Network Strategy, Governance, Ethics, and Sustainability

Introduction

Advanced computer networks are no longer merely technical infrastructures for moving packets. They are strategic capabilities that support digital products, analytics platforms, artificial intelligence, cloud services, industrial operations, public services, and organisational resilience. Decisions about network architecture therefore create long-term commitments involving capital expenditure, operating models, suppliers, legal obligations, environmental effects, and social consequences.

A technically elegant network may still be a poor organisational investment if it creates excessive vendor dependence, violates data-residency requirements, consumes disproportionate energy, or cannot produce reliable audit evidence. Conversely, a modest architecture may be strategically superior when it is interoperable, governable, secure, observable, and aligned with business priorities.

Network strategy connects organisational purpose with technical choices. Governance establishes who may make those choices, according to which principles, with what evidence and accountability. Ethics examines whether network-enabled practices respect human rights, fairness, autonomy, and legitimate expectations. Sustainability extends evaluation beyond immediate performance to energy use, carbon emissions, equipment life, circularity, and social impact.

Learning Objectives

By the end of this chapter, students should be able to:

1. Evaluate network architecture investments using financial, operational, risk, and strategic criteria.
2. Compare sourcing and operating models, including internal delivery, outsourcing, managed services, and cloud networking.
3. Design meaningful service-level agreements and distinguish availability from broader service quality.
4. Analyse compliance, privacy, data sovereignty, and auditability requirements.
5. Evaluate ethical issues in monitoring, inspection, automation, and algorithmic network management.
6. Assess vendor and supply-chain risk using structured due diligence.
7. Apply standards and governance frameworks without treating certification as a substitute for control effectiveness.
8. Integrate energy efficiency and sustainability into network architecture and digital transformation roadmaps.

1. Network Strategy as an Investment Discipline

A network strategy should begin with organisational outcomes rather than fashionable technologies. Relevant outcomes may include reliable customer access, safe operation of critical infrastructure, rapid deployment of digital services, lower transaction costs, regulatory compliance, or improved analytical capability.

A useful strategic assessment considers six dimensions:

1.1 Total cost of ownership

Initial purchase price is only one component of network economics. Total cost of ownership (TCO) normally includes acquisition, installation, licences, facilities, energy, staffing, support, upgrades, security controls, training, migration, downtime, and eventual disposal.

Here, C_a is acquisition cost, C_i installation and migration cost, C_l licensing cost, C_o ongoing operations cost, C_s security and compliance cost, C_m major maintenance or upgrade cost, and C_d decommissioning cost. All terms must be expressed in the same currency and evaluation period. The formula is a planning model, not an accounting standard; organisations should define whether labour, financing, taxes, and opportunity costs are included.

For competing investments, discounted cash-flow analysis may be appropriate because a cost or benefit received later is generally not economically equivalent to one received today. Net present value is represented by:

B_t is benefit in period t, C_t is cost in that period, r is the discount rate per period, and n is the evaluation horizon. Cash flows must be measured consistently, such as annual nominal values with a nominal discount rate. NPV does not capture every strategic effect: resilience, legal exposure, employee trust, and architectural flexibility may require additional qualitative or scenario analysis.

Worked example: comparing two network options

An organisation compares Option A and Option B over three years. Option A costs £400,000 initially and £150,000 per year to operate. Option B costs £650,000 initially and £80,000 per year to operate. Ignoring discounting, the three-year TCOs are:

• Option A: £400,000 + 3 × £150,000 = £850,000.
• Option B: £650,000 + 3 × £80,000 = £890,000.

Option A is cheaper by £40,000 on direct cost. However, suppose Option B is expected to reduce outage-related losses by £100,000 per year. Its net three-year economic advantage over Option A becomes approximately £260,000 before discounting: £300,000 avoided loss minus £40,000 additional TCO. This does not automatically justify Option B; assumptions about avoided loss, implementation risk, resilience, and service criticality must be tested. A sensitivity analysis should examine optimistic, expected, and pessimistic demand and failure scenarios.

1.2 Real options and architectural flexibility

Some network investments have option value. An open API, standards-based routing design, portable identity system, or modular edge platform may cost more initially but reduce future switching costs. Flexibility is particularly valuable when technology or regulation is uncertain. Decision-makers should therefore ask not only “What is the lowest current cost?” but also “What future choices does this architecture preserve or eliminate?”

2. Architecture Choices and Strategic Trade-offs

Centralisation, decentralisation, and edge computing

Centralised architectures can simplify control, procurement, observability, and policy enforcement. They may, however, increase latency, create concentration risk, and make a wide-area failure more consequential. Distributed and edge architectures can reduce latency and localise processing, but they increase operational complexity, physical exposure, configuration variance, and the number of systems requiring patching.

The correct choice depends on workload characteristics. Industrial control, autonomous systems, and interactive applications may require local processing. Large-scale analytics may benefit from centralised data platforms. Hybrid models frequently provide the best balance, provided that identity, policy, logging, and lifecycle management remain coherent across locations.

Internet, private, and software-defined networks

Public Internet connectivity provides reach and often low entry cost, but performance and route control may be variable. Private networks can offer greater predictability and contractual assurance, usually at greater cost. Software-defined networking and network-function virtualisation can improve programmability and resource utilisation, while introducing dependence on controllers, orchestration platforms, APIs, and software supply chains.

A strategic architecture should identify control-plane dependencies, management-plane isolation, failure domains, and recovery paths. “Cloud” does not remove networking responsibility: customers still govern identity, segmentation, configuration, encryption, logging, and provider dependency.

3. Sourcing and Operating Models

Organisations may operate networks internally, outsource selected activities, use a managed service provider, purchase connectivity as a service, or combine several models. Sourcing decisions should be based on capability, risk, economics, and strategic importance rather than on the assumption that outsourcing automatically reduces cost.

A sourcing decision should address retained responsibilities, service boundaries, data access, subcontractors, incident cooperation, audit rights, portability, exit assistance, and the provider’s financial and technical viability.

Vendor concentration and lock-in

Concentration risk occurs when a single provider, technology family, geographic region, or undersea route supports too much critical capability. Multi-sourcing is not automatically resilient: two providers may depend on the same upstream carrier, software library, cloud region, or hardware manufacturer. Dependency mapping should extend beyond direct contracts to important fourth parties.

Exit planning is an engineering requirement. It should specify data formats, configuration export, identity portability, replacement connectivity, transition time, cost assumptions, and the conditions under which a provider must support migration. A contract that permits termination but makes migration technically impossible does not provide meaningful portability.

4. Service-Level Agreements and Assurance

A service-level agreement (SLA) translates service expectations into measurable obligations, responsibilities, remedies, and evidence requirements. It should define the service boundary precisely. “Network availability” is meaningless unless the measurement point, protocol, test frequency, maintenance exclusions, and dependency assumptions are stated.

Availability is often calculated as:

T_total is the agreed measurement period and T_unavailable is qualifying unavailable time. Both durations must use the same units. Planned maintenance may be excluded only if the SLA defines notice, duration, and maximum frequency. A 99.9% annual availability target permits approximately 8.76 hours of unavailability in a 365-day year, because 0.1% × 8,760 hours = 8.76 hours.

Availability alone is insufficient. A mature SLA may include latency, jitter, packet loss, throughput, restoration time, incident-response time, change success rate, security-notification time, backup recovery objectives, and reporting quality.

Two related continuity metrics are recovery time objective (RTO), the maximum acceptable time to restore a service, and recovery point objective (RPO), the maximum acceptable amount of data or state that may be lost measured in time. They are requirements, not predictions. A provider may meet an RTO only if dependencies, staffing, access, and recovery procedures have been tested.

SLAs should also specify:

• measurement ownership and independent verification;
• sampling methods and aggregation intervals;
• severity definitions and escalation paths;
• service credits or other remedies;
• security and privacy incident obligations;
• force majeure and dependency treatment;
• continual-improvement and review mechanisms.

Service credits may compensate customers but do not necessarily compensate business impact. Critical services may require stronger remedies, audit rights, redundant design, or termination rights rather than relying on credits.

5. Governance, Standards, and Auditability

Governance is the system by which authority, accountability, decision rights, and oversight are established. Management performs activities; governance evaluates direction, prioritisation, risk, and performance. Effective network governance normally includes an architecture authority, risk ownership, change control, asset ownership, supplier management, and independent assurance.

A practical governance structure contains:

1. Principles: for example, least privilege, secure-by-design, interoperability, resilience, and data minimisation.
2. Policies: mandatory organisational rules.
3. Standards: approved technical patterns and minimum configurations.
4. Procedures: repeatable operational activities.
5. Evidence: records demonstrating that controls operated effectively.
6. Review: testing, metrics, exceptions, remediation, and accountability.

Widely used references include ISO/IEC 27001 for information-security management systems, ISO/IEC 27002 for security controls, ISO/IEC 27701 for privacy-information management, ISO 22301 for business continuity, NIST Cybersecurity Framework 2.0, NIST SP 800-53, COBIT, and sector-specific requirements. These frameworks are complementary rather than interchangeable. A framework should be selected according to the organisation’s risks, jurisdiction, contractual environment, and assurance needs.

Certification can demonstrate that a management system has been assessed against a defined standard, but it does not prove that every service is secure or that every risk has been eliminated. Auditability requires traceable evidence: approved designs, asset inventories, configuration baselines, access records, change tickets, test results, incident records, supplier attestations, and exception approvals. Logs should be time-synchronised, protected from unauthorised alteration, retained according to purpose and law, and subject to access controls.

A control is stronger when its owner, objective, frequency, evidence, test method, and failure response are explicit. Evidence collection should be designed into operations rather than assembled hurriedly before an audit.

6. Privacy, Data Sovereignty, and Compliance

Network decisions affect personal data even when the network is not the primary data-processing system. Source addresses, device identifiers, location information, traffic metadata, authentication records, and behavioural patterns may be personal data under applicable law. Deep packet inspection and persistent monitoring can reveal sensitive information and create surveillance risks.

Privacy governance should address:

• purpose limitation and lawful basis;
• data minimisation and retention limits;
• transparency and user rights;
• access, correction, deletion, and objection processes where applicable;
• encryption in transit and at rest;
• role-based access and privileged-use monitoring;
• breach detection and notification;
• processor and subprocessor controls;
• privacy impact assessment for high-risk processing.

Data sovereignty has at least three distinct meanings: the jurisdiction in which data is stored, the jurisdiction in which it is processed or accessed, and the legal authority that may compel access. A data centre located in one country does not by itself resolve all cross-border legal exposure. Data-flow mapping should identify collection, transit, storage, backup, support access, telemetry, and deletion locations.

Compliance is context-dependent. Financial, health, education, telecommunications, government, and critical-infrastructure sectors may impose different retention, localisation, security, and reporting obligations. Legal interpretation should be obtained from qualified professionals; technical teams should translate those interpretations into enforceable architectures and operating controls.

7. Ethics of Network Monitoring and Automation

Monitoring supports reliability, security, capacity planning, and incident response. It can also become disproportionate surveillance. Ethical monitoring requires a legitimate purpose, necessity, proportionality, transparency, access limitation, retention discipline, and independent oversight.

Important questions include:

• Are users informed about what is collected and why?
• Is content inspection necessary, or would metadata suffice?
• Are employees or customers subjected to materially different monitoring without justification?
• Could automated classifications produce discriminatory outcomes?
• Can a person challenge an automated decision?
• Are emergency powers narrowly defined and reviewed afterward?

Network analytics and artificial intelligence introduce additional concerns. A model may infer sensitive attributes from traffic patterns, incorrectly label benign behaviour as malicious, or amplify historical bias in incident prioritisation. Human analysts should understand model limitations, confidence levels, training-data provenance, and escalation rules. High-impact actions such as account suspension or isolation should generally have human review, except where immediate automated containment is necessary and subsequently audited.

Ethical practice is not equivalent to avoiding all monitoring. It means aligning monitoring with legitimate objectives while protecting autonomy, confidentiality, dignity, and due process.

8. Vendor and Supply-Chain Risk

Network infrastructure depends on hardware manufacturers, firmware, software libraries, cloud providers, carriers, integrators, maintenance contractors, and data-centre operators. Risk assessment should examine:

• ownership, financial stability, and geopolitical exposure;
• secure development and vulnerability-disclosure practices;
• software bills of materials and component provenance;
• patch support and end-of-life policy;
• privileged-access arrangements;
• subcontractors and fourth parties;
• manufacturing integrity and counterfeit risk;
• incident history and notification capability;
• resilience of logistics and replacement supply;
• contractual audit, liability, and exit provisions.

A risk register should record the threat, affected asset, likelihood, impact, existing controls, risk owner, treatment, and review date. Qualitative scales are useful for governance but should not create false precision. Where credible frequency and loss estimates exist, expected annual loss can be represented as:

p_i is the probability of scenario i during the chosen period, L_i is its monetary loss, and k is the number of scenarios. The calculation assumes scenarios and estimates are defined consistently; correlated events and intangible harms may make simple addition inappropriate. It should support—not replace—expert judgement and scenario testing.

9. Sustainability and Energy-Efficient Networking

Sustainable networking considers the full lifecycle of equipment and services. Relevant impacts include operational electricity, embodied carbon from manufacture, refrigerants and facility energy, transport, repairability, e-waste, and labour conditions in supply chains.

A common data-centre efficiency metric is power usage effectiveness (PUE):

Both quantities must refer to the same boundary and period, usually measured in kilowatt-hours. A PUE of 1.4 means that for every 1 kWh consumed by IT equipment, the facility as a whole consumed 1.4 kWh. PUE does not measure total sustainability, renewable-energy quality, embodied carbon, or the usefulness of computing work; reducing IT energy while reducing service quality is not automatically an improvement.

Network sustainability practices include right-sizing links, using sleep or low-power modes where service requirements permit, consolidating underutilised equipment, improving cooling, extending equipment life through support and repair, purchasing efficient hardware, selecting renewable electricity with credible accounting, and designing for reuse and recycling. Traffic engineering can reduce unnecessary transport and processing, but efficiency gains may be offset by rebound effects if lower cost stimulates substantially higher demand.

Environmental decisions should be balanced against resilience and security. Disabling redundancy may reduce energy use but create unacceptable outage risk. Lifecycle assessment should therefore compare alternatives across service performance, reliability, emissions, and social impact.

10. Digital Transformation Roadmaps

A digital transformation roadmap converts strategic intent into sequenced capabilities. It should not be a list of products. A useful roadmap has a baseline, target architecture, transition states, dependencies, investment gates, measurable outcomes, and a mechanism for revising assumptions.

A five-stage pattern is often effective:

1. Discover: inventory assets, data flows, contracts, technical debt, risks, and stakeholder needs.
2. Stabilise: remove unsupported systems, improve identity, logging, backup, segmentation, and incident response.
3. Standardise: establish reference architectures, automation, configuration management, and common service metrics.
4. Transform: introduce cloud, edge, zero-trust principles, programmable networking, and data-driven operations where justified.
5. Optimise: measure outcomes, reduce waste, improve resilience, and retire obsolete capabilities.

Each initiative should have a measurable hypothesis. For example: “Automated configuration validation will reduce failed changes by 30% within two quarters without increasing restoration time.” Baseline data, measurement method, owner, and review date are required. Transformation should proceed through controlled pilots and architectural guardrails rather than an irreversible “big bang.”

Applied Case: Regional Health Network Modernisation

Background

This illustrative case concerns a regional healthcare provider with 18 hospitals and 120 outpatient clinics. Its network contains ageing private circuits, inconsistent wireless security, multiple monitoring platforms, and a central data centre. Clinical applications require high availability, while patient data is subject to strict confidentiality and jurisdictional controls.

Problem

The provider proposes a rapid move to a cloud-managed wide-area network. The business case predicts lower connectivity costs and faster deployment. However, clinicians are concerned about outages, the privacy office is concerned about telemetry leaving the jurisdiction, and the security team is concerned about concentration in one supplier.

Analysis

The programme team maps clinical, administrative, diagnostic, and guest traffic separately. It identifies critical dependencies, recovery requirements, supplier concentration, cross-border support access, and the energy profile of the existing data centre. TCO analysis includes migration, licences, circuits, staff training, dual running, incident response, and exit costs rather than only monthly subscription fees.

The team defines service objectives by application class. Emergency clinical systems receive stricter latency, restoration, and change-control requirements than guest Internet access. Privacy assessment shows that detailed flow telemetry is personal data in some contexts. The proposed contract lacks sufficient audit rights, subcontractor transparency, and configuration portability.

Approach and solution

The provider adopts a hybrid, multi-carrier architecture with diverse physical routes for major sites. Local survivability is retained for essential clinical functions. The cloud-managed platform is approved only after regional processing controls, encryption, role separation, independent logging, incident cooperation, and an exit test are included in the contract. A pilot is conducted in three clinics, with clinicians included in service acceptance testing.

Governance establishes a clinical-risk owner, a network architecture board, a privacy review, and quarterly supplier assurance. Monitoring is minimised to the data required for security and performance. Energy targets include retiring inefficient equipment, extending usable hardware life where secure, and measuring facility and network energy rather than relying solely on vendor claims.

Outcome

The programme reduces routine provisioning time and improves visibility without placing all clinical operation on a single provider. Its direct financial savings are lower than the original proposal because dual-carrier connectivity, privacy controls, and exit preparation are funded explicitly. Nevertheless, the resulting architecture has stronger resilience, clearer accountability, and lower strategic risk.

Learning points

1. A lower subscription price is not equivalent to lower TCO.
2. Critical services require differentiated SLAs.
3. Data sovereignty includes support access and telemetry, not only storage location.
4. Portability and exit testing are architectural controls.
5. Ethical monitoring and clinical participation improve legitimacy and adoption.
6. Sustainability must be evaluated alongside, not against, resilience and safety.

Challenges and Limitations

Strategic network evaluation is difficult because benefits are often indirect and risks are uncertain. Reliability investments may prevent events that never occur, making their value difficult to demonstrate. Vendor claims may use different measurement boundaries. PUE, availability, risk scores, and service credits can be manipulated or misunderstood if definitions are weak. Multi-provider strategies may improve concentration risk while increasing integration failures. Open standards reduce lock-in but do not guarantee interoperability in practice. Finally, governance can become bureaucratic if approval processes are disconnected from material risk.

The remedy is not a single universal score. Organisations should combine quantitative analysis, architectural evidence, scenario exercises, independent assurance, stakeholder participation, and periodic review. Decisions should record assumptions and uncertainty so that they can be revisited when conditions change.

Best-Practice Principles

• Align network investment with explicit organisational outcomes.
• Evaluate lifecycle cost, risk, flexibility, and sustainability together.
• Define service boundaries and measurement methods before signing SLAs.
• Treat identity, logging, configuration, and evidence as core architecture.
• Map data flows and legal access, not merely data-centre locations.
• Use least-privilege, purpose-limited, transparent monitoring.
• Require supplier transparency, vulnerability support, portability, and exit assistance.
• Test resilience and recovery rather than relying on design claims.
• Use standards as structured guidance, not as substitutes for judgement.
• Include energy, embodied impact, repairability, and disposal in procurement.
• Deliver transformation incrementally with measurable hypotheses and accountable owners.

Chapter Summary

Network strategy evaluates infrastructure as a long-lived organisational capability. Sound decisions combine TCO, discounted investment analysis, resilience, flexibility, assurance, and sustainability. Sourcing choices must account for retained responsibilities, concentration, subcontractors, portability, and exit. SLAs require precise boundaries, measurable service attributes, evidence, remedies, and tested recovery objectives.

Governance translates principles into authority, policy, standards, controls, evidence, and review. Compliance and privacy require data-flow mapping, minimisation, lawful processing, secure access, retention discipline, and attention to jurisdictional exposure. Ethical network management balances legitimate monitoring with transparency, proportionality, autonomy, and human oversight of high-impact automation. Vendor risk extends across the supply chain, while sustainability requires lifecycle analysis rather than reliance on a single efficiency metric. Finally, digital transformation should progress through discovery, stabilisation, standardisation, transformation, and optimisation, with explicit assumptions and measurable outcomes.

Key Terms

Network strategy: A long-term plan aligning network capabilities with organisational objectives.

Total cost of ownership: The full lifecycle cost of acquiring, operating, securing, upgrading, and retiring an asset or service.

Net present value: The present value of future benefits minus the present value of future costs.

Service-level agreement: A contractual statement of measurable service expectations and remedies.

Availability: The proportion of an agreed period during which a service is usable according to defined criteria.

RTO: Recovery time objective; the maximum acceptable restoration time.

RPO: Recovery point objective; the maximum acceptable data-loss interval.

Governance: Direction, oversight, accountability, and decision rights applied to an organisation or capability.

Auditability: The ability to demonstrate control operation through reliable, traceable evidence.

Data sovereignty: The legal and jurisdictional conditions governing data storage, processing, access, and control.

Privacy by design: Integrating privacy protections into systems and processes from the beginning.

Purpose limitation: Collecting and using data only for specified legitimate purposes.

Vendor lock-in: Dependence that makes changing suppliers technically, economically, or legally difficult.

Concentration risk: Exposure created by excessive dependence on one provider, route, region, or technology.

Supply-chain risk: Risk arising from suppliers, components, subcontractors, and upstream dependencies.

PUE: Power usage effectiveness, the ratio of total facility energy to IT equipment energy.

Embodied carbon: Emissions associated with producing, transporting, and disposing of equipment.

Digital transformation roadmap: A sequenced plan for moving from current capabilities to a target operating and technology model.

Review Questions

Short Answer Questions

1. Why is acquisition price an inadequate measure of network investment value?
2. Define RTO and RPO and distinguish their purposes.
3. What information should an SLA specify about availability measurement?
4. Why does data sovereignty involve more than physical storage location?
5. State two ethical safeguards for network monitoring.

Long Answer Questions

1. Explain how TCO, NPV, resilience, and architectural flexibility should be combined when evaluating a network investment.
2. Compare internal operation, managed services, cloud networking, and multi-provider sourcing.
3. Discuss how governance frameworks, standards, and audit evidence interact in network assurance.
4. Analyse the privacy, legal, and ethical risks of deep packet inspection and behavioural network analytics.
5. Explain how sustainability can be integrated into network procurement and transformation without compromising resilience.

Analytical / Application Questions

1. An organisation can choose a low-cost single-provider WAN or a more expensive multi-provider design. Develop a decision framework that includes TCO, concentration risk, recovery requirements, privacy, and exit strategy.
2. Design an SLA for a critical clinical application. Specify availability, latency, incident response, RTO, RPO, measurement evidence, exclusions, and remedies.
3. Critically evaluate a proposal to deploy AI that automatically isolates users classified as anomalous. Identify technical, governance, privacy, ethical, and operational controls required before deployment.

Multiple Choice Questions with Answers

Question 1

Which item is most clearly part of total cost of ownership rather than merely acquisition cost?

A. Purchase price only

B. Decommissioning and disposal cost

C. Advertised throughput

D. Number of vendor employees

Correct Answer: B. Decommissioning and disposal cost

Question 2

An annual availability target of 99.9% permits approximately how much unavailability in a 365-day year?

A. 8.76 hours

B. 0.876 hours

C. 87.6 hours

D. 876 hours

Correct Answer: A. 8.76 hours

Question 3

What does an RPO primarily specify?

A. Maximum restoration time

B. Maximum acceptable data-loss interval

C. Maximum network latency

D. Maximum supplier response time

Correct Answer: B. Maximum acceptable data-loss interval

Question 4

Which statement best describes data sovereignty?

A. It concerns only the country where a server is physically located

B. It concerns jurisdiction over storage, processing, access, and control of data

C. It is equivalent to network availability

D. It eliminates the need for encryption

Correct Answer: B. It concerns jurisdiction over storage, processing, access, and control of data

Question 5

Which practice best supports ethical network monitoring?

A. Collecting all traffic indefinitely

B. Using monitoring only for legitimate, proportionate, and transparent purposes

C. Allowing unrestricted administrator access to logs

D. Making automated decisions unreviewable

Correct Answer: B. Using monitoring only for legitimate, proportionate, and transparent purposes

Question 6

A PUE of 1.4 means that:

A. IT equipment uses 1.4 times total facility energy

B. The facility uses 1.4 units of energy for each unit used by IT equipment

C. 40% of network packets are lost

D. The network is available 1.4% of the time

Correct Answer: B. The facility uses 1.4 units of energy for each unit used by IT equipment

Question 7

Which contractual feature most directly supports supplier portability?

A. A broad marketing commitment

B. Configuration export and exit assistance

C. A higher service-credit maximum only

D. A restriction on independent audits

Correct Answer: B. Configuration export and exit assistance

Question 8

Why is certification alone insufficient evidence of effective network security?

A. Certification never involves documented controls

B. Certification does not prove that every service is secure or every risk is eliminated

C. Certification prevents the use of standards

D. Certification applies only to physical cabling

Correct Answer: B. Certification does not prove that every service is secure or every risk is eliminated

Question 9

In the expected annual loss model, what does pᵢ represent?

A. The probability of scenario i in the chosen period

B. The physical distance of scenario i

C. The provider’s annual profit

D. The number of controls applied

Correct Answer: A. The probability of scenario i in the chosen period

Question 10

Which sequence best represents a staged digital transformation roadmap?

A. Transform, discover, retire, stabilise, audit

B. Discover, stabilise, standardise, transform, optimise

C. Procure, outsource, centralise, ignore, replace

D. Monitor, encrypt, advertise, certify, decentralise

Correct Answer: B. Discover, stabilise, standardise, transform, optimise