Chapter 9: Digital Services¶
Definition of a digital service taken from the AFNOR Spec:
A digital service is made up of a set of software products, terminals, infrastructures (networks and data centres). It can itself be made up of other digital services. It enables one or more actions to be carried out in digital format. Examples include "book a seat on a train", "make an appointment with a doctor", "send an e-mail to friends", "watch a video online", "exchange views on social networks", "make a money transfer", "schedule leave days", "participate in a video conference", "fill in an expenses report", "model a mechanical part", etc.
Open questions¶
- How do you take into account the environmental and societal footprint of the digital services that you develop or use, in your organisation?
- Have you taken a specific initiative to tackle bloat software and fight obsolescence? On which eco-design and accessibility references is your initiative based?
- How do you master multidisciplinary competences, and interdependencies, to raise synergies between cybersecurity, sustainable IT, architecture, quality and strategy? For example, considering Open Source.
- How do you take into account specificities induced by data management and Artificial Intelligence?
9.1 How do you take into account the environmental and societal footprint of the digital services that you develop or use, in your organisation?¶
Rationale¶
The environmental footprint of IT is clearly due to equipment, but hardware has just one function: running software. Thus, by working on digital services we can also reduce the need of hardware resources, fight against their obsolescence and increase their lifespan.
Evaluation criteria¶
| Evaluation criterion | Recommended priority | Proposed weighting (total = 25 points) |
|---|---|---|
| The bidder has launched an initiative to consider the environmental and societal footprint of digital services in its selection or development process. | P1 | 5 |
| The footprint evaluation is done under Life Cycle Assessment methodologies. The LCA must be multicriteria and have a critical review. | P1 | 5 |
| The link between the software and hardware has been made, taking into account the environmental footprint of the digital service due to hardware (manufacturing and energy consumption) but also that the hardware is used to run software, thus working on the sufficiency of software is mandatory for reducing hardware requirements. | P2 | 3 |
| The footprint evaluation must conform to the Digital Services PCR and its specific derivatives. | P2 | 3 |
| Reporting is done in line with CSRD at the level of digital service. | P2 | 3 |
| Enterprise and IT architects are involved in the Sustainable IT initiative. | P2 | 3 |
| A UX/UI team or competences exist in the organisation. They are always involved at the beginning of any new project or digital service development, as soon as the client requests. | P2 | 3 |
9.2 Have you taken a specific initiative to tackle bloat software and fight obsolescence? On which eco-design and accessibility references is your initiative based?¶
Rationale¶
Enabled by Moore’s law, software demands more and more resources and computation. Niklaus Wirth showed that software gets slower more rapidly than hardware becomes faster (Wirth’s law). This divergence is not sustainable and the only way to address it is to eco-design digital services.
Evaluation criteria¶
| Evaluation criterion | Recommended priority | Proposed weighting (total = 25 points) |
|---|---|---|
| The bidder knows the different eco-design references (at least two, for example: RGESN, GR491, SDIA, AFNOR Spec) and accessibility references (WCAG/RGAA) in existence for digital services. | P1 | 4 |
| The bidder has launched an initiative to adapt these references to its own IT organisation, creating a specific reference that its suppliers apply and request in Calls for Tenders. | P1 | 4 |
| Decommissioning is foreseen in the life cycle of any digital service, including a fixed date for challenging the need for the service. | P1 | 4 |
| The value of a digital service for the business is considered and challenged in terms of its Return On Invest and Impacts (ROII). | P2 | 2 |
| Evaluate the maturity index of any new digital service, based on the requirements requested in this reference and the best practices of the ecodesign references. | P2 | 3 |
| Actions to fight software obsolescence and fashion obsolescence are taken. | P2 | 3 |
| Action is taken to limit the increase in demand- for hardware IT resources, and to fight Wirth’s law. | P2 | 2 |
| A “3U” policy is respected: each digital service has to prove that it is Useful, its capacity to be Used by any and only people who need it is demonstrated, and finally its real Usage is frequently checked. | P2 | 2 |
| IT resources are challenged even during the use of the digital service and scalability of virtual machines is promoted. | P3 | 1 |
9.3 How do you master multidisciplinary competences, and interdependencies, to raise synergies between cybersecurity, sustainable IT, architecture, quality and strategy? For example, considering Open Source.¶
Rationale¶
When creating an eco-design reference, we notice that some best practices are not specific to Sustainable IT but are fundamentals of UX/UI jobs, for example, or are basics of a quality process, they can also be an opportunity for cybersecurity by encouraging a reduction in the attack surface, for example. These synergies must be identified and used operationally. The 3 Pillars (3P) of Sustainability, People, Planet, Prosperity, may become 4P with Protection.
Evaluation criteria¶
| Evaluation criterion | Recommended priority | Proposed weighting (total = 25 points) |
|---|---|---|
| All departments of the digital department of the organisation contribute to the sustainable IT initiative and the decrease in the footprint of digital services; both hardware and software competences are represented, including cybersecurity and the Service Level Agreement (SLA). | P1 | 10 |
| Synergies between cybersecurity, maintainability, Total Cost of Ownership and Sustainability are considered in technical decisions. Security and Sustainability by design are both considered and may be merged. For example: having an updated CMDB. | P2 | 8 |
| Opportunities for Open Source are considered in order to reduce the dependency on some suppliers and increase the interoperability, sovereignty and resiliency of the IT Department. | P2 | 7 |
9.4 How do you take into account specificities induced by data management and Artificial Intelligence?¶
Rationale¶
Artificial Intelligence (AI) frequently reflects Human Intelligence, including its different types of biases. It also requires a lot of data, servers and energy for its learning phases, and the most popular generative AI can be used by millions of people, resulting in massive rebound effects that are already visible in the Corporate Sustainability Reports of major players, threatening their climate engagement. Specific actions must be launched to avoid compromising the sustainability of all the IT industry.
Evaluation criteria¶
| Evaluation criterion | Recommended priority | Proposed weighting (total = 25 points) |
|---|---|---|
| The use of AI is transparent and challenged for any digital service, considering whether alternative solutions with lower impacts can replace it. | P1 | 6 |
| The guides and reference specific to AI are known and effectively used (e.g.: AI guide - RIA31 - from the Institute for Sustainable IT, AFNOR specification for frugal AI). | P1 | 6 |
| A Data Management policy is deployed in the organisation, respecting regulation (GDPR), including for AI use, promoting the quality of the data and limiting its proliferation, as a massive increase in poor-quality data is a real brake to AI sustainable development of AI. | P2 | 5 |
| Data governance considers the type of data and encourages to respect for the real need: for example, video formats are challenged in favour of audio or written data, in box mails have a limited lifetime. | P2 | 4 |
| The global and exhaustive volume of stored data, and the volume of used data should be monitored and communicated at least each year, both for internal and external data storage. | P2 | 4 |