ISACA Journal
Volume 1, 2,017 


Smart Sustainable Cities Need Well-governed Disruptive IT, Not Just IT 

Graciela Braga, CGEIT, COBIT Foundation, CPA 

Most people live in cities, so they enjoy or endure city attributes as part of their day-to-day lives. Because those lives may be complicated and busy, people may see the impact and benefit of IT only when it is not there: failures, service unavailability, loss of physical devices, low battery, natural disasters and so on.

When discussing the impact of IT on cities, some questions arise: How have cities been transformed by IT? Can this transformation be measured? What are the benefits and risk factors of the transformation? Is this transformation a necessity? Do people still desire life in a non-IT city?

Cities, Smart Cities and Smart Sustainable Cities

The definition of “city” has evolved and IT has been an enabler for that evolution. A city is defined as an urban geographical area with one (or several) local government and planning authorities.1 A smart city is a new concept and a new model that applies to the new generation of information technologies, such as the Internet of Things (IoT), cloud computing, big data and space/geographical information integration, to facilitate the planning, construction, management and smart services of cities.2

A smart sustainable city is an innovative city that uses information and communication technologies (ICTs) and other means to improve quality of life, efficiency of urban operation, and services and competitiveness, while ensuring that it meets the needs of present and future generations with respect to economic, social, environmental and cultural aspects.3

If IT is an enabler for a smart sustainable city, four (or more) questions need to be answered:4

  1. How does a city get value from the use of IT?
  2. How can a city best exploit new technology, such as cognitive technology, for new strategic opportunities?
  3. How does a city manage performance of IT?
  4. Are end users/citizens satisfied with the quality of the IT service?

Implementing an IT Governance Framework to Ensure Value From IT

As the ISACA publication Getting Started With GEIT: A Primer for Implementing Governance of Enterprise IT concludes,5 IT governance can benefit enterprises (and cities, of course) in many ways. The main benefit is effective and efficient use of resources to deliver value. The case study herein follows the structure proposed by that publication.

A city’s board and executive managers need to answer the four questions listed earlier, taking into consideration the requirements of all of the city’s stakeholders: the citizenry; national government and regulators; the private sector; IT manufacturers and vendors; the international and national investment community; and other cities, nations, and their boards and executive managers.

Transparency and accountability are primary requirements, not only for investments and use of the community’s financial resources. Governance practices and activities can be adapted to balance IT with environmental, social and economic aspects. Cultural aspects need to be considered as well.

IT use needs to be directed through prioritizing and defining goals for the city, IT and enablers such as:

  • City goal—The principles of the Quito Declaration on Sustainable Cities (Draft)6 are suitable to express or define the city goal: Ensure “leave-no-one-behind, sustainable and inclusive urban economies, and environmental sustainability.”
  • IT-related goals—Based on the IT balanced scorecard (BSC),7 these goals have been selected for the city in this case study:
    • Alignment of IT and city strategy
    • Regulatory compliance
    • Transparency of IT costs, benefits and risk
    • IT integration into city processes and IT agility
  • Enabler goals:
    • Principles, policies and frameworks—There are different proposals and drafts for policies prepared or to be prepared by the United Nations Conference on Housing and Sustainable Urban Development (Habitat III)8 and the International Telecommunication Union (ITU).9 With regard to frameworks, COBIT 5 is the first option as a result of its IT and business scope; completeness; and international government, enterprise, academic and professional recognition.
    • Processes—A baseline proposal of selected processes based on the COBIT 5 Process Reference Model10 and the principles of the Quito Declaration on Sustainable Cities (Draft) is shown in figure 1.
    • Organizational structures—The city should include in its structure the appropriate level of responsibility and authority to make the IT decisions. The escalation procedures for reporting and reporting scope should be defined in advance.
    • Culture, ethics and behavior—This is one of the most important enablers in this case. A city is defined by its citizens’ culture, ethics and behavior. No two cities are the same and this is because no two cities’ people are the same, even if these cities are in the same country. Culture must be taken into consideration when IT solutions and services are selected.
    • Information—This is another important enabler. A draft establishing a decision-making framework for sharing data and information services has been published and presented for public review recently.11 Because data are being shared by multiple organizations and/or cities, missing or misinterpreted data can lead to the wrong actions being taken by city decision makers. For this reason, the policies around data and information sharing must be spelled out clearly and succinctly in the decision-making framework.
    • Services, infrastructure and applications— Cities should establish, build or acquire, and maintain the right level of service capabilities to ensure that objectives are met. City IT dependability or support has to be taken into consideration. A deeper analysis should be undertaken if a third party provides critical IT infrastructure.
    • People, skills and competencies—Cities require different roles (public policy makers, managers and technical IT, social media and community relationship specialists) and appropriate levels of skills should be ensured.

Click to view large image.

To demonstrate that value has been delivered, benefits realization and risk and resource optimization should be measured and compared with expectations.

However, use of an IT governance framework will ensure that stakeholders are identified and city and IT needs evaluated and aligned, making it more likely that ICT processes are capable of delivering planned outcomes, even under less-than-perfect conditions.


IT can be a strategic resource to transform a city into a smart city or a smart sustainable city. The level of use of IT should be decided in accordance with the culture and expectations of the citizenry. All types of disruptive or cognitive technology have benefits and risk, but if they are well governed, the probability of value delivery will increase.


1 International Telecommunication Union, “Overview of Key Performance Indicators in Smart Sustainable Cities,” Rec. ITU-T Y.4900/L.1600 (06/2016), ITU-T Recommendations,
2 International Organization for Standardization/ International Electrotechnical Commission, Smart Cities Preliminary Report, ISO/IEC JTC 1 Information Technology, Switzerland, 2015,
3 Op cit, ITU
4 Braga, G.; “How a Well-governed and Managed ICT Can Help to Adopt a New Urban Agenda,” 6th ITU Green Standards Week, Montevideo, Uruguay, 5-9 September 2016,
5 ISACA, Getting Started With GEIT: A Primer for Implementing Governance of Enterprise IT, USA, 2016,
6 United Nations Conference on Housing and Sustainable Urban Development (Habitat III), New Urban Agenda (Draft), 28 July 2016,
7 ISACA, COBIT 5, USA, 2012,
8 Op cit, Habitat III
9 United Nations Economic Commission for Europe and International Telecommunications Union, “United 4 Smart Sustainable Cities,” ITU, October 2015,
10 Op cit, COBIT 5
11 British Standards Institution, Smart Cities—Guide to Establishing a Decision-making Framework for Sharing Data and Information Services, PAS 183, Draft 2 for Public Consultation, Review dates 16 September 2016-20 October 2016

Graciela Braga, CGEIT, COBIT Foundation, CPA
Is a certified professional in governance of enterprise IT (GEIT), oriented to the strategic alignment between business/government objectives and information and communication technology including sustainability and green IT. She has worked on audits and reviews for public and private entities using international frameworks such as COBIT, Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated Framework and International Organization for Standardization (ISO) standards. She is an author and researcher on management and government of information and information and communication technology (ICT) in various media including the ISACA Journal and COBIT Focus. Braga has also been a speaker at recent Green Standards Weeks organized by the International Telecommunication Union (ITU), the United Nations’ specialized agency for ICT.


Add Comments

Recent Comments

Opinions expressed in the ISACA Journal represent the views of the authors and advertisers. They may differ from policies and official statements of ISACA and from opinions endorsed by authors’ employers or the editors of the Journal. The ISACA Journal does not attest to the originality of authors’ content.