API Governance
8 likes6,126 views
The document outlines an API governance framework consisting of 6 key components: 1) API Organization to establish guiding principles, roadmaps, funding models, roles and responsibilities. 2) Policies, procedures and standards for operating models, best practices and API development guidelines. 3) Risk controls for regulatory compliance, security controls and risk adjudication. 4) Technology and platforms including service gateways, registries and reference architectures. 5) Vendor management for 3rd party relationships and data ownership implications. 6) Change management to address business impacts, communications and API marketplace updates. The framework provides governance for API teams to deliver solutions within organizational risk appetite.
API Governance
- 1. API Governance Risk and Control Consideration “Governance should make it easy for people to do the things the right way and hard for people to do things the wrong way.”
- 2. 2 Lifecycle Management 1. API Organization a. Guiding Principles b. Business Road-mapping & Inventory c. Funding Model & Monetization d. Operating Model e. Roles & Responsibilities f. Decision Rights g. Syndication Model h. API Ownership & Accountability i. Define metrics j. Lifecycle Management API Governance Framework 2. Policies, Procedures & Standards a. Operating Model b. Roles & Responsibilities c. API Ownership & Accountability d. Best Practices e. API Development Guidelines f. Cataloging & Classification g. API Ontology 4. Technology & Platforms a. Services Gateway b. Services Registry & Catalogue c. Information Model d. Development Model (Int. & Ext.) e. Best Practices f. Reference Architecture Blueprint i. Conceptual & Logical Layers g. Sustainment h. Containerization Vision & Strategy 6. Change Management a. Business Impact & Readiness b. IT Operations c. Stakeholder Management d. Communication & Training e. API Market Place Updates 5. Vendor Management a. 3rd Party API Vendor Relationships b. Data Ownership & Privacy c. Legal Implications Foundational Infrastructure Services Platform Services Layer API Consumers API Providers Discovery Catalogue Versioning Authentication Entitlements Discovery API Ownership Data Standards Data Ownership API Lineage Controls Risk Ownership Deviation Process 3. Risk Controls a. Regulatory Compliance b. Information Security Controls c. Risk Adjudication d. API Controls Frameworks e. Controls Automation CI/CD f. Continuous Controls Monitoring Business Process Architecture Provides a governance framework (ring fence) where each team can operate in an agile manner and deliver solutions in line with the organizational Risk Appetite.
- 3. 3 API Governance Operating Model Notional Functional Organization to enable the success of the API strategy. API Organization Team Policies, Procedures, & Standards Risk Control & Security Stakeholders & Executing Steering Committee Technology & Platforms Vendor Management Change Management Set Vision & Strategy 1 API Lifecycle2 3 4 5 6 Guiding Principles, Roadmaps, Lifecycle Management Technology Enablement & Foundational Services Operating Model Governance, Controls, 1st Line of Defense Platform and Runtime Vendor Relationships Business Impact, Change & Communications
- 4. 4 Notional API User Community User Community Interactions. API Governance needs to account for the different types of interaction scenarios and related to controls in each scenario and interaction point. API Developer. Other API Developers will incorporate API into their Code base. (Partners & Trusted Developer) Mobile Platform Users who consume and incorporate API data into their App Development API Consumer 3rd Party Consumer API Eco-system API Producers API Consumers Internal 3rd Party API that Systems and App will consume 3rd Party APIs • Internal Developers • Partner Developers • External Developers
- 5. 5 API Power Plant Analogy – Vision of what we need to build and govern… APIs provide a simplified standard interface for users to access the power of Citi through foundational architecture and processes. Simple Standard Interface Abstracts Complexity for the User Monetization Metering Elasticity Controls Security
- 6. 6 API and Business Process Context There is a risk that organizations incorrectly treat APIs as independent entities; APIs should be identified and created within the context of a business process. APIs help the business process of the organization
- 7. 7 1.0 API Organization An API organization is needed to address the following: a. Guiding Principles: The guiding principles guide the development of an API organization to measure the effectiveness of APIs. Questions related to “what quantifiable business value, pricing model?” Guiding API producers to assess regulatory & reputational impact, reusability, naming convention, information model, standards based. Enable users to understand the business process to be enabled. Define common traits so that teams are not re-inventing the wheel repeatedly. b. Business Road Mapping & Inventory: Creates a multi-year roadmap with quarterly goals and update. Create execution plan with checkpoints to align with roadmap. Incorporate input from Stakeholders and Steering Committee. Identify Assets that really matter both from a Business Value perspective and Risk perspective c. Funding Model & Monetization: Translate Roadmap to funding model and monetization model for internal and external consumers. Do we have a model to capture the end to end lifecycle of the APIs? APIs provide a single end point and a splintered funding model can risk the success of APIs strategy. d. Functional Team Operating Model: Create and manage the Citi API Functional Team model and interactions (Slide # 3). Update functional changes and ensure communications and updates between groups. e. Roles & Responsibilities: Clearly outline and help manage the roles and responsibilities of Citi API ecosystem. f. Decision Rights: Formalized decision-ing rights as to who or what group that decides on make or break call. g. Syndication Model: Model for teams to pool resources, funding and shared model to API management - e.g. APIs can aggregate data from multiple distributed systems and data; this will bring to light support and issue ownership implications. h. API Ownership & Accountability: Translate/personalize the change to the impacts within their function/LOB. They are also the advocate - the go-to person within their function/LOB to understand the changes. i. KPI and Metrics Definition: Create KPIs to quantify business value and metrics that organizations can use measure progress. j. Lifecycle Management: In reference to Slide #3, own the “dashboard” around the management, care and feed of the end of the end lifecycle of the APIs.
- 8. 8 2.0 Policies, Procedures & Standards Responsible for Policy Creation, Procedure Documentation, and Standardization…. a. Operating Model : Do we have a set of questions that will guide the development of APIs and measure the effectiveness of APIs? For e.g. what is the business value and does it provide measurable business value? What is the regulatory impact, reputational impact? Develop naming conventions, informational model & standards. Which business processes do they enable? b. Roles & Responsibilities : Assign and identify roles and responsibilities within the API ecosystems within the context of the operating model. c. Best Practices : Translate Roadmap to funding model and monetization model for internal and external consumers. Do we have a model to capture the end-to-end lifecycle of the APIs? APIs provide a single end point and a splintered funding model can risk the success of APIs strategy. d. API Development Guidelines & Cookbooks.: Create API Development guidelines for the Business (Product Owners) and Development teams to build API using a standard Reference Architecture. Cookbooks outline step-by- step details on how to build APIs in a consistent model and ensure multiple teams can be leveraged to source and build APIs. e. Cataloguing & Classification: Similar to a book library, create the process to catalogue and classify the different types of APIs (business, infrastructure, partner etc.) based on a standard taxonomy. Ensure meta-data exists for ease of discovery and re-use. f. API Ontology Model: Building upon taxonomy we have a need to create an Ontological Model for APIs and their semantic relationships and dependencies.
- 9. 9 3.0 Risk Controls The 1st line of defense to help drive compliance and assure that necessary controls are in place… a. Regulatory Compliance: Understand the regulation implications of creating APIs. This is especially important when we start exposing APIs as public or partner end-points. b. Security Controls : Information Security guidelines and standards to ensure secured, auditable and hardened APIs in line with the Security Standards. c. Risk Adjudication: As multiple teams and groups build APIs, act as the arbitrator and adjudication agent to assign Risk from an enterprise perspective in line with organizational risk appetite. d. API Controls Framework: Develop Controls Framework that is based on the API architecture. e. Risk Controls Automation CI/CD: Build time injection of Compliance controls within the CI/CD process during the API build process. f. Continuous Controls Monitoring: Operational Monitoring of APIs during run-time: metrics gathering, analytics, monetization and value measurement.
- 10. 10 4.0 Technology & Platforms Foundational Technology Platforms that and architecture to enable the organization to realize API a. Technical Stack: Provide Technical Reference Architecture and stack to jump-start API development. b. Lifecycle Management: Foundational technology to enable Lifecycle management as outlined through the API Organization functional stream. c. Service Gateway: Gateway infrastructure to create secure API end points for managing consumers and producers. d. Service Registry & Catalogue: Registry for API and cataloguing method, naming conventions, policy management e. Information Model : Determine and publish a industry based Information Model that is line with Citi Data Standards. f. Development Model (Internal & External): Create environment for development and publishing of APIs, keeping in mind the different interaction paradigms. Manage a developer community to ensure API adoption and contribution. g. Technology Best Practices: Knowledge base of best practices to capture best practices and lessons learned. How do we build effective APIs? h. Reference Architecture Blueprint: Layered Reference Architecture that illustrates a multi-tier architecture e.g. Process Layer, Conceptual Layer, Logical Layer, Services, Platforms etc. i. Sustainment: Determine the process for sustainment of APIs based on SLAs. Sustainment should take into account a distributed support model (e.g. when an API aggregates data from other APIs or data sources). j. Containerization : Modular packaging of APIs and platform agnostic implementation (e.g. Docker)
- 11. 11 5.0 Vendor Management a. 3rd Party Vendor Relationships: a. API Vendors b. Technology Vendors c. Data Vendors b. Data Ownership & Privacy : Who owns the data? In a distributed data model, APIs could aggregate or translated data from various systems or perhaps consumed in various mobile apps. What happens when someone uses am API to build a mission-critical app and the API breaks ? a. Cross border movement of data: what are the implications of an API consumer from Europe using an API that has data from the US? Privacy Laws are relative to the geography you are in. c. Legal Implications : What are legal implications when APIs are consumed or produced in the API economy? How do things work in a partnership model? What are the legalities around using APIs from the social media or open source APIs? Vendor Management for APIs create new interaction points with partners, development teams and internal stakeholders….
- 12. 12 a. Business Impact of Change & Readiness: CM Process and impact on business, controls… b. IT Operations: Change Process centered around IT operations that support APIs. c. Stakeholder Management: Managed changes to API Consumers, Vendors, Steering Committee, Business Owners, Developer Community, Integrations. d. Communication & Training: Communication Plan and forum for changes being made, sunset APIs, data quality and training. Developer Training, API Community Support, market to deliver and create API eco-systems and build co- brand and brand recognition. e. API Market Places: API Content Management, Developer Communication, Partner Integration. 6.0 Change Management Address API Changes and Business Impact… *Source : IBM API Reference Architecture