Not all your systems are worth the same: how much to invest in each one, depending on how critical it is

On Tuesday, April 17, 2018, the Bank of Mexico learned that one of the participants in the country's transfer system had been breached [10].

Over the next three weeks there were four more cases; in October, a sixth [8][10]. The central system of SPEI (Mexico's interbank electronic payment system), which the Bank of Mexico operates, was not affected [4][10]. What failed was on each participant's side: the piece it used to connect to the system or the equipment it ran on [8][10].

Even so, the problem reached customers. The Bank of Mexico warned that, in some cases, a transfer could take one or more days to be credited [9].

The question for you is a different one: which of your company's systems, if they go down for an hour, leave it unable to sell, collect or invoice? And how much are you investing in them, compared with the ones that do not?

One clarification before we start: the case is told using only public reports from Banxico and the CNBV; it does not use information from Hábil's clients. Banxico is the Bank of Mexico, the country's central bank; the CNBV, the Comisión Nacional Bancaria y de Valores, Mexico's banking and securities regulator. Each fact carries its reference number. The sources cited do not name the institutions affected, and neither do we. When something is our reading, we say so.

In 1 minute

• The risk: splitting your systems budget with a single rule. What works for your payroll does not work for your invoicing, and vice versa. In 1983, Warren McFarlan and two colleagues proposed in Harvard Business Review placing each company in one of four quadrants: support, factory, transition or strategic [1][2].
• The case: in 2018, six participants in the country's transfer system suffered attacks on the piece they used to connect to it [10]. The security rules already existed; the Bank of Mexico found that they were met unevenly [8][10].
• What not acting costs: according to Banxico, with the information available in May 2018, about 300 million pesos in irregular transfers were subject to review [9]. They were the institutions' own funds [9]: according to Banxico, «los recursos de los clientes nunca estuvieron en riesgo» [customers' funds were never at risk] [10]. In Uptime Institute's global survey of the data center sector, 57% said their most recent serious outage cost more than 100,000 dollars [15].
• What you have to decide on Monday: which systems are "factory" (they cannot go down) and which are "strategic" (they define how you compete), who answers for each one and how much an hour without them costs you. At the end there is an inventory to take to your meeting.

In this article

1. What does the McFarlan matrix say, in short?
2. Which quadrant are your company and each of your systems in?
3. What changes in budget, governance and risk in each quadrant?
4. What does SPEI in 2018 teach you about your most critical system?
5. How much does an hour without a system cost you?
6. What breaks when you treat a critical system as if it were support?
7. Which mistakes cost the most?
8. What should you bring to Monday's meeting?
9. Key takeaways
10. What does Hábil do?
11. Frequently asked questions

What does the McFarlan matrix say, in short?

The matrix proposes splitting your systems budget with two questions: how much it hurts if they go down today, and how much they help you compete tomorrow.

In two lines: in January 1983, F. Warren McFarlan, James L. McKenney and Philip Pyburn argued in Harvard Business Review that the role of systems varies from one company to another, and that each company should plan them according to that role [1]. They summed it up in a four-quadrant matrix, which McFarlan himself called a strategic grid when he cited that article a year later [2].

The matrix's two questions are [1]:

• Today: how much do daily operations depend on systems working without interruption?
• Tomorrow: how much do the systems being built matter for competing?

Matrix redrawn in our own words from McFarlan, McKenney and Pyburn [1]. In the original, the quadrant we call "transition" here is called turnaround: the company that turns itself around with its systems.

Each quadrant, with an example from the authors:

• Factory. Operations depend on systems, but what is being built does not change how the company competes. The authors placed certain manufacturers, airlines and store chains here, where, they wrote, "even a one-hour disruption in systems" affects business performance [1].
• Strategic. It depends on them today and needs them to win tomorrow. Their examples were many banks and insurers [1].
• Transition. Today it does not fully depend on them working without interruption, but what it is building is vital to its strategy. Their example: a manufacturer that grew so fast its controls could no longer keep up [1].
• Support. Neither do operations depend on them, nor is what is being built decisive. Their example: a large manufacturer that spent nearly 30 million dollars a year on systems and could keep operating, albeit with stumbles, if they failed [1].

Two warnings from the original article are useful to you. The first: there is often a distance between the quadrant where the company is and the one its leadership believes it is in [1]. The second: different parts of the organization can be at different stages, and the way of planning changes with them [1].

In 2005, McFarlan and Richard Nolan took the matrix to the board of directors, also in Harvard Business Review: the kind of oversight the board should exercise over systems depends on the quadrant [3]. The thresholds in the next section come from that article.

Which quadrant are your company and each of your systems in?

Place yourself with numbers, not opinions: how many hours you can last without the system, and what share of your investment goes to technology.

Nolan and McFarlan gave three concrete thresholds [3]:

For strategic they do not give a threshold of its own: they say it requires the same reliability as factory [3]. If a system meets the one-minute threshold and also scores high on the "tomorrow" axis, assess whether it is strategic.

They add two traits of the factory quadrant: going back to working by hand is hard or impossible, and customers and suppliers tend to communicate with the company through its systems [3].

With that, we put together eight questions. The list is ours, not the model's; each question says where it comes from.

"Today" axis: how much do your operations depend on this system?

1. If it goes down for an hour, do you stop selling, collecting, invoicing or delivering? [1]
2. Would spending 12 hours without it, on paper, cause you serious consequences? [3]
3. Does a law, a regulator or a contract require this system for you to operate? In Mexico, for example, without the CFDI (Mexico's electronic invoice) validated by the SAT (Mexico's tax authority), no tax receipt has been issued: before it is issued, it is sent to the SAT, which validates it and assigns it a folio number [13].
4. Do your customers or suppliers connect directly to it? [3]

"Tomorrow" axis: how much does it help you compete?

1. Do the projects under way on this system change how you win customers: price, speed, channel or service? [1]
2. Does a significant share of your sales come in through a digital channel of your own? (our reading)
3. Is a competitor already winning customers from you with a system you do not have? [2]
4. Does technology take more than half of your capital investment or more than 15% of your costs? [3]

How to read it (a guideline, ours): two or more "yes" answers on an axis is "high". Today high and tomorrow low: factory. Both high: strategic. Today low and tomorrow high: transition. Both low: support. Question 8 is answered only once, for the whole company, not system by system; if it is "yes", add it to the systems in the transformation project.

The authors classify the company as a whole [1][3]. We propose answering the list system by system, because it is rare for all of them to fall in the same quadrant. The payroll, the invoicing and the online store of the same company can be in three different quadrants. That application is our reading, supported by the 1983 warning about parts of the organization moving at different paces [1].

What changes in budget, governance and risk in each quadrant?

Each quadrant calls for a different spending rule and a different owner; using the same one for all means paying too much in some and too little in others.

Nolan and McFarlan gave each quadrant a one-line spending rule and a type of oversight [3]. The rules are in our own words; the last two columns are our reading.

Two details that change decisions:

• In factory, the board's question is about continuity. The authors ask the board to check that security and disaster recovery are covered, and that backups are tested on an ongoing basis to know they really work [3].
• In transition, the company does not stay long. When the change is finished, it moves to factory or to strategic; and after the new systems are installed there is no going back to manual work [3].

What does SPEI in 2018 teach you about your most critical system?

If your most critical piece depends on a third party, govern it as part of operations and check with evidence that it meets the rule: in SPEI in 2018, the rule existed, but it was met unevenly.

The Sistema de Pagos Electrónicos Interbancarios (SPEI) is the one that moves transfers between banks and other financial institutions in Mexico. The Bank of Mexico calls it «el sistema de pagos mexicano más importante» [the most important Mexican payment system] [10].

Three facts to size it:

• In 2018 it processed 595 million transactions between end users, and at year-end it had 92 participants [10].
• The institutions that suffered the attacks handled, together, about 13% of SPEI transactions [8][10].
• Its rules measure service in seconds: during operating hours, the bank receiving a transfer of more than 8,000 pesos has 5 seconds to credit it to its customer, and in other cases the limit is 30 seconds [6][8].

For the purposes of the model, that connection illustrates a component of high operational criticality, like the one Nolan and McFarlan describe in the factory quadrant: business is lost even if the failure lasts a minute [3]. The sources do not allow placing each participant in a quadrant; the reading is ours and is limited to the piece.

What happened, in order?

Everything comes from what the Bank of Mexico and the CNBV published.

The CNBV, in its 2018 report, includes these events among the attacks on the country's main payment systems, and says it followed up on their identification, containment and remediation [11]. The figure of 300 million comes only from the Bank of Mexico [9], which gave it «con la información disponible» [with the information available] at the time.

What matters for you

1. What was most critical depended on a third party. In all the cases identified as attacks, the connection application had been developed by a third party [8][10]. On the same page, Banxico clarifies that «la vulnerabilidad pudo tener su origen tanto en los sistemas, como en la infraestructura en la que fue instalado» [the vulnerability may have originated either in the systems or in the infrastructure on which it was installed], and there were institutions with an external provider that were not affected [8]. The Bank of Mexico does not validate or certify them: each participant is responsible for its application, whether its own or a provider's [8][10]. For you: the provider of a "factory" piece is governed as part of operations.
2. The rule existed; compliance, not always. According to the Bank of Mexico's annual report, the attacks happened because of uneven compliance with the security requirements [10]. Treating a requirement for a "factory" piece as a "support" formality is the reading we make.
3. The damage did not stay with those affected. The Bank of Mexico warned that some participants' non-compliance makes the whole system vulnerable [8]. The delays could also reach customers of institutions not directly affected [5].
4. Governance rose to the level of its quadrant. After the crisis came a responsible security officer, written protocols, trustworthiness checks on third parties, a four-level alert system and inspections of the providers [10]. That is what Nolan and McFarlan ask for in a factory quadrant: proven continuity and someone who answers for it [3]. That connection is our reading.

This is not a judgment on any institution. The sources do not say which ones they were, and none is assessed here. It is the question the model would put to any board, including yours: does our governance match the quadrant we are really in?

How much does an hour without a system cost you?

If you do not know how much an hour down costs you, it will be hard to know whether your system is overprotected or underprotected.

In 2018 the cost had several layers: money under review [9], months of operating through a slower arrangement [8][10] and customers waiting for their transfer, in some cases one or more days [9].

For your company, the calculation has four parts. The formula is ours:

1. Sales that are not recovered: the customer who bought elsewhere.
2. Extra work: hours to re-enter, reconcile and handle complaints.
3. What the law, the regulator or the contract obliges you to meet. Check what deadlines and penalties your service contract carries, and what your regulator asks of you when a system goes down.
4. What is not measured at the time: trust, reputation and your leadership team's attention.

Example scenario (not a real case). A distributor sells 312 million pesos a year and operates 10 hours a day, six days a week: about 3,120 selling hours. Each hour of operation moves, on average, 100,000 pesos. If its order and invoicing system goes down for an hour and half of those orders are recovered later, the sales at risk are about 50,000 pesos, plus the extra work and any contract penalty. With that number, an annual investment in backup and monitoring stops being a "systems expense" and is compared against hours of outage avoided.

Nor does the failure have to originate in your company. In July 2024, a software update that CrowdStrike, an independent cybersecurity company, released on the 18th affected about 8.5 million Windows computers worldwide, less than 1% of the total, according to Microsoft [14]. Microsoft clarified that it was not its own incident: the origin was a third party's update [14].

And an international reference. In Uptime Institute's annual survey, 57% of respondents said their most recent serious outage cost more than 100,000 dollars, and one in five, more than a million [15]. According to the same press release, over nine years of tracking, close to two thirds of publicly reported outages came from external technology providers: cloud, internet, telecommunications and data centers [15]. It is a global survey of the data center and technology services sector; use it as an order of magnitude, not as your figure.

What breaks when you treat a critical system as if it were support?

A critical system treated as support can hold up for months; the risk is that it fails on the day it is needed most, and with no plan.

This is what tends to break when a factory system is budgeted as support. The table is our reading, with a source where indicated.

The opposite mistake also costs: treating as strategic what is support, and paying for redundancy and committees that change nothing. For support, the authors' rule is to watch every peso [3].

Which mistakes cost the most?

Several of the most expensive mistakes are about location: investing as if you were in one quadrant when you are in another.

1. A single budget rule for everything. Nolan and McFarlan contrast a clothing store with a large airline: one's strategy does not work for the other [3]. Consequence: what does not matter is overprotected, and what halts operations is left exposed.
2. Believing you are in one quadrant while being in another. It is the distance the authors found between the real quadrant and the one leadership believes it is in [1]. Consequence: systems plans that do not serve the strategy, or a technology department that learns of the direction too late.
3. Getting comfortable in "support". In 1984, McFarlan told the case of a distributor that connected its customers to its computers so they could place their orders directly; its competitor, comfortable in support, did not see what was happening in time, and catching up turned out to be hard and costly [2]. Consequence: you lose ground that is very costly to win back.
4. A large project without decisions watched from the top. Nolan and McFarlan say that surprises most often come from loose project management, and ask that the key decisions move up to the level where they belong [3]. Their example is Hershey: after expanding its new management system, Halloween arrived and it had no way to follow orders, revenue or inventory; according to the best estimates they report, it cost Hershey 151 million dollars [3]. Consequence: the project that was supposed to give you an advantage becomes the crisis of the year.
5. Governing the provider as an expense, not as part of operations. In 2018, in all the cases identified as attacks, the connection application belonged to a third party [8][10]; Uptime attributes close to two thirds of public outages to external providers [15]. Consequence: the day that piece fails, your company has neither a plan nor a say.
6. Taking a rule as met because it is written down. The SPEI requirements had existed since 2017 [8]; what was missing at some participants was meeting them [10]. Consequence: the rule does not protect, and it also makes clear who should have met it.
7. Not knowing the cost of an hour. Our reading. Consequence: every investment in continuity is debated as an expense and loses to any other priority.

What should you bring to Monday's meeting?

An inventory of your systems, classified in the matrix, with an owner, the cost of an hour down and a decision.

It is the first step Nolan and McFarlan ask of any board [3]. The format is ours. Each row is a system; the columns answer what your committee needs to decide.

Example scenario (not a real case). The same distributor with 312 million pesos a year.

How to fill it in within a week (our steps):

1. List the systems operations use, including third-party ones, the pieces that connect you with banks, the SAT or your customers, and the spreadsheets that hold up a process.
2. Assign a business owner to each one. If nobody raises a hand, you have already found a risk.
3. Answer the eight questions on the list for each system and assign it a quadrant.
4. Estimate the cost of an hour down with the four parts of the formula. A rough estimate is enough to start.
5. Write one decision per row: invest, maintain, replace or switch off. And who reviews it, according to Nolan and McFarlan's governance table [3].

How to read it: if a system is factory and its decision says "maintain" with no recovery test, that is where you start. If a system is strategic and nobody on the leadership committee oversees it, that is where you go next.

Key takeaways

Three questions for your next leadership committee:

1. Which of our systems leave us unable to sell, collect or invoice if they go down for an hour, and how much does that hour cost us?
2. Does our systems budget use a single rule for everything, or does it distinguish between what cannot go down and what makes us compete?
3. What part of what is most critical depends on a third party, who checks that it meets what we require, and what would we do if it failed tomorrow?

What does Hábil do?

Hábil builds the system your operation needs when no product fits, and connects it to what you already have.

We start from the systems and processes that work for you today. Replacing something only comes up when it no longer makes sense to keep it.

• Custom systems. Portals, approval workflows and the internal operation that today lives in spreadsheets and email. We build it to your specifications, connected to your systems, and deliver it to you working.
• What is yours when we finish: the system up and running, the code in your name in your repository, the automated tests and the documentation, with the handover to whoever will operate it. If tomorrow you want another team to maintain it, you can.
• Before we write a single line, we review with you whether something already exists that solves it. Building is the answer only when it makes sense.

See Custom systems.

And if what you need is to integrate your systems, we build the layer that connects them, with every operation confirmed and traceable, and the ability to change one with the least impact on the others. We have integrated enterprise systems since 2012. See Integration.

If you already know which one is your "factory" system, let's start there. Request your first conversation, at no cost. In it we review whether it makes sense to configure, use a product or build, and what you would receive in each case. Write to us on WhatsApp.

Frequently asked questions

Does a company always stay in the same quadrant?

No. The authors warn that the role of systems can grow or shrink [1], and that the transition quadrant is temporary: when the change is finished, the company moves to factory or to strategic [3]. That is why the inventory is reviewed every year.

Why are the institutions affected in 2018 not named?

Because they are not named in the Bank of Mexico and CNBV sources cited, and this article is based only on them. The case does not use information from Hábil's clients.

Sources consulted on October 22, 2026. The single quotation from Harvard Business Review is kept in its original English; quotations from Spanish-language documents are kept in the original, with a translation in brackets.