Thursday, July 02, 2009

SERVICE DESK

Though Service Desk is not a process, the Service Desk is an important function within the service support.

Objective:
To focus on Incident Control and Communication as it is the first and ideally single point of contact for users (SPOC).

How it works?
The Service Desk handles all incoming calls through Mail / Phone / ticketing system and escalates them to the second or third tier support as and when necessary.
The Service Desk will have access to a Knowledge Base, which will contain a list of known solutions for some common incidents. This way queries or incidents can be solved by the Service Desk staff without escalating to next level and taking much time from IT Engineers.
The Service Desk is responsible for keeping the customer informed on the status of their request.
For the customer the advantage is that they are the single point of contact and they don’t have to go around searching for the right person to solve their problem.
For IT personnel (IT Domain Engineers) they only have to deal with issues that are related to their skills or area of responsibility.

Process of Service Desk:
• Provide Assistance, advice and guidance to customers
• Communicate and promote IT services as per the SLA
• Manage and control service communications to customers, suppliers, Vendors and the business
• Coordinate Incident Management activities
• Manage people, processes and technologies w.r.t operations of an IT infrastructure
• Provide management information about Service Desk quality and operations

Critical Success Factors (CSFs)
• Ensure long term Customer retention and satisfaction (as they are the face of the IT department.)
· Reduce support costs by the efficient use of resource and technology

Key Performance Indicators (KPIs)
Ensure Long Term Customer Retention and Satisfaction
• Percentage of Customers provided Satisfaction Surveys
• Customer Satisfaction Rating on Service Desk
• Percentage of Caller Hold Times within SLA
• Percentage of Calls Responded To Within SLA
• Number of Incident Records Not Yet Closed With in SLA
• Number of Calls Abandoned
Reduce Support Costs by Efficient Use of Resources and Technologies
• Percent of Calls Resolved At the Service Desk without Escalation
• Staff Turnover Rate on the calls / requests.
• Overall Cost per Call.

Finally Service Desk stands for providing a central point of contact for customers and supports the Incident Management process by providing a single point of contact to manage incidents to resolution w.r.t operations.

CHANGE MANAGEMENT

Objective:
To ensure that standardized methods and procedures are used / followed for efficient and prompt handling of all changes, to minimize the impact of Change-related incidents upon service quality and day-to-day operations of the organization, and in order to improve the day to day operations of organization.

Input: RFCs, CMDB, Forward Schedule of Changes (FSC)

Process of Change Management:
• Filtering changes
• Managing changes and the change process
• Chairing the CAB and CAB/EC
• Reviewing and closing RFCs
• Management reports

Procedure of Change Management:
• Accept Changes (RFCs)
• Prioritize and classify changes
• Coordinate for change impact assessment
• Coordinate for approval of changes
• Coordinate for scheduling of changes
• Coordinate for implementation of changes
• Conduct post implementation reviews
• Provide management information about Change Management quality and operations

Advantages of Change Management:
• Better alignment / assesments of IT service to business requirements
• Increased visibility and communication on changes to both business and Operations.
• Improved risk assessment
• Reduced adverse impact of changes on the quality of services and on SLAs
• Improved problem, availability and capacity management through the use of valuable management information relating to changes
• Minimal changes to be backed-out

Critical Success Factors (CSFs)
• Controlling Changes
• Making Quick and Accurate Changes Based on Business Priorities / request.
• Protecting Services When Making Changes to IT infrastructure.

Key Performance Indicators (KPIs)
Controlling Changes
• Number of RFCs processed
• Number of RFCs rejected
• Number of unauthorized changes detected
• Number of RFCs implemented on schedule
• Number of RFCs requiring reschedules
Making Quick and Accurate Changes Based On Business Priorities / request
• Number of RFCs marked as URGENT
• Number of RFCs not tested prior to implementation
• Number of RFCs that failed
• Number of RFCs without business case
• Number of RFCs bypassing CAB or CAB/EC
Protecting Services when making Changes to IT Infrastructure.
• Number of SEV1 incidents caused by RFC implementation
• Number of SEV2 incidents caused by RFC implementation
• Number of other incidents caused by RFC implementation
• Number of RFCs without a backup strategy

Names to remember:
RFC: Request for Change
RFC represents the change with a unique number that is going to be implemented.
FSC: Forward schedule of Changes
FSC contains the information on the upcoming changes planned for the IT Infrastructure changes and it should be circulated to all the key stake holders of the Project / Company.
CAB: Change Advisory Board
CAB is an authority board to approve the RFC in a scheduled CAB meets (Weekly / bi-weekly) with all the IT domains heads.
CAB EC: Change Advisory Board – Emergency Committee
CAB EC is a special authority board to approve RFC in a critical situation or in emergency conditions, where in they can not wait for the formal approval process.

Finally, Change Management stands for Coordinating and controlling all changes to IT services to minimize adverse impacts of those changes to business, operations and the users of IT services.

CONFIGURATION MANAGEMENT

Objective:
Providing information on the IT infrastructure to all other processes and IT management.
Enabling control of the infrastructure by monitoring and maintaining information on all the resources needed to deliver services

Process of Configuration Management:
• Planning.
• Identification and naming.
• Control.
• Status accounting.
• Verification & audit.
· Update CMDB – Configuration Management Database

Procedure of Configuration Management:
• Plan for Configuration Management databases and activities
• Identify Configuration Items
• Control Configuration Item information
• Perform status accounting
• Perform verification and audit of Configuration Management databases
• Provide management information about Configuration Management quality and operations

Critical Success Factors (CSFs)

• Managing Configuration Item information end to end of IT infrastructure.
• Providing capability to perform risk analysis of changes and releases performed.

Key Performance Indicators (KPIs)

Managing Configuration Item Information end to end of IT Infrastructure
• Number of Configuration Items logged and tracked
• Number of Configuration Items with attribute failures
• Number of changes to Configuration Item attributes
• Number of additional Configuration Items
• Number of deletions of Configuration Items
• Number and frequency of exceptions in configuration audits

Providing Capability to Perform Risk Analysis of Changes and Releases performed
• Number of incidents caused by inaccurate configuration data
• Percentage of Services tracked with Configuration Items versus known products and services

Advantage of Configuration Management:
• Provides accurate information on Configuration Items (CIs) and their documentation
• Controls valuable CIs
• Facilitates adherence to legal obligations
• Helps with financial and expenditure planning
• Making software changes visible
• Contributes to contingency planning
• Supporting and improving Release management
• Allowing the organization to perform impact analysis and schedule changes safely and efficiently
• Providing problem management with data on trends

Are tools required for Managing CMDB?
Yes, Software tool is key to maintain CMDB especially for large infrastructure. Most of the organizations require a Configuration management-based tool, capable of storing all relevant configuration items (CIs) and should have the following facilities:
• Problems, RFCs are stored upon the same database in an easily accessible format.
• The ability to identify the relationship among CIs (physical and logical), and between CIs and RFCs, RFCs and Problems, RFCs and CI

Finally Configuration Management stands to identify, record and report on configuration items and their relationships for IT services.

PROBLEM MANAGEMENT

What is a Problem?
A ‘Problem’ is the unknown cause of one or more incidents, often identified as a result of multiple similar incidents.

Objective:
The objective of Problem Management is to minimize the impact of problems on the organization. Problem Management plays an important role in the detection and providing solutions to problems (work arounds & known errors) and prevents their reoccurrence.

{ Know Error!!!!
A ‘Known error’ is an identified root cause of a Problem.
Work Around?
Work around is temporary solution for a problem. }

Inputs & Outputs of PM:
Inputs:
Incident Records And Details About Incidents
Known Errors
Information From Other Processes
Outputs:
RFCs (Request for Change)
Management Information
Work Arounds
Known Errors
Update Problem Records (solved problems records if the known error is resolved)

Process of Problem Management:
Problem control
· Problem detection and Recording
· Identify the repeated incidents.
· Perform Root Cause Analysis (RCA)
Error control
· Identify Know error and provide workaround.
· Resolve the root cause and provide permanent solution or Initiate RFC’s.
Proactively manage problems
Conduct major problem reviews
Provide management information about Problem Management quality and operations

Critical Success Factors (CSFs)

• Avoiding Repeated Incidents
• Minimizing Impact of Problems

Key Performance Indicators (KPIs)

Avoiding Repeated Incidents
• Number of repeated incidents
• Number of existing Problems
• Number of existing Known Errors
Minimizing Impact of Problems
• Average time for diagnosis of Problems
• Average time for resolution of Known Errors
• Number of open Problems
• Number of open Known Errors
• Number of repeat Problems
• Number of Major Incident/Problem reviews

Names to remember:

Known Errors: A Known Error is a problem for which the root cause is understood and there is a temporary workaround or a permanent fix has been identified. Note that the implementation of the permanent fix may be some time in the future.
RFC: RFC is an acronym for: Request for Change. This is normally part of a formal procedure, and can, for example, be an input to a service desk. It is largely part of ‘business as usual’ in a development or business cycle.
Work Around: work around is an uncommon solution to a problem where the known methodology is insufficient. Work arounds are usually used to minimize the effects of the problem, until a permanent solution is offered. Note that when the root cause has been identified Work Arounds become Known Errors.

Finally, Problem Management stands for minimizing the adverse impacts of incidents and problems on the business caused by errors in the IT infrastructure and initiate actions to prevent recurrence of incidents related to those errors.

INCIDENT MANAGEMENT

What is an Incident?
An ‘Incident’ is any event which is not part of the standard operation of the service and which causes, or may cause, an interruption or a reduction of the quality of the service.

Objective:
The objective of Incident Management is to restore normal operations as quickly as possible with the least possible impact on either the business or the user, at a cost-effective price.

Inputs & Outputs of IM:
Inputs, mostly come from users, but can have other sources as well like management Information or Detection Systems.
The outputs of the process are RFC’s (Requests for Changes), resolved and closed Incidents, management information and communication to the customer.

Process of Incident Management:
· Incident detection and recording
· Classification and initial support
· Investigation and diagnosis
· Resolution and recovery
· Incident closure
· Incident ownership, monitoring, tracking and communication
*** These elements provide a baseline for management review.

Procedure of Incident Management:
• Detect and record incidents
• Classify incidents
• Provide initial incident support
• Prioritize incidents based on impact and urgency
• Investigate and diagnose incidents
• Resolve incidents and recover service per agreed service levels
• Close incidents
• Maintain ownership, monitoring, tracking and communications about incidents
• Provide management information about Incident Management quality and operations

What are the Critical Success Factors (CSFs) of IM?
• Maintaining IT Service Quality
• Maintaining Customer Satisfaction
• Resolving Incidents Within Established Service Times

What are the Key Performance Indicators (KPIs) for IM?
Maintaining IT Service Quality
• Number of Severity 1 incidents (total and by category)
• Number of Severity 2 incidents (total and by category)
• Number of other incidents (total and by category)
• Number of incidents incorrectly categorized
• Number of incidents incorrectly escalated
• Number of incidents bypassing Service Desk
• Number of incidents not closed/resolved with workarounds
• Number of incidents resolved before customers notice
• Number of incidents reopened
Maintaining Customer Satisfaction
• Number of User/Customer surveys sent
• Number of User/Customer surveys responded to
• Average User/Customer survey score (total and by question category)
• Average queue time waiting for Incident response
Resolving Incidents Within Established Service Times
• Number of incidents logged
• Number of incidents resolved by Service Desk
• Number of incidents escalated by Service Desk
• Average time to restore service from point of first call
• Average time to restore Severity 1 incidents
• Average time to restore Severity 2 incidents

Finally, Incident management stands for Restoring normal state of IT service operations as quickly as possible to minimize the adverse impact on business operations.

Thursday, May 01, 2008

ITIL????

What is ITIL?

A brief history: In 1989, the Central Computer and Telecommunication Agency (a division of the UK government) published the first elements of what would later become known as the IT infrastructure Library, or ITIL. A series of best practice books, ITIL gained more widespread acceptance in the mid-1990’s, and has come to be adopted as the standard by many of today’s top IT businesses (an example: Microsoft chose ITIL as the basis for its Microsoft Operations Framework).

What does ITIL do?

ITIL is a series of best practice books that provide recommendations to IT organizations on ways to best optimize their delivery or management of IT services. ITIL provides a great foundation to systematically improve the delivery of IT services.

Why ITIL?

? ITIL is best practice in IT Service Management (A Set of Books developed by OGC, UK).
? ITIL is the most widely used best practice for IT Service Management.
? World’s de-facto standard best practice framework for IT service management
? Provides a systematic, process-based approach, supported by procedures for key ITSM processes.
? ITIL is the IT Infrastructure Library and ITIL® is a Registered Trade Mark and a Community Trade Mark of the OGC

Why should I study ITIL?

To Gain good IT Service Management Skills….
  • ITIL certification will allow you to understand the common language of ITIL, understood by IT professionals worldwide, and will increase your standing within the IT community.
  • ITIL gives you an adaptive and flexible framework for managing IT services and encourages you to use common sense rather than follow a rigid set of rules.
  • To Improve your Employment Prospects.
  • ITIL will create a common understanding between your IT staff, suppliers, contractors and users within the business by creating a common approach and language towards IT services.
  • ITIL can deliver huge cost savings for an organization by promoting the optimum use of people, process and technology.
  • Pro-active management and continuous service improvement will help to increase quality while reducing overall costs.

ITIL V2 - V3 Differences??

What are the differences between ITIL V2 and ITIL V3?
What has changed?


Amongst the key changes you’ll see in ITIL V3 is a wholesale shift towards a service-driven lifecycle approach and guidance which aims to be more prescriptive.
Where ITIL V2 outlined what should be done to improve processes, ITIL V3 explains clearly how you should go about doing it.
Another key ITIL V3 addition is demonstrating return on investment to the business. This was one of the most frequent requests from the industry consultations, carried out as part of the version three project.

Structural Changes:

ITIL V3 includes some significant structural changes. The library now consists of five volumes, these are:

Service Strategy
Service Design
Service Transition
Service Operation
Continual Service Improvement

The foundation level exam syllabus has been expanded to include content from all five volumes. The new library also includes greater detail on the key roles, and outlines the responsibilities attached to each, along with clear focus on the importance of communication throughout the lifecycle. Greater focus on the use of process models and the identification of the constituent parts is all new to version three. Finally Continual Service Improvement or CSI, explains the use of process improvement models and identifies metrics to support improvements.

ITIL Frequently Asked Questions - V2 vs. V3

What is the difference between V2 and V3?

Amongst the key changes you’ll see in ITIL V3 is a wholesale shift towards a service-driven lifecycle approach and guidance which aims to be more prescriptive. Where ITIL V2 outlined what should be done to improve processes, ITIL V3 explains clearly how you should go about doing it. Another key ITIL V3 addition is demonstrating return on investment to the business. This was one of the most frequent requests from the industry consultations, carried out as part of the version three projects.

If I already hold an ITIL V2 qualification how do I upgrade to V3?

Anyone who holds an ITIL V2 certificate will have the option to take a short bridging course and exam to bring them in-line with the new ITIL V3 qualifications.The ITILV2-V3 Bridging course has been developed and is running regularly.The Manager and Practitioner bridging course syllabi are still under development by the examination board.

How do I know whether I should go for V2 or V3?

ITIL V3 is an updated version of ITIL and ITIL V2 qualifications and exams will be phased out over the coming months. With this in mind anyone who is new to ITIL, contractors, consultants and those who are required to show they have the most up to date qualifications should undertake the ITIL V3 Courses. If your organization is operating under ITIL V2 guidelines, a more structured approach to the transition will be required and during this time it may be advisable to continue with the ITIL V2 Courses.

Will V2 exams still be available?

ITIL V2 exams will continue to be available until late 2008 through prometric centres or via an accredited training provider.

How much does the ITIL V3 foundation bridging exam cost?

It is not possible to sit the ITIL V3 foundation bridging exam on it’s own. You will only be able to sit it as part of an accredited training course.Be sure to check with your ITIL training provider that the cost of the exam is included in your ITIL Foundation V3 Bridge Course..

Will the Practitioners and Managers qualification remain the same?

No, the ITIL Qualification structure has completely changed and ITIL managers and practitioners will be required to take a bridging course and exam in order to be eligible for the new ITIL Diploma certificate.The courses and examinations for ITIL managers and practitioners to bridge to ITIL V3 are still under discussion by the examination board and are expected to be realsed over the coming few months.

Can I take the V3 exam in a prometric centre?

Prometric do not yet offer ITIL V3 exams, although they hope to have them available from early 2008. In the mean time you can still sit an ITIL V3 foundation exam through an accredited training provider as part of an ITIL V3 Foundation course.

What is an ITIL qualification?

The ITIL Certificates are designed as - IT Service Management - qualifications . They are aimed at all personnel who wish to become familiar with the best practices for IT Service Management, as defined in the OGC IT Infrastructure Library guidelines.

What does having ITIL Certification mean?

The holder of the Foundation Certificate in IT Service Management should be aware of the techniques, processes and functions in the core ITIL publications of Service Strategy, Service Design, Service Transition, Service Operation and Continual Service Improvement. He or she should be able to relate this knowledge to wider IT issues and to their own work environment.

How do I get recognised in ITIL?

To get recognised in ITIL as an individual you need to achieve certification by taking an ITIL examination through a recognised exam centre. There are Several Levels to ITIL Certifictions and which one aim to reach will depend on your current career level and your aspirations for the future. For companies wishing to adopt ITIL, the route tends to be slightly different. The biggest decision is deciding if ITIL is right for you and that requires an investment of time, collecting and reviewing information from the marketplace.

Why do I need an ITIL Qualification?

The majority of people that consider ITIL as a qualification do so for career and personal development reasons. Often this is driven by a change of job or career, where you notice that to get to the top of the CV pile, you need to have an extra qualification like ITIL (even if you have been involved in service management successfully for many years without it). In many advertised positions ITIL has become a prerequisite.The majority of companies that implement ITIL also encourage their employees to take the exams. If your staff has accredited ITIL qualifications, then you can present your company as using ITIL. This works particularly well where you tender for or supply to any large IT organizations or outsourcing companies.

Can I use the ITIL Manuals only to study?

For foundation level you can, as the ITIL manuals contain pretty much everything you need. However it is hard work, and often your own interpretation of ITIL may be different to that required. If you are working on a shoestring budget, then this may be the only option open to you, but with all the extra study involved, your time may be better spent learning using an accredited course. For the intermediate or diploma levels in is compulsory to attend an accredited training course.

What languages are the ITIL examinations available in?

The Foundation examinations are available in English, French, Spanish, German, Portuguese, Chinese, Japanese and Russian. The Practitioner examinations are available in English only. The Service Manager examinations are available in English, German and Russian.

If I take ITIL Foundation in another language do I still have to learn the ITIL terms in English?

Yes, you do. In the examinations you will find both the English as well as the Spanish terms. The ITIL terms can be found in the exam requirements.

How long do I have to wait for the results of my multiple choice examinations?

For each multiple choice exam, every candidate receives the result paper and certificate within four weeks after the examination session.

How can I specify how my name should be printed on the certificate?

At the start of the examination session one fills in the Personal Data Form. On this form there is an item where you can specify exactly how your name should be printed on the certificate.

What happens if I fail an exam?

In the unfortunate case you failed an examination; you can take part in another examination session. This does not necessarily have to be at the same examination centre. For the retake of a ITIL Foundation examination you could for example turn to one of the Prometric Testing Centers. There is no limit to the number of times you can retake the examination.

Will I have to update my Foundation certification with the release of ITIL V3?

Yes, if you hold an ITIL foundation certificate from any of the previous versions of ITIL you need to attend a one day course with an examination in order to update it to an ITIL V3 qualification. This will be essential for anyone wishing to go onto the higher levels of ITIL.

ITIL Frequently Asked Questions -

Where did it come from- ITIL?

A brief history: In 1989, the Central Computer and Telecommunication Agency (a division of the UK government) published the first elements of what would later become known as the IT infrastructure Library, or ITIL. A series of best practice books, ITIL gained more widespread acceptance in the mid-1990's, and has come to be adopted as the standard by many of today's top IT businesses (an example: Microsoft chose ITIL as the basis for its Microsoft Operations Framework and they do have a seperate framework deifned).

What does ITIL do?

ITIL is a series of best practice books that provide recommendations to IT organizations on ways to best optimize their delivery or management of IT services. ITIL provides a great foundation to systematically improve the delivery of IT services.

How can ITIL be useful to an IT organization?

"ITIL is intended to assist organizations to develop a framework for IT Service Management." The key drivers of that sentence are "assist" and "framework." ITIL's biggest strength is that it provides an internally consistent framework around which IT organizations can structure their service management. The problem that many organizations run into is that they approach ITIL as a complete solution rather than as an aid to an end objective.

How do you use ITIL?

ITIL currently consists of set process which can be customized as per the project or company requirements as it provide a baseline / guidelines to customize the process.
IT organizations can use recommendations to optimize and/or simplify their IT service management infrastructure from:
IT Service Support, IT Service Delivery, Planning to Implement Service Management, Application Management, Infrastructure Management, Security Management, Software Asset Management, and the Business Perspective.

What kind of issues is addressed by ITIL?

Issues pertaining to Operations / Management / Services which can be mapped to ITIL process shall be addressed.
Some of the Process which can be mapped to our services / operations are:

Change Management
Change Management provides a consistent approach to evaluating and implementing any change to the IT infrastructure. It details processes that allow users to assess the impact, risk and resource requirements associated with proposed changes.

Problem/Incident Management
Problem management occurs in the form of the identification, investigation and classification of problems. It is a key role in IT Service Management. Problem management pro-actively reduces incident volumes and continually improves the underlying IT infrastructure.

Incident Management records, classifies, tracks and closes all incidents in a controlled and consistent manner. This allows operational service levels to be restored as quickly as possible and helps reduce the number of new incidents.

Service-Level Management
This aims to ensure a satisfactory quality of IT service provision by setting realistic and agreed targets between provider and customer. A process of monitoring, reporting and reviewing of actual service levels highlights any problem areas and facilitates continuous service improvement.

Continuity Management
This process ensures that major failures of technical equipment or facilities associated with IT Service provision are managed efficiently and service levels are restored back to an acceptable level within agreed timescales.

Configuration Management
This provides the crucial foundation for Incident, Problem and Change Management. It records, audits and tracks all configuration items in the IT infrastructure and their relationships from purchase to obsolescence.

Release Management
Release Management offers a systematic framework for large or critical hardware roll-outs, major software roll-outs or bundled sets of changes. It takes into account all technical and non-technical aspects of a release from initial release policy and planning through to development, testing and controlled implementation.

Capacity Management
This process aims at aligning IT service level provision to the current and future business needs. It is concerned with optimizing the usage of existing IT resources as well as ensuring new resources are made available in a timely and efficient manner.

Financial Management
Also known as Cost Management, this process provides essential management information on IT asset and service costs. Through a process of budgeting and accounting true costs are revealed and the value of IT to the business can be demonstrated.

Availability Management
Availability Management ensures that all IT systems and services are functioning as required and that availability is sustained in a reliable and cost-effective way. With the supply and provision of information companies need to consider security management as well to prevent unauthorized use of information.

Security Management
Based on ISO 17799 (a code of practice defined by the International Organization for Standardization), the ITIL security management process is split into two segments: a realization of a basic level of security, and a realization of the security requirements defined in existing service level agreements. The processes defined in the ITIL security segment are centered around achieving those two goals.

Help Desk Management
The Service Desk function is the face of IT to its users and therefore of vital importance in any organization. Service Desk staff log, resolve or escalate and close all incidents. They also increasingly provide more high-level first line support as well as initiatives for service improvement and cost reduction.

What is Prometric and what is its role?
Thomson Prometric is a worldwide provider of computer based examinations. The - ITIL Foundation examination is one of the examinations available in the Prometric Authorized Testing Centers.

What is the difference between EXIN and ISEB?
It is of same value; ISEB and EXIN are accredited as Examination Institutes by the Office of Government and Commerce (OGC) and meet regularly to ensure that the ITIL Foundation qualifications are broadly in line with each other.

What is ISEB?
The Information Systems Examinations Board (ISEB) is a division of the British Computer Society. ISEB was created in 1990 from the Systems Analysis Examinations Board (which was set up in 1967). ISEB administrates examinations and issues certificates in a variety of subjects in the field of information systems engineering. A list of qualifications can be obtained from ISEB.

How can ITIL be useful to an IT organization?
Quoting the ITIL website, “ITIL is intended to assist organizations to develop a framework for IT Service Management.” The key parts of that sentence are “assist” and “framework.” ITIL’s biggest strength is that it provides an internally consistent framework around which IT organizations can structure their service management. The problem that many organizations run into is that they approach ITIL as a complete solution rather than as an aid to an end objective.

Are there support groups for ITIL?
Yes. The official group is the IT service management forum (ITSMF). There are also a myriad number of groups that use and/or comment on ITIL.

Tuesday, April 29, 2008

ITIL Quick Reference

ITIL Quick Reference

1. Business and IT Service MappingThe first key task during a SLM implementation is to map the current Business Process to the provision of IT Services. This document guides you through this. Plus you will get a template to capture the information.

2. Business Justification DocumentThis template is a business case document that will help you structure a successful document that can be presented to senior management and board members justifying the need for Service Level Management in your organization.

3. Communication PlanTo be successful with a process implementation it is important to have a communication plan in place. This document provides an approach and a list of documents that need to be created for your communication campaign.

4. Corporate Based SLAThis document is a template for Service Level Agreements at a Corporate Level.

5. Customer Based SLAThis document is a template for Service Level Agreements at a Customer Level.

6. E-Mail TextDuring your communication campaign it is important to let the IT staff know about the Service Level Management process and the benefits it will provide to them. This document provides a useful template for this communication.

7. Functional Specifications Template for the functional specification of the services being provided by the IT department. This would be written in Business English.

8. Technical SpecificationsTemplate for the technical specifications of the services provided by the IT department. This would be written in Technical English.

9. Operational Level AgreementsThis template provides a structure for agreeing and creating agreements on services provided by internal departments within the Organisation.

10. SLM Powerpoint PresentationDuring the implementation it is considered best practice to involve all necessary parties. To get significant buy-in across the organization a number of road shows may need to be conducted. This powerpoint presentation provides you with 1 hour of slides defininge Service Level management.

11. Service Based SLAThis document is a template for Service Level Agreements.

12. Service CatalogueThe Service Catalogue is a list of Services that the IT Department can or does deliver to its Customers.

13. Price ListTemplate or Appendix that can be used to show a break down of the price for each service.

14. Service Level Project PlanThis documents provides a skeleton outline for planing and project managing your process implementation.

15. Service Level Management Policies and GuidelinesIt is important to set Policies and Guidelines for your Service Level Management process. This document provides a structure and written words.

16. Service Level Management Process TemplateThis document includes a series of objectives and goals for the SLM process along with a skeleton map of the process itself. It also includes a process for instigating and running a Service Improvement Programe.

17. Service Level Management Review DocumentThis document provides a guideline for reviewing your organizations current Service Level Management process. It will provide you with a maturity level for the process and highlight those areas that are open for improvement.

18. Service Level Management Scope DocumentAll processes need to have a Scope. This document will provide a template for creating your Scope for the Service Level Management process.

19. Service Level RequirementsA template and list of questions for gathering the Customers requirements regarding desired services.

20. Service OptionsTemplate for breaking the services into options, i.e. Gold, Silver, Bronze level of Service.

21. SLM Flyer - Business and IT FlyersDuring your communication campaign it is important to let the organisation now what IT is doing. These flyers present an easy way of doing this.

22. Reports and KPI targets and additional metricsA list of key reports and Key Performance Indicators for the Service Level Management process, plus additional metrics that may need to be considered.

23. SLM Process Manager DocumentThis document outlines the role, responsibility and tasks of the SLM Process Manager. It also includes a brief outline of the necessary skills needed by a SLM Process Manager.

24. Underpinning ContractsThis template provides a structure for agreeing and creating Underpinning Contracts with External Service Providers.

Tuesday, April 22, 2008

ITIL Quick Guide

Welcome To the ITIL

The Information Technology Infrastructure Library (ITIL) defines the organisational structure and skill requirements of an information technology organisation and a set of standard operational management procedures to allow the organisation to manage an IT operation and associated IT infrastructure. The operational procedures are supplier independent and apply to all items of equipment within the IT Infrastructure.

The 'library' itself comprises seven distinct sets: Service Support; Service Delivery; ICT Infrastructure Management; Planning to Implement Service Management; Applications Management; The Business Perspective; and Security Management. Within these sets are the specific descriptions and definitions of the various ITIL disciplines.

ITIL was originally created by the CCTA under the auspices of the British government, and ITIL is a registered trademark of the UK Government's Office of Government Commerce (usually known as the OGC).

The two most commonly used sets (the core sets) are Service Support and Service Delivery. The disciplines within these are as follows:

-Incident Management

-Problem Management

-Configuration Management

-Change Management

-Release Management

-Service Desk

-Service Level Management

-IT Financial Management

-Capacity Management

-Availability Management

-IT Service Continuity Management

-IT Security Management

Service Support

Incident Management

An 'Incident' is any event which is not part of the standard operation of the service and which causes, or may cause, an interruption or a reduction of the quality of the service.

The objective of Incident Management is to restore normal operations as quickly as possible with the least possible impact on either the business or the user, at a cost-effective price.

Inputs for Incident Management mostly come from users, but can have other sources as well like management Information or Detection Systems. The outputs of the process are RFC’s (Requests for Changes), resolved and closed Incidents, management information and communication to the customer.

Activities of the Incident Management process:

Incident detection and recording

Classification and initial support

Investigation and diagnosis

Resolution and recovery

Incident closure

Incident ownership, monitoring, tracking and communication

These elements provide a baseline for management review.

Incident Management Overview

Mission Statement

Restore normal state IT service operations as quickly as possible to minimize the adverse impact on business operations.

Process Goal Achieve the process mission by implementing:

• ITIL-aligned Incident Management Policies, Processes and Procedures

• Incident escalation standards

• Dedicated Incident Management Process Owner

• Incident classification categories

• Incident reports

• Incident communications and education for IT staff

Critical Success Factors (CSFs)

The Critical Success Factors are:

Maintaining IT Service Quality

• Maintaining Customer Satisfaction

• Resolving Incidents Within Established Service Times

Key Activities

Key Activities the key activities for this process are:

Detect and record incidents

• Classify incidents

• Provide initial incident support

• Prioritize incidents based on impact and urgency

• Investigate and diagnose incidents

• Resolve incidents and recover service per agreed service levels

• Close incidents

• Maintain ownership, monitoring, tracking and communications about incidents

• Provide management information about Incident Management quality and operations

Key Performance Indicators (KPIs) Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Maintaining IT Service Quality

• Number of Severity 1 incidents (total and by category)

• Number of Severity 2 incidents (total and by category)

• Number of other incidents (total and by category)

• Number of incidents incorrectly categorized

• Number of incidents incorrectly escalated

• Number of incidents bypassing Service Desk

• Number of incidents not closed/resolved with workarounds

• Number of incidents resolved before customers notice

• Number of incidents reopened

Maintaining Customer Satisfaction

• Number of User/Customer surveys sent

• Number of User/Customer surveys responded to

• Average User/Customer survey score (total and by question category)

• Average queue time waiting for Incident response

Resolving Incidents Within Established Service Times

• Number of incidents logged

• Number of incidents resolved by Service Desk

• Number of incidents escalated by Service Desk

• Average time to restore service from point of first call

• Average time to restore Severity 1 incidents

• Average time to restore Severity 2 incidents

The Difference between Incident Management and Problem Management

Incidents and Service Requests are formally managed through a staged process to conclusion. This process is referred to as the "Incident Management Lifecycle". The objective of the Incident Management Lifecycle is to restore the service as quickly as possible to meet Service Level Agreements. The process is primarily aimed at the user level.

Problem Management deals with resolving the underlying cause of one or more Incidents. The focus of Problem Management is to resolve the root cause of errors and to find permanent solutions. Although every effort will be made to resolve the problem as quickly as possible this process is focused on the resolution of the problem rather than the speed of the resolution. This process deals at the enterprise level.

Problem Management

The objective of Problem Management is to minimize the impact of problems on the organisation. Problem Management plays an important role in the detection and providing solutions to problems (work arounds & known errors) and prevents their reoccurrence.

A 'Problem' is the unknown cause of one or more incidents, often identified as a result of multiple similar incidents.

A 'Known error' is an identified root cause of a Problem.

There is frequently a Conflict between Incident Management and Problem Management

Conflict between Incident Management and Problem Management:

Background: Incident Management is concerned with restoring service as quickly as possible. Problem Management is concerned with determining and eliminating root cause (and hence eliminating repeat problems).

So from an Incident Management perspective the best decision is to, for example, reboot a server to restore the service. This is not ideal from a Problem Management perspective as the reboot may destroy any diagnostics and so prevent progress towards identifying root cause.

Possible Solution: Form a plan of attack for the next occurrence of the problem:

• What diagnostics to collect

• How long to allow for diagnostics before service is restored

• Prepare the necessary resources (people, process, and technology) prior to the incident

• Communicate the plan to the stakeholders.

The Problem Management process uses these inputs:

  • Incident Records And Details About Incidents

  • Known Errors: A Known Error is a problem for which the root cause is understood and there is a temporary workaround or a permanent fix has been identified. Note that the implementation of the permanent fix may be some time in the future.

  • Information about CIs From The CMDB

  • Information From Other Processes

The outputs of the PM process:

  • RFCs (Request for Change)
  • RFC: RFC is an acronym for: Request for Change.

This is normally part of a formal procedure, and can, for example, be an input to a service desk. It is largely part of 'business as usual' in a development or business cycle.

  • Management Information
  • Work Arounds:

A work around is an uncommon solution to a problem where the known methodology is insufficient. Work arounds are usually used to minimize the effects of the problem, until a permanent solution is offered. Note that when the root cause has been identified Work Arounds become Known Errors.

  • Known Errors
  • Update Problem Records (solved problems records if the known error is resolved)

Problem management Overview

Mission Statement

Minimize the adverse impacts of incidents and problems on the business caused by errors in the IT infrastructure and initiate actions to prevent recurrence of incidents related to those errors.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned Problem Management Policies, Processes and Procedures

• Dedicated Problem Manager

• Problem classification categories

• Problem trend reports

• Publicized Known Errors

• Problem analysis toolkit

• Root Cause Analysis skills and culture

• Actions to minimize impact of problems

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

Avoiding Repeated Incidents

• Minimizing Impact Of Problems

Key Activities

The key activities for this process are:

Provide problem control

• Provide error control

• Proactively manage problems

• Conduct major problem reviews

• Provide management information about Problem Management quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Avoiding Repeated Incidents

• Number of repeat incidents

• Number of existing Problems

• Number of existing Known Errors

Minimizing Impact of Problems

• Average time for diagnosis of Problems

• Average time for resolution of Known Errors

• Number of open Problems

• Number of open Known Errors

• Number of repeat Problems

• Number of Major Incident/Problem reviews

Configuration Management

Goals: Providing information on the IT infrastructure to all other processes and IT management. Enabling control of the infrastructure by monitoring and maintaining information on all the resources needed to deliver services

Activities

• Planning.

• Identification and naming.

• Control.

• Status accounting.

• Verification & audit.

Benefits

• Providing accurate information on Configuration Items (CIs) and their documentation

• Controlling valuable CIs

• Facilitating adherence to legal obligations

• Helping with financial and expenditure planning

• Making software changes visible

• Contributing to contingency planning

• Supporting and improving Release management

• Allowing the organization to perform impact analysis and schedule changes safely and efficiently

• Providing problem management with data on trends

Configuration Management Overview

Mission Statement

To identify, record and report on configuration items and their relationships that underpin IT services.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned Configuration Management policies, processes and procedures

• Dedicated Configuration Management Process Owner

• Configuration Management Database (CMDB) data schema

• Proper authorization and control over CMDB data

• Periodic audits and reviews of IT services and their configuration items.

• Accurate information on IT services and their configuration items

• Verification of configuration records against the IT infrastructure and correction actions for any exceptions found.

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Managing Configuration Item information

• Providing capability to perform risk analysis of changes and releases

Key Activities

The key activities for this process are:

• Plan for Configuration Management databases and activities

• Identify Configuration Items

• Control Configuration Item information

• Perform status accounting

• Perform verification and audit of Configuration Management databases

• Provide management information about Configuration Management quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF) that was listed above.

Managing Configuration Item Information

• Number of Configuration Items logged and tracked

• Number of Configuration Items with attribute failures

• Number of changes to Configuration Item attributes

• Number of additional Configuration Items

• Number of deletions of Configuration Items

• Number and frequency of exceptions in configuration audits

Providing Capability To Perform Risk Analysis Of Changes and Releases

• Number of incidents caused by inaccurate configuration data

• Percentage of Services tracked with Configuration Items versus known products and services

Software tools

Most organisations should required a Configuration management-based tool, capable of storing all relevant configuration items (CIs). Such a tool should have the following facilities:

• Problems, RFCs are stored upon the same database in an easily accesible format.

• The ability to identify the relationship among CIs (physical and logical), and between CIs and RFCs, RFCs and Problems, RFCs and CI

Change Management

Goal: Ensure that standardized methods and procedures are used for efficient and prompt handling of all changes, in order to minimize the impact of Change-related incidents upon service quality, and consequently to improve the the day-to-day operations of the organization

Input: RFCs, CMDB, Forward Schedule of Changes (FSC))

Activities

• Filtering changes

• Managing changes and the change process

• Chairing the CAB and CAB/EC

• Reviewing and closing RFCs

• Management reports

Benefits

• Better alignment of IT service to business requirements

• Increased visibility and communication on changes to both business and service support staff

• Improved risk assessment

• Reduced adverse impact of changes on the quality of services and on SLAs

• Improved problem and availability management through the use of valuable management information relating to changes

• Fewer changes to be backed-out

Change Management Overview

Mission Statement

Coordinate and control all changes to IT services to minimize adverse impacts of those changes to business operations and the users of IT services.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned Change Management Policies, Processes and Procedures

• Standardized methods and techniques for efficient handling of changes

• Dedicated Change Manager

• Change Advisory Board

• Forward Schedule of Changes (FSC)

• Published Service Availability (PSA) reports

• Proper levels of pre and post Change communications with customers and users

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Controlling Changes

• Making Quick And Accurate Changes Based On Business Priorities

• Protecting Services When Making Changes

Key Activities

The key activities for this process are:

• Accept Changes

• Prioritize and classify changes

• Coordinate change impact assessment

• Coordinate approval of changes

• Coordinate scheduling of changes

• Coordinate implementation of changes

• Conduct post implementation reviews

• Provide management information about Change Management quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Controlling Changes

• Number of RFCs processed

• Number of RFCs rejected

• Number of unauthorized changes detected

• Number of RFCs implemented on schedule

• Number of RFCs requiring reschedules

Making Quick and Accurate Changes Based On Business Priorities

• Number of RFCs marked as URGENT

• Number of RFCs not tested prior to implementation

• Number of RFCs that failed

• Number of RFCs without business case

• Number of RFCs bypassing CAB or CAB/EC

Protecting Services When making Changes

• Number of SEV1 incidents caused by RFC implementation

• Number of SEV2 incidents caused by RFC implementation

• Number of other incidents caused by RFC implementation

• Number of RFCs without a backup strategy

Release Management

This discipline of IT Service Management is the management of all software configuration items within the organisation. It is responsible for the management of software development, installation and support of an organization’s software products.

Software is often not regarded as a tangible asset because of its intangible nature, which results in it not being effectively controlled. There can be several versions of the same software within the organization, and there can also be unlicensed and illegal copies of externally provided software.

The practice of effective Software Control & Distribution (SC&D) involves the creation of a Definitive Software Library (DSL), into which the master copies of all software is stored and from here its control and release is managed. The DSL consists of a physical store and a logical store.

The physical store is where the master copies of all software media are stored. This tends to be software that has been provided from an external source.

The logical store is the index of all software and releases, versions, etc. highlighting where the physical media can be located. The logical store may also be used for the storage of software developed within the organization.

SC&D procedures include the management of the software Configuration Items and their distribution and implementation into a production environment. This will involve the definition of a release programme suitable for the organization, the definition of how version control will be implemented, and the procedures surrounding how software will be built, released and audited.

Release Management Overview

Mission Statement

Implement changes to IT services taking a holistic (people, process, technology) view which considers all aspects of a change including planning, designing, building, testing, training, communications and deployment activities.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned Release Management policies, processes and procedures

• Collaboration with those organizations outside of IT that impact IT services to plan and ensure impacted stakeholders are involved and that the service is appropriately tested (from a customer’s perspective) following implementation

• Dedicated Release Manager

• Actions for planned Releases to analyze impacts and, wherever possible, coordinate efforts (such as packaging Release Units)

• A set of standard repositories for maintaining all authorized versions of software (Definitive Software Library – DSL)

• A set of recognized storage locations for spare parts and other hardware (Definitive Hardware Stores – DHS)

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Producing Operable Solutions

• Controlling Releases Into Production

• Implementing Releases Into Production On Time

Key Activities

The key activities for this process are:

• Conduct release planning

• Coordinate design, building and configuring of releases

• Coordinate release acceptance

• Conduct rollout planning

• Coordinate release communications, preparations and training activities

• Coordinate distribution and installation of releases

• Provide management information about Release Management quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Producing Operable Solutions

• Number of implementations bypassing Change Management

• Number of implementations utilizing non-standard components

• Number of implementations utilizing non-licensed components

• Number of implementations non-authorized

• Number of incidents caused by releases

• Number of failed Releases

Controlling Releases Into Production

• Number of Releases implemented without a corresponding RFC

• Number of urgent releases

• Number of releases implemented but not adequately tested

• Number of releases implemented without operational assurance

Implementing Releases Into Production On Time

• Number of Releases implemented

• Number of Releases implemented late

Service Desk

Though not a process, the Service Desk is an important function within the service support set. It is the first and ideally single point of contact for users (SPOC).

The two main focuses of the Service Desk are: Incident Control and Communication.

The Service Desk handles all incoming calls and only escalates them to the second or third tier support when necessary.

Ideally, the Service Desk will have access to a Knowledge Base, which will contain a list of known solutions for common incidents. This way queries or incidents can be solved by the Service Desk staff without taking time from skilled IT technicians.

For the customer the advantage is that they don’t have to ring around searching for the right person to solve their problem and for IT personnel it means that they only have to deal with issues that are related to their skills or area of responsibility.

The Service Desk is responsible for keeping the customer informed on the status of their request.

A Service Catalogue should be available which lists all of the services that IT provides to the business. This catalogue should list the services from a users perspective. A suggestion from the SLM2000 Service Catalogue template for information to be included in a Service Catalogue is listed below. Actual components required in a Service Catalogue will differ depending on the business situation however.

IT Service Management Service Catalogue

1 Executive Overview

2 Scope

3 Service Summary Sheet

4 Service A

4.1 Description

4.2 Customers

4.3 Options

4.4 Price List

4.5 Dependencies & Contributors

4.6 Functional Specification

4.7 Technical Specification

4.8 Support Activities

4.9 Customizations or Variants

4.10 Existing SLAs

4.11 Restrictions

5 Appendices

6 Terminology

Service Desk Function Overview

Mission Statement

Provide a strategic central point of contact for customers and support the Incident Management process by providing an operational single point of contact to manage incidents to resolution.

Function Goal

Achieve the function mission by implementing:

• ITIL-aligned Service Desk function

• Dedicated Service Desk Function Owner

• Centralized function for incident and request handling

• Ongoing monitoring and management of customer satisfaction

• Strong levels of incident communications and ownership

• Right level of support and customer care skills among Service Desk staff and management

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Ensure long term Customer retention and satisfaction

• Assist in the identification of business opportunities.

• Reduce support costs by the efficient use of resource and technology

Key Activities

The key activities for this function are:

• Provide advice and guidance to customers

• Communicate and promote IT services

• Manage and control service communications to customers, suppliers and the business

• Coordinate Incident Management activities

• Manage people, processes and technologies that form the contact infrastructure

• Provide management information about Service Desk quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Ensure Long Term Customer Retention and Satisfaction

• Percent Of Customers Given Satisfaction Surveys

• Customer Satisfaction Rating Of Service Desk

• Percent Of Caller Hold Times Within Service Targets

• Percent Of Calls Responded To Within Service Targets

• Number Of Incident Records Not Yet Closed

• Number Of Calls Abandoned

Assist In The Identification Of Business Opportunities

• Number Of Calls Referred To Sales Organization

• Dollar Value Of Referred Calls To Sales Organization

Reduce Support Costs By Efficient Use Of Resources and Technologies

• Percent Of Calls Resolved At The Service Desk Without Escalation

• Staff Turnover Rate

• Overall Cost Per Call.

Service Delivery

Service Level Management

Service Level Management is the process that forms the link between the IT organization and customers.

Implementing Service Level Management can only be completely successful when the other ITIL processes are implemented as well.

The main aim of SLM is to ensure the quality of the IT services provided, at a cost acceptable to the business/customer.

The goal for SLM is to maintain and improve on service quality through a constant cycle of agreeing, monitoring, reporting and improving the current levels of service. It is focused on the business and maintaining the alignment between the business and IT.

Service Level Management Overview

Mission Statement

Plan, coordinate, negotiate, report and manage the quality of IT services at acceptable cost.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned Service Level Management policies, processes and procedures

• Business-aligned IT services through a constant cycle of agreeing, monitoring and reporting

• Dedicated Service Level Management Process Owner

• Holistic management over IT services versus independent technical silos

• IT Service Catalog

• Service Level Agreements for customers of IT services

• Operational Level Agreements and Underpinning Contracts with IT suppliers

• Reports on the quality of IT services on a regular basis

• Proactive actions to seek service improvements where needed

• Proactive actions to eradicate unacceptable levels of service.

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Meeting Customer Needs And Priorities

• Adherence To Service Levels

• Providing Services Cost Effectively

• Controlling Service Delivery

• Maintaining Recognized Industry Acceptance For IT Quality

• Maintaining An IT Service Culture

Key Activities

The key activities for this process are:

• Identify IT services and service requirements

• Define, build and manage the IT Service Catalog

• Define, build and negotiate Service Level Agreements (SLAs)

• Define, build and negotiate Operational Level Agreements (OLAs)

• Identify Underpinning Contract service requirements (UCs)

• Monitor and manage SLAs, OLAs and UCs

• Initiate service improvement actions

• Provide management information about Service Level Management quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Meeting Customer Needs and Priorities

• Customer satisfaction score/rating

• Average time to implement SLA requests

• Number of SLAs in renegotiation

• Number of SLAs requiring changes (targets not attainable, etc.)

• Number of SLA issues logged

Adherence To Service Levels

• Number of SLA targets missed

• Number of SLA targets threatened

Providing Services Cost Effectively

• Current cost per customer for delivery of services

• Percentage improvement in delivery cost per customer

Controlling Service Delivery

• Number of OLA issues logged

• Number of Underpinning Contract issues logged

Maintaining Recognized Industry Acceptance For IT Quality

• Number of ITs articles/white papers published

• Percentage IT Operations staff in industry (i.e; itSMF) programs

• Percentage progress towards industry certification (i.e; ISO9000)

• Dollars spent on external communications activities

Maintaining an IT Service Culture

• Percentage of IT Operations staff ITIL-aware

• Number of IT Operations staff ITIL certified

• Number of IT Operations staff with advanced ITIL certification

• Number Of Agreed SLAs Not Supported By OLAs/UCs

IT Financial Management

IT Financial Management is the discipline of ensuring that the IT infrastructure is obtained at the most effective price (which does not necessarily mean cheapest) and calculating the cost of providing IT services so that an organisation can understand the costs of its IT services. These costs may then be recovered from the customer of the service.

Costs are divided into costing units: Equipment; Software; Organisation (staff, overtime; accommodation; transfer costs (costs of 3rd party service providers)

These costs are divided into Direct and Indirect costs and may be Capital or Ongoing.

The practice of IT financial management enables the Service Manager to identify the amount being spent on security countermeasures in the provision of the IT services. The amount being spent on these countermeasures needs to be balanced with the risks and the potential losses that the service could incur as identified during a business impact assessment and risk assessment. Management of these costs will ultimately reflect on the cost of providing the IT services and potentially what is charged in the recovery of these costs.

Financial Management Overview

Mission Statement

Provide budgeting, accounting and charging services to control, manage and recover IT cost and spend.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned IT Financial Management policies, processes and procedures

• Dedicated Financial Management Process Owner

• Effective IT budget and planning practices

• Accurate and efficient IT charging and cost recovery for IT services

• Accurate accounting of IT expenditures and revenues

• Reporting on the state and health of IT costs and revenues on a regular basis

• Periodic audits of IT financial information to ensure accuracy

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Effective stewardship over IT finances

Key Activities

The key activities for this process are:

• Perform budgeting for IT services and activities.

• Perform IT accounting activities.

• Perform IT charging and billing activities.

• Provide management information about Financial Management quality and operations.

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Effective Stewardship Over IT Finances

• Overall cost of delivery per customer

• Percentage of IT costs not accounted for

• Dollar value of budget variances/adjustments

• Percentage of IT financial objectives met

• IT Service Headcount

Capacity Management

Capacity Management is the discipline that ensures IT infrastructure is provided at the right time in the right volume at the right price, and ensuring that IT is used in the most efficient manner.

This involves input from many areas of the business to identify what services are (or will be) required, what IT infrastructure is required to support these services, what level of Contingency will be needed, and what the cost of this infrastructure will be.

Capacity management is made up of three sub processes:

Business capacity management (BCM)

Service capacity management (SCM)

Resource capacity management (RCM)

These sub processes all share a common set of activities that are applied from different perspectives. They include the following:

Modeling

Service monitoring

Performance management

Demand management

Workload management

Analysis

Change initiation

Optimization

Trend analysis

These are inputs into the following Capacity Management processes:

· Performance monitoring

· Workload monitoring

· Application sizing

· Resource forecasting

· Demand forecasting

· Modelling

From these processes come the results of capacity management, these being the capacity plan itself, forecasts, tuning data and Service Level Management guidelines.

Capacity Management Overview

Mission Statement

To ensure that all current and future capacity and performance aspects of the IT infrastructure are provided to meet business requirements at acceptable cost.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned Capacity management policies, processes and procedures

• Dedicated Capacity Management Process Owner

• Business Capacity Management to forecast capacity needs based on business events

• Service Capacity Management to ensure capacity levels support established service level targets

• Resource Capacity Management to ensure capacity levels are provided for at the individual IT device level

• Actions to ensure appropriate levels of capacity have been built into new IT Solutions

• Periodic and ongoing forecasting for capacity needs based on both business and technical input

• Ongoing monitoring and analysis of current performance to ensure appropriate levels of capacity have been provided and resources are optimally tuned

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Providing Accurate IT Capacity Forecasts

• Providing Appropriate IT Capacity To Meet Business Needs

Key Activities

The key activities for this process are:

• Perform demand management for business, service and resource capacity activities

• Perform modeling for business, service and resource capacity activities

• Provide application sizing for business, service and resource capacity activities

• Provide capacity plans for business, service and resource capacity activities

• Perform capacity monitoring, analysis and tuning activities

• Implement capacity-related changes

• Control storage of capacity data for capacity activities

• Provide management information about Capacity Management quality and operations.

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Providing Accurate IT Forecasts

• Total dollars in unplanned capacity expenditures

• Total dollars in unused capacity expenditures

• Percent of capacity forecasts that were accurate

• Number of inaccurate business forecast inputs provided

Providing Appropriate IT Capacity To Meet Business Needs

• Number of incidents related to capacity/performance issues

• Number of SLA performance targets missed due to capacity

Availability Management

Availability is usually calculated based on a model involving the Availability Ratio and techniques such as Fault Tree Analysis, and includes the following elements:

· Serviceability – where a service is provided by a 3rd party organisation, this is the expected availability of a component.

· Reliability – the time for which a component can be expected to perform under specific conditions without failure.

· Recoverability – the time it should take to restore a component back to its operational state after a failure.

· Maintainability – the ease with which a component can be maintained, which can be both remedial and preventative.

· Resilience – the ability to withstand failure.

· Security – the ability of components to withstand breaches of security.

Availability Management and IT Security

IT Security is an integral part of Availability Management, this being the primary focus of ensuring IT infrastructure continues to be available for the provision of IT Services.

Some of the above elements are really the outcome of performing a risk analysis to identify any resilience measures to be put in place, identifying just how reliable elements are and how many problems have been caused as a result of system failure.

The risk analysis also recommends controls to improve availability of IT infrastructure such as development standards, testing, physical security, the right skills in the right place at the right time, etc..

Availability Management Overview

Mission Statement

Optimize the capability of the IT infrastructure, services and supporting organization to deliver a cost effective and sustained level of service availability that meets business requirements.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned Availability Management policies, processes and procedures

• Dedicated Availability Management Process Owner

• Holistic management of IT service availability versus independent technical silos

• Actions to ensure availability levels meet established service level targets

• Service Improvement Projects (SIPs) to address availability

• shortfalls and concerns

• Actions to proactively seek availability improvements where needed

• Actions to ensure appropriate levels of availability have been built into new IT solutions

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Maintaining Availability And Reliability Of IT services

• Providing Availability Cost Effectively

• Proactively Addressing Availability Improvements Where Needed

Key Activities

The key activities for this process are:

• Determine availability requirements

• Compile availability plans

• Monitor availability

• Monitor maintenance obligations

• Provide management information about Incident management quality and operations

Key Performance Indicators (KPIs) Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Maintaining Availability and Reliability Of IT Services

• Number of incidents caused by hardware failures

• Number of incidents caused by maintenance failures

• Number of incidents caused by resilience failures

• Number of incidents caused by security failures

• Number of incidents caused by operational failures

• Number of incidents caused by application failures

• Number of incidents caused by data issues/problems

• Number of incidents caused by lack of support skills

• Number of incidents caused by customer actions

Providing Availability Cost Effectively

• Percentage of delivery cost per customer related to availability activities

• Percentage of delivery cost per customer related to resiliency measures implemented

Proactively Addressing Availability Improvements Where Needed

• Number of Service Improvement Initiatives (SIPs) in place

• Number of SIPs completed on time

• Number of SIPs not yet staffed/started

IT Service Continuity Management

Continuity Management / Disaster Recovery / Business Continuity

Continuity management is the process by which plans are put in place and managed to ensure that IT Services can recover and continue should a serious incident occur. It is not just about reactive measures, but also about proactive measures - reducing the risk of a disaster in the first instance.

Continuity management is so important that many organizations will not do business with IT service providers if contingency planning is not practiced within the service provider’s organisation. It is also a fact that many organizations that have been involved in a disaster where their contingency plan failed ceased trading within 18 months following the disaster.

Continuity management is regarded as the recovery of the IT infrastructure used to deliver IT Services, but many businesses these days practice the much further reaching process of Business Continuity Planning (BCP), to ensure that the whole end-to-end business process can continue should a serious incident occur.

Continuity management involves the following basic steps:

· Prioritising the businesses to be recovered by conducting a Business Impact Analysis (BIA)

· Performing a Risk Assessment (aka Risk Analysis) for each of the IT Services to identify the assets, threats, vulnerabilities and countermeasures for each service.

· Evaluating the options for recovery

· Producing the Contingency Plan

· Testing, reviewing, and revising the plan on a regular basis

Continuity Management and Contingency Planning Information & Resources

A number of portals exist which offer guidance upon the topic of continuity management and contingency planning. For example: www.disasterrecoveryworld.com

Continuity Management and IT

Security Continuity Management (and contingency planning, business continuity and disaster recovery) is an integral part of IT security and risk analysis. Inadequate contingency planning is regarded as a risk to the business, and is often overlooked until it is too late, when a security or other breach results in the loss of supporting IT systems. This is a complex area, but fortunately a methodology and tool has evolved to greatly simplify it. The COBRA system emerged to counter the problems encountered through the use of older, less dynamic systems and approaches. It greatly reduces reliance upon external expertise, being equipped with significant knowledge within its 'knowledge bases'.

IT Service Continuity Overview

Mission Statement

Support business continuity management functions by ensuring that IT services can be recovered in the event of a major business disruption within required timescales.

Process Goal

Achieve the process mission by implementing:

• ITIL-aligned IT Service Continuity Management policies, processes and procedures

• Dedicated IT Service Continuity Management Process Owner

• Holistic recovery of IT services to ensure business services are recovered versus technologies

• Alignment of IT service recovery plans with Vital Business Functions

• Actions to ensure Operational Level Agreements and Underpinning Contracts with IT suppliers will support recovery services

• Periodic testing and audits of IT service continuity plans

• Communications for IT service recovery needs and requirements across the IT organization

• Staff awareness and education on IT service continuity actions to be taken in the event of a major business disruption

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Ensuring IT Service Recovery Within Agreed Timescales

Key Activities

The key activities for this process are:

• Define scope of IT Service Continuity Management

• Conduct Business Impact Analysis

• Conduct IT Risk Assessment.

• Define IT Service Continuity Strategy in line with Business Continuity strategy

• Perform IT Service Continuity organization and implementation planning activities

• Implement standby arrangements and risk reduction measures

• Develop IT recovery plans and procedures

• Perform Testing of IT recovery plans and procedures

• Review and audit IT recovery plans and procedures

• Perform IT Service Continuity educational training and awareness activities

• Assess impact of IT changes on IT Service Continuity plans and processes

• Validate ongoing ability of IT Service Continuity strategies to meet business requirements

• Provide management information about IT Service Continuity Management quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Ensuring IT Service Recovery within Agreed Timescales

• Percentage of Vital Business Functions covered by IT Service Continuity Plans

• Percentage of Vital Business Functions covered by annual IT Continuity tests

• Number of annual IT Service Continuity Plan testing failures

• Number of 3rd party recovery support contracts not agreed

• Number of audits performed on IT Service Continuity Plan

• Number of business issues logged against IT Service Continuity.

IT Security Management

According to BS 7799, Information Security refers to maintaining:

Confidentiality - Information is accessible only to those authorized.

Integrity- Safeguarding the accuracy and completeness of information

Availability– Authorised users have access to information when required.

C I A

Objectives:

To ensure that it complies with the external requirements-legislation SLA’s etc.

To create a secure environment regardless of the external requirements

Benefits:

Vital Business Information is kept secure

High availability

Quality of information

Security Management Function Overview

Mission Statement

To prevent the occurrence of security-related incidents by managing the cconfidentiality, integrity and availability of IT services and data line with business requirements at acceptable cost.

Function Goal

Prevent security related incidents by establishing:

Achieve the function mission by implementing:

• ITIL-aligned Security Management function

• Dedicated Security Management Function Owner

• Holistic management view of security considering people, process and physical items as well as technical items

• Centralized function for managing security and establishing security related policies

• Ongoing monitoring and reporting of security

• Proactive actions to prevent security related incidents

• Periodic auditing of security practices to continually improve overall security functions and controls

• Effective security controls that are in line with business and regulatory requirements at acceptable cost levels

Critical Success Factors (CSFs)

The Critical Success Factors (CSFs) are:

• Managing Confidentiality, Integrity and Availability Of IT Services And Data

• Providing Security Cost Effectively

• Proactively Addressing Security Improvements Where Needed

Key Activities

The key activities for this function are:

• Plan for Security Management in line with service and policy requirements

• Coordinate implementation of Security Management people, process and technologies

• Execute Security Management control activities

• Evaluate and audit the Security Management supporting infrastructure

• Maintain Security Management people, processes and technical infrastructure

• Provide management information about Security Management quality and operations

Key Performance Indicators (KPIs)

Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Managing the Confidentiality, Integrity and Availability of IT Services and Data

• Number of incidents caused by internal security failures

• Number of incidents caused by external security failures

• Number of security audit and testing failures

Providing Security Cost Effectively

• Percentage of delivery cost per customer related to security management activities

• Percentage of delivery cost per customer related to security measures implemented

Proactively Addressing Security Improvements Where Needed

• Number of Security Improvement Initiatives in place.

• Number of Security Improvement Initiatives completed on time

• Number of Security Improvement Initiatives not yet staffed/started

• Number of Security incidents related to non-current security maintenance.