TA 12.MG02 M&G Data and Technology Business Case€¦ · As an enterprise shared service, IT indirectly supports our business across all of our performance commitments either through

1 TA 12.MG02 M&G Data & Information Technology – Business Case

TA 12.MG02 M&G Data and Technology

Business Case


Contents 1. Executive Summary ............................................................................ 5

2. Scope of Technical Annex .................................................................10

3. AMP6 Strategy ..................................................................................11

4. AMP6 Investment Strategy ................................................................12

Wholesale Technology Investment........................................................12

Retail Technology Investment ...............................................................13

Customer benefits and resilience ..........................................................13

Corporate resilience:..........................................................................13

Operational resilience: .......................................................................14

Customer Impact in AMP6 ....................................................................15

External Customers ...........................................................................15

Internal customer (Southern Water) ..................................................15

1. Drivers for Change.............................................................................16

Customer and Stakeholder Views .........................................................16

Internal customer (Southern Water) ..................................................16

Direct Customers ...............................................................................16

Future Trends and Pressures ................................................................17

AMP7 Strategy ..........................................................................................19

5. Investment Strategy ...........................................................................20

Business strategy and IT alignment ......................................................20

PR19 Technology technical annex - Prioritisation of IT investment ...21

AMP7 Wholesale Control Investment Summary ................................22

6. AMP7 Retail Control Investment Summary .......................................25

Wholesale and Retail Control Investment Breakdown...........................26

7. Innovation ..........................................................................................28

What is innovation? ...........................................................................29

Why do we innovate? ........................................................................29

How are proposing to innovate in IT ..................................................30

How are we proposing to deliver emerging technologies as business as usual? ...........................................................................................30

Supporting our five transformation programmes in AMP7 .................34

8. Summary of AMP7 Proposals ............................................................36

Wholesale Investment Proposal Summary ............................................36

Retail Investment Proposal Summary ...................................................36

9. Customer Benefits and Resilience .....................................................37


How is resilience in the round being supported by IT in AMP7? ........40

10. Value for Customers .......................................................................46

Customer Engagement .........................................................................47

Customer Support .............................................................................49

Effectiveness .....................................................................................49

Efficiency ...........................................................................................49

Accessibility .......................................................................................49

11. Plan Options ...................................................................................50

Medium & Long-Term proposals ...........................................................52

AMP8 Strategy ..................................................................................52

AMP9 Strategy ..................................................................................52

Use of Market Mechanism .....................................................................53

12. Costing Strategy .............................................................................53

Cost approach .......................................................................................54

Historical and Actual Cost Analysis ...................................................54

Asset cost models (Pioneer and Scheme Builder) .............................54

Bottom up cost-analysis .....................................................................54

Top-down cost analysis .....................................................................54

Industry benchmarking ......................................................................55

Options and priorities .........................................................................55

Stakeholder assurance ......................................................................55

Cost assurance .....................................................................................55

13. Deliverability of AMP7 proposals ....................................................56

Deliverability Approach ..........................................................................56

Customer Priority ...............................................................................56

Consider Industry Good Practice .......................................................56

Technology Assumptions and Dependencies ....................................56

Business Assumptions and Dependencies ........................................56

Proposed roadmap and plan .................................................................56

Delivering the plan .................................................................................57

New Business Value ..........................................................................58

Governance and operating model .....................................................59

New enterprise architecture ...............................................................59

New methods and tools .....................................................................60

New technology .................................................................................60

14. Deliverability assurance ............................................................... 61


15. Key Risks & Opportunities ..............................................................62

Key Risks ..............................................................................................62

Key Opportunities ..................................................................................70

Appendix 1: Projects and Schemes ..........................................................75

Appendix 2: Further Information ...............................................................76

Glossary ................................................................................................77

PR19 business strategy and IT alignment .............................................81


1. Executive Summary Name of technical annex

TA.12.MG02.M&G Data and Information Technology

Context The Technology technical annex in support of Southern Water Wholesale and Retail.

Customer and stakeholder views

Background Analysis To build our technical annex we have analysed the views gathered from a survey of our customers and have engaged with over 120 internal stakeholders across wholesale operations, retail and corporate functions. We have captured over 130 business needs across the organisation and through a rigorous process of review, challenge and prioritisation determined 18 work-packages. These work-packages are fully aligned to our customer and business needs. As part of our value case, we have analysed and identified multi-millions in cost benefits across our business which our proposed technology investment will enable being realised. Areas of business benefit include BIM, data reporting, asset management, supply chain to name a few. Without sustained investment in IT, our PR19 business plan will be unable to deliver the potential customer benefits, services and efficiency gains required across our business. How is IT Perceived? IT is pervasive within our company and having a stable and resilient IT is crucial to the operational success of the business, as well as being the key critical digital ‘shop-window’ for our customers. The need for IT to enable operational effectiveness and efficiency is a standard expectation of most companies and Southern Water is no different. In our business, we need to significantly invest in IT to simply run effectively and to underpin customer service excellence; cyber-threat prevention; data exploitation (e.g. DataWell); drive business innovation; and fundamentally support our business strategy which is focused on shifting how we operate to being “Brilliant at the Basics”.

Our aim

The AMP7 investment strategy for technology is therefore focussed on proving sustained improvements to stabilise and de-risk the current state of enterprise IT/OT and provide the underlying capabilities to enable the business as it transforms. As such, our aim has been to fully align our IT strategic objectives and work-packages to the OFWAT’s themes and our business objectives. Each work-package has been assessed for deliverability and a roadmap defined. In developing the AMP7 technology technical annex and to show ‘Line of Sight’ we have mapped all our activities from Southern Water’s Mission Statement, OFWAT and internal business objectives to the IT work-packages:


Wholesale Expenditure £m

Water resources 4.6

Water networks plus 91.8

Wastewater network plus 167.1

Bio resources 24.7

Net Wholesale Business Case 288.2

Central IT & Data services charged across all programmes 51.5

Additional efficiency applied 45.0

Gross Wholesale Business Case (pre-efficiency) 384.7

Retail Expenditure £m

Retail - Residential household 29.1

Scope of this technical annex

Our technology technical annex supports the enterprise investment required to fund the IT function across the wholesale and retail price controls: As shown above and in Table 8 the scope of this technical annex is the £384.7m totex investment required during AMP7 for IT, OT, data and telecoms for Wholesale with £29.1m for Retail. £51.5m of wholesale central IT services is charged across all programmes of work and is therefore funded via the other business cases. We also recognise the fast pace of technology development and as such have assumed further efficiencies can be derived over the course of AMP7. As such £45.0m of additional Capex procurement efficiencies have been applied at programme level. Accordingly the bottom up programme costs within this annex refer to £384.7m of wholesale funding.


Botex Enhancement Total

Totex (£’m) £288.2m - £288.2m1

Opex (£’m) £122.8m - £122.8m

Capex (£’m) £163.0m - £163.0m

Residual, post-AMP7 capex (£’m)

- - -

20-year Whole life totex

- - -

Materiality (% of the wholesale wastewater plan)

- - -

Relevant business plan table lines

WS1 (Lines 6,13) WWS1 (Lines 6, 13)

- WS1 (Lines 6,13) WWS1 (Lines 6, 13)

Botex

Overview of AMP7 proposals

Our AMP7 investment strategy for Wholesale and Retail is categorised across three key cases for investment: Legal obligations (DWI and EA): Investment that focuses on improving the state of critical operational technology instrumentation, networks, infrastructure, information life-cycle management and the resilience of our asset information systems. Core IT (Maintain IT): Investment that focuses on maintaining and upgrading the current state of technology from core IT, application / infrastructure transformation, information security to driving insights from data. Enable Business: Investment that focuses on delivering key business capabilities from capital works to commercial services. Capabilities that enable the business to transform the services being delivered to our customers, and are essential for the delivery of all five of our transformational programmes. Within these 3 cases for investment, there are 18 work-packages which define in more detail the overall areas of delivery which will be executed in AMP7.

Why the proposals are the best programme-level option for customers

In developing the plan for our AMP7 investment across the wholesale controls four spend profile options were considered. These options considered a range of investment along with the benefits and consequences of increasing or decreasing spending. We used four criteria to determine which of the investment options was most appropriate: - Customer priorities; The four themes laid out in OFWAT PR19 methodology; Our business objectives which consider customer outcomes and long-term goals; and Risk and deliverability. As a Shared Service cutting investments in IT/OT is complex as Enterprise Projects and Solutions are by their very nature cross-cutting across all areas of our business and materially impact the benefits companies can gain if only partially implemented. In gauging our investment we have traded-off

1 An additional £54.0m of wholesale investment is included in other wholesale business cases and a £45.0m

wholesale technology procurement target has been applied. See Table 8.


such risk against the need to deliver “Brilliant at the Basics” and customer value which require continued, sustained IT/OT investment to deliver and execute transformational change. The preferred Option 2 of £369m represented an investment approach that considered an optimal balance of risk, affordability and deliverability whilst maintaining full alignment with our business and customer objectives. Options 3 and 4 were deemed not acceptable when considered against the criteria as they were too high risk from a deliverability perspective, and more expensive to our customers’ affordability. Option 1 was deemed too high risk as it only allows IT to tactically “keep the lights on” without adequately de-risking the IT operation or allowing us to sufficiently undertake new investments to improve resilience/security; efficiency gains; operational technology; and / or enable our business to effectively support our customers. We recognise that our proposed option will increase our customers’ bills by circa £1 per year for the £100m additional spend for Option 2 over Option 1. For further information regarding the retail control options please refer to the chapter concerning retail cost controls.

What we would like to highlight

Key highlights include: Our investment in technology is increasing – in recognition that sustained technology investment is fundamental to enabling business efficiency, digital transformation, maintaining IT/OT resilience and underpinning customer excellence. This is not unique to Southern Water; Industry benchmarks all show a marked increase in IT investment due to the major and increasing reliance on technology. This increase in IT investment is also as a result of certain areas of business investment in technology (OT) being shifted into IT from our operation due to continued IT/OT convergence Cyber-Security is a major threat – leading to the need for significantly increased investment in information security with the backdrop of increasing physical and IT/OT cyber-threat and addressing compliance needs raised through the GDPR / NIS Directives Our business needs high quality, timely data to enable robust decision making – we are investing in real-time telemetry systems, networks, asset information life-cycle management (ILM) and the provision of predictive analytics to enable our operations to pro-actively monitor and manage issues and incidents before our customers are impacted. Further, we acknowledge our “prescribed” assurance status under OFWAT’s Company Monitoring Framework. This investment seeks to actively address this Systems-Thinking - we have critically reviewed our technology components and approach to promote enterprise platforms which consider the ‘whole’ i.e. end-to-end architectural landscape of IT/OT. Our proposed investment approach is capability focused, rather than just fixing problems in vertical silos. This approach will allow us to innovate internally whilst also considering wider external dynamics and strategies

Performance Commitments supported by this technical annex

As an enterprise shared service, IT indirectly supports our business across all of our performance commitments either through the provision of critical systems, infrastructure to driving insight with data. This is as technology is a key enabler for our business to perform their day to day activities and deliver customer outcomes.

Schemes and options

Options


Schemes over £20m

Description Cost Selected option and rationale

Each IT work-package is made up of several incremental initiatives/schemes. No individual IT initiative / scheme exceeds £20m.


2. Scope of Technical Annex The scope of our technology technical annex is the Totex AMP7 investment required for

information technology (IT), operational technology (OT), data and telecoms. This includes both

the capital and operating spend that will be required.

Our technology technical annex supports the investment required to fund the services need to

deliver environmental enhancements and customer across the following price controls: -

Water resources;

Water networks plus;

Wastewater network plus;

Bio resources;

Residential household;

In defining the scope of the PR19 technology technical annex, an adaptation of the ISA 95 and

ISA62443 international standards for the integration of enterprise and control systems was used.

This industry recognised standard was adapted, as illustrated in Figure 1, to understand what is in

and out-of-scope of the PR19 technology technical annex. Figure 1, also illustrates where IT, OT,

Data and Telecoms converge and the role that governance, cyber-security (NIS), resilience,

human machine interface, infrastructure to architecture play when integrating enterprise and

control systems.

Figure 1: Technology Investment Technical annex Scope

To address the growing convergence of managing information and operational technology the scope and definition of what is to be included in-scope of the PR19 technology investment case has become more holistic / system-thinking than in PR14. For example, edge of network technology and data integration costs to OT systems were previously not considered within the real time systems budget of IT for PR14. Redefining the scope of information technology in this way has provided the opportunity for the following:


1. A more transparent business plan by capturing the technology investment being proposed. 2. Greater clarity of the boundaries as to where investment in IT/OT and capital delivery technology

investment is made thereby eliminating the potential for unfunded gaps or duplicate spend2. 3. Centralised architecture, controls and spend to more effectively deliver enterprise shared

services across IT/OT/Data and Telecoms. Level 1 Intelligent Devices are budgeted outside of the PR19 technology business case, but will be covered by IT and cyber-security controls.

3. AMP6 Strategy Our PR14 business plan followed a risk-based approach that sought to deliver resilience at the best value to the customer. In the first three years of AMP6 (2015 to 2018), all five key areas in our PR14 plan (Corporate, Retail, Asset, Operations & Capital Delivery, Infrastructure, and Real-Time Systems) have seen the delivery of one or more of the proposed PR14 IT initiatives. The IT initiatives that were delivered have resulted in incremental improvements in our day to day operations, enabling our business to provide better services to our customers. Key outcomes have been: Improvements to the SAP customer relationship management system which enabled us to

offer innovative tariffs such as “WaterSure” and “Essentials” to low-income customers. Delivery of our retail e-services and developer services platforms making it easier and simpler

for our customers to do business with us online. Delivery of enhancements to our supplier relationship management system to improve the

quality of works/services provided to our customers. Delivery of the Market Reform project, a regulatory driven requirement, which introduced the

integration between the Market Operator Services Ltd (MOSL) and our business. Enhancements to our financial systems enabling us to meet our regulatory obligations for

financial separation. Delivery of a series of IT improvement projects to enable us to drive efficiencies and operate

under our new operating model in AMP6. Whilst we have delivered improvements to the current systems capabilities, we continue to support an ageing information and operational technology estate. Over 80%3 of our IT/OT estate requires investment to meet business needs or regulatory obligations e.g. the “Security of Network Information Systems” (NIS) directive. Moreover, the state of our technology, including IT/OT, Data and Telecoms, has been identified by the DWI and OFWAT as a concern, resulting in the recent DWI notice issued in April 20184 and CMF summary report published in November 20175. As part of this notice, we are committed to making a significant investment that will improve information life-cycle management, telemetry and operational asset information systems. Our technology initiatives delivered to-date and in the plan for the remaining two years of this AMP will focus on making further investments to stabilise, de-risk and improve the current state of our IT/OT estate. In the last two years of AMP6 (2018 to 2020), further work will be carried out that will

2 Additional analysis was carried out against the pioneer and scheme builder models to identify and eliminate instances of duplicated

spend. 3 A review was carried out by Capgemini in 2016 (“WARP”), highlighting those applications currently end of life or out of support.

Similarly, an ‘application value assessment final findings’ report was provided by Fujitsu in November 2016. High-level analysis was carried out against the current state of IT, leveraging the insights from both the Capgemini and Fujitsu reports as part of the as-is performance review for our PR19 technical annex. 4 The DWI enforcement is SRN_3951_Data_Undertaking_Schedule, please refer to this notice for further information. 5 OFWAT Company Monitoring framework – Individual Company report – Southern Water November 2017


set some of the necessary foundations in place, ahead of the proposed AMP7 investment. We recognise that our AMP6 investment will not address all current risks; and that further investment and focus on transforming our core IT/OT capabilities will be required in AMP7. Through to March 2020 we will incrementally implement the following transformation activities that are underpinned by technology: An end to end risk-based review of our core information technology systems, operational

technologies (telemetry and SCADA systems, Network communications), and information lifecycle management practices to provide the DWI with remedial recommendations.

Invest in Operational Asset Management (OAM) capabilities enabled through GIS, EAM to BIM.

Delivery of improved services in readiness for AMP7 across human capital management, procurement and developer services.

Continued focus on incrementally re-architecting the IT/OT estate to deliver improvements in corporate and operational resilience. In doing so this will address legacy applications, infrastructure and devices.

Please refer to sections 3.2, 3.3 and Appendix 2: Additional AMP6 Measures for further information regarding the activities taking place in the final 2 years of the AMP6.

4. AMP6 Investment Strategy

Wholesale Technology Investment Our current actual and forecasted Totex investment in technology for AMP6 is expected to be £288m. By the end of AMP6 we will have invested an additional £50m Totex on IT related compared to our PR14 final determination6. Table 1 (below) presents the detailed year by year breakdown of the investment made across the wholesale controls. The increased spend is due to increased investment in Information Security, resilience and to address new regulatory requirements such as new GDPR / NIS coming into effect.

Table 1: Actual and forecasted break down of AMP6 expenditure for Wholesale M&G IT

Spend category

AMP6 actual and forecasted spend (2015-2020)

2015/16 (£’m)

2016/17 (£’m)

2017/18 (£’m)

2018/19 (£’m)

2019/20 (£’m)

AMP6 Total

Totex 42.8 64.0 51.0 78.9 54.4 291.1

Capex 23.5 40.8 24.0 46.4 22.5 157.2

Opex 19.2 23.2 27.0 32.5 31.9 133.8

In AMP6 we have also started defining and delivering the information and data requirements of our five transformational programmes, which are:

Target 100

Sustainable Drainage 2030

Catchment First

Resource Hubs

Network 2030 For further details regarding the initiatives that have been delivered to date please refer to appendix 10.2.

6 PR14 Business Plan scaled back to Final Determination


Retail Technology Investment Table 2 (below) presents the year by year breakdown of this investment. For further details regarding the initiatives that have been delivered to date across the retail control please refer to appendix 2.

Table 2: Actual and forecasted break down of AMP6 costings for Retail M&G IT

Spend category

AMP6 actual and forecasted spend (2015-2020)

2015/16 (£’m)

2016/17 (£’m)

2017/18 (£’m)

2018/19 (£’m)

2019/20 (£’m)

AMP6 Total

Totex 3.450 4.921 8.178 6.247 3.813 24.260

Capex 808 1.927 5.393 0.000 0.000 8.128

Opex 2.642 2.994 2.785 3.900 3.813 16.132

Customer benefits and resilience Corporate resilience:

In AMP6, we have improved corporate resilience for our customers through the successful delivery of IT-driven and/or enabled initiatives such as: -

Delivery of legal requirements including GDPR requirements through to enhancements to our financial systems that now enable the automatic enrolment of Southern Water employees into an HMRC pension scheme.

Maintenance and improvement of IT Security measures including: Improvements made to access management (identify management, network access controls)

through initiatives such as ‘identity hub’. Improvements made to the web security, cloud security controls and email filtering email

by introduction of new security tools. Governance of Shadow IT - In the first three years of AMP6, IT and our delivery partners

identified several instances of “Shadow IT” spend. Shadow IT, is defined by Gartner as “Investment in acquiring, developing and/or operating IT solutions outside the control of a formal IT organisation”7. Whilst Shadow IT is not new within the industry, the impact to overall corporate resilience (e.g. spend leakage, downtime costs, data loss, reporting integrity) can be significant if un-governed, un-managed and un-guided as it increases corporate exposure to outages, security issues and controls on data governance. To address Shadow IT, a multi-stage strategy has developed that we have begun to implement by i) re-defining technology and related spend controls; and ii) by embedding new IT governance and accountability measures to effectively manage technology requests made by internal customers. In the last two years of AMP6, the resilience initiatives we plan to deliver include:

Enhancement of our Information Security capabilities - In FY18/19 we are undertaking a review and update of our cyber security framework, policies and standards across IT and OT. The purpose of this review is to develop security as a core business capability that enables us to better detect, protect, respond, recover and prepare for security threats (incl. physical and cyber).

Architecture and systems review -In FY18/19 we are undertaking a review of our +650 applications and databases to understand the scope, performance, inter-relationships and inter-dependencies of systems, environments and the overall IT infrastructure that underpin our service delivery. The outcome of which is to continue the further prioritised rationalisation and

7 Gartner 2017: Embracing and Creating Value From Shadow IT


consolidation of our IT/OT estate to deliver improvements in our overall corporate resilience. This addresses the availability, recoverability and security of our technology, as well as supports improvements to information lifecycle management to address our CMF and DWI notices.

Operational resilience:

In AMP6, we have supported our business in operational resilience through the delivery of IT-driven and/or enabled initiatives including:

Investment in operational technology and real-time systems such as: - SCADA / PLC / HMI asset modernisation at 23 sites. Telemetry assets have been modernised at 100-150 sites have been updated.

- Support the integration of flow meters in 2250 sewage pumping stations addressing, resilience, efficiency and compliance challenges.

Upgrade to our Telemetry platform that has improved situational awareness for our control room operators helping identify the risk of operational failure.

Enhancements to systems to support pollution and spills reporting. Investments to improve the communication and IT infrastructure such as: -

Investment in the telecommunication network, desktop phone and mobile telephony e.g. upgrades to the current telephony platform for contact centres and desk phone upgrades;

Migrating key applications from unsupported legacy platforms such as: - Customer payments processing activities shifting from unsupported, unsecured end of life

technologies to environments which are supported and patched. In the last two years of AMP6, the resilience initiatives we plan to deliver include:

Continued investment in operational technology and real-time systems- In the remainder of AMP6 we will carry out an end to end risk-based review of core information management systems, telemetry and SCADA systems, Network communications and IT systems, data and information management. Alongside this review, we will continue to refresh and modernise the following on-site operational technology such as SCADA, HMIs, and PLCs.

Continued investment to improve the communication and IT infrastructure - Establish a new co-located data centre infrastructure to improve the resilience of operational and corporate systems.


Customer Impact in AMP6 As IT is a shared service, we recognise that the customer impact of our IT investments requires

consideration of our external customers and internal customers. As a shared service our

investment is multi-purpose and multi-customer focused. Each of the customer types and the key

outcomes delivered by IT in AMP6 will be discussed in turn below.

External Customers

In AMP6, we have made investments to improve the digital channels and capabilities available to our customers. For example: -

Customer e-Services; We successfully delivered a customer-centric new digital E-service

platform called ‘Your Account’ that enables customers to access their accounts on a pc, tablet or

smartphone, at a time that suits them8. As part of this transformation we have also simplified the

payment process, and options that are available, by considering the end to end customer journey.

The outcome of this e-services platform has seen close to 30% of our customers register to use

this digital platform reducing the volume of inbound calls being made to Southern Water;

Customer Relationship Management; Delivered improvements to the customer relationship management systems which enabled us to offer innovative tariffs such as “WaterSure” and “Essentials” to lower-income customers;

Home Move Services; We have transformed our home move services by enhancing the

processes and systems that underpin this service. The outcome of this has improved our SIM

scores and resulted in a 50% reduction in repeat contacts relating to home moves being made by

our customers;

Developer Services; We have developed an online portal for developers and builders with regards

to Southern Water’s Developer Services9. This portal enables our customers to quickly and easily

apply and pay for new water and waste water connections and/or to request for further information

regarding any open queries (e.g. pre-development enquiries to fresh water capacity checks). The

online platform also provides a comprehensive repository of additional information e.g. guidance

forms, templates and to FAQs such as the impact of charges and new/existing regulation.

Finally, the investment that has been made in technology has supported the wholesale water and

waste commitments to our customers of ‘driving improvements for our customers in providing a

constant supply of ‘high-quality drinking water’; ‘removing wastewater effectively’; and ‘looking after

the environment’. For further information regarding the customer impact of wholesale waste and

water services please refer PR19 Chapters 11 (Wholesale Water) and 12 (Wholesale Wastewater).

Internal customer (Southern Water)

During AMP6, investment in IT has primarily focused on the following internal customer outcomes

and objectives identified in our PR14 plan. For example:

Business continuity- By delivering improvements that seeks to stabilise and de-risk the state of

technology by enhancing our infrastructure resilience (e.g. network, legacy infrastructure

replacement). The outcome of this is to improve the availability and security of our enterprise IT.

8 For further information please go to https://www.southernwater.co.uk/your-account-is-here 9 For further information please go to https://developerservices.southernwater.co.uk/


Cost Controls- By putting in place governance groups that seek to identify, manage and guide

shadow and non-shadow related IT spend. The outcome of this is to de-risk technology investment

in non-resilient IT.

Regulatory compliance- By delivering regulatory requirements e.g. market reform; GDPR and

NIS compliance; to separating financial systems. The outcome of this is to support our business in

it meeting its external obligations.

Increased productivity- By our proposed PR14 IT initiatives such as the supplier relationship

management system upgrade enabling the business to improve the quality of works/services

provided to both our ‘direct customers’ and ‘indirect customers’.

Agility, flexibility and scalability- By reviewing the IT/OT architecture and delivery model of IT to

i) improve alignment of our architecture to business needs; and ii) changes to the IT operating

model to respond to business demand with improved agility and pace.

Data Analytics – By improving the overall data availability, quality and trustworthiness through the

mobilisation of a dedicated Data Services Team within Southern Water that delivers analytics and

reporting to the business.

1. Drivers for Change

Customer and Stakeholder Views Technology underpins our business across Water, Wastewater and Retail. By investing in the appropriate technology tool and infrastructure we can realise improvement in customer services and network performance across all areas of our technical annex. As mentioned in section 3.3, technology investment can be multi-purpose and multi-customer. For this reason, a customer-centric approach was taken to identify, prioritise and validate the proposed technology investment for AMP7. For the purposes of this technical annex, both customer externally and internally were engaged.

Internal customer (Southern Water)

Over 120 internal stakeholders across wholesale operations, retail and corporate functions, have been engaged through all phases of the development of the PR19 technology technical annex. This approach was taken to capture the challenges, opportunities and key capabilities that technology will need to address.

Direct Customers

Alongside the views and priorities identified by our internal customers, we sought to understand the views of our utility customers. Through surveys, workshops and focus groups 17 key priorities were identified with the top three priorities for our customers being the reduction of leakages, supply interruptions and improvement in water quality1011. Section 5 will describe in greater detail the proposed technology investment and identify how the proposed technical annex addresses both internal and utility customer priorities at best value.

10 ODI Research (April 2018) 11 PC Focus Group (2018)


Future Trends and Pressures Our PR19 business plan has been developed during a time of unprecedented change because of the revolutionary impact of digital technologies. Digital technologies are transforming the expectations of our customers as a result of new disruptive business models, the way we as a business operates and the way our services are delivered. Fundamentally, digital technologies are having a profound impact on society at large and creating a debate about security and privacy. As a provider of such a critical service, we are acutely aware of the responsibility we have in this new operating environment. We also recognise that the pace of technology change is accelerating, and this has played an important part in our thought process as we have shaped our business plans for AMP7. In particular, we have considered the way we can harness the combination of digital technology trends to transform both our customer and colleague experience. As an example, we have the ability to make use of advances in cloud technology together with the increasing availability of sophisticated devices, sensors, and the ever-increasing computer power available for complex “big data” analytics and to predict potential service impacting issues on our networks to prevent issues before they impact our end customers. This means we need to be smarter in defining and selecting our technology choices to promote a holistic view of how we can support our internal and external customers using system thinking techniques. The longer-term concepts of ‘smart’ whole-system thinking is increasingly needed across utilities, networks, regional/national areas and cities. With the impact of population growth, environmental factors and climate change our investment plan will continue to invest in cutting-edge and emerging technologies as both pilots and as part of business as usual. At the heart of our approach will be to maintain an agile and flexible IT/OT estate to support the ongoing transformation of our business capabilities to respond to multiple external and internal pressures, risks and factors. Fundamental to our vision for the way we deliver our core business services is the capabilities now enabled by IT/OT convergence. When addressing IT/OT alignment Gartner stated, “By following a maturity model, asset-intensive companies can transform from disconnected or minimally integrated IT and operational technology environments into integrated businesses.”12. In line with this, Southern Water will adopt a unified approach to manage our IT and OT infrastructure. The key benefits of doing this are, amongst others, minimised cyber risk, minimised failure through software management, shortened IT/OT project timelines, and reduced cost of ownership from consolidation IT and OT thereby minimising duplication. Our operational technology relies on remote data devices to feed operational data to manage our

water and wastewater network. Emerging threats are drastically increasing particularly against

remote data devices. Symantec reports that in between 2016 and 2017 attacks against Internet of

Things (IoT) devices has increased 600%13. As a core component of the UK’s critical national

infrastructure, we recognise that we must respond to this and correspondingly increase our

investment. This change in landscape is reflected in the introduction of the directive on the security

of network and information systems (NIS) compliance will necessitate increased spend to improve

the overall security and resilience.

We have also considered that the way IT/OT services are delivered is also changing;

developments in modern IT are blurring the boundaries between IT “support” and IT “development

activities. We are increasingly seeing opportunities to work in more agile ways; delivering short

sprints of change to get solutions into the hands of users or customers more regularly with

12 Gartner 2018 Strategic Roadmap for IT/OT Alignment published 4th June 2018 13 Symantec Internet Security Threat Report Volume 23


constant evolution and refinement. In AMP7 we will embrace these new ways of working. This

enables us to ensure that we are agile and flexible enough to adapt our investment plans to take

advantage of new advances in technology during the next AMP that are not yet mature or even

understood yet.


AMP7 Strategy In AMP7 we will continue to invest in technology to stabilise, de-risk and enable our business. The investment proposed will see the continuation of the work being delivered in AMP6 of re-setting the necessary foundations and platforms from which we are able to deliver our commitments of AMP7 and beyond. Our PR19 technology technical annex, followed a robust methodology across seven key steps to identify, prioritise and test the proposed technology initiatives against OFWAT’s nine test areas. Figure 2 below illustrates the overall methodology taken in shaping the AMP7 investment strategy and technical annex. This enables us to show the rigour undertaken during the process to validate alignment to the needs of our business and OFWAT’s tests.

Figure 2: PR19 technology technical annex methodology, refer to Appendix 2 for further information

In developing our AMP7 investment strategy the following steps and considerations were taken: 1. Alignment on the scope of Technology – refer to section 2 of this document 2. As-is performance - refer to section 3 of this document 3. Alignment of IT to the business strategy and vision 4. PR19 technology technical annex

Future trends and pressures - refer to section 4 AMP Investment Strategy AMP7 Strategy Innovation Impact of AMP7 Strategy on serviceability and resilience Value for money for customers in AMP7 Plan Options Medium and long-term proposals Use of Market mechanisms Costing Strategy – refer to section 6

5. Development of a proposed roadmap – refer to section 7 of this document 6. Risks and opportunities - refer to section 8 of this document Within this section of the document the highlighted steps taken in defining the PR19 technology technical annex will be discussed in further detail below.


5. Investment Strategy

Business strategy and IT alignment In developing the AMP7 technology technical annex and to show ‘Line of Sight’ we have mapped all our activities from Southern Water’s Mission Statement, OFWAT and internal business objectives to the IT work-packages (see figure 3). This approach has been used to validate that the focus of our proposed IT investment is fully aligned and driven by a set of 5 key IT strategic objectives.

Figure 3: Overall alignment of technology investment

These strategic IT objectives are discussed in further detail in Table 3 below.


Table 3: Definitions of our 5 IT objectives

IT Strategic Objective Meaning

Support SWS as a leading provider

For IT as a Shared Service to support our business intent to become a leading provider of Water and Waste Services to our customers. In doing so IT has aligned itself to undertake work-packages which support the needs of the business in improving its market position and providing great customer service.

Support Continuity of Business

IT alignment to the needs of improving our overall business resilience. In doing so IT is supporting the continuity of our business through work-packages which serve to improve resilience, business continuity, security, availability of our operation.

Support Efficiency and Effectiveness

To support our business in improving affordability and vulnerability, IT’s objective is enable our business in promoting increased efficiency and effectiveness in how we operate.

Deliver leading-edge technologies

Regarding the Innovation Objective, IT will support our business by delivering leading-edge technologies to enable business, customer, process, cultural or operational innovation. Best practices from inside and outside the Industry will be investigated driven by the need for delivering best value to our customers.

Integrated and Quality Driven

IT and OT is fully aligned for the fundamental need for our business to be ‘Brilliant at the Basics’. Our strategic objective is to promote an integrated approach to managing IT/OT technology and architecture, underpinned by the key principles of quality delivery, systems, security and service to our business and customers.

For a more detailed end to end view of business to IT alignment please refer to Appendix 2. PR19 Technology technical annex - Prioritisation of IT investment

Our AMP7 investment strategy for Wholesale and Retail is categorised across three cases for investment. These are defined as follows: -

Legal obligations (DWI and EA): Investment that focuses on improving the state of critical operational technology instrumentation, networks, infrastructure, information life-cycle management and the resilience of our asset information systems.

Core IT (Maintain IT): Investment that focuses on maintaining and upgrading the current state of technology from core IT, application / infrastructure transformation, information security to driving insights from data.

Enable Business: Investment that focuses on delivering key business capabilities from capital works to commercial services. Capabilities that enable the business to transform the services being delivered to our customers, and that support the five-wholesale waste and water transformation initiatives.

Across each of these key cases for investment are several distinct IT work-packages which seek to address over 130 customer needs across wholesale and retail controls.


In deciding the priority of technology investment, we considered both the potential impact, such as cost/benefits analysis, improvement in performance and delivery of resilience in the round against the delivery risk and complexity of a project. We are proposing within AMP7 of pursuing a two-speed strategy. In pursuing a two-speed strategy with an overriding focus on advancing the business objectives with more agile, transformative strategic capabilities. This two-speed strategy will enable us to pursue delivery of both strategic and tactical initiatives based on business priority.

Figure 4: PR19 IT modernisation prioritisation matrix

In considering our AMP7 investment strategy we have used our overarching IT Strategic Objectives throughout the business plan recognising where our business currently is and needs to be.

AMP7 Wholesale Control Investment Summary

Our wholesale technology investment has taken 130 prioritised business needs which have been assessed against the business and IT objectives, 3 key cases and grouped into 17 distinct work-packages which relate to work of a similar nature being clustered. As discussed in section 3, IT is a key enabler for our business. The key challenges and risks facing information technology, operational technology and data are: the pressures to be flexible and agile enough to manage the level of transformation required

both from external customer, regulatory and internal business needs; The need to ensure resilience and business continuity; The pressure to keep technologies current, secure and aligned to delivering our customer

needs in an increasingly changing consumer world. Where customers have higher-expectations on the role of technology in enabling our business.

Following the analysis of over 130 business needs for IT investment, the overall AMP7 position is £385m gross Totex (Please refer to table 4 for details). This investment is distributed across the 3 key cases for investment DWI & EA, Core IT, Enable Business. For further details of how this was estimated, please refer to section 12.


Figure 5: Breakdown of

investment across the 3 core elements.

Major areas of cost in AMP7 include: DWI/EA enforcement regulation (~£75m) – investment to transform asset information

systems and information lifecycle management;

Information Security regulation (~£24m) – as part of core IT investment, driven by current

and emerging cyber-security threat;

Business Enablement (~50m) – Key investment in business operations and processes to

improve operational performance, efficiency, effectiveness, customer excellence and

enhance data assurance.

Both the DWI enforcement and Information security investments are fundamentally needed to address regulatory enforcement and our focus in enhancing our resilience measures in the face of increasing GDPR / NIS related fines and security threats to the network.

As a Shared Service cutting investments in IT/OT is complex as Enterprise Projects and Solutions are by their very nature cross-cutting across all areas of our business and materially impact the benefits companies can gain if only partially implemented. In gauging our investment we have traded-off such risk against the need to deliver “brilliant at the basics” and customer value which require continued, sustained IT/OT investment to deliver and execute transformational change.

Table 4: AMP7 expenditure on Wholesale Assets IT & General IT in comparison with

AMP6 expenditure (2017-18 prices)

AMP6 Actual AMP7 Total

TOTEX 174.035 288.200

CAPEX 114.989 125.208

OPEX 59.045 162.992

Our expenditure in AMP8 and AMP9 is as shown below:


Table 5: Predicted future expenditure on Wholesale Assets IT & General IT (2017-18 prices)

AMP6

(£’m) AMP7

(£’m) AMP8

(£’m) AMP9

(£’m)

TOTEX 174.035 288.200 351.432 351.432

CAPEX 114.989 122.757 188.440 188.440

OPEX 59.045 162.992 162.992 162.992


6. AMP7 Retail Control Investment Summary Across our retail price control our investment seeks to deliver 5 customer experience propositions: ‘Reach and Support’, ‘Make it Count’, ‘Spring Solutions’, and ‘Valuing water’. Each of these propositions is underpinned by the need for technology enablement and IT investment. The key capabilities needed to realise these propositions are: Omni-channel Customer Experience - Having the digital capabilities to provide an omni-

channel experience, that ensures a seamless and consistent customer experience which will

benefit all of our customer groups.

Digital Customer Services - Developing the functionality of our website and online portal to

increase the range of customer processes available online and self-identification for additional

support requirements.

Data Analytics - Capturing, analysing and storing high-integrity data to support our debt

management strategy.

Case Management - Delivering improved case management capabilities to improve our ability

to service our customers by for example reducing hand-offs between operators.

For further details please refer to the retail control and great customer service OFWAT Chapters.

Figure 6: Capex Opex split of Retail Investment

Following the analysis of over 130 business needs for IT investment, the AMP7 position is ~£29m gross Totex (Please refer to table 6 for details). This investment is distributed fully into the business enable case for investment. This proposed investment represents an increase of approximately £4.7m from the current projected AMP6 spend. This increase in spend is driven by the need to improve our current digital contact channels.


Table 6: AMP7 expenditure on Retail Assets IT spend in comparison with AMP6 expenditure

Category Spend AMP6 Actual AMP7 Total (£’m) (£’m)

Totex 24.3 29.1

Capex 8.1 10

Opex 16.132 19.09

The expected spend in AMP8 and AMP9 is projected to remain broadly flat as the business generates efficiencies from developing digital, data and information technologies but reinvests in improving customer experience.

Table 7: Predicted future expenditure on Retail Assets IT & General IT (2017-18 prices)

AMP6

(£’m) AMP7

(£’m) AMP8

(£’m) AMP9

(£’m)

Totex 24.300 29.100 29.100 29.100

Capex 8.100 10.000 10.000 10.000

Opex 16.132 19.090 19.090 19.090

Wholesale and Retail Control Investment Breakdown Our technology investment is spread across 18 work-packages (17 wholesale, 1 retail) with needs derived from interviews and workshops held with over 120 stakeholders from across the business. As shown in figure 7 our work-packages align to: The three strategic investment elements (EA & DWI, Core IT and Business Enablement). The four OFWAT Themes of Great Customer Service; Resilience; Vulnerability and

Affordability; and Innovation. Our business’s the 5 outcomes and 5 long-term goals. The technical annex assessment assumes the following: - Core IT spend includes Opex running costs stays at the £32m per annum based on the

projected spend forecast. Consideration has been made to business change as part of these costs. Our investment has considered cross work-package synergies to seek to deliver economies of

scale. A fully detailed description of the cost breakdown, justification and purpose of each work-package can be found in appendix 2.


Figure 7: breakdown of how the 18 technology investment work-packages align to the OFWAT Themes, Strategic Outcomes and Long-

Term


7. Innovation As mentioned in section 4, we are in a time of unprecedented change due to the revolutionary impact of digital technologies, operating in an end of life legacy tech estate. As such it’s important for us to keep an eye on the industry trends and pace to ensure that our investment approach is balanced between stabilising, de-risking the core, enabling the business to the adoption of new innovative technologies and methods.

Figure 8: Striking a balance overview. Adapted from Accentures “how to make a wise pivot to the new 2017”

We need to pivot wisely, recognising that we need to deliver at a pace sustainable to our business. If we pivot too quickly then it is likely that we will increase our risk and reduce our ability to change successfully. Likewise, if we pivot too slowly we run the risk of not mitigating legacy risks, and potentially forego the full benefits and outcomes that comes from innovation. As such, we are proposing to strike a balance between the two as part of our PR19 technology technical annex. In delivering our IT objective for innovation by ‘delivering leading edge technologies’, we need to understand and answer following questions: - How do we define innovation? Why do we innovate and how do we measure success? Who do we innovate with? How are we proposing to innovate in IT? How are we proposing to deliver emerging technologies as business as usual? What innovative technologies are we proposing to adopt in AMP7? Each of these questions will be addressed with a focus on how IT’s objective of delivering ‘leading edge technologies’ will seek to both deliver and support the innovation agenda at Southern Water.


What is innovation?

As mentioned in the innovation chapter of our response, we define innovation as “the process of identifying and implementing something new that delivers value to our customers, stakeholders and organisation”. Innovation is no longer a ‘nice to have’ – it is essential in achieving value and operational efficiency and delivering against changing customer expectations. We also recognise that Innovation enabled through technology does not always need to be ground-breaking, many improvements can be achieved by being “Brilliant at the basics” and making increment changes.

In understanding what innovation is, we considered technology innovation from five different perspectives that guide and inform the way we handle and manage the innovation:

1. Business model’s innovation to exploit new markets and introduce new ways of working; 2. Management and culture innovation to create a corporate culture and value chain that

facilities innovation; 3. Business process reinvention to increase efficiency, reduce costs and support new

business models; 4. Technology innovation to leverage emerging technologies to transform our business; 5. Service delivery innovation to enhance the way we run provide services to our business.

Why do we innovate?

At Southern Water, as part of our culture we want to put in the innovation governance to initiate opportunities that could deliver new or more efficient services, processes or solutions for our customers at the very best possible value for money. In our view investing and innovating in IT is a key driver for changing a business perception of IT, shifting emphasis from ‘keeping the lights on’ to a forum where IT is seen to be adding value, and changing/disrupting how a business can operate in support of its continued evolution. We see our evolution as illustrated in figure 9 below by delivering the basics brilliantly to get the fundamental right, support and optimise the business.

Figure 9: Hierarchy of IT needs across the organisation (source: infotech.com)


How are proposing to innovate in IT

Our commitment in delivering value-driven IT and in continuous improvements means that innovation opportunities may be identified from any part of Southern Water or from our stakeholders. to support this our business is proactively encouraging our stakeholder groups to co-ideate and co-create innovation ideas. Alongside the investment being made in our Blue-wave innovation hub, we will seek to leverage the use of market mechanisms and our delivery partners to co-fund proof of concept ideas with us directly. As we, external stakeholders and our delivery partners identify innovation ideas, these will be scoped out to the extent that is required to understand what the associated costs and benefits could be in delivering a proof of concept. Creating the right environment to co-innovate and collaborate with the Water Industry is also critical for us to move, enable, and change. An example of this is our DataWell concept14 that is leading the way in helping us and other water utilities to transform data within companies, leveraging the insights and experience of companies such as Google, start-ups to non-profit organisation. Thought leadership will be a key theme that our IT procurement events will request of our delivery partners to showcase innovation and the latest thinking. How are we proposing to deliver emerging technologies as business as usual?

In support of innovation in technology and across our business, IT has developed a three-stage approach designed to co-ideate, co-create, scale and maintain the implementation of emerging innovative technology with agility to enable sustained improvements to our productivity and the quality of our services for our customers. The three steps are: Step 1 – Co-ideate innovative ideas (“concepts”) Step 2 – Co-create, scope and prioritise concepts and use cases; Step 3 – Deliver and value realisation measurement. Step 1: Co-ideate innovative concepts Together with our stakeholders, Step 1 is an opportunity co-ideate and identify innovation concepts that aligns to our customers outcomes, captures the perspective of a varied group of stakeholders both internal and external to our organisation (See Figure 10).

,

14 https://wwtonline.co.uk/news/southern-water-working-with-google-on-datawell


Figure 10: Technology innovation flows from our stakeholders to our 3 categorised innovation pools.

Examples technologies in Pool 1, 2 and 3 are illustrative of the technologies that could be innovated.

All innovative concepts will be initially categorised into thee innovation pools. As part of a portfolio, each concept will be reviewed quarterly based on their potential application (relevance), technological maturity, and potential benefits to Southern Water. Ideas will be captured through multiple funnels from our digital idea portal, innovation database to one on one discussions held with internal and external stakeholders. The technology innovation pools serve as a structured vehicle to guide and progress innovative ideas forward, identifying where significant customer outcomes are possible. To reflect this, we propose 3 pools of investment aligned to the current and upcoming price review periods, considering an ongoing development of business and technology maturity. Under this structure, pool 1 reflects potential innovation for AMP7 and will feed into step 2. An example of the technologies that can be considered as part of these pools can be taken from the Gartner Hype Cycle. Technologies that are emerging as “Innovation triggers”, such as “Augmented Reality in Utilities” could be candidates for pool 2. Whereas, more mature technologies, such as “Cloud in Utilities” or “Big Data” may be candidates for pool 1 innovation. Please refer to figures 11 and 12 that depict the leading disruptive innovations across all industries respectively and the maturity of digital innovations within the utility industry. Ideas and concepts will be regularly reviewed to provide the opportunity to account for the latest industry trends and emerging technologies by accelerating or decelerating innovative concept (moving them from one pool to another, depicted in figure 10).


Figure 11: Gartner Hype Cycle for Emerging Technologies 2017. This Hype cycle contains the leading innovative technologies that are disrupting technology worldwide. 15

Figure 12: Gartner Hype Cycle for Utility Industry IT, 2017 “This Hype Cycle contains utility technologies critical for delivering reliable, affordable and ubiquitous commodity services” 16

15 Hype Cycle for Emerging Technologies, 2017 16 Hype Cycle for Utility Technologies, 2017


Step 2: Co-create, scope and prioritise concepts Step 2 takes concepts from pool 1 and follows a staged process to iterate and develop the innovative concepts. For each technology innovation concept, a lightweight business case and solution outline will be produced that can be used by the design authority and sponsors to inform decision making. Using this design, the IT design authority can make a prioritisation decision based the potential application, maturity, readiness and value to the customer that the innovation could deliver. Following the portfolio prioritisation, the design authority will align the innovation to one of 3 paths:

Path 0 – If the maturity and applicability of innovation is deemed as being too risky, the design authority may chose to postpone the innovation, effectively moving the concept back to Pool 2 or 3.

Path 1 – If the innovative concept is considered as a a proof of concept solution, as the business case is less mature, then it may be a concept that is delivered via the blue wave innovation hub. This delivery path seeks fail fast ahead of a larger tactical deployment.

Path 2 – If the application and business case of the emerging technology is more mature and well understood then it will be delivered by IT. This delivery path seeks to embed the innovation at a larger tactical scale and monitor it values across a longer timeframe.

Paths 1 and 2 run in parallel to develop and assess innovation potential. Once innovations have graduated step 2, they progress to step 3 for BAU business portfolio consideration funding and roll-out.

Figure 13: The individual and activites requried to take an innovative idea from

concept-pool to funding.


Step 3: Deliver and value realisation measurement Once concepts are being trialled and delivered via either path 1 or 2, there will be a period of operating, maintaining and value realisation tracking. As mentioned in step 2, proof of concept ideas will be trialled for a shorter timeframe than those concepts being delivered via path 2. At a point in time, a tipping point may reach in which the proof of concept ideas and IT-led innovation are no longer tactical but rather strategic initiatives for wider scale deployment. Supporting our five transformation programmes in AMP7

Under our Innovation approach in AMP7 our intent is to continue the work started in AMP6 and trial and develop innovative technologies needed by our five transformational programmes. These are:

Target 100

Sustainable Drainage 2030

Catchment First

Resource Hubs

Network 2030 Areas such as advanced analytics and data science, machine learning / artificial intelligence (AI), drones, augmented reality (AR), robotic process automation (RPA) and IoT (Internet of Things) are all potential innovations in our pipeline of investments over AMP7 and AMP 8. In the following section, we go into further detail on two key areas of innovations that follow path 2 of IT-led Innovation: Networks 2030; control and Production Planning, and Data Analytics.

1.1.1.1 Networks 2030: Network Control and Production Planning A key component of our Network 2030 transformational programme is having the technology application platforms in place to control and monitor networks dynamically, as well as the compatible hardware and infrastructure to monitor changes and execute control. AMP7 technology investment will deliver active network management and production planning through the introduction of an integrated Network Management system (NMS). NMS enables the business to predict where network failures may occur, providing the opportunity to intervene before customer are impacted. Furthermore, an NMS enables the transformational initiatives taking place in Brighton, and open opportunities for transformation in water supply. Network 2030 Customers can expect improved water quality and security of supply resulting from the dynamic management of the water Networks and the ability to respond to proactive to pressures and strains in the network. For further details on Networks 2030 and the transformation of our business refer to the “Our Strategy” chapter17

1.1.1.2 Driving insight with data Throughout AMP7 we plan to continue to innovate in the way the business uses data by delivering information lifecycle management improvements. The centralised data services function will use innovative tools and data science methods to provide analytics and reporting services to the business. Southern Water aims to continue to work collaboratively within the Industry to co-create insights that are valuable to the customer. We have identified over 50 analytic ideas that we aim to deliver through the data services function. Some examples of this include: Consumption Analytics: There is a need to use meter data to transform our customer

experiences and our industry leading transformational programme Target 100 depends on the support of a number of data services. For example predictive and prescriptive models can use consumption data, to identify high customer usage, enabling the business to support customer in reducing consumption, and reducing bills.

17 Chapter 3 “Our Ambition”

Regular reviews Regular reviews


Drainage Analytics: There are necessary for Sustainable Drainage 2030, which focusses on creating capacity across our sewer network by implementing surface and foul water drainage solutions and creating smart networks to resolve pollution and internal flooding/blockages issues. There is also an opportunity to harness the data produced to inform future decisions.

Catchment Analytics: Catchment First focusses on bringing our catchments into the heart of our decision making and delivery processes to achieve a more resilient service and environment. Data analytics are needed to model and structure catchments to inform future schemes, incentives, strategies and monitor future works.

Power and Resource Analytics: There are essential capabilities which we need to develop our Resource Hub concepts. Sub-metering of power in real time, predictive management of energy consumption and generation and resource movements and treatment are all capabilities we need to develop further throughout AMP7 as we deliver our Resource Hub concept.

Network Analytics: These are essential components of our Network 2030 proposals. They allow the use of data to identify trends, methods and dynamics of blending and storage of water to address emerging risks such as nitrate pollution.


8. Summary of AMP7 Proposals

Wholesale Investment Proposal Summary AMP7 sees an overall planned increase in IT investment across the wholesale controls from AMP6 to AMP7. This investment will be used to stabilise and de-risk the state of IT/OT and data across Southern Water and support the delivery of customer outcomes at best value. The proposed investment has been rigorously reviewed and each work-package has been validated against our customers’ priorities, OFWAT’s themes and southern waters business imperatives. Table 8: AMP7 expenditure on Wholesale Assets IT & General IT (2017-18 prices)

Category Spend

AMP6 Actual AMP7

AMP7 Total

(£’m) (£’m)

Funded in this Technical Annex

174.035 288.200

Add back technology procurement target

0 44.955

Add back scope funded in other business cases

117 51.500

Totex 291.035 384.655

Capex 157.195 172.038

Opex 133.84 212.617

Retail Investment Proposal Summary AMP7 sees an overall planned increase in IT investment across the retail control of £2.3m from AMP6 to AMP7. This will be used to enable substantial change within our retail business, enabling a refreshing simple customer experience.

Table 9: AMP7 expenditure on Retail Assets IT & General IT (2017-18 prices)

Category Spend

AMP6 Actual AMP7

(£’m) AMP7 Total

(£’m)

Totex 24.26 29.09

Capex 8.128 10

Opex 16.132 19.09


9. Customer Benefits and Resilience As section 4 discusses, there is a recognition across the industry that market drivers from climate change to the adoption of “Internet of Things” (IoT) technologies are providing new challenges in both serviceability and being able to deliver resilience in the round. During AMP7 Our aim to continue to stabilise and de-risk the convergent IT/OT environment. Our information technology investment work-packages contribute to all aspects of delivering resilience in the round. Understanding that resilience risks are multi-dimensional, we recognise that we need to have a robust multi-dimensional strategy and response for AMP7 that delivers resilience at the best value to our customer. We have considered the options available and proposed 18 key work-packages aligned to deliver more resilient services for customers. Building on the 4Rs of resilience we have also taken the step to recognise the importance of preparation, monitoring and detection in regards to IT/OT security, in order to prevent and minimise threat in the first instance. Regarding information security the trend in integrating previously stand-alone OT systems, assets and sensors is increasing our vulnerability to potential cyber-attack. As the attack surface expands through the increased convergence in IT/OT environments cybercriminals now have new digital access points that previously may have been isolated or required physical tampering. Recent attacks on the Ukrainian Grid, WannaCry ransomware in the UK, plus the growing evidence of cyber-security weaknesses in Internet of Things (IoT) devices have also significantly increased the appreciation that IT/OT architecture must be designed, tested and operated with security, availability and serviceability as key non-functional requirements. To underpin the importance of this the latest 2018 NCSC threat assessment for the Water Industry is deemed as ‘Substantial’. To support the need for increased vigilence and awareness we undertake regular meetings, reviews and exercises with the NCSC so we are aware and better prepared for the cyber-threats we may face in managing our operation with regard to cyber-security and how we manage compliance to NIS and GDPR Directives. Additionally we have adopted security frameworks such as NIST/ISO27001 to underpin the management of cyber-security across our organisation:

Figure 14: NIST/ISO27001 cyber-security framework.

This is recognition that the four NIS principles that NCSC have adopted, and the Indicators of Good Practice that sit beneath them, are all designed to be consistent with NIST Framework.


To date we have made progress in AMP6 in delivering more resilient systems and capabilities, reviewing and improving our compliance to GDPR and NIS, and improving our security posture in SCADA. As shown in Figure 15 below our technology investment work-packages contribute to all aspects of delivering resilience in the round. Understanding that resilience risks are multi-dimensional, we are required to have a robust multi-dimensional strategy and response for AMP7 that delivers resilience at the best value to our customer.

Figure 15: Resilience in Southern Water and IT work-package overview.

Our ambitions within AMP7 is to embed a set of characteristics surrounding resilience and security

that our investment in technology is aligned to support (Table 10).

Table10: Southern Water Characteristics around Resilience

Characteristic SWS Approach Defra 2017 Cyber-Risk

Review Alignment

Adaptable, flexibile, scalable and compliant

Utilisation of Enterprise architecture driving common principles standards and policies across how we design and manage IT/OT

Replacement of legacy IT/OT and drive towards a strategic component-based architecture to provide agility in our technology

Privacy by design

Architectural design/separation of Information Technology (IT) and Operational Technology (OT).

Common cyber security management


of IT and OT (and a single set of security policies for both).

Trained and prepared

Defined corporate Governance around Information and Security, Resilience and Recovery

Regular training and awareness in Information Governance and security across our company to support our business in being prepared for differing types of threat and response to incidents (including GDPR / NIS)

Scenario planning and exercises/simulation of types of incidents and continuity situations we could encounter

Regular dialogue, meetings and reviews with the NCSC in support of GDPR and NIS Directives

Cyber security and awareness training

Cyber incident response planning and exercising

Coordinated risk managed

Defined and managed risk and incident management processes

Focus on high priority risk mitigation activities

Enterprise cyber-security framework

Cyber risk from third parties

Risk managing supply chain and 3rd party companies (e.g. contract, access management, regular audit)

Interdependent and integrated

Holistic assessment of IT/OT risk and utilising system thinking

Common architectural approach and technical standards across the company to standardise asset integration

Design for security segregation in our IT/OT Networks

Investment in Enterprise SOC / NOC capabilities in IT

Common access controls

Architectural design/separation of Information Technology (IT) and Operational Technology (OT).

Common cyber security management of IT and OT (and a single set of security policies for both).

Proactive and responsive

Utilisation of software, sensors and predictive analytics to identify deviations from established normal system behaviours and raise alerts to pre-empt response

Focus on architectures promoting interconnected, real-time data to support making informed decisions

Use of sensors and software for protective monitoring.


Investment in Information life-cycle management

In delivering our IT objective of ‘supporting the continuity of the business’ to deliver resilience we have considered the following:

a) Five core dimensions of: 1. leadership, 2. culture, 3. people, 4. systems, process and policies 5. infrastructure.

b) Resilience in the round; c) OFWATs 4R’s in which resilience is provisioned ; d) 1st layer of characterstics

How is resilience in the round being supported by IT in AMP7?

1.1.1.3 Leadership and Culture In AMP6, the focus of resilience in technology is on building IT stability and we have already begun to embed several IT-led initiatives such as implementing a new operating model, defining a new IT/OT standards governance, information security governance, through to how to control and reduce “Shadow IT” spend (Refer to section 3.2 for further details).

The shift in AMP7 is to further develop resilience as a core discipline which is architected into our shared services. Architectural principles will underpin how we will build in resilience within IT (e.g. security, availability, recovery) based on the business need to maintain and improve our business continuity. We will therefore plan to continue to focus on the importance of resilience through our corporate strategy, product/solution design, technology architecture and strategic investments.

1.1.1.4 People resilience

To reduce both corporate and operational resilience, investment in developing the right skills and capabilities of our people is required. By accident or intent, employees and third parties can be the cause of, or best mitigation against, operational incidents or cyber-attacks. In AMP7, we propose to deliver several technology-led initiatives that will train, prepare and reinforce the appropriate culture and response of our employees and third parties to an incident. Supporting initiatives include: - W8 - Information Security. W10 - Operational Real Time Control and Monitoring. W15 - Human Capital Management and Finance. W16 - Digital and Collaboration. A sub-set of the IT initiatives being proposed to improve people resilience include: - W8 – We plan to carry out cyber and IT resilience training to skills reinforcement via for

example phishing tests (refer to cyber and IT resilience for further information). W10 - We plan to deliver an operational learning management solution to support the

operational control room training across water and waste-water services. This investment is required to comply with the recent control room operations competency framework. This framework requires us under our licence obligations to standardise the training and assessment of control room operatives.

Finally, we see the investment in both learning management solutions and on-going training as critical. Our Customer’s outcomes will be safeguarded through enhanced skills and standardised ways of working. Furthermore, our people will be able to better prepare, detect, protect, and respond to incidents.


1.1.1.5 System and process resilience In delivering system and process resilience the following need to be considered:

Enterprise Architecture. Cyber and information security. Business continuity.

1.1.1.5.1 What Cyber, and Information Security resilience measures are we prosing to adopt in AMP7

In AMP7, we are proposing to enhance our core capabilities further to address the emergence of security threats on critical national infrastructure (CNI) organisations. Because of this, we plan to invest £24m in Information Security (W8) that will enable us to continue to develop core cyber and information security capabilities within Southern Water. Our security capability will operate information resilience tooling that will seek to mitigate our risk posture and proactively identify resilience threats across the IT/OT estate. Our proposed approach in delivering cyber and information security resilience is aligned to the recommendations given by DEFRA, to: Understand threats: Build on and develop our understanding of the cyber threats being faced,

as they evolve. Manage risks: Develop and implement approaches to manage risks and address cyber

security vulnerabilities now and in the future. Manage incidents: Respond effectively to serious cyber incidents, including those that

compromise critical water infrastructure. Protect information & assets: Protect information (customer and corporate) and assets to

ensure regulatory compliance and strong controls. Manage identities: Ensure that suitable processes protect credentials and appropriate levels

of access. Enhance awareness: Develop training and education processes to enlighten staff and

suppliers on cyber threats and actions. A sub-set of the IT initiatives within work-package 8 that plan to improve our Cyber and Information Security resilience including: Implementation of activities which improve our risk posture to NIS. New cyber defence tools and threat intelligence platforms. Enhanced identity governance management. As discussed in the “future trends and pressures” section of this document (4.1), digital technologies are exposing cyber and physical security risks across all industries, particular CNI sectors such as water and sewerage. We see the sustained investment across IT as critical to reducing our risks in security.

1.1.1.5.2 What business continuity and enterprise resilience measures are we proposing to adopt in AMP7?

Business continuity management (BCM) at Southern Water is a corporate activity that is regularly reviewed, tested and continuously improved.

We are currently reviewing, aligning and enhancing business continuity with the proposed AMP7 strategic vision and priorities for delivering resilience. This review increasing the coverage of scope from AMP6 as we assess our BCM policies, procedures, enterprise architecture, and rapidly converging IT and OT estate. In doing so, our aim is to incrementally improve business resilience that factors in regulatory directives, industry standards and best practice (e.g. ISO27001 /

ISO22301) in the plan-do-check-act response to IT/OT incidents.


Figure 14: Business Continuity Management

In AMP7, we propose to deliver several technology-led initiatives to enhance our business continuity measures and capabilities across critical assets and processes in the IT and OT estate. Some of the key IT work-packages that seek to enhance our business continuity capabilities include: W4 - Operational Asset Management. W6 - Application Transformation. W7 - Core IT. W9 - Driving insight with data. A sub-set of the IT initiatives being proposed that will improve our business continuity and enterprise resilience include: W4 – We are proposing to enhance our corporate risk management capabilities by the

implementation of a new corporate risk management solution. This solution will replace our legacy solution which is end-of-life and out of support at the end of AMP6.

W6 – Leverage the investment made already made in AMP6 in stabilising our data centres to provide a core IT infrastructure that is stable and capable of maintaining continuity of service. Having invested in new infrastructure, we will continue to transform applications across the

IT/OT estate. In doing so we will design and architect for resilience across the full solution stack from application through to communications.

W7 – We are proposing to optimise the configuration and consolidation of our current IT and data environments to enable us to improve non-functional aspects such as security, availability, capacity, recoverability and maintainability to mitigate risks in business continuity.

We also recognise that our supply chain partners play a critical role in supporting business continuity. To support this, we are: Enhancing current policies and procedures to systematise and prioritise the due diligence

investigation of suppliers on the front end of the vendor vetting. Establishing effective governance giving the right levels of accountability to owners of the

appropriate decision-making powers for third party risk management. Designing risk-based segmentation to better triage third parties to ensure the most BCM effort

is devoted to the highest risk and potential alternatives. Embedding contractual processes which allow SWS to validate 3rd parties in relation to supply

chain practices, processes, security and audit (GDPR/NIS)


1.1.1.6 Infrastructure resilience During AMP6 we have undertaken a concerted drive to stabilise and de-risk our business by investing in the refresh of IT/OT infrastructure. The proposed sustained AMP7 investment in infrastructure considers the continued investment in the maintenance and refresh of IT/OT/Telecoms estate that underpins our corporate, operational and financial capabilities and systems. Some of the key IT work-packages that seek to enhance our infrastructure resilience include: - W1 - Critical Monitoring and instrumentation. W2 - Telemetry system replacement. W3 - Communication network replacement. W4 - Operational Asset management systems. W6 - Application Transformation. W7 - Core IT. W17 - Water and Wastewater transformation. A sub-set of IT/OT-led activities to improve infrastructure resilience in AMP7 include: - W1 to 3 – We are proposing to invest circa £30m in operational technologies that will support

and improve the overall infrastructure resilience of the wholesale waste and water services. This investment is needed to support changes to our network and to maintain/refresh key instrumentation, telemetry and edge of network telecoms at our waste and water-services sites.

W6 – We are proposing to re-platform several business-critical applications to address risks arounds resilience, availability and other non-functional requirements.

W7 – We plan to continue investing into the cyclical refresh and maintenance of end user computing, hardware and core network infrastructure to maintain IT operational resilience

1.1.1.6.1 Physical infrastructure Some of the key IT work-packages that seek to enhance our physical infrastructure resilience include: W8 - Information security. An example of IT-led activity that will seek to improve physical infrastructure resilience in AMP7 is: - To support the growth and ongoing maintenance of existing sites, we are proposing to invest in

additional CCTV and access management measures. These measures will consider access privileges based on the roles and responsibilities of our workforce (and including third party suppliers).

For further information regarding physical infrastructure measures being considered in AMP7, please refer to the M&G Property technical annex.

1.1.1.6.2 Supplier resilience We recognise that to deliver resilience, we need to also think beyond our IT/OT estate and consider the ecosystem of suppliers that work with us and integrate into our technology estate. An example of IT-led activity that will seek to improve supplier resilience in AMP7 is: - Govern and manage ecosystem risk systematically – All suppliers that work with us and

integrate into our technology estate will need to comply with our security standards and procedures. Required resilience measures will be defined within contractual arrangements. An example of a recent change that we have required all our suppliers to comply with is the handling-off customer-related data (GDPR).


1.1.1.7 How the Business Plan will support Southern Water in managing its resilience and risk posture with relation to NIS/GDPR Directives

Figure 17 provides an overview of the IT and Operational Technology (OT) work-packages and identifies which packages support improving our risk posture in relation to the NIS / GDPR Directives:


Figure 15: Alignment of PR19 work-packages to NIS and GDPR directives

Each work-package identified in the diagram will support improving our risk posture in relation to NIS / GDPR Directives. This will be with regard to improvements in:

1) How we operate

2) management of information

3) Refresh of legacy infrastructure and applications

4) Security and resilience of infrastructure / systems in IT/OT

5) Providing better insight and decision-making for our business in the management of risk.

The summary AMP7 technology investment for each work-package is as follows:

Table11: AMP7 Technology work-packages

Technology Work-package AMP7 Investment Directive

W1: Critical Monitoring and instrumentation replacement

£17m NIS

W2: Telemetry System replacement £5m NIS

W3: Network Communications and IT Infrastructure

£9m NIS / GDPR

W4: Operational Asset Management £36m NIS

W5: Information Life-Cycle Management

£8m NIS / GDPR

W6: Application Transformation £49m NIS / GDPR

W7: Core IT £170m NIS / GDPR

W8: Information Security £24m NIS / GDPR

W10: Operational real-time control and monitoring

£15m NIS

W12: Work, Asset resilience and compliance

£6m NIS / GDPR

W15: Human Capital Management & Finances

£6m NIS / GDPR

W17: Waste & Water Transformation £2m NIS


10. Value for Customers As mentioned in our affordability and vulnerability chapter we define affordability and value for customers as “The ability for our customers to pay their bills”. Within our AMP7 business plan, technology investment underpins our business plans across Water, Wastewater and Retail and the associated customer benefits by providing the supporting and enabling tools and infrastructure. Technology present three important opportunities to improve value to our customer: Firstly, technology underpins our transformational programmes, such as Networks 2030 and

Sustainable Drainage 2030, which will deliver affordable resilient services for our customers in the future.

Secondly, technology can enable efficiencies within our business to support an effective capital delivery, operational maintenance and corporate management.

Finally, our investment improves our information lifecycle management and data assurance in reporting and improving our data management.

However, while understanding that customer value and affordability is multifaceted our technical annex has considered customer value and affordability across OFWAT’s five broad principles, depicted below in figure 18.

Figure 16: Affordability in PR19 is discussed across 5 principles: Customer engagement,

Customer Support, Accessibility, Effectiveness and Efficiency


Customer Engagement Technology supports customer engagement by providing the underlying applications, infrastructure and datasets to enable our business to meet our customer outcomes. Figure 19 illustrates the mapping of each work-package against our stated customer priorities to demonstrate how each work-package will support each customer outcome.


Figure 17: Our PR19 Technology Investment work-packages against Customer Priorities


Customer Support

As a shared service, IT provides the technology enablers to our business to provide cross-organisational support for our customers to use. Our technology has focussed on maintaining this service at best value by considering 4 different plan options, while considering the impact to the customer for each. For further details on the plan options considered across technology investment please refer to section 5.8. As an example, in AMP7 we plan to invest in wholesale case management to improve how we manage incidents in the wholesale network and to provide a coherent customer support.

Effectiveness

During AMP6 we are have expanded our focus and deepened our understanding of our customers to enable us to deliver effective service to customers by getting most of the data we had available. In AMP7 we plan to develop this further by enabling increased data analytics capability (tooling, people) to support internal customer-facing teams with actionable insights and unlock significant value. Efficiency

While developing this technology technical annex to deliver efficient services to customers, we undertook a rigorous approach to assessing and costing our technology investment. To minimise regret, spend and maximise customer value the following options were kept in mind when reviewing customer and business technology needs: remediate, re-platform, replace and retire. For a full and detailed description of the costing approach employed, please refer to the costing strategy section of this document (Section 6)

Accessibility

Technology is a key enabler in providing accessible channels for our customer to contact us. As discussed in section 3.1, in AMP6 we successfully introduced the e-Services platforms in AMP6 which provides digital contact channel capabilities for our customers. In AMP7 our investment in digital collaboration and retail transformation seeks to further develop our digital capabilities. Specifically, improvements to digital channel development and enhancements to customer relationship management capabilities which may help to identify and contact our customers that may be vulnerable or facing affordability issues.


11. Plan Options In developing the wholesale plan for AMP7 we considered four different investment options. Table 12 below shows the technology investment breakdown for each of the 4 options considered, including our proposed investment strategy option (green). Each of these options and our analysis of them will be briefly discussed in turn. These options considered a range of investment along with the benefits and consequences of increasing or decreasing spending. We used four criteria to determine which of the investment options was most appropriate:

1. Customer priorities;

2. The four themes laid out in OFWAT PR19 methodology;

3. Our business objectives which consider customer outcomes and long-term

goals;

4. Risk and deliverability

As a Shared Service cutting investments in IT/OT is complex as Enterprise Projects and Solutions are by their very nature cross-cutting across all areas of our business and materially impact the benefits companies can gain if only partially implemented. In gauging our investment we have traded-off such risk against the need to deliver “brilliant at the basics” and customer value which require continued, sustained IT/OT investment to deliver and execute transformational change. Option 1: The investment of £272m would only allow for partial elements of core related IT/OT

spend to be delivered with no available funding to support and enable the business. Furthermore, this option would not be able to deliver security / resilience in the round nor the level of quality, ambition and innovation both OFWAT, our customers and business requires.

Option 2: The investment of £385m, sees an uplift of our IT/OT related spend over AMP6 by

£100m to stabilise, de-risk and enable the business to deliver our commitments in AMP7. The level of spend has considered the risks and deliverability of the plan across the AMP and provides the opportunity for us to deliver a step-up in service to both our external and internal customers.

Option 3 & 4: As with the other options, cost to serve and value for our customers was at the

heart of our optioneering. On review it was determined that the additional investments in Options 3 and 4 would not be able to deliver the additional needs and outcomes within the timeframes available

Table 12: Costing breakdown and value for the 4 options of the PR19 plan

Option Option Summary and Impact to

customer

Totex Investment (£’m)

Cu

sto

mer

Pri

ori

ties

O

FW

AT

Pri

ori

ties

B

usi

n

ess

Str

at

egy

Del

iv

era

bil

ity

DWI/ EA Core IT Bus.

Enable Total

Option 1:

Basic

Investment

Option 1 focusses on doing the absolute basics to keep the lights running. This investment does not consider the development of significant business enablement initiatives to drive operational efficiency.

£58.8 £213.3 £0 £272.0 ◔ ◑ ◑ ●

Option 2:

Stabilise, De-

risk and

enable the

business

Option 2 represents a blend of investment that considers how we do the basics brilliantly and enable sustainable services to customers. As well as use modern technologies to share efficiencies across the business

£75.0 £260.0 £50.0 £385.0 ● ● ● ●


and enable us to deliver the wider business plan.

Option 3:

Enhanced

Business

Capabilities

Option 3 provides a notably up-lift in investment vs option. This includes the investment in more advanced technology capabilities such as User Experience centre of excellence. Under option 2, all of this type of investment has been deferred to AMP8 or beyond.

£84.7 £260.8 £82.0 £428.0 ● ◕ ● ◑

Option 4:

Transform

the business

Option 4 represents the full transformation of our business, including significant internal IT and digital capabilities. At this price point, while the investment will deliver substantial cost reduction savings

£99.9 £299.5 £104.7 £504.0 ● ◑ ● ◔

Please note: Retail costing approach and options are covered in detail in the Retail Control chapter of our business plan.

The preferred Option 2 of £385m (pre-efficiency and overhead recharge) represented an investment approach that considered an optimal balance of risk, affordability and deliverability whilst maintaining full alignment with our business and customer objectives.

Options 3 and 4 were deemed not acceptable when considered against the criteria as they were too high risk from a deliverability perspective, and more expensive to our customers’ affordability.

Option 1 was deemed too high risk as it only allows IT to tactically “keep the lights on” without adequately de-risking the IT operation or allowing us to sufficiently undertake new investments to improve resilience/security; efficiency gains; operational technology; and / or enable our business to effectively support our customers.

We recognise that our proposed option will increase our customers’ bills by circa £1 per year for the £100m additional spend for Option 2 over Option 1.


Medium & Long-Term proposals Following AMP7 our aim is that we will have laid the foundations to look at the deployment of advanced, emerging and disruptive technologies across our IT/OT estate in AMP8/AMP9.

AMP8 Strategy

AMP8 presents the opportunity to invest in the key initiatives that were deprioritized from AMP7 investment. It also presents an opportunity for us to embed as business as usual some of the proof of concept innovations delivered through the bluewave Innovation Hub in AMP7. Examples could include a single integrated real-time model of the operation, machine learning and artificial intelligence, customer virtual assistance, augmented reality, to the potential application of blockchain for peer to peer device authentication. We will also seek to exploit the potential of the Internet of Things (IoT), such as streaming data from asset sensors to get the most out of our assets. As well as continue to build on access and trust of technology (IT/OT/Data), to enable the business to deliver customer outcomes and efficiencies at best value. AMP8 will need to continue with the sustained investment in the underlying Core IT technology infrastructure, networks and analytics to support of all five of our transformational programmes such as Network 2030, Sustainable Drainage 2030, Resource Hubs, Catchment First and Target 100.

AMP9 Strategy

Technology is fast-moving, and it will be crucial that AMP9 sees the continued, sustained investment in IT/OT to support the needs for real-time operational control, collaboration and coordination, and the longer-term concepts of ‘smart’ whole-system thinking is increasingly needed across utilities, networks, regional/national areas and cities. With the impact of population growth, environmental factors and climate change our investment plan will continue to invest in cutting edge and emerging technologies as both pilots and as part of business as usual. At the heart of our approach will be to maintain an agile and flexible IT/OT estate to support the ongoing transformation of our business capabilities to respond to multiple external and internal pressures, risks and factors.


Use of Market Mechanism In AMP7 IT plans to leverage and make the best use of external markets with a view to further improve customers’ priorities and outcomes. How and for what purpose we propose to leverage external markets is as follows: -

How Southern Water will ‘deliver’ - There is recognition that, to deliver the ambitions and

goals set out within the PR19, support of the right combination of external skills will be required. When external assistance is required, we will undertake a competitive tendering process to safeguard customers’ interests and to select the right parties with the relevant know-how and experience.

How Southern Water will ‘innovate’- As mentioned in the AMP7 innovation section (5.3) of this technical annex, engaging stakeholders is an integral driver and enabler for innovation. Our IT function and ‘bluewave Innovation Lab’ will proactively engage with stakeholders in the development and delivery of proof of concept solutions.

How Southern Water will ‘inform’ - The pace of technology alongside other market drivers is

impacting key decisions around what and when investments are required. We seek to continue to be informed of external drivers, market trends and the implications to utilities. We propose to actively participate and lead discussions around key industry topics across both forums and conferences. An example of a key working forum our IT function participates in is the National Cyber Security Centre. Within this working group topics around the latest cyber threats, best-practice and lessons learnt are discussed.

12. Costing Strategy Our PR19 IT technical annex and costing strategy is focused on delivering enterprise platform capabilities rather than point to point solutions to fixes and issues across the IT/OT estate. This platform approach will serve to rationalise applications, reduce technical complexity and support a more agile and flexible architecture to support enterprise business change as required as the internal and external environment demands Our PR19 costing strategy considers the efficient and timely investment in IT/OT to minimise regret spend and maximise the return on investment for our customers. We considered cost efficiencies by reviewing customer priorities and needs with the following options in mind: - Re-architect / remediating /refactoring - re-engineering legacy systems to deliver more

modern performance and interoperability without the need for re-platforming or replacement. Re-platforming - “lifting and shifting” systems from high-cost hardware or out of support

applications to cloud/non-cloud systems and platforms using commoditized technologies where appropriate.

Replacing - deploying entirely new solutions and platforms that provide off the shelf capabilities rather than point to point fixes.

Retiring - decommissioning applications/tools/ databases that have become redundant. The costing and assurance approach taken will be discussed in detail below.


Cost approach This technical annex has applied a robust costing approach to identify budgetary technology spend associated to delivering customer needs and outcomes across the AMP. Our approach aimed to ensure that there are minimal unfunded gaps or duplicate spend within our technical annex. The iterative costing approach applied for our PR19 technology technical annex is illustrated in figure 20 and is discussed in further detail below.

Figure 18: Cost analysis and approach cycle

Historical and Actual Cost Analysis

To understand the current level of Capex and Opex spend, a detailed review of the AMP6 actual and forecasted spend was undertaken. This analysis included drill downs into the Capex and Opex spend composition to enable the identification of unit costs. The identified unit cost relevant for future areas of investment due to new or existing capabilities formed the baseline data set as part of the ‘bottom-up costing analysis’. Asset cost models (Pioneer and Scheme Builder)

A detailed review was carried out across the of pioneer and scheme builder cost models to identify and eliminate duplicate spend for OT related investment. Our review analysed over 20,000+ line items within the models followed by multiple workshops held with key business and PR19 stakeholders over the course of three months. Bottom up cost-analysis

Where possible, initiatives would be costed up based on bottom-up analysis, leveraging historical unit cost spend data e.g. refresh of end user computing (laptops), insourcing of activities (e.g. average labour costs).

Top-down cost analysis

Where internal spend data was not available, technology initiatives were costed based on a high-level set of needs. From these needs, indicative costs were modelled based on what other organisations (utilities and non-utilities) are spending to deliver a similar scope of work and set of capabilities. Finally, several technology options were considered to provide an indicative Totex spend profile across AMP7.


Industry benchmarking

The total technology investment spend, including both the bottom and top-down spend analyses, was benchmarked against comparable utilities to validate the total cost of ownership in delivering the technology initiatives.

Options and priorities

Investment being considered for PR19 and beyond was prioritised based on a business need. Each need was then tested with the business to understand the implications and so-what of i) ‘not doing it’; ii) the scale of the initiative being proposed; and iii) the timeliness of the need. This approach has ensured that the final PR19 technology investment proposed was customer centric and value for money. Stakeholder assurance

As previously mentioned, all IT initiatives are based on a set of high-level customer priorities, and needs raised by over 120 stakeholders (internal and external). A robust cost assurance process was then undertaken internally with members of Southern Waters Executive Leadership Team, the board and by third party experts to further priorities spend and reduce overall scope.

Cost assurance Additional assurance reviews were conducted by third party experts to assess the credibility of the technology cost estimates that constitute the business plan. Accenture, provided exemplar and budgetary cost analysis for needs across the wholesale

controls and corporate functions where there was no available internal cost data available.

PWC, provided exemplar and budgetary cost analysis for the IT initiatives proposed across the

retail controls.


13. Deliverability of AMP7 proposals To develop the PR19 delivery plan our initiatives were assessed to ensure that they can be delivered within the financial, technological and operational constraints while maximising the value and benefit to the customer. In understanding deliverability, four key considerations were made: Can high-value initiatives be accelerated to maximise technology-enabled value to our

customers? What is the best practice example from industry (Utilities and beyond) can we use to validate

the proposed timescale and activities? What technology and business enablers are needed to support the key transformational

initiatives within the PR19 business plan? What are the internal and external factors that prevent excellence in IT delivery?

The approach and delivering the plan will be discussed in the sub-sections below.

Deliverability Approach Customer Priority

To ensure the delivery plan considers the customer priorities first, a “Shift Left” approach has been taken to accelerate work. This ensures that the delivery of any initiative that provides critical enablers to the customer or southern water’s business is accelerated. For further details on the roadmap please refer to section 7.2 Consider Industry Good Practice

To help us to validate the deliverability of our technical annex, we used industry exemplary case studies to benchmark our delivery plan against the expected timescales, delivery models and end-to-end activities required for a successful delivery where possible. Technology Assumptions and Dependencies

It is critical that we consider the current estate when planning for future delivery. In certain areas, we may need to develop cautiously to protect our customers and infrastructure, whereas other we can be bold and make significant transformation changes. To ensure that our technical annex is deliverable, we captured the assumptions and enablers associated with each technology initiative. This included, but was not limited to, technology platforms, technology infrastructure and technology operating model pre-requisites.

Business Assumptions and Dependencies

A key challenge to effectively delivering IT initiatives is having the availability of business resources for two reasons: Firstly, to support the delivery of the new technology or process; Secondly to adopt absorb and maximise the new system and applications. To ensure that our technical annex is not only technologically feasible, we considered a manageable rate of business change based upon the number of business users impacted and business users involved in the delivery of the plan.

Proposed roadmap and plan As mentioned in our approach to developing the plan, we acknowledge that technology cannot operate in a vacuum and that technology is closely tied to the business operations, services and processes they support. As such the proposed roadmap moves in concert with the business and is aligned with the overall AMP7 plan to ensure that IT can support our customer outcomes, long-term goals and five transformation initiatives (refer to figure 20).


Figure 19: PR19 Technology Investment Roadmap by work-package

Delivering the plan

As illustrated in Figure 22, there are five factors in our ‘new journey to delivering technology’ in

Southern Water, these are: -

New Business Value

Governance and operating model

New enterprise architecture

New methods and tools

New technology

Each of these will be discussed in further detail below and consider our past performance, lessons

learnt and ambitions for AMP7.


Figure 20: our new journey to delivering IT

New Business Value

Part of the new operating model and governance control measures is the principle of ‘value driven IT’. This is the principle that If we cannot identify how any form of IT investment will deliver value to the customer in either the short to long-term, whether its innovative or not, then we will not proceed with it. This is the case for potential investments in the IT and OT space. For this reason, we are proposing to centralise the spend of IT, OT and telecommunications under IT services, as per the scope outlined in section 2. However, IT and Data cannot deliver new business benefits and value in isolation. To realise the full potential of our proposed technical annex, a core IT-led change management function is needed.

1.1.1.8 The role of change and enablement

It is very rare for companies to realise the benefits of both tactical and strategic technology investments over time without an integrated business change management effort. We are proposing in AMP7 to promote success in IT Delivery by gaining the acceptance and support needed to sustain lasting change by the following measures (not limited to): Providing a clear understanding as to the impact of IT across people and process. Provision of focused and timely communication that explains to our internal customers what a

change will mean for them in their day to day interactions of IT/OT systems. Emphasis on the importance of data and creating a sense of ownership within the business as

to its overall quality.

Our approach will be to build commitment to the change rather than simply “compliance” so that our customers embrace and use the deliverables of the IT as designed rather than


reverting to old habits and behaviours. Collectively, these activities will be managed and delivered like any other aspect of a project delivery plan.

Governance and operating model

In the face of the current state of IT and the external market drivers, we recognise that the success of our AMP7 ambitions for IT will go hand in hand with how we govern and operate IT and Data as shared services. The core elements of our governance and operating model are: -

Two speed delivery models and our partners; Demand management; Focus on insourcing core delivery activities;

1.1.1.9 Two speed delivery models and our delivery partners

As described in the previous sections, to deliver our AMP7 ambitions, address our legacy IT/OT estate and to enable the business, a two-speed operating model is required. Our two-speed operating model enables the flexibility to operate at different paces of technology transformation. This means being able to support the day-to-day steady state of systems maintenance while simultaneously delivering the multitudes of other projects moving at different speeds. As per section 5.5, we recognise that right combination of external skills will be required to support both the steady state of systems needing to be maintained and in delivering key transformation projects.

1.1.1.10 Demand and portfolio management A key factor to enable us to keep momentum in AMP7, is by matching the speed of technology to the speed at which the business needs to consume it. While our customers will want us to move at full speed, our governance and operating model plays a critical role in us finding the right gear that matches both being able to enable the business, stabilise the core and innovate. Recognising this, we have embedded both IT business as usual as well as in our Innovation delivery model a demand and portfolio management process. This capability, is supported by our IT Business Partner Managers to coordinate and support the multitude of requirements spanning legacy to the

new requirements.

1.1.1.11 Focus on insourcing core delivery activities

In AMP7, we are seeking to strategically insource many of the core IT and data related activities within Southern Water thereby enhancing knowledge-based value-add capabilities, reducing the reliance on third-party proprietary skills and ultimately delivering high quality IT services more cost-effectively. In doing so we are determining where the new skills are required to support our multi-speed agenda. Identifying individuals with the right skill sets in methods like waterfall, agile to new tools and techniques like DevOps etc.

New enterprise architecture

As part of this investment transition, our investment seeks to develop a flexible and modular technology architecture that is designed to adapt and adjust quickly to changes in both business and technology demand. Our architecture strategy seeks reduce the risk of regret spend whilst providing a platform in which future technology options can readily integrated. Legacy simplification offers an architecture to support our ambitions for AMP7 and beyond whilst also delivering total cost of ownership benefits. In turn, this allows us to invest in new technologies


and is critical to delivering our core IT transformation. Having a simpler architecture will enable us to deliver IT at pace and will reduce pressure on resources with scarce skills. Furthermore, we are proposing to introduce application programming interface (API) layers to expose the core data sources enabling new digital channels and the creation of new resilient ecosystems This increasingly self-serve model—which even extends into developing applications and preparing data for analysis—may relieve some of the demands on an IT team, or it could mean added complexity and more moving parts to manage

New methods and tools

To support the deliverability of our AMP7 technology investment we seek to adopt new delivery methods and tools that will the robust delivery of our projects and programmes. We strive to: Build and stabilise our IT services, technologies and existing capabilities Transition the people processes and technologies that are currently operated by our third-party

partner Transform and enable our business with technologies and capabilities to drive and realise our

benefits plan To achieve this, we must have the delivery tools and methods in place enable IT and the business to implement excellent solutions.

1.1.1.12 New Delivery Methods In AMP7, we will use a blend of different delivery approaches and ways of working that focus on

using the appropriate methods for each delivery to bring business and development together,

focusing on delivery robust solutions. For example, using scaled hybrid agile delivery models

deliver iterative solutions such as a website or digital based technology, while keeping traditional

waterfall practices for large-scale implementations such as operational asset management.

To complement our methods, our strategy intends to govern IT programme and portfolio

management through a centralised project management office (PMO). The centralised PMO will

provide and coordinate the appropriate levels of governance, project, risk, quality assurance and

change management across programmes. This proactive governance model enables excellence in

IT portfolio management and programme delivery.

1.1.1.13 Tools and Accelerators

To inform and enable our programme delivery, our strategy looks to use emerging technology tools

and accelerators thereby providing automation and expertise to our project teams. The key

examples within our strategy are the desire to establish and maintain a DevOps capability and

testing centre of excellence that provides services to our business.

New technology

Our commitment effective and efficient service delivery in the future relies on the use of right technology pave the way to stabilise our technology infrastructure and enable our business to operate more efficiently in the future. We are proposing in AMP7 to leverage technologies to underpin success in IT delivery. For example: Cloud and non-cloud infrastructure to provide a balance of control and security over our data

and integration;


Integrated platforms and ecosystems to provide flexible interconnectivity between applications across the IT estate;

Information Security platforms to support our systems against cyber and physical threats in the future;

Data management tools and platforms to inform and enable our business during and after delivery.

For further details on our approach to Innovation and the potential modern technologies that are in our pipeline of investments please refer to section 5.3 and the Innovation OFWAT Chapter.

14. Deliverability assurance Due to the ambitions of the PR19 business plan and the proposed technology investment, additional assurance reviews were conducted by third-party experts to assess the credibility and deliverability of the plan.

CIO of a national infrastructure company as part of the PR19 challenge panel (CCG), reviewed the deliverability of the technology plan and confirmed that “during a 3-hour deep dive into the IT plan, it was clear from my perspective, that SWS recognise what can be done in the short and medium term. The proposed plans are very sensible and deliverable”;

Accenture, Letter of Assurance (dated 10th August 2018)


15. Key Risks & Opportunities We have identified a total of 13 risks and 15 opportunities in delivering the proposed Technology Investment plan. In the sub-sections to which will be discussed in detail in the sections below.

Key Risks 10 key risks and mitigations have been identified for the proposed PR19 Technology Investment during AMP7. These key risks have been considered alongside OFWAT’s nine test areas: -

Table 13: Key risks associated with our technology investment plan

Risks Mitigation and Controls

OFWAT Test Area Risk no

There is a risk that… event

Leading to… consequence

Because of… Mitigation

1

Our third party / supply chain providers are GDPR non-compliant.

One or multiple penalties being issued to our business at 4% of Net Revenue per Fine

Third party supplies hold customer data that is not complaint with the GDPR directive

All third parties will need to agree as part of their contractual arrangements to appropriate GDPR and customer data contract provisions.

Engaging Customers

2

Customer data (including vulnerable customers) may be impacted by the IT transformation programme e.g. unsuccessful migration to the new IT estate/applications.

Potential loss of customer data including vulnerable customers.

Customer data being stored in multiple bespoke IT and OT applications / tools.

We will deploy a robust implementation and data migration approach as part of any IT transformation programme of work.

Addressing affordability and vulnerability


3

Our Business requirements and needs evolve or change during the AMP due to internal and external market drivers

Leading to potential initiatives being re-scoped from AMP7 post a re-prioritisation of spend activities.

The cause of new requirements can be driven by the following (not exhaustive): - - New regulation (incl. Brexit); - Legal Notice - New value case or threat identified - Unplanned climate

and environmental challenges

Across the AMP, our primary priority is to support the business and deliver the proposed capabilities and technology related initiatives. In the event of new requirements or significant changes, we propose to proactively engage OFWAT and our customers during AMP7 notifying them of any impacts around changing requirements during the AMP. We will also start to implement a modular and flexible IT/OT architecture to reduce the impact and associated costs of changes in direction. Please note - we will re-prioritise any new needs with our business against our current initiatives to minimise the risk of spend increasing, whilst

Delivering outcomes for customers


looking for opportunities that manage our total cost to serve to our customers.


4

Our business and / or third parties integrated into our ecosystem incur a cyber security breach directly or indirectly impacting our business (NIS).

One or multiple penalties being issued to our business at 4% of Net Revenue per Fine and/or Unknown cost associated to cyber security threat.

An increase of cyber security threats/incidents expected across critical national infrastructure.

Our investment plan takes a more holistic approach to cyber and physical security. This includes reviewing our extended supply chain and associated contractual arrangements For further information around our proposed resilience measures please refer to section 5.5 in the Technology Investment Technical Annex.

Securing long-term resilience

5

Innovation may be perceived by wider industry to only regard something as being 'innovative' when it involves a pilot or implementation of the latest novel technologies e.g. Artificial Intelligence.

Missed opportunities to also address day to day challenges through simple ‘innovative’ approaches (e.g. process, culture) and doing the basics brilliantly that will deliver tangible business value.

Innovation not fully capturing the voice of the customer (internal and external) and/or being value focused.

An Innovation Governance will test the ideas generated against several success criteria, including alignment to customer-related targets and measures where appropriate. Innovation within our business will look at both growing/enhancing core capabilities and at disruption.

Targeted controls, markets and innovation


6

The implementation costs of IT/OT and data are higher than forecasted.

Leading to potential initiatives being de-scoped from AMP7 post a re-prioritisation of spend activities.

Currency fluctuations. and/or Poorly defined business requirements contracted for resulting in re-work or additional change requests.

Rigorous demand management processes leading to improved visibility of needs, risks and deliverability prior to initiative execution Close working with procurement to factor in the appropriate safeguards.

Securing cost efficiency

7

The Business is not able to cope with the level of transformation required.

The Business is not able to cope with the level of transformation required, resulting i) delays to initiatives and ii) lower benefit realisation than expected.

The scale of Technology and business Transformation required across the organisation being significant and only being successful is business change and adoption is successfully undertaken.

A detailed roadmap has been developed as part of PR19 with programmes of work and initiatives prioritised based on value and deliverability. This will ensure business change and governance is factored in. We propose to also develop a Transformation delivery arm incorporating business and IT working outside of BAU activities. Finally, several key data and IT initiatives are already underway and will be complete by the

Accounting for past delivery/Resilience


beginning of AMP7 to minimise business impact and maximise value across the AMP for our customers.

8

The new Target Operating Model (TOM) for our business is still in progress.

A lack of IT/OT, business and Data governance as RACI, measures are not clearly known and defined. Resulting in the continuation of un-controlled shadow IT spend and/or “Regret spend”.

A lack of engagement and cultural resistance in adopting and embedding ways of working and TOM.

TOM is implemented pre-AMP7 including new ways of working, governance, clarity in RACI, updated vision, strategy, standards and policies.


9

IT will not have the right skills and appropriate capabilities in place by AMP7 to deliver the overall scope (insourcing of skills)

Potential delays to insourcing, and/or increased Totex pressures due to extension of contractual arrangements, and additional resource

IT has not been able to recruit / upskill the right resources to deliver the plan at the right pace required

During AMP6, as part of our overall TOM restructure, we have begun to re-align internal resource and capabilities.



required from third party contractors.

The Data Team Transformation began over 12 months ago, with the sole objective of readying SW for the next AMP. This initiative is on track to reduce headcount and increase capability, whilst still maintaining day to day operations. For those skills and capabilities currently not within our business, we have begun in FY18 to recruit for positions. We have a defined transition plan in place and being executed to underpin required insourcing activities

10

IT does not have the ability to assure technical roadmaps, or architect options for delivery leading to decreased confidence in our function

A lack of Enterprise Architecture, solution architecture and technical assurance has led to a complex technical landscape with low levels of technical delivery success

IT has not had a strong architectural function to provide control of the architecture or provide technical assurance and confidence in IT delivery

IT is implementing a new target operating model which has put in place a new enterprise architectural practice. This will be used to set technical direction, solution new requirements and provide

Securing confidence and assurance


technical assurance to improve confidence in IT


Key Opportunities 14 key opportunities have been identified for the proposed PR19 Technology Investment during AMP7. These opportunities have been considered alongside OFWAT’s nine test areas: - Table 14: Key opportunities associated with our technology investment plan

Opportunity OFWAT Test

Area Opp #

There is an opportunity that… event

Leading to… consequence Because of…

1

We plan to continue in AMP6 and beyond to engage with industry stakeholders (customers, academia, digital start-ups, delivery partners) to co-create solutions for current and future challenge areas. An example of such engagement can be seen through our DataWell initiative or similar initiatives deployed by Network Operators in the UK e.g. NIC/NIA18.

The co-creation and collaboration of ideas and lessons learnt with both customers and wider industry to deliver outcomes that society value. Minimising the potential for our business and other water utilities investing in opportunities that result in regret spend and/or resulting in ‘re-inventing the wheel’ type spend.

We want to be transparent with customers around the investment being made in technology solutions. Realising these benefits through the investment made though the ‘digital and collaboration’ work-package.

Engaging Customers

18 Network innovation allowance and Network innovation competition – OFGEM innovation initiatives, for further information please go to www.ofgem.gov.uk

http://www.ofgem.gov.uk/


2

We plan to continue to invest in supporting customers though digital and non-digital customer centric solutions. Proactively improving accessibility and support for all customers including those in circumstances of vulnerability and/or affordability.

A tailored customer interaction experience that provides the flexibility for the customer to choose how they wish to engage and interact with us.

Providing ease of access to information and available support that is both relevant, personal and timely 24/7, 365 days a year.

Realising these benefits through the investment in the following (not exhaustive): -

Wholesale case management;

Digital collaboration work-package;

Retail transformation.


3

We invest in greater operational insight and control across our network to better identify and prioritise the resolution of unplanned outages that will consider the impact to vulnerable and high-priority registered customers.

Improved customer response for vulnerable customers in the event of unplanned outage.

Realising these benefits through the investment in the following (not exhaustive):

Operational asset management;

Information lifecycle management;

Driving insight with data;

Operational real time control and monitoring;

Wholesale case management.


4

The proposed technology investment will deliver improved outcomes for customers through the following:

improving efficiency and effectiveness of our operation;

Improving overall productivity/quality of works delivered; and

Cost benefit e.g. avoidance of fines, business process improvement

Delivery of customer outcomes through improved quality of services and/or improvements in efficiency.

Identifying and realising these benefits through the investment in all the proposed programmes of work and work-packages. Assessing and validating as part of demand and portfolio management processes

Delivering outcomes for customers


5

Our investment delivers resilience in the round by improving the overall state of IT estate and security.

Improvement in corporate resilience. Investment in the following corporate resilience measures, including: 1. Information Security 2. Application Transformation 3. Core IT


6

Our investment delivers resilience in the round by improving the overall state of IT/OT and Telecoms.

Improvement in operational resilience.

Investment in the following operational resilience measures including: - 1. Critical monitoring and instrumentation replacement 2. Telemetry system replacement 3. Network communications and IT infrastructure replacement 4. Operational Asset Management Systems 5. Information lifecycle management 6. Operational real time control and monitoring7. Work, Asset resilience and compliance


7

Our business can deliver resilience in the round by improving how internal/external customers understand the company’s corporate financial structures and how they relate to its long-term financeability.

Improvement in financial resilience and reduction in overall cost ownership

Investment in the following financial resilience measures including: 1. Commercial Services 2. Human Capital Management and Finance Securing

long-term resilience


8

IT and data services will continue to proactively engage with stakeholders both within and outside of the industry to improve and accelerate value realisation.

Opportunities to collaborate on proof of concept ideas as well as the sharing of lessons learnt to reduce the delivery risk of IT/OT initiatives.

The proposed approach of engaging the industry and working with our ‘bluewave innovation lab’.


9

We plan to leverage the market mechanism where and when appropriate to identify proven delivery partners that will support us in the successful delivery of technology initiatives (IT/OT/Data).

The opportunity to re-align current and future delivery partners to the AMP7 outcomes and measures.

IT procurement activities requiring delivery partners to showcase value for money and how they are aligned to our customer priorities and long-term goals.


12

The additional investment being made in the last two years of AMP6 will set some of the necessary foundation in place ahead of the proposed AMP7 investment.

The delivery risk to lower and return of IT investment being maximised, with key initiatives prioritised seeking to deliver value early in the AMP7.

A ‘shift to the left approach’ has been taken to help maximise the value and benefits that technology will seek to unlock value, for both internal and external customers The proposed roadmap and detailed delivery plans for IT/OT/Data investment considering factors to align risk and return including:

Value and customer outcomes;

Dependencies and assumptions;

Deliverability and lessons learnt.

Aligning risk and return

13

We plan to continue to improve the state of IT/OT and data to deliver customer outcomes, recognising past delivery and the lessons learnt across AMP6.

Delivery of customer outcomes through improved quality of services and/or improvements in service efficiency and effectiveness.

An understanding that we must first lay the foundation of our technology infrastructure before we can truly transform our business.

Accounting for past delivery


Our AMP7 investment presents an opportunity to future proof our technology for future AMPs.

14

The investment being proposed will develop capabilities across a flexible and modular architecture.

An IT/OT estate that is cheaper and more flexible to maintain in the long-term. Securing confidence that the investment being proposed minimises regret spend and is more resilient in the round and able to more effectively address changing requirements in the long-term.

The proposed approach of using centralised IT enterprise architects guiding and supporting the business in their decisions on technology solutions.

Securing confidence and assurance


Appendix 1: Projects and Schemes Table 15 below contains the projects and scheme breakdown for our PR19 technology investment.

Table 15: Key opportunities associated with our technology investment plan19

# Work Packages AMP7 Totex

(£ms)

5 Year Amortised expenditure

1 Critical monitoring and instrumentation £17m £3,4m

2 Telemetry systems transformation £5m £1.0m

3 Network communications and IT infrastructure

£9m £1.8m

4 Operational and asset management systems £36m £7.2m

5 Information lifecycle management £8m £1.6m

6 Application transformation £49m £9.8m

7 Core IT £170m £34m

8 Information security £24m £4m

9 Driving insight with data £17m £3.4m

10 Operational real time control and monitoring £15m £3m

11 Wholesale case management £4m £0.8m

12 Work, asset resilience and compliance £6m £1.2m

13 Engineering and construction £5m £1m

14 Commercial Services £4m £0.8m

15 Human capital management and finance £6m £1.2m

16 Digital and collaboration £8m £1.6m

17 Waste and Water transformation £2m £0.4m

18 Retail transformation £29m £5.8m

Totals £414,000 £82,800

19 Technology investment project schemes have been sourced and reviewed with finance in the context of the PR19 plan as a whole

PR19 Technology Investment Gold Technical annex Highly Confidential


Appendix 2: Further Information The appendix covers additional content that is intended to support the core technical appendix. This includes:

Glossary of terms PR19 business strategy & IT alignment



Glossary

Glossary Terms Definition

Active Network Management

Proactive management and monitoring of water and wastewater network production, capacity, and flows.

Advanced Analytics Advanced business intelligence that seeks to model and forecast events based on complex datasets

Application Rationalisation

Where possible consolidating applications and licences to reduce the total number of applications and subsequently the total cost of ownership of the IT estate

Application remediation Where possible upgrading application to ensure they maintain

Artificial Intelligence/Machine Learning

The development of systems and applications that are able to perform tasks “intelligently” . Typically achieved using machine learning algorithms to train applications

Asset models (e.g. pioneer and scheme builder)

Pioneer and scheme builder are the top down and bottom up asset investment tools used to develop our estimate and develop our asset business cases

Augmented reality An interface or screen that is capable of imposing computer-generated images onto a user’s real-world view

Business continuity management (BCM)

The maintenance and management of business and technology capabilities under challenging circumstances such as emergency, crisis or disaster.

Big Data The practice of using large data sets to drive business insights and decision making.

BIM Business Information Modelling the tools and capabilities to produce a digital representation of physical and functional characteristics

Blockchain An emerging distributed ledger technology capable of capturing and recording transaction that a crucially stored across one or mode nodes.

Business Enablement Technologies that extends the businesses current level of capabilities, such as providing an improved design modelling tool

CMA Competition and Markets Authority

C-Mex Customer Measure of Experience

CMF OFWAT Company Monitoring Framework – Framework to ensure companies are employing the high-standards of assurance expected by OFWAT

CNI Critical National Infrastructure. The assets and services that are critical to the functioning of society.

Coe Centre of Excellence: a centralised business capability that provides the expertise, equipment and technology to support a niche function.

Core IT Applications, IT infrastructure, resources and processes necessary to support fundamental day-to-day business activities. For example, end user computing laptops and mobile phones

CRI Compliance Risk Index



Customer virtual assistance

Automated application-based customer service assistants that act as a primary line of engagement for customer’s with less complex requests

Cyber Threats Internet based threats to information security

Data Exploitation Capitalising and maximise upon the value within our data

Data Science A field that uses scientific methods, algorithms and processes to extract knowledge and actionable insights from data.

DataWell The collaborative initiative between Southern Water, Water Companies, Regulators and Google to share data on water quality and spills

External Customers The customer of Southern water who are using our services in the South East

DEFRA Department of Energy Food and Rural Affairs. Holds responsibility for guidelines on Conservation, Access and recreation reporting

D-Mex Developer Measure of Experience: introduced by OFWAT in PR19

DWI Drinking water inspectorate: A key regulatory of the water industry

EA Environment Agency: A key regulatory of the water industry

EAM Enterprise Asset Management: A core application for all asset-organisation. Use to hold and manage information on assets across the estate.

Enterprise Architecture An IT Function that provide guidance and advice on the organisation-wide

ERI Event Risk Index: Introduced by OFWAT in PR19

E-services platform Our digital portal deployed in AMP6

Extranet The primary Southern Water websites and accessed by third parties and our customers

GDPR General data protection regulation introduced in 2018. This has a significant impact of data management and data protection practices

GIS Geographic information systems: Used to capture and manage the location of assets

HCM Human Capital Management: Applications and processes used to manage the core corporate human capital functions

HMI Human Machine interfaces

Hub and Spoke Model Business model that uses a centralised business capability to provide specific services to multiple business areas.

Internal Customer Our internal staff, employees and colleagues within Southern Water

Intranet The internal pages and sites used by for internal functions within Southern Water

Internet of Things (IoT) The interconnection of many ‘smart’ devices via the internet. This is a key trend across industries.

ISA 95 / ISA62443 The international standards for automation for developing an automated interface between enterprise and control systems

IT

Information technology includes the use of systems to manage business information and office functions. For example: servers, software applications, office telecommunication networks, end user computing and peripherals used.



IT/DATA Operating Model

The culture, structure, process and leadership mindset used to run business capabilities and prepare for future success

KPI Key performance indicators

Logical Security The security associated with user access rights and passwords for applications, sites and data.

NIS Network and Information Systems regulations

OEM Original Equipment Manufacturer

OFGEM The Office of Gas and Electricity Markets

OFWAT The Office of Water Market Regulation

Operating model The functional representation of how a function (Or organisation) is structured to provide a defined set of capabilities

OT Operational Technology the hardware and software used to monitor and control field devices and equipment such as SCADAs and HMIs

Outsourcing IT operating model where function operated by third parties.

PCC Per Capita Consumption – A key metric of domestic water consumption

Physical Security The security associated with the physical access to sites, hardware and equipment. For example, access to a treatment works, the remote-control centre, or Southern Water’s data centres.

PLC Programmable logic controllers

PoC Proof of concept

PR19 Price review cycle for planning investments for 2020-2025

Production Planning The modelling and planning of the water and waste across our infrastructure. Used to forecast and predict where operational issues might occur.

RCC Remote control Centre that supports, controls and manages the operational assets

Refactoring The restructuring and continuous improvement of technology to optimise performance and operations.

Replatforming The transition between infrastructure platforms or delivery models. Typically, from local hosting to cloud based or vice versa.

Risk Posture Stance and position to level of risk

Robotic process automation

Software that can be programmed to do basic application-based tasks in the place of a human. Typically, administrative or repetitive tasks are candidates for automation.

SAP Vendor of the core enterprise resource planning, billing system and customer relationship management systems

SCADA Supervisory Control and Data Acquisition systems

Shadow IT Investment in acquiring, developing and/or operating IT solutions outside the control of a formal IT organization

Technical Security The security associated with protecting information and operational technology from technology-based threats.

Technology Infrastructure

The technology infrastructure is our organisation’s hardware, software, networks, data-centres, facilities and related equipment that is used to manage, maintain, and develop our technology estate



Technology Architecture The technology estate structure, model and specification

Two-speed IT Two speed IT enable IT function to decouple high-speed digital technologies (Such as customer facing apps or websites) and legacy systems. The benefits of a two speed

Upstream Competition Upstream services are those that the customer doesn’t see and that typically require lots of assets to provide (pipes, sewers, treatment works)

Whole System/ System Thinking

System thinking is a method of critical thinking by which you analyse the relationships between the system's parts in order to understand a situation for better decision-making. The essence of systems thinking and practice is in 'seeing' the world in a particular way, because how you 'see' things affects the way you approach situations or undertake specific tasks.



PR19 business strategy and IT alignment The full PR19 business strategy and IT alignement is shown in figure 23 below.

Figure 21: Full alignment of the AMP7 work-packages with our IT Strategy

Documents

TA 12.MG02 M&G Data and Technology Business Case€¦ · As an enterprise shared service, IT indirectly supports our business across all of our performance commitments either through