We already have the auditing and the inviting and the quarantine pieces in place. It's just the classification part we don't have, and that's very difficult and will take time.
Going back to BYOD, you say you give out three types of devices. Do users have a say in what they get?
We learned that lesson the hard way. At the end of 2008 we were about to launch our first commercial field force to sell our drug, so we decided to buy the entire field force the same laptop, and while we were at it, we decided to buy everyone else the same laptop. This is like IT 101. Put everybody on the same laptop and three years later upgrade them all.
So we did that. We went out and bought everyone the same laptop and it didn't matter what you did or whether you needed something with more power or less power. We just bought you the same laptop. Most people were just doing Word all day. It doesn't matter.
And then three years later it's time to replace all the laptops and we did that, but by now we're really moving the company towards the cloud and BYOD, so everyone is bringing in their own stuff, but they still have to use the crappy laptop we gave them. So people end up with two laptops on their desks.
That's when we stopped and said, "So, are we really going to do this, or are we going to continue screwing around?" So it was determined then and there we were never going to do this PC upgrade thing again.
So now it's a matter of going to every person in the company and saying, "What do you need to be better?" The biggest return is simply asking that question. "Oh, you need a Gantt charting system? How about Smartsheet? Test it out. Oh, you found this product that you really like and you want to put it in permanently? Let's look at it. We'll talk to the vendor and, if they're good, they check out, you can have them."
I hear people talking about shadow IT and my sense is if there is shadow IT in your company then your CIO really screwed up. Because if you let people talk openly about what they need to make their departments better and you actually listen to them, you'll never have it happen to you.
Do you give people a stipend for the stuff or do they buy it?
We just buy it for them.
So they specify what they want?
If they want a Windows PC, I have an opinion. If I'm going to buy you a PC, I'm going to go look at the best in the market and help you make the decision. But if you want a Mac, it's one of two. If you want a Chromebook, then Samsung or Acer, take your pick. We don't really care because they're the same price. And for phones, it is Android or iPhone.
Sign up for CIO Asia eNewsletters.