Leading the charge: AIG CIO Mark Popolano's drive for infrastructure, storage and governance model changes, along with strengthening the relationship between IT and business, are helping the company maintain its position as a technology leader.

Since joining American International Group Inc. in 1995, Chief Information Officer Mark Popolano has seen a lot of changes and plans more to come. He's not only developing and maintaining disaster recovery, security and business continuity infrastructure; he also has redefined the company's IT governance model to support AIG's diverse business organizational models.

Popolano's implementations, which include a global program office, AIG's Office of the Chief Information Officer, and strict adherence to a governance model with worldwide technology standards and compliance, as well as financial reporting and tracking, continue to benefit the company. He leads AIG's team of divisional CIOs who manage IT infrastructure for AIG member companies worldwide.

Popolano also heads up AIG Technologies Inc., a provider of utility-based IT management solutions and professional services. As its president, he's responsible for overseeing the daily operational controls of AIG Technologies' Livingston, N.J., and Fort Worth, Texas, data centers to enhance the organization's global infrastructure and improve technology service levels.

During a recent interview, Popolano discussed several major technology initiatives he has planned for the coming years.

What do you hope to bring to your newly expanded position as CIO, and what prior responsibilities and past experiences have best prepared you for your new role?

AIG has implemented a multitude of strategies over the years, and this year we're driving at several main targeted areas. First is the redesign of our internal infrastructure, what we call "Next Generational Networks." This project includes building a network infrastructure at a global level that we will consolidate, restructure and manage accordingly. We're building a worldwide network infrastructure with distribution and access points that lead into those countries where we have a presence. As a result, we'll be able to not only manage our services such as Web and security monitoring, but we'll also be positioned to better service our customers by allowing greater distribution into various areas, such as China, India, Southeast Asia and Europe.

We're also creating business models and working closely with various vendor alliance partners to modify our data center operational models, including virtualization. We are examining our data center components according to a financial model with three constructs--the actual physical plant that has a fixed-cost model (use of internal environments only), a hybrid fixed-variable model (fixed costs associated with internal assets housed in a third-party facility) and true variable assets (using others' facilities for equipment and cooling on demand). In addition, we are virtualizing the central processing unit, network and storage to further leverage the facilities while maximizing cooling and power. This model allows us to bypass the concept that data centers are just large brick-and-mortar facilities. Instead of having only large centers that require considerable capital investment, we are positioning ourselves to distribute our infrastructure over multiple sites with smaller capacity and creating a distributive model that allows for better disaster recovery, increased agility and improved responsiveness to our business partners.

We're also examining the virtualization of data storage requirements to allow us to manage our storage as one pooled resource. This design will allow us to tier our storage needs, depending upon the priority of the particular application, which further improves our internal price point.

Based on my years of experience, I have an appreciation of the interrelationship between applications and infrastructure. I've designed and built many applications that were implemented in back, middle and front-office operations. I have also been responsible for designs around e-business and customer distribution. I have formulated and implemented a number of pragmatic strategies that have aided the business in transforming their operations.

What was the first thing you did after assuming your new role?

My first priorities were to evaluate the current state of AIG U.S.-based data centers and provide a road map to improve efficiencies and expand capacity against the existing environment in order to better serve internal and external clients.

What do you see as the biggest challenges that lie ahead for you, and how do you hope to overcome those challenges?

The biggest challenge in an organization of our size, or any multinational organization, is creating the organizational synergies required to implement global projects. In a highly distributed environment, you need to work with various organizations and business partners to design and package the plans to drive them throughout the enterprise.

Identifying technologies that can be implemented on a global scale poses a significant challenge. AIG's IT Standards must be written so as to provide both structure and flexibility for its IT operations worldwide. We need to be cognizant of the local laws and regulations in every area where AIG operates. This requires constant discussion with IT professionals at the divisional, group and business unit levels to ensure that every office--no matter how small or remote--has the necessary infrastructure and complies with AIG's IT policies and standards.

Keeping a global enterprise secure is also a challenge in today's business environment. The overall IT infrastructure should include an identity management backbone and data encryption measures. However, in the final analysis, the human element is the strongest security measure. Employees must be educated so they recognize and respect the importance of IT security and the dangers facing every individual in the company when data isn't properly secured and processes are not properly documented. A work force that is diligent, knowledgeable and aware is the best weapon against information security threats.

How is the role of technology in a company with many lines of business--such as AIG--different from the role of technology in a smaller company?

The difference is that there is no one governance model that can be applied to an organization of this size. You have to use various governance models and compliance models. Different management models must be applied to functions and organizations that allow latitude where efficiencies and agility can be produced and stringent controls where cost containment must be attained.

The organization's CIO stewardship allows the use of duopolies, federations and monarchies that meet organizational demand and provide the basis for the greatest organizational agility. You have to create a model that complements the various organizations and supports road maps that meet business deliverables. One size rarely fits all. By integrating the IT architectural road map with the business directives, the appropriate delivery models of build, buy or integrate can be determined. You also need to clear away the complexities and the hot points in each division you're supporting, while retaining the overall strategy that allows them to connect. It all comes down to organizational management, communication and stewardship.

What sets AIG apart from its peers in terms of technology?

We are in many areas a leading-edge--not bleeding-edge--technology company. Collectively working with our business partners, we target projects that provide the greatest return on investment that increases organizational agility. Many companies spend a great deal of money on IT but are unable to determine the value proposition. AIG assesses technology and looks at its applicability to give itself a competitive advantage. That's a business model--not a technology model. We aren't enamored so much of the technology but how it can bring to AIG a greater competitive advantage. For example, two organizations can use the same application: one gains a clear competitive advantage because of its business imperatives while the other company does not. The difference is how the companies apply it, not the application itself.

How have you dealt with the proverbial legacy problem?

At AIG, we call them "heritage systems." When any corporation invests hundreds of millions of dollars into something that still works, something must have been done right. We categorize those applications that provide business value and determine the lifespan of those applications. Our architectural road maps have an evolutionary path that allows applications to grow and shrink according to business needs. When businesses are aligned with the value of their applications, they can easily create an application sunsetting strategy. The result is a plan that links to affordable business solutions that support market demands. This simple approach allows systems to evolve and bring business value. Also, evaluating one's portfolio of business applications jointly with the business partners allows an organization to manage the capital expenditures against the legacy applications, thereby minimizing the erosion of the bottom line.

When it comes to technology, what keeps you awake at night?

It's not technology that keeps me up but rather the hype. It's important to align operational processes around IT to separate the reality from the hype. If you need to choose technology, then you need to choose carefully. IT is process driven, not technology driven. One of the key things is creating a process around managing your vendors, analyzing what is being sold to you, how you align the technology to the business need, and knowing when you need to pull the trigger to apply it. If the CIO does that, there are few things in the technology space that will keep them up at night. Making sure the process models that I'm applying keep the business agile is what sometimes keeps me awake at night.

What is your biggest goal for the next several years?

I believe the biggest goal of any CIO is to continue sitting at the table with the business partners and evolving the IT role as a business peer. No one is interested in bits and bytes anymore, just the business value. CIOs must be well versed in legal, compliance, governance and security models. They must be aware of the business implications of their decisions and understand that sales is an intricate part of their job. The CIO is evolving to become the business transformation officer. The "I" in my CIO title stands not only for information but for insurance and innovation, as this role is transforming the business competitive landscape.

Key Points

* Building a worldwide technology infrastructure is a priority.

* The biggest challenge in a multinational organization is creating the organizational synergies required to implement global projects.

* CIOs must be well versed in legal, compliance, governance and security models.

Learn More

American International Group

A.M. Best Company # 05953

Distribution: Global, national, regional and local independent brokers

For ratings and other financial strength information about this company, visit www.ambest.com.