BUSINESS CASE ANALYSIS:

San Francisco International Airport and Quantum

Secures SAFE for Aviation System

Daniel Diermeier and Evan Meagher

Kellogg School of Management, Northwestern University

Graduate Program in Information Systems Management

Bob Wittstein Harvard University Extension School
ISMT E-200
bob_wittstein@harvard.edu All rights reserved. Bob Wittstein. 2013-2015
Case Summary
2

This case describes:

q Business rationale for SFO

q SFOs current systems landscape
q Benchmarking and metrics for investment justification
q Business processes, as-is and to-be
q Business requirements and expected system capabilities
q Selection of a new system.
Business View
3

1. What problems was SFO trying to solve?

2. What are the business goals and requirements?
3. Comparing the As-Is and To-Be processes, how do they
demonstrate business value?
4. How are the business requirements defined as system capabilities
that ultimately satisfy use cases?
5. How/why was SAFE for Aviation selected and justified?
6. What metrics are discussed and how are they used?
7. Describe the migration and integration challenges; justify the
approach taken by IT.
 Business Goals
4

q Renovate Terminal 2 to meet rising passenger counts

q Improve airport security and TSA compliance starting with
Terminal 2
q Mandate to overhaul security infrastructure for
passengers and employees including badge credentialing
and physical identity and access management
q Create a single notion of user identity and access rules
across the entire facility
q Automate manual processes to reduce cost, increase
efficiency and accuracy
 SFO - Terminal 2
5
 Business Requirements
6

Conduct background checks and obtain security

clearances for access to secured locations
Use biometric data to communicate with the
Transportation Security Clearinghouse
Automate badging function and storage of related docs
Administer self-service access rights
Enforce compliance with new security directives
Integrate with larger SFO ecosystem of PACS, HR, IT
and biometric databases
Perform regular identity audits.
 AS-IS
7

Manual data
entry
Data entry
errors
Re-entry
Manual
notifications
Delays
Unauthorized
access
 TO-BE
8
 TO-BE
9
 Non-functional Requirements
10

Flexible system architecture and policy/rules-based

framework
Ability to apply changes to rules, workflows, and policies
without expensive development
Integration into existing airport security infrastructure,
ability to talk with older PACS.
 Benchmarking/Metrics/Selection
11

Compared to Toronto Pearson Airports SAFE for

Aviation implementation:
Served 175 per day and 45,000 per year
Reduced badge processing cost by 28%, from $49 to $35
Cut average wait times by 96%, from 560 min to 20 min
Decreased avg service time by 66%, from 74 min to 25 min
Streamlined credentialing operations with full audit and
compliance.
Used a systems integrator to conduct RFP to evaluate
other PACS to replace the twenty-year-old SFO system.
Selected Quantum Secures SAFE for Aviation.
 Metrics to justify system cost
12

Risk evaluation: Serious security breaches were very

rare but resulted in very painful consequences = Low
frequency but high impact. Not a slam-dunk to spend $.

Risk mitigation analysis

SFO
High
Impact
Low

Low High
Frequency
 Metrics to justify system cost
13

Therefore, need to look at:

Reduced labor and material costs
Increased accuracy of record keeping
Improved compliance with safety regulations
Avoided costs of replacing old systems by enabling
integration and interoperation
SFO metrics:
Support 2,000 users in Terminal 2 and 20,000 overall at SFO
Reduce badge processing cost by 35%, from $44 to $29
Eliminate the need to issue dual badges and hire extra
support staff
<90% reduction, or 7 person-days per month reconciling and
correcting user database errors
No accurate compliance data.
 Metrics to justify system cost
14

Despite the Finance departments looking for a payback

period on the $250,000 investment and $25,000 annual
maintenance, in the end, the need to increase badging
staff alone more than justifies this cost.
 Importance to our course
15

q Demonstrates the value of a strong business case with

clear user stories
q Uses the As-Is and To-Be business processes to
demonstrate system capabilities and benefits
q Connects functional and non-functional system
requirements to the business requirements
q Demonstrates the benchmarking tactic, how it supports
the case benefits through metrics
q Shows how compelling, quantifiable business and
system metrics justify the value and cost of enterprise
systems implementations.

Note: All graphics used with permission of SFO Media