SOA cannot emphasize homogeneity at the expense of business performance, however. One of the most important functions of SOA governance is to determine the specific aspects of software components that should not be shared. For example, a software component that performs a credit check may be applicable in many business processes, but those processes may all require different levels of security. Therefore, security has to be thought through in all possible usage scenarios, not just within the context of an individual software project.

For example, at Hygeia, in order to deal with HIPAA rules that require strict monitoring and access control to medical data, Hamilton stores access privileges to the data in databases that are separate from the service software components. Before giving users access to data, the service calls the database to verify access privileges. If the user doesn’t have the right privileges, he can’t access that data or run that service.

Governance Is Gradual

While analysts such as Gaughan and Hurwitz say that tackling governance issues early is the best policy, they know that most organizations cannot afford to wait on SOA until they define governance fully. "It would be nice to define [governance] up front, but that would make the investment hard to swallow," says AMR’s Gaughan. Instead, SOA pioneers are tackling the critical cultural and political issues around defining the right business processes and then retraining their IT staffs—and the business groups—to design sharable, reusable and extensible services that both save money and allow for more rapid development of new business functions. Governance will come along the way.

The CIO 100 honorees exemplify that reality. Like his fellow honorees, Money¿Gram’s Albright knows what the governance issues are in SOA, but he’s gambling that he can develop them as the basic SOA principles of process design and service development take root in business and IT. Getting the basics right will give him the buy-in he needs to invest the people and resources to figure out the other governance issues. KnowledgeBase’s Camp has a similar view. "We’ll take a deeper dive when we add more services," he says.

That leap of faith is scary, but necessary, says Hurwitz. "Being timid is not a good thing—people do need to get started now on the processes, understand the stages and develop a road map."