2 Development of Data Centre This initiative is implemented based on establishment of Data Centre as a part of the Executive Administration of the Company. Availability of own DC in the Company is conditioned by the necessity of reliable, smooth-running operation of server equipment for steady performance of functions of System Operator of the UPS. Equipment for DC will constitute unified and standardized set of IT solutions. Thus, the DC will be a platform and infrastructure foundation for most applications and information systems of the Company. As a result, services for delivery of computing power for most applications will be centralised; this will lead to optimization of cost for ownership of server infrastructure of the Company through: optimization of server equipment load (optimization of used server equipment quantity); optimisation of costs for server equipment service and maintenance. Optimisation and balancing of server equipment load will be provided with increased use of servers that support virtualization technology. The costs will be optimised by means of introduction of unified approach to purchase of equipment. In the long term, establishment of back-up data centre will be under consideration. Its function will be to provide services if the main DC breaks down; this will ensure continuity of business processes. 7.4.3 Introduction of Business Continuity Assurance Process in case of Emergency Situations The following alternative scenarios for implementation of this initiative were determined: Introduction of business continuity assurance process in case of emergency situations within the Executive Administration and MES; Introduction of business continuity assurance process in case of IT emergency situations within the Executive Administration; Introduction of business continuity assurance process in case of emergencies within the Company. Analysis of each alternative scenario is given below: PwC 64 Option 'Introduction of business continuity assurance process in case of emergency situations within the Executive Administration and MES' Description Advantages Assurance of business continuity will Expandability of IT business continuity cover information systems in the process assurance at substations if Executive Administration, and then necessary, and availability of staged introduction in MES experience for expansion. Opportunity to provide fault-tolerant IT infrastructure in the Executive administration Disadvantages Score Relatively high cost of introduction project (as compared to initiative 1). High total cost of ownership in the long term (personnel and technologies). Risk of IT inaccessibility at substations Risk of project failure due to its complexity Option 'Introduction of business continuity assurance process in case of IT emergency situations within the Executive Administration' Description Advantages Disadvantages Assurance of business continuity will Expandability of IT business continuity Risk of IT inaccessibility in MES and at cover information systems in the assurance in MES and at substations if substations Executive Administration only necessary, and availability of experience for expansion. Opportunity to provide fault-tolerant IT infrastructure in the Executive administration The lowest cost of project introduction The lowest cost of ownership Score Option 'Introduction of business continuity assurance process in case of emergency situations within the Company' Description Advantages Disadvantages Valuation Assurance of business continuity will Assurance of complete IT business The highest cost of project cover all information systems in the continuity within the Company introduction Executive Administration, and then The highest cost of ownership staged introduction in MES and at The most maximum timelines of substations project introduction The highest risk of project failure due to its complexity Based on the analysis, we have chosen a scenario for implementation of this initiative through introduction of business continuity assurance process in case of emergencies within the Executive administration and MES. The main factors to choose this scenario are as follows: high cost of introduction and ownership of project when introducing within the Company (Executive administration, MES and substations); high risks of project failure when introducing within the Company (Executive administration, MES and substations), due to project complexity and the personnel's lack of experience and competence. Reliable operation of ITS is a critical factor for functioning of the Company's business. It should also be noted that in result of increased level of business process automation in the Company, consolidation of IT services in the data centre, the role of IT in the Company's business would only become more critical. In this connection, the policy on business continuity assurance will be developed and introduced to ensure business continuity in the Company. The scope of business continuity assurance primarily will cover business processes within the Executive administration, and then within MES in a staged manner. In order to mitigate risk of operational and supporting business processes, fault-tolerant technologies and methods (mesh topology) of corporate network will be applied within IT infrastructure. As result of development and introduction of business continuity assurance policy and implementation of measures mitigating risks of IT infrastructure fault-tolerance, the Company will raise the level of business process accessibility and reliability of IT infrastructure. 7.4.4 GPS Upgrading Guaranteed Power Supply (GPS) is backup power for the Company's facilities. Its readiness to support operational systems in case of failure of the main power source is one of key factors of reliable operation of Kazakhstan National Power Grid. GPS equipment was put into operation in 2003; GPS equipment service life is 12 years, service life of storage batteries for GPS is seven (7) years. All the GPS equipment is fully amortised and needs upgrading. PwC 65 This project will provide for preliminary inspection of the existing GPS network for conformity to the requirements for the Company's facilities operation continuity and necessity of subsequent upgrading. Feasibility study will be developed for follow-up works. Further, based on conducted inspection, GPS will be upgraded in troubled facilities of the Company. The key advantages that will be reached through implementation of this initiative are as follows: improvement of reliable operation of the National Power Grid; compliance of the Company with the best world practices and recommendations relating to business continuity assurance. Implementation of this initiative will result in significant improvement of reliable operation of operational systems. Moreover, idle hours will be reduced in operation of operational equipment at substations, and this finally will positively reflect on the reliability of electricity supply to consumers. PwC 66 7.5 Improvement of Maturity Level in Information Security Process 7.5.1 Improvement of cyber security level The following alternative scenarios for implementation of this initiative were determined: Cyber security within the Executive administration and MES; Cyber security within the Executive administration, MES and substations. Analysis of each alternative scenario is given below: Option 'Cyber security within the Executive administration and MES' Description Advantages Disadvantages Improvement of cyber security Required cyber security at the level of Risk of cyber security incident at the within the Executive administration the Executive administration and MES level of substations and gradually in the main branches (average level of cyber security) Moderate risk of project failure due to its complexity Score Option 'Cyber security within the Executive administration, MES and substations' Description Advantages Disadvantages Improvement of cyber security level Assurance of full level cyber security The highest cost of introduction project at all levels of the Company: first of within the Company (maximum level The highest cost of ownership all, Executive administration, then of cyber security) The highest risks of project failure due to MES and substations step-by-step its complexity (version II) Score Based on the analysis, we have chosen a scenario for implementation of this initiative through cyber security within the Executive administration and MES. The main factors to choose this scenario are as follows: high risk of project failure when introducing cyber security within the Company (Executive administration, MES and substations), due to project complexity and the personnel's lack of experience and competence; high cost of cyber security system development and ownership within the Company under the cyber security development within the Executive administration, MES and substations; Due to more frequent attacks on operational systems worldwide, there is a critical issue on cyber security. Security of the Company's operational processes is a key factor to ensure uninterrupted operations. Implementation of this initiative will mitigate the risk of operations interruption, environment pollution and security leakage as result of cyber-attacks. Implementation of this initiative includes introduction of innovative solutions of cyber protection means (ADCS and ASPMS) manufacturers within the Executive administration and systematic introduction of these solutions in MES. In the long term, proactive protection means, for example, accumulation of threats base, will be used to raise level of cyber security. Benefits of this initiative include: possibility to differentiate protection means in accordance with the security level; possibility of proactive management of operations capacity losses risks and environmental impact risk; prevention from potential cyber-attacks on operational processes. 7.5.2 Introduction of Information Security Management System The following alternative scenarios for implementation of this initiative were determined: ISMS introduction within the Executive administration and MES; ISMS introduction within the Executive administration; ISMS introduction within the Company (including substations and TESs) Analysis of each alternative scenario is given below: PwC 67 Option 'ISMS deployment within the Executive administration and MES' Description Advantages Disadvantages Score Information security management Low cost of project introduction Non-coverage of the Company's system will be introduced in the Low cost of information security business processes (Executive Executive administration, and then in all administration and MES only) management system ownership MES step-by-step. (business processes, personnel and Risk of IS incident at substations technologies) Faster periods of project implementation owing to IS formalised documentation Optimisation of costs for information security management system coping in branches and TES using learnt lessons within the Executive administration and MES Option 'ISMS deployment within the Executive administration' Description Advantages Disadvantages Score Information security management The lowest cost of project introduction Non-coverage of the Company's system will be introduced within the The lowest cost of information security business processes, including the Executive administration only main processes (only Executive management system ownership administration), and occurrence of (business processes, personnel and IS incidents at substations and MES technologies) as consequence The fastest periods of project implementation owing to IS formalised documentation Optimisation of costs for information security management system coping in MES, branches and TES using learnt lessons within the Executive administration Option 'ISMS introduction within the Company (including substations and TESs)' Description Advantages Disadvantages Score Information security management Potential reduction of total costs for The highest cost of project system will be introduced in the introduction (for example, lower prices introduction Executive administration, and then in from manufacturers due to immensity) The highest cost of information MES and substations step-by-step. security management system ownership (business processes, personnel and technologies). The longest duration of introduction Based on the analysis, we have chosen a scenario for implementation of this initiative through introduction of information security management system within the Executive administration and MES. The main factors to choose this scenario are as follows: high risk of project failure when introducing within the Company (Executive administration, MES and substations), due to project complexity and the personnel's lack of experience and competence; high cost of introduction and ownership at attempt of introduction within the Company; low level of information security when introducing information security management system within the Executive administration. Responsible units of the Company jointly with EnergoInform JSC will introduce the information security management system in the Company within the Executive administration, and then stage wise in MES in order to meet the requirements for business processes regarding information security. Information security management system will be based on the following fundamental principles: Confidentiality; Entirety; Accessibility. International standards and practices such as ISO 27001, NIST, ANSI/ISA, NERC and API will be applied as a basis for creation of information security management system. Furthermore, the Company will perform continuous working on the following: PwC testing of information security management system for compliance with the laws of the Republic of Kazakhstan; monitoring of working capacity efficiency, risk, threat and vulnerability analysis, as well as application of corrective measures. 68 Implementation of strategic aim to introduce the information security management system will grant the Company the following advantages: PwC Accessibility of operational business processes; Confidentiality, entirety and accessibility of used information within business processes; improve corporate governance; improve the confidence of shareholders, international partners and clients. 69 8. Plan of IT Initiatives Implementation Plan of IT initiatives implementation depends on the following: prioritizing of IT initiatives; mutual influence of IT initiatives. 8.1 Prioritizing of IT Initiatives; Comparative analysis of IT initiatives was held to determine priority of these initiatives with account of: importance to achieve the Company's strategic aims; complexity of IT initiatives implementation plan. Prioritizing results are given in the Figure below: PwC 70 Figure 8.1 IT Initiatives and Priorities Cost I Name of IT Initiatives II 1 High 5 6 20 14 9 4 2 18 Importance 17 11 III. 12 15 7 8 1 Optimization of ITS Management Model 2 Introduction of business continuity assurance process in case of emergency situations 3 Refinement of IT Services and Maturity Level of IT Processes 4 Optimization of the licensing and software update process 5 Upgrade of SCADA/EMS 6 16 7 3 21 13 19 IV. 10 8 9 Low Complexity High Importance means a level of influence on achievement of strategic business goals Introduction of document management system in KEGOC branches and its integration with the DMS of the Executive Administration Automation of personnel training process Development of Automated Balanced Scorecard System 10 Introduction of a corporate system of applications integration and Business Intelligence analytical system 11 Automation of technical control and occupational safety 12 Development and extension of EMS features 13 Low Upgrade of commercial metering system Automation of the Risk Management System 14 Improvement of the data transmission rate and quality in CDN 15 Improvement of cyber security level 16 17 18 Introduction of Information Security Management System Development of Data Centre (DC) GPS upgrading 19 Automation of the Project Management Process 20 Automation of electricity losses calculation 21 Automation of the electricity and capacity balance forecasting process PwC 71 8.2 Mutual Influence of IT Initiatives The initiatives were analysed for their dependency on each other in order to analyse the mutual influence of IT initiatives relative to each other. The analysis addresses both technical dependency of initiatives on each other and organizational aspects specific to the Company. The results of analysis of mutual influence of IT initiatives are given in the Figure below: 9(II) 20 9(I) 5 10 7 Automation of business processes Name of IT Initiatives 1 2 12 3 6 21 13 8 19 11 4 5 6 7 18 IT Infrastructure 17 8 14 9 2 10 11 Information security (IS) 15 12 13 16 1 4 IT activity management Optimization of ITS Management Model Introduction of business continuity assurance process in case of emergency situations Refinement of IT Services and Maturity Level of IT Processes Optimization of the licensing and software update process Upgrade of SCADA/EMS Upgrade of commercial metering system Introduction of document management system in KEGOC branches and its integration with the DMS of the Executive Administration Automation of personnel training process Development of Automated Balanced Scorecard System Introduction of a corporate system of applications integration and Business Intelligence analytical system Automation of technical control and occupational safety Development and extension of EMS features Automation of the Risk Management System 14 Improvement of the data transmission rate and quality in CDN 15 Improvement of cyber security level 16 17 18 Introduction of Information Security Management System Development of Data Centre (DC) GPS upgrading 19 Automation of the Project Management Process 3 20 Automation of electricity losses calculation January 2014 21 Automation of the electricity and capacity balance forecasting process PwC 11 72 8.3 Plan of IT Strategy Implementation Plan of IT strategy implementation extending to 2019 was developed based on prioritizing of IT initiatives and analysis of their mutual influence. The Implementation plan is given in the Figure below: Figure 8.3.1 Plan of IT Strategy Implementation * - This budget is only for initial subprojects. To determine the total budget a feasibility study is required ** - a feasibility study is required to determine the budget *** - it is proposed to use DTIT's resources **** - The budget for the implementation of the initiative has been already allocated PwC 73 9. Risk Register for Implementation No. 1 Risk Blurring of responsibility for the strategy implementation 2 Resistance of the Company's personnel to changes 3 Delays and increased expenses during IT project implementation (scope and complexity of projects, lack of competence) 4 Disinterest in participation of key business users in projects Lack of competence and knowledge loss during IT strategy implementation 5 IT Strategy Risk Mitigation Measures Appointment of responsible IT personnel for implementation of IT projects Appointment of sponsors for IT projects from among the Company's management Appointment of IT project working groups comprising of business and IT representatives Periodic control of IT project progress Appointment of sponsors for change management from among the Company's management Regular communication to personnel on structure of changes, roles, goals and expectations through IT portal etc. Regular communication on obtained results through IT portal etc. Interaction with interested parties on IT projects within the project office Training for the Company's personnel Training for managers of IT projects for IT project management methodology Application of the Company's IT project management methodology Assessment of project risks before commencement of the project Periodic control of IT project progress Preparation of regular reports on IT project implementation Regular information sharing among sponsors on IT project implementation Education and training for IT personnel and business users Project documentation during IT strategy implementation PwC 74 Appendix No. 1: Terms and Abbreviations Project Information and telecommunications development strategy of KEGOC for 2013 - 2019 AAMS Automated asset management system ADCS Automated dispatch control system ARPAW Automated relay protection and automation workstation ASPMS Automated substation process management system AUSMS Automated user support management system BCP Business continuity plan BEM RES Balancing electricity market system Renewable energy source BEMS Balancing electricity market system Beneficiary Code 27001 International standard of information security, developed jointly by the International Organization for Standardization and the International Electrotechnical Commission BSC Balanced Scorecard CAP Comprehensive action plan CDN Corporate data network CIM Common information model CMR Commercial metering system CobIT A package of open documents in the field of IT governance, audit and IT security Company DLS Kazakhstan Electricity Grid Operating Company JSC Daily Load Schedules and Power Balance Subsystem DMS Document Management System DMZ Demilitarized zone DRP Disaster recovery plan DS Digital signature DWDM Wavelength division (WDM) technology EA ECP Executive administration Energy Consumption Planning Subsystem EFCC Energy Facility Condition and Configuration Subsystem EFDS Energy Facility Diagnostics System ERP Enterprise resource planning FOCL; FO communication lines FS Feasibility study FTE Full-time equivalent GIS Geographic information system GPS Guaranteed Power Supply IEC International Electrotechnical Commission IS Information system PwC 75 ISMS Information Security Management System IT Information Technology IT Process ITD a tool to organize a system of effective management and measurement of IT Innovation and technology development ITIL Library, describing best practices to organise the operations of units or companies engaged in the provision of information technology services ITS Information and telecommunications system MES Intersystem Electric Networks MIS Management Information System MPLS Multiprotocol Label Switching MRS Management reporting system NDC SO the National Dispatch Centre of the System Operator NPG National Power Grid OIS Operational Information System OLA Operational-level agreement PBX Private branch exchange PLC channels PLC channels RRC Radio Relay Communication SCADA / EMS Supervisory Control and Data Acquisition Service Desk Service Desk SLA SSU Service-level agreement Separate structural units SW Software SW pckg Software package SWOT analysis Identification of weaknesses and strengths in IT architecture, organization; analysis of threats and identification of opportunities in the internal and external environment; TES Territorial electricity networks TITMO Telecommunications and Information Technology Management Office UPS Unified Power System VPN Virtual private networks PwC 76 Appendix No. 2: Interrelation of IT Objectives with the Company's Strategic Goals IT initiatives Strategic tasks Strategic goals Map of ITS Development Strategy goals Reliable operation of the Kazakhstan National Power Grid in accordance with the state needs Quality performance of its functions by the System Operator Deployment of information security management system Introduction of business continuity assurance process in case of emergency situations Improvement of the efficiency of administration activity Enhancement of efficiency of operational activity Upgrade of ADCS (SCADA/EMS) Improvement of cyber security level Categories of IT Initiatives: PwC Enhancement of the efficiency of the Company's operations Increase in the shareholder value of the Company Innovations development and introduction CMS Upgrading Optimization of ITS Management Model Improvement of the customer servicing level Introduction of CSAI and BI system Development of Data Centre (DC) Enhancement of IT Management Function; Net profit growth Improvement of the data transmission rate and quality in CDN Introduction of Document Management System in KEGOC Branches and its Integration with the DMS of the Executive Administration Promotion of corporate governance and sustainability Maintenance of shareholders rights and development of stakeholder relationships Professional development of personnel RMS Automation Refinement of IT Services and Maturity Level of IT Processes Improvement of automatic control in business processes Enhancement of personnel loyalty Automation of personnel training process Development and extension of EMS features Achievement of stable partnership relationships with the utility companies of neighbouring countries. Maintenance of occupational safety Development of automated BSC Optimization of the licensing and software update process Enhancement of ITS infrastructure Maintenance of parallel operation with power systems of neighbouring states Automation of technical control and occupational safety Automation of electricity losses calculation Improvement and enhancement of the efficiency of the electricity market in Kazakhstan Automation of the Project Management Process Automation of the electricity and capacity balance forecasting process Improvement of IS maturity 77 GPS upgrading Appendix No. 3: Portfolio of IT Strategic Projects with regard to their Classification No. Strategic IT initiatives Optimization of IT management model IT projects Description of IT projects Updating of regulations and job description for TITMO's personnel Updating of regulations and job description for TITMO's personnel according to the goal of the IT management model (reorganisation of TITMO into TITMD) 1 Establishment of Coordination Council Business continuity assurance in case of emergency situations 2 Refinement of IT Services and Maturity Level of IT Processes Development of IT BCP policy within the Executive administration and then in MES in stages Implementation of IT BCP policy within the Executive administration and then in MES in stages Introduction of IT processes in the Executive administration IT process re-engineering in branches using the policies and procedures of the Executive administration Improvement of IT process maturity level in the Company 3 4 ITS Optimization of the licensing and software update process Upgrade of ADCS (SCADA/EMS) 5 Elaboration of policies and procedures for software assets management Automation of inventory process and accounting of software assets management Analysis of business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of system System introduction External quality control 6 7 PwC Upgrade of commercial metering system Upgrading of telecommunication equipment, data collection and transfer unit, meters, server equipment and software. Introduction of document management system in KEGOC branches and its integration with the DMS of the Executive Definition of processes and documents for flow and document management in the system, definition of functional and technical requirements for DMS, and elaboration of Feasibility study Approval of the regulations Coordination Council Customer on Muktar O. Bekenov Managing Director – Branches and Affiliates Serik I. Anessov Development of IT BCP policy within the Executive administration and then in MES in stages IT training and process design in the Executive administration Development of policies and procedures for IT processes in the Company IT process re-engineering in branches Sponsor of IT project TITMO ITS Implementation of IT BCP policy within the Executive administration and then in MES in stages Responsible person on behalf of TITMO/EnergoInform JSC Serik I. Anessov Serik I. Anessov/ Nurlan B. Kundakbayev Start Date End Date Duration of IT initiative Phase I: 1QTR2014 Phase II: 1QTR2018 Phase I: 2QTR2014 Phase II: 2QTR2018 3 months 2QTR2014 3QTR2014 6 months High High Muktar O. Bekenov, Managing Director – Branches and Affiliates TITMO High High Serik I. Anessov/ Nurlan B. Kundakbayev Muktar O. Bekenov, Managing Director – Branches and Affiliates TITMO High 1QTR2014 4QTR2018 60 months Further improvement of IT process maturity level up to '4' level within the Company Analysis of dispatching business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of automated dispatch control system (ADCS); Implementation of SCADA/EMS upgrading initiative Strategic initiative implementation quality control with the involvement of third party Upgrading of telecommunication equipment, data collection and transfer unit, meters, server equipment and software. Analysis of flow and document management processes, definition of functional and technical requirements, and elaboration of Feasibility study for improvement High High Elaboration of policies and procedures for software assets management Automation of inventory process and accounting of software assets management Priority Serik I. Anessov/ Nurlan B. Kundakbayev EnergoInfo rm JSC Serik I. Anessov/ Sergey A. Prikhodko National Dispatch Centre of the System Operator (NDC SO) Muktar O. Bekenov, Managing Director – Branches and Affiliates Askarbek D. Kuanyshbayev, Managing Director – NPG Development and System Services 3QTR2014 4QTR2014 6 months High High 1QTR2015 4QTR2018 48 months High High High Relay Protection and Automation Departmen t (RPAD) Documenta tion Manageme nt and Control Office Serik I. Anessov/ Sergey A. Prikhodko Kulyai B. Kezekeneva, Head of Office Abat A. Akmurzin, Deputy Chairman of Management Board for Operations Kairat T. Zhakipbayev, Managing Director – Legal Support and Security 78 1QTR2014 3QTR2015 21 months High 1QTR2014 1QTR2015 12 months High No. Strategic IT initiatives Administration IT projects Description of IT projects Coping Coping of available DMS in the Company's branches Integration with ERP Strategic initiative implementation quality control with the involvement of third party Analysis of personnel training business process, definition of functional and technical requirements for information system for automation of this process Selection of information system for deployment Development of media textbooks for distance training Analysis of functional and technical requirements Purchase and installation of equipment for training centre Integration with ERP External quality control Automation personnel process of training Analysis of business processes, definition of functional and technical requirements Selection of system 8 Development of media textbooks Analysis of requirements for training centre infrastructure Purchase and installation of equipment 9 Customer Development of Automated Balanced Scorecard System Integration of BSC Implementation of BSC automation initiative Introduction of a corporate Data Warehouse (DWH) and Business Intelligence system. Analysis of business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of system Fundamental analysis of dispatching business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of BI information system for introduction Introduction of instruments for data migration from transactional database to DWH. Introduction of Corporate Data Warehouse Selection of DWH information system for introduction DWH introduction project implementation Strategic situation room initiative implementation quality control with the involvement of third party Analysis of technical control and occupational health business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of automated technical control and occupational health system Implementation of technical control and occupational health automation initiative Strategic initiative implementation quality control with the involvement of third party Analysis of risk management system business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of risk management system information system for introduction Implementation of RMS automation initiative Strategic initiative implementation quality control with the involvement of third party Introduction of ETL instruments 10 Introduction of DWH Selection of system System introduction External quality control Automation of technical control and occupational health 11 Analysis of business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of system System introduction External quality control Automation of the Risk Management System 12 Analysis of business processes, definition of functional and technical requirements, and elaboration of Feasibility study Selection of system System introduction External quality control Development extension of features and ERP Definition of functional technical requirements and Analysis of requirements functional and technical 13 System introduction PwC Implementation of ERP features development and extension initiative Responsible person on behalf of TITMO/EnergoInform JSC Khanat A. Aimenov Human Resources Departmen t Sponsor of IT project Start Date Duration of IT initiative Priority Aibek T. Botabekov, Managing Director Economics High 1QTR2015 Nurlan Ye. Duysenov EnergoInfo rm JSC Corporate Developme nt Departmen t End Date 2QTR2016 18 months Muktar O. Bekenov, Managing Director – Branches and Affiliates Serik I. Anessov, Head of Telecommunications and Information Technology Management Office Zhanabai M. Beksary Deputy, Chairman of Management Board – Corporate Governance Yerbossyn K. Akhmetov, Head of Corporate Development Department Aibek T. Botabekov, Deputy Chairman of the Management Board Corporate Governance Medium High 1QTR2018 2QTR2018 6 months High Corporate Developme nt Departmen t 1QTR2015 Serik I. Anessov/ Nurlan B. Kundakbayev Technical control and occupation al health service 4QTR2018 48 months Bolat Zh. Temirbekov, Managing Director – Technical Supervision and Supply Low High 1QTR2015 3QTR2015 9 months High High High Serik I. Anessov Corporate Developme nt Departmen t Zhanabai M. Beksary, Deputy Chairman of Management Board – Corporate Governance High 1QTR2018 2QTR2018 6 months High High High Treasury Departmen t Serik I. Anessov/ Nurlan B. Kundakbayev Aibek T. Botabekov, Managing Director Economics High 2QTR2014 Treasury Departmen t 2QTR2014 3 months High 79 No. Strategic IT initiatives 14 Automation of the loss calculation process 15 Automation of the electricity and capacity balance forecasting process 16 Automation of the Project Management Process Improvement of the data transmission rate and quality in CDN 17 IT projects Deployment of information security management system and Definition of functional technical requirements and System development introduction and Implementation of electricity and capacity balance forecasting process automation initiative Development of project management methodology Development of project management process destination model in accordance with the best practices Analysis of functional and technical requirements Implementation of project management automation initiative Definition of functional technical requirements System development introduction and and Preparation of Feasibility study of communication Analysis of business processes, definition of functional and technical requirements, and elaboration of Feasibility study Fundamental analysis of all the Company's business processes for cyber security Elaboration of functional and technical requirements for cyber security Development of goal state for cyber security process Selection of systems for cyber security Achievement of goal state for cyber security process Definition of the Company's information security management system frameworks Definition of the information security management system frameworks through elaboration of information security management system applicability in the Company Inventory of assets selected by MES Analysis and assessment of risks with regard to inventoried assets Definition and implementation of information security measures Coping of information security management system pilots External quality control PwC Pre-project analysis and analysis of communication channels upgrading expediency Development of comprehensive communication channels upgrading plan Communication channels upgrading according to the comprehensive plan Cyber security goal state development and achievement quality control Introduction of information security management system measures Formalisation and updating of information security processes Development of Data Centre (DC) Analysis of electricity balance forecast business process, compilation of business requirements for the system features External quality control Personnel training 20 NPG Developme nt Departmen t System development introduction Inventory of assets Analysis and assessment of risks 19 Analysis of loss calculation business process, compilation of business requirements for the system features Implementation of loss calculation process automation initiative and Selection of system Achievement of goal state for cyber security process 18 Customer Definition of functional technical requirements Assembly channels Improvement of cyber security process Description of IT projects Definition of functional and technical requirements, and elaboration of Feasibility study Development of comprehensive personnel interaction plan Development and/or updating of the existing information security processes and coping of processes in MES Training for business process owners, IT personnel on application of information security management system Coping of information security management system in the rest MES Information security management system deployment quality control with the involvement of third party Definition and analysis of functional and technical requirements, and elaboration of Feasibility study Development of comprehensive personnel interaction plan during establishment and after introduction of the Data Centre NPG Developme nt Departmen t TITMO TITMO TITMO Responsible person on behalf of TITMO/EnergoInform JSC Serik I. Anessov/ Sergey A. Prikhodko Serik I. Anessov/ Sergey A. Prikhodko Serik I. Anessov/ Nurlan B. Kundakbayev Serik I. Anessov/ Sergey A. Prikhodko Sponsor of IT project Askarbek D. Kuanyshbayev, Managing Director – NPG Development and System Services Askarbek D. Kuanyshbayev, Managing Director – NPG Development and System Services Aibek T. Botabekov, Managing Director Economics Serik I. Anessov/ Nurlan B. Kundakbayev Priority 4QTR2015 3QTR2016 12 months High 1QTR2015 1QTR2015 6 months High 1QTR2016 4QTR2016 12 months Medium 1QTR2014 4QTR2018 60 months High 1QTR2016 4QTR2017 24 months Medium 1QTR2014 4QTR2016 36 months Medium 3QTR2014 1QTR2015 9 months Medium Kairat T. Zhakipbayev, Managing Director – Legal Support and Security Security Service TITMO Duration of IT initiative Kairat T. Zhakipbayev, Managing Director – Legal Support and Security Security Service Head of Security Service End Date Muktar O. Bekenov, Managing Director – Branches and Affiliates Serik I. Anessov/ Sergey A. Prikhodko Head of Security Service Start Date Muktar O. Bekenov, Managing Director – Branches and Affiliates 80 No. Strategic IT initiatives IT projects Description of IT projects Inventory of equipment /applications Comprehensive plan for equipment transfer (equipment sequence, backup storage processes during transportation, commissioning and testing schedule) Establishment of Data Centre Inventory of operating equipment to define plans for equipment purchase and migration Development of comprehensive plan for equipment migration to the Data Centre External quality control 21 PwC GPS upgrading Survey of the existing state of the Company's GPS network Development of design and estimate documentation Definition of financing source and scheme Tendering under selection of contractors Performance of construction and erection works Commissioning of the facilities Customer Responsible person on behalf of TITMO/EnergoInform JSC Sponsor of IT project Start Date End Date Duration of IT initiative Priority TITMO Serik I. Anessov/ Nurlan B. Kundakbayev Muktar O. Bekenov, Managing Director – Branches and Affiliates Phase I 1QRT2014; Phase II 1QRT2016 Phase I 3QRT2014; Phase II 1QRT2017 Phase I - 6 months; Phase II 12 months High Implementation of Data Centre establishment initiative Strategic initiative implementation quality control with the involvement of third party Survey of the existing state of the Company's GPS network Development of design and estimate documentation Definition of financing source and scheme Tendering under selection of contractors Performance of construction and erection works Commissioning of the facilities 81