With more and more companies focusing on innovating, whether it is because the market desires it or to outrun the competition, the importance and difficulty of the innovation process increases. Innovation is not the process of finding that one great idea anymore. It is a complex and company-wide endeavor that requires structured, organized, and encouraging processes. Portfolio management aligns the product development activities with the organization's strategy. The literature review in chapter 2 aims to gain a better understanding of the context and the portfolio management process. The three goals of the strategic portfolio management process were defined. First, achieving the right balance, the portfolio can be balanced on several parameters, among others are the lead time, risk, the number of products, and the spread across the funnel. Second, align with strategy, by creating an overview portfolio management allows aligning the research activities with the strategy set by the executive board. And third maximize the value, realize the most value out of the limited available resources. This thesis explores the practice of portfolio management within TNO, an independent research organization in the Netherlands. The focus lies on the usage and transfer of data needed in the portfolio management process, in this case, the strategic meetings and Flightmap, the digital tool used to manage the portfolio data. In chapter 3 a systematic analysis is presented of the implementation and use of portfolio management within TNO, including the reason for implementation, the position of portfolio management in the organization, the governance, and the process activities. To increase the efficiency of data presentation for the decision-making process the field of information transfer is explored in chapter 4. The interactions around and in strategic meetings as well as Flightmap are analyzed. Three problem clusters are identified: the lack of data tracking, the lack of a clear meeting focus, and the poor Flightmap user experience. To explore the solution space a diversity of design generative tools is used. After an ideation phase, a concept was created and improved through three iterative cycles including ideating, prototyping, and testing. Eventually, an integrated solution with three deliverables is presented in the form of a meeting format, an annual plan, and a Flightmap redesign. The solution contributes to four aspects: creating an overview on all levels of TNO’s portfolio management, creating strategic structure and awareness, providing an integrated solution to manage the portfolio on each level and enabling to make informed decisions on the balance, the status, and the impact. Since this solution represents a future vision, an implementation plan is presented to outline the steps towards the realization. The final design is validated through three activities. The solution was discussed in a team of directors meeting where the decision was made to use the status board, the portfolio review meeting, and the meeting format in the coming strategic meetings. Next to this, the Flightmap redesign was validated in two sessions with business developers. The concept was received extremely well. The final design was discussed in two sessions with experts from the strategy department. In the next Flightmap update a first version of the dashboards introduced in this thesis will be implemented.

In the times of emerging technologies and rising individuals’ awareness more light is shed on privacy and associated risks. This does not go unnoticed by regulators, that develop and enforce tighter requirements towards organisations. Simultaneously, outsourcing relationships develop and offshoring as well as nearshoring are still popular among cost-optimisation methods. While many security methods are discovered and developed and numerous standards and best practices exist that talk about information security management systems, there is only limited literature on how to develop and implement these controls so that they bring the expected value. The goal of this research was to present guidelines for designing and implementing information security management system controls on basis of identified risks and issues with controls existing at the time. This was to support existing financial institutions with improving their internal controls for information security when engaging in offshoring relationships. The goal was achieved through qualitative methods: case study observation followed by a questionnaire that was distributed among and answered by information security advisors and specialists with extensive experience in financial sector. Case study is a Swiss globally operating bank that outsources its processes to a number of offshore and nearshore locations. The bank has had a number of controls and processes already well established at the time of the research. This research confirms that financial institutions face various obstacles and issues at different phases of offshoring. The most commonly identified included: dispersed responsibilities, issues arising at the time of offshoring that could be identified prior to decision to outsource and finally – lack of power to enforce technical controls over vendors. The guidelines developed include but are not limited to: focus on additional areas when preparing for offshoring initative, establishing and defining responsibilities across different teams in the organisation and with the vendor and defining detailed contractual clauses. The findings from this thesis also open opportunities for further research – to investigate the relationship between these guidelines and efficiency of information security management system or to quantify impact of these guidelines in order to prioritise them. Similar research could also be conducted in other sectors and organisations to provide evidence for the research generalization.