4 service design

Editor's Notes

• #3: Purpose: Key Message: Additional Information: N/A Transition to Next Slide:
• #4: Purpose: Key Message: Additional Information: N/A Transition to Next Slide:
• #5: Purpose: Key Message: Additional Information: N/A Transition to Next Slide:
• #6: Purpose: Key Message: There are five aspects of design that need to be considered: The design of the services, including all of the functional requirements, resources and capabilities needed and agreed The design of Service Management systems and tools, especially the Service Portfolio, for the management and control of services through their lifecycle The design of the technology architectures and management systems required to provide the services The design of the processes needed to design, transition, operate and improve the services, the architectures and the processes themselves The design of the measurement methods and metrics of the services, the architectures and their constituent components and the processes. Additional Information: N/A Transition to Next Slide:
• #7: Purpose: Key Message: Reduced total cost of ownership (TCO): cost of ownership can only be minimized if all aspects of services, processes and technology are designed properly and implemented against the design Improved quality of service : both service and operational quality will be enhanced Improved consistency of service : as services are designed within the corporate strategy, architectures and constraints Easier implementation of new or changed services : as there is integrated and full Service Design, and the production of comprehensives Service Design Packages Improved service alignment : involvement from the conception of the service ensuring that new or changed services match business needs, with services designed to meet Service Level Requirements More effective service performance : with incorporation and recognition of Capacity, Financial, Availability and IT Service Continuity plans Improved IT governance : assists with the implementation and communication of a set of controls for effective governance of IT More effective service management and IT processes : processes will be designed with optimal quality and cost-effectiveness Improved information and decision-making: more comprehensive and effective measurements and metrics will enable better decision-making and continual improvement of service management practices in the design stage of the Service Lifecycle. Additional Information: N/A Transition to Next Slide:
• #9: Purpose: Key Message: Additional Information: N/A Transition to Next Slide:
• #11: Purpose: Key Message: Over the years, organizations’ IT infrastructures have grown and developed, and there may not be a clear picture of all the services currently being provided and the customers of each service. In order to establish an accurate picture, it is recommended that an IT Service Portfolio containing a Service Catalogue is produced and maintained to provide a central, accurate set of information on all services and to develop a service-focused culture. The Service Portfolio is produced as part of Service Strategy and should include participation by those involved in Service Design, Transition, Operation and Improvement. Once a service is ‘chartered’ (being developed for use by customers, Service Design produces the specifications for the service and it is at this point that the service should be added to the Service Catalogue. Additional Information: N/A Transition to Next Slide:
• #13: Purpose: Key Message: The Service Catalogue has two aspects: The Business Service Catalogue: containing details of all the IT services delivered to the customer, together with relationships to the business units and the business process that rely on the IT services. This is the customer view of the Service Catalogue. The Technical Service Catalogue: containing details of all the IT services delivered to the customer, together with relationships to the supporting services, shared services, components and CIs necessary to support the provision of the service to the business. This should underpin the Business Service Catalogue and not form part of the customer view. Additional Information: N/A Transition to Next Slide:
• #14: Purpose: Key Message: Additional Information: N/A Transition to Next Slide:
• #17: Purpose: Key Message: SLM should provide a point of regular contact and communication to the customers and business managers of an organization. It should represent the IT service provider to the business, and the business to the IT service provider. This activity should encompass both the use of existing services and the potential future requirements for new or changed services. SLM needs to manage the expectation and perception of the business, customers and users and ensure that the quality of service delivered by the service provider is matched to those expectations and needs. In order to do this effectively, SLM should establish and maintain SLAs for all current live services and manage the level of service provided to meet the targets and quality measurements contained within the SLAs. SLM should also produce and agree SLRs for all planned new or changed services. Additional Information: N/A Transition to Next Slide:
• #18: Purpose: Key Message: SLM provides a consistent interface to the business for all service-related issues. It provides the business with the agreed service targets and the required management information to ensure that those targets have been met. Where targets are breached, SLM should provide feedback on the cause of the breach and details of the actions taken to prevent the breach from recurring. Thus SLM provides a reliable communication channel and a trusted relationship with the appropriate customers and business representatives. Additional Information: N/A Transition to Next Slide:
• #19: Purpose: Key Message: SLM is the name given to the processes of planning, coordinating, drafting, agreeing, monitoring and reporting of SLAs, and the ongoing review of service achievements to ensure that the required and cost-justifiable service quality is maintained and gradually improved. However, SLM is not only concerned with ensuring that current services and SLAs are managed, but it is also involved in ensuring that new requirements are captured and that new or changed services and SLAs are developed to match the business needs and expectations. SLAs provide the basis for managing the relationship between the service provider and the customer, and SLM provides that central point of focus for a group of customers, business units or lines of business. An SLA is a written agreement between an IT service provider and the IT customer(s), defining the key service targets and responsibilities of both parties. The emphasis must be on agreement, and SLAs should not be used as a way of holding one side or the other to ransom. A true partnership should be developed between the IT service provider and the customer, so that a mutually beneficial agreement is reached – otherwise the SLA could quickly fall into disrepute and a ‘blame culture’ could develop that would prevent any true service quality improvements from taking place. SLM is also responsible for ensuring that all targets and measures agreed in SLAs with the business are supported by appropriate underpinning OLAs or contracts, with internal support units and external partners and suppliers. An OLA is an agreement between an IT service provider and another part of the same organization that assists with the provision of services – for instance, a facilities department that maintains the air conditioning, or network support team that supports the network service. An OLA should contain targets that underpin those within an SLA to ensure that targets will not be breached by failure of the supporting activity. Additional Information: N/A Transition to Next Slide:
• #20: Purpose: Key Message: Additional Information: N/A Transition to Next Slide:
• #22: Purpose: Key Message: The key activities within the SLM process should include: Designing SLA frameworks Using the Service Catalog as an aid, SLM must design the most appropriate SLA structure to ensure that all services and all customers are covered in a manner best suited to the organization’s needs (Service-based, Customer-based, or Multi-level SLA) Determine, negotiate, document and agree requirements for new or changed services in SLRs, and manage and review them through the service lifecycle into SLAs for operational services. This is one of the earliest activities within the Service Design stage of the service lifecycle. Once the Service Catalog has been produced and the SLA structure has been agreed, a first SLR must be drafted. It is advisable to involve customers form the outset, but rather than going along with a a blank sheet to start with, it may be better to produce a first outline draft o f the performance targets and the management and operational requirements, as a starting point for more detailed and in-depth discussion. Monitor and measure service performance achievements of all operational services against targets within SLAs. Nothing should be included in an SLA unless it can be effectively monitored and measured at a commonly agreed point. Collate, measure and improve customer satisfaction. There are a number of important ‘soft’ issues that cannot be monitored by mechanistic or procedural means, such as customer’s overall feelings. For example, even when there have been a number of reported service failures, the customers may still feel positive about things, because they may feel satisfied that appropriate actions are being taken to improve things. Review and revise underpinning agreements and service scope. IT service providers are dependent to some extent on their own internal technical support teams or on external partners or suppliers. They cannot commit to meeting SLA targets unless their own support team’s and supplier’s performances underpin these targets. Contracts with external suppliers are mandatory, but many organization have also identified the benefits of having simple agreements with internal support groups, usually referred to as OLAs. ‘Underpinning agreements’ is a term used to refer to all underpinning OLAs, SLAs and underpinning contracts. Produce service reports Immediately the SLA is agreed and accepted, monitoring must be instigated and service achievement/misses reports must be produced. The SLA reporting mechanisms, intervals and report formats must be defined and agreed with the customers. Conduct service reviews and instigate improvements within an overall Service Improvement Program/Plan (SIP). Periodic review meetings must be held on a regular basis with customers (or their representatives) to review the service achievement in the last period and to preview any issues for the coming period. It is normal to hold such meetings monthly, or as a minimum, quarterly. Review and revise SLAs, service scope and underpinning agreements All agreements and underpinning agreements, including SLAs, underpinning contracts and OLAs, must be kept up-to-date. They should be brought under Change and Configuration Management control and reviewed periodically, at least annually, to ensure that they are still current and comprehensive, and are still aligned to business needs and strategy. Develop and document contracts and relationships with the business, customers and stakeholders It is very important that SLM develops trust and respect with the business, especially with the key business contacts. Using the Service Catalog, especially the Business Service Catalog element of it, enables SLM to be much more proactive. Develop, maintain and operate procedures for logging, actioning and resolving all complaints, and for logging and distributing compliments. The SLM process should also include activities and procedures for the logging and management of all complaints and compliments. The logging procedures are often performed by the Service Desk as they are similar to those of Incident Management and Request Fulfillment. Additional Information: N/A Transition to Next Slide:
• #24: Purpose: Key performance indicators (KPIs) and metrics can be used to judge the efficiency and effectiveness of the SLM activities and the progress of the SIP. These metrics should be developed from the service, customer and business perspective and should cover both subjective and objective measurements such as the following: Key Message: Objective Metrics Number or percentage of service targets being met Number and severity of service breaches Number of services with up-to-date SLAs Number of services with timely reports and active service reviews Subjective Metric Improvement in Customer Satisfaction Additional Information: N/A Transition to Next Slide:
• #25: Purpose: Key Message: The Service Level Manager has responsibility for ensuring that the aims of Service Level Management are met, as the process owner. This includes responsibilities such as: Additional Information: Keeping aware of changing business needs, understanding what customers need Ensuring that the current and future service requirements of customers are identified, understood and documented in SLA and SLR documents Negotiating and agreeing levels of service to be delivered with the customer (either internal or external). Formally documenting these levels of service SLAs. Negotiating and agreeing OLAs and in some cases other SLAs and agreements that underpin the SLAs with the customers of the service. Assisting with the production and maintenance of an accurate Service Portfolio, Service Catalog, Application portfolio and the corresponding maintenance procedures. Ensuring that targets agreed within underpinning contracts are aligned with SLA and SLR targets. Ensuring that service reports are produced for each customer service and that breaches of SLA targets are highlighted, investigated and actions taken to prevent their recurrence. Ensuring that service performance reviews are scheduled, carried out with customers regularly and are documented with agreed actions progressed. Ensuring that improvement initiatives identified in service reviews are acted upon and progress reports are provided to customers. Reviewing service scope, SLAs, OLAs and other agreements on a regular basis, ideally at least annually. Ensuring that all Changes are assessed for their impact on service levels, including SLAs, OLAs and Underpinning Contracts, including attendance at CAB meetings if appropriate. Identification of all key stakeholders and customers. Developing relationships and communication with stakeholders, customers and key users. Definition and agreement of complaints and their recording, management, escalation where necessary and resolution. Definition recording and communication of all complaints. Transition to Next Slide:
• #26: Purpose: Key Message: One challenge faced by SLM is that of identifying suitable customer representatives with whom to negotiate. Who ‘owns’ the service? In some cases, this may be obvious, and a single customer manager is willing to act as the signatory to the agreement. In other cases, it may take quite a bit of negotiating or cajoling to find a representative ‘volunteer’ (beware that volunteers often want to express their own personal view rather than represent a general consensus), or it may be necessary to get all customers to sign. Care should be taken when opening discussions on service levels for the first time, as it is likely that ‘current issues’ (the failure that occurred yesterday) or long-standing grievances (that old printer that we have been trying to get replaced for ages) are likely to be aired at the outset. On negotiating the current support hours for a large service, that span geographies, an organization may found discrepancies in the required time of usage between Head Office and the field office’s customers. Head Office might win the ‘political’ argument, but if field office’s has the majority of the customers, they actually will be using more services than the Head office. Where no past monitored data is available, it is advisable to leave the agreement in draft format for an initial period, until monitoring can confirm that initial targets are achievable. Targets may have to be re-negotiated in some cases. One point to ensure is that at the end of the drafting and negotiating process, the SLA is actually signed by the appropriate managers on the customer and IT service provider sides to the agreement. This gives a firm commitment by both parties that every attempt will be made to meet the agreement. Generally speaking, the more senior the signatories are within their respective organizations, the stronger the message of commitment. Additional Information: N/A Transition to Next Slide:
• #27: Purpose: Key Message: There are a number of sources of information that interfaces an are relevant to the Service Level Management process. These should include: Business information: from the organization’s business strategy, plans, and financial plans and information on their current and future requirements The strategies, policies and constraints from Service Strategy The Service Portfolio and Service Catalog Continuous Service Improvement – Service Improvement Program/Plan (SIP): An overall program or plan of prioritized improvement actions, encompassing all services and all processes , together with associated impacts and risks Service Knowledge Management System: Containing information on the relationships between the business services, the supporting services and the technology Advice, information and input from any of the other processes, for example: Incident Management – Number/period of incidents, major incidents Capacity Management, Availability and IT Services Continuity Management – understand risks, options and Business Impact Analysis Change Management – Information such as a Change Schedule and a need to assess all changes for their impact on all services Together with the existing SLAs, SLRs, and OLAs and past service reports on the quality of service delivered. Additional Information: N/A Transition to Next Slide:
• #29: Purpose: Capacity Management process ensures that cost-justifiable IT capacity in all areas of IT always exists and is matched to the current and future agreed needs of the business, in a timely manner. Key Message: Capacity Management is a process that extends across the Service Lifecycle. A key success factor in managing capacity is ensuring it is considered during the design stage. It is for this reason that the Capacity Management process is included in this publication. Capacity Management is supported initially in Service Strategy where the decisions and analysis of business requirements and customer outcomes influence the development of patterns of business activity (PBA), levels of service (LOS) and service level packages (SLPs). This provides the predictive and ongoing capacity indicators needed to align capacity to demand. Additional Information: N/A Transition to Next Slide:
• #30: Purpose: The purpose of Capacity Management is to provide a point of focus and management for all capacity- and performance-related issues, relating to both services and resources. Key Message: The objectives of Capacity Management are to: Produce and maintain an appropriate and up-to-date Capacity Plan, which reflects the current and future needs of the business Provide advice and guidance to all other areas of the business and IT on all capacity- and performance-related issues Ensure that service performance achievements meet or exceed all of their agreed performance targets, by managing the performance and capacity of both services and resources Assist with the diagnosis and resolution of performance- and capacity-related incidents and problems Assess the impact of all changes on the Capacity Plan, and the performance and capacity of all services and resources Ensure that proactive measures to improve the performance of services are implemented wherever it is cost-justifiable to do so. Additional Information: N/A Transition to Next Slide:
• #33: Purpose: Key Message: Capacity Management ensures that the capacity and performance of the IT services and systems matches the evolving agreed demands of the business in the most cost-effective and timely manner. Capacity Management is essentially a balancing act: Balancing costs against resources needed: the need to ensure that processing capacity that is purchased is cost-justifiable in terms of business need, and the need to make the most efficient use of those resources. Balancing supply against demand: the need to ensure that the available supply of IT processing power matches the demands made on it by the business, both now and in the future. It may also be necessary to manage or influence the demand for a particular resource. Capacity Management processes and planning must be involved in all stages of the Service Lifecycle from Strategy and Design, through Transition and Operation to Improvement. Additional Information: N/A Transition to Next Slide:
• #34: Purpose: Key Message: The appropriate capacity and performance should be designed into services and components from the initial design stages. This will ensure not only that the performance of any new or changed service meets its expected targets, but also that all existing services continue to meet all of their targets. This is the basis of stable service provision. The overall Capacity Management process is continually trying cost-effectively to match IT resources and capacity to the ever-changing needs and requirements of the business. This requires the tuning and optimization of the current resources and the effective estimation and planning of the future resources, as illustrated in this slide. Additional Information: N/A Transition to Next Slide:
• #35: Purpose: Capacity Management has three levels of concern: Key Message: Business Capacity Management This sub-process translates business needs and plans into requirements for service and IT infrastructure, ensuring that the future business requirements for IT services are quantified, designed, planned and implemented in a timely fashion. This can be achieved by using the existing data on the current resource utilization by the various services and resources to trend, forecast, model or predict future requirements. These future requirements come from the Service Strategy and Service Portfolio detailing new processes and service requirements, changes, improvements, and also the growth in the existing services. Service Capacity Management The focus of this sub-process is the management, control and prediction of the end-to-end performance and capacity of the live, operational IT services usage and workloads. It ensures that the performance of all services, as detailed in service targets within SLAs and SLRs, is monitored and measured, and that the collected data is recorded, analyzed and reported. Wherever necessary, proactive and reactive action should be instigated, to ensure that the performance of all services meets their agreed business targets. This is performed by staff with knowledge of all the areas of technology used in the delivery of end-to-end service, and often involves seeking advice from the specialists involved in Component Capacity Management. Wherever possible, automated thresholds should be used to manage all operational services, to ensure that situations where service targets are breached or threatened are rapidly identified and cost-effective actions to reduce or avoid their potential impact implemented. Component Capacity Management The focus in this sub-process is the management, control and prediction of the performance, utilization and capacity of individual IT technology components. It ensures that all components within the IT infrastructure that have finite resource are monitored and measured, and that the collected data is recorded, analyzed and reported. Again, wherever possible, automated thresholds should be implemented to manage all components, to ensure that situations where service targets are breached or threatened by component usage or performance are rapidly identified, and cost-effective actions to reduce or avoid their potential impact are implemented. Additional Information: Transition to Next Slide:
• #37: Purpose: The Capacity Management Information System (CMIS) is the cornerstone of a successful Capacity Management process. Information contained within the CMIS is stored and analysed by all the sub-processes of Capacity Management because it is a repository that holds a number of different types of data, including business, service, resource or utilization and financial data, from all areas of technology. Key Message: The CMIS holds the information needed by all sub-processes within Capacity Management. For example, the data monitored and collected as part of Component and Service Capacity Management is used in Business Capacity Management to determine what infrastructure components or upgrades to components are needed, and when. The full range of data types stored within the CMIS is as follows. Business data It is essential to have quality information on the current and future needs of the business. The future business plans of the organization need to be considered and the effects on the IT services understood. The business data is used to forecast and validate how changes in business drivers affect the capacity and performance of the IT infrastructure. Business data should include business transactions or measurements such as the number of accounts, the number of invoices generated, the number of product lines. Service data To achieve a service-orientated approach to Capacity Management, service data should be stored within the CMIS. Typical service data are transaction response times, transaction rates, workload volumes, etc. In general, the SLAs and SLRs provide the service targets for which the Capacity Management process needs to record and monitor data. To ensure that the targets in the SLAs are achieved, SLM thresholds should be included, so that the monitoring activity can measure against these service thresholds and raise exception warnings and reports before service targets are breached. Component utilization data The CMIS also needs to record resource data consisting of utilization, threshold and limit information on all of the technological components supporting the services. Most of the IT components have limitations on the level to which they should be utilized. Beyond this level of utilization, the resource will be over-utilized and the performance of the services using the resource will be impaired. For example, the maximum recommended level of utilization on a processor could be 80%, or the utilization of a shared Ethernet LAN segment should not exceed 40%. Also, components have various physical limitations beyond which greater connectivity or use is impossible. For example, the maximum number of connections through an application or a network gateway is 100, or a particular type of disk has a physical capacity of 15Gb. The CMIS should therefore contain, for each component and the maximum performance and capacity limits, current and past utilization rates and the associated component thresholds. Over time this can require vast amounts of data to be accumulated, so there need to be good techniques for analysing, aggregating and archiving this data. Financial data The Capacity Management process requires financial data. For evaluating alternative upgrade options, when proposing various scenarios in the Capacity Plan, the financial cost of the upgrades to the components of the IT infrastructure, together with information about the current IT hardware budget, must be known and included in the considerations. Most of this data may be available from the Financial Management for IT services process, but Capacity Management needs to consider this information when managing the future business requirements. Additional Information: N/A Transition to Next Slide:
• #38: Purpose: A Capacity Manager, as the process owner, has responsibility for ensuring that the aims of Capacity Management are met. Key Message: This includes such as tasks as: Capacity Management has overall responsibility for ensuring that there is adequate IT Capacity to meet required levels of service and for ensuring that senior IT management is correctly advised on how to match Capacity and demand, and to ensure that use of existing Capacity is optimized. Forecasting future capacity requirements based on business plans, usage trends, sizing of new services, etc. Identifying with the Service Level Manager, capacity requirements through discussions with the business users Understanding the current usage of the infrastructure and IT services, and the maximum capacity of each component Production, regular review and revision of the Capacity Plan, in line with the organization’s business planning cycle, identifying current usage and forecast requirements during the period covered by the plan Identifying and initiating any tuning to be carried out to be optimize and improve capacity or performance Identifying and implementing initiatives to improve resource usage – for example demand management techniques Assessment of new technology and its relevance to the organization in terms of performance and cost Raising incidents and problems when breaches of capacity or performance thresholds are detected and assisting with the investigation and diagnosis of capacity-related Incidents and Problems. Technical and Application Management roles assist with day-to-day capacity management activities. Additional Information: N/A Transition to Next Slide:
• #41: The goal of the Availability Management process is to ensure that the level of service availability delivered in all services is matched to or exceeds the current and future agreed needs of the business, in a cost-effective manner. The purpose of Availability Management is to provide a point of focus and management for all availability-related issues, relating to both services and resources, ensuring that availability targets in all areas are measured and achieved. The objectives of Availability Management are to: Produce and maintain an appropriate and up-to-date Availability Plan that reflects the current and future needs of the business Provide advice and guidance to all other areas of the business and IT on all availability-related issues Ensure that service availability achievements meet or exceed all their agreed targets, by managing services and resources-related availability performance Assist with the diagnosis and resolution of availability-related incidents and problems Assess the impact of all changes on the Availability Plan and the performance and capacity of all services and resources Ensure that proactive measures to improve the availability of services are implemented wherever it is cost-justifiable to do so. Availability Management should ensure the agreed level of availability is provided. The measurement and monitoring of IT availability is a key activity to ensure availability levels are being met consistently. Availability Management should look to continually optimize and proactively improve the availability of the IT infrastructure, the services and the supporting organization, in order to provide cost-effective availability improvements that can deliver business and customer benefits.
• #42: Purpose: The Availability Management process is continually trying to ensure that all operational services meet their agreed availability targets, and that new or changed services are designed appropriately to meet their intended targets, without compromising the performance of existing services. In order to achieve this, Availability Management should perform the reactive and proactive activities illustrated in the figure: Key Message: Availability Management process includes Proactive activities Design and planning activities Planning, design and improvement of availability Reactive activities Operational activities Monitoring, measuring, analysis and management of all events, incidents and problems involving unavailability Additional Information: The reactive activities of Availability Management consist of monitoring, measuring, analyzing, reporting and reviewing all aspects of component and service availability. This is to ensure that all agreed service targets are measured and achieved. Wherever deviations or breaches are detected, these are investigated and remedial action instigated. Most of these activities are conducted within the Operations stage of the lifecycle and are linked into the monitoring and control activities, Event and Incident Management processes The proactive activities consist of producing recommendations, plans and documents on design guidelines and criteria for new and changed services, and the continual improvement of service and reduction of risk in existing services wherever it can be cost-justified. These are key aspects to be considered within Service Design activities. Transition to Next Slide:
• #43: Purpose: Key Message: Additional Information: N/A Transition to Next Slide:
• #44: Purpose: Key Message: Reliability: a measure of how long a service, component or CI can perform its agreed function without interruption. The reliability of the service can be improved by increasing the reliability of individual components or by increasing the resilience of the service to individual component failure (i.e. increasing the component redundancy, e.g. by using load-balancing techniques). It is often measured and reported as Mean Time Between Service Incidents (MTBSI) or Mean Time Between Failures (MTBF): Maintainability: a measure of how quickly and effectively a service, component or CI can be restored to normal working after a failure. It is measured and reported as Mean Time to Restore Service (MTRS) and should be calculated using the following formula: Serviceability: the ability of a third-party supplier to meet the terms of their contract. Often this contract will include agreed levels of availability, reliability and/or maintainability for a supporting service or component. Additional Information: Definition of resilience – the capability of a set of CIs to continue to provide a required function when one or more CIs in the set have suffered a failure. Transition to Next Slide:
• #45: Purpose: From the above it can be seen that an incident can be broken down into individual stages within a lifecycle that can be timed and measured. This lifecycle view provides an important framework in determining, amongst others, systems management requirements for event and incident detection, diagnostic data capture requirements and tools for diagnosis, recovery plans to aid speedy recovery and how to verify that IT service has been restored. The individual stages of the lifecycle are considered in more detail as follows. Key Message: Incident detection: the time at which the IT service provider organization is made aware of an incident. Systems management tools positively influence the ability to detect events and incidents and therefore to improve levels of availability that can be delivered. Implementation and exploitation should have a strong focus on achieving high availability and enhanced recovery objectives. In the context of recovery, such tools should be exploited to provide automated failure detection, assist failure diagnosis and support automated error recovery, with scripted responses. Tools are very important in reducing all stages of the incident lifecycle, but principally the detection of events and incidents. Ideally the event is automatically detected and resolved, before the users have noticed it or have been impacted in any way. Incident diagnosis: the time at which diagnosis to determine the underlying cause has been completed. When IT components fail, it is important that the required level of diagnostics is captured, to enable problem determination to identify the root cause and resolve the issue. The use and capability of diagnostic tools and skills is critical to the speedy resolution of service issues. For certain failures, the capture of diagnostics may extend service downtime. However, the non-capture of the appropriate diagnostics creates and exposes the service to repeat failures. Where the time required to take diagnostics is considered excessive, or varies from the target, a review should be instigated to identify if techniques and/or procedures can be streamlined to reduce the time required. Equally the scope of the diagnostic data available for capture can be assessed to ensure only the diagnostic data considered essential is taken. The additional downtime required to capture diagnostics should be included in the recovery metrics documented for each IT component. Incident repair: the time at which the failure has been repaired/fixed. Repair times for incidents should be continuously monitored and compared against the targets agreed within OLAs, underpinning contracts and other agreements. This is particularly important with respect to externally provided services and supplier performance. Wherever breaches are observed, techniques should be used to reduce or remove the breaches from similar incidents in the future. Incident recovery: the time at which component recovery has been completed. The backup and recovery requirements for the components underpinning a new IT service should be identified as early as possible within the design cycle. These requirements should cover hardware, software and data and recovery targets. The outcome from this activity should be a documented set of recovery requirements that enables the development of appropriate recovery plans. To anticipate and prepare for performing recovery such that reinstatement of service is effective and efficient requires the development and testing of appropriate recovery plans based on the documented recovery requirements. Wherever possible, the operational activities within the recovery plan should be automated. The testing of the recovery plans also delivers approximate timings for recovery. These recovery metrics can be used to support the communication of estimated recovery of service and validate or enhance the Component Failure Impact Analysis documentation. Availability Management must continuously seek and promote faster methods of recovery for all potential Incidents. This can be achieved via a range of methods, including automated failure detection, automated recovery, more stringent escalation procedures, exploitation of new and faster recovery tools and techniques. Availability requirements should also contribute to determining what spare parts are kept within the Definitive Spares to facilitate quick and effective repairs, as described within the Service Transition publication. Incident restoration: the time at which normal business service is resumed. An incident can only be considered ‘closed’ once service has been restored and normal business operation has resumed. It is important that the restored IT service is verified as working correctly as soon as service restoration is completed and before any technical staff involved in the incident are stood down. In the majority of cases, this is simply a case of getting confirmation from the affected users. However, the users for some services may be customers of the business, i.e. ATM services, internet-based services. For these types of services, it is recommended that IT service verification procedures are developed to enable the IT service provider organization to verify that a restored IT service is now working as expected. These could simply be visual checks of transaction throughput or user simulation scripts that validate the end-to-end service. Additional Information: N/A Transition to Next Slide: Let’s proceed with the agenda of the module
• #46: Purpose: The term Vital Business Function (VBF) is used to reflect the business critical elements of the business process supported by an IT service. The service may also support less critical business functions and processes, and it is important that the VBFs are recognized and documented to provide the appropriate business alignment and focus. Certain VBFs, may need special designs, which are now being used as a matter or course within service design plans, incorporating High Availability, Fault Tolerance, Continuous Operation and Continuous Availability. Key Message: High Availability: A characteristic of the IT Service that minimizes or masks the effects of IT component failure to the users of a service Fault Tolerance: The ability of an IT service, component or CI to continue to operate correctly after failure of a component part Continuous Operation: An approach or design to eliminate planned downtime of an IT service. Note that individual components or CIs may be down even though the IT service remains available. Continuous Availability: An approach or design to achieve 100% availability. An IT service that has no planned or unplanned downtime. Additional Information: N/A Transition to Next Slide:
• #47: Purpose: The Availability Manager is the process owner that has responsibility for ensuring that the aims of Availability Management are met. This includes responsibilities such as: Key Message: Ensuring that all new services are designed to deliver the levels of availability required by the business Ensuring that all existing services deliver the levels of availability agreed with the business ins SLAs Creation and maintenance of an availability plan Assessing changes for their impact on all aspects of availability including overall service availability and the Availability Plan To be responsible for the monitoring of IT components and actual IT Services availability achieved against SLA, creating relevant reports To proactively improve service availability wherever possible and to optimize the availability of the IT infrastructure to deliver cost effective improvements that deliver tangible benefits to the business Assisting with the investigation and diagnosis of al incidents and problems which cause availability issues or unavailability of services or components Additional Information: N/A Transition to Next Slide:
• #49: Purpose: The goal of ITSCM is to support the overall Business Continuity Management process by ensuring that the required IT technical and service facilities (including computer systems, networks, applications, data repositories, telecommunications, environment, technical support and Service Desk) can be resumed within required, and agreed, business timescales. Key Message: IT Service Continuity Management (ITSCM) supports the overall Business Continuity Management process by ensuring that the required IT technical and service facilities (including computer systems, networks, applications, data repositories, telecommunications, environment, technical support and Service Desk) can be resumed within required, and agreed, business timescales. Additional Information: N/A Transition to Next Slide:
• #50: Purpose: Key Message: The objectives of ITSCM are to: Maintain a set of IT Service Continuity Plans and IT recovery plans that support the overall Business Continuity Plans (BCPs) of the organization Complete regular Business Impact Analysis (BIA) exercises to ensure that all continuity plans are maintained in line with changing business impacts and requirements Conduct regular Risk Analysis and Management exercises, particularly in conjunction with the business and the Availability Management and Security Management processes, that manage IT services within an agreed level of business risk Provide advice and guidance to all other areas of the business and IT on all continuity- and recovery-related issues Ensure that appropriate continuity and recovery mechanisms are put in place to meet or exceed the agreed business continuity targets Assess the impact of all changes on the IT Service Continuity Plans and IT recovery plans Ensure that proactive measures to improve the availability of services are implemented wherever it is cost-justifiable to do so Negotiate and agree the necessary contracts with suppliers for the provision of the necessary recovery capability to support all continuity plans in conjunction with the Supplier Management process. Additional Information: As technology is a core component of most business processes, continued or high availability of IT is critical to the survival of the business as a whole. This is achieved by introducing risk reduction measures and recovery options. Like all elements of ITSM, successful implementation of ITSCM can only be achieved with senior management commitment and the support of all members of the organization. Ongoing maintenance of the recovery capability is essential if it is to remain effective. The purpose of ITSCM is to maintain the necessary ongoing recovery capability within the IT services and their supporting components. Transition to Next Slide:
• #53: Purpose: Key Message: A lifecycle approach should be adopted to the setting up and operation of an ITSCM process. The slide shows the lifecycle of ITSCM, from initiation through to continual assurance that the protection provided by the plan is current and reflects all changes to services and service levels. ITSCM is a cyclic process through the lifecycle to ensure that once service continuity and recovery plans have been developed they are kept aligned with Business Continuity Plans (BCPs) and business priorities. The slide also shows the role played within the ITSCM process of BCM. Initiation and requirements stages are principally BCM activities. ITSCM should only be involved in these stages to support the BCM activities and to understand the relationship between the business processes and the impacts caused on them by loss of IT service. As a result of these initial BIA and Risk Analysis activities, BCM should produce a Business Continuity Strategy, and the first real ITSCM task is to produce an ITSCM strategy that underpins the BCM strategy and its needs. Additional Information: N/A Transition to Next Slide:
• #54: Purpose: An organization’s ITSCM strategy is a balance between the cost of risk reduction measures and recovery options to support the recovery of critical business processes within agreed timescales. The following is a list of the potential IT recovery options that need to be considered when developing the strategy. Key Message: Manual work-arounds For certain types of services, manual work-arounds can be an effective interim measure for a limited timeframe until the IT service is resumed. For instance, a Service Desk call-logging service could survive for a limited time using paper forms linked to a laptop computer with a spreadsheet. Reciprocal arrangements In the past, reciprocal arrangements were typical contingency measures where agreements were put in place with another organization using similar technology. This is no longer effective or possible for most types of IT systems, but can still be used in specific cases – for example, setting up an agreement to share high-speed printing facilities. Reciprocal arrangements can also be used for the off-site storage of backups and other critical information. Gradual recovery This option (sometimes referred to as ‘cold standby’) includes the provision of empty accommodation, fully equipped with power, environmental controls and local network cabling infrastructure, telecommunications connections, and available in a disaster situation for an organization to install its own computer equipment. It does not include the actual computing equipment, so is not applicable for services requiring speedy recovery, as set-up time is required before recovery of services can begin. This recovery option is only recommended for services that can bear a delay of recovery time in days or weeks, not hours. Any non-critical service that can bear this type of delay should take into account the cost of this option versus the benefit to the business before determining if a gradual recovery option should be included in the ITSCM options for the organization. The accommodation may be provided commercially by a third party, for a fee, or may be private, (established by the organization itself) and provided as either a fixed or portable service. A portable facility is typically a prefabricated building provided by a third party and located, when needed, at a predetermined site agreed with the organization. This may be in another location some distance from the home site, perhaps another owned building. The replacement computer equipment will need to be planned, but suppliers of computing equipment do not always guarantee replacement equipment within a fixed deadline, though they would normally do so under their best efforts. Intermediate recovery This option (sometimes referred to as ‘warm standby’) is selected by organizations that need to recover IT facilities within a predetermined time to prevent impacts to the business process. The predetermined time will have been agreed with the business during the BIA. Most common is the use of commercial facilities, which are offered by third-party recovery organizations to a number of subscribers, spreading the cost across those subscribers. Commercial facilities often include operation, system management and technical support. The cost varies depending on the facilities requested, such as processors, peripherals, communications, and how quickly the services must be restored. The advantage of this service is that the customer can have virtually instantaneous access to a site, housed in a secure building, in the event of a disaster. It must be understood, however, that the restoration of services at the site may take some time, as delays may be encountered while the site is re-configured for the organization that invokes the service, and the organization’s applications and data will need to be restored from backups. One potentially major disadvantage is the security implications of running IT services at a third party’s data centre. This must be taken into account when planning to use this type of facility. For some organizations, the external intermediate recovery option may not be appropriate for this reason. If the site is invoked, there is often a daily fee for use of the service in an emergency, although this may be offset against additional cost of working insurance. Commercial recovery services can be provided in self-contained, portable or mobile form where an agreed system is delivered to a customer’s site, within an agreed time. Fast recovery This option (sometimes referred to as ‘hot standby’) provides for fast recovery and restoration of services and is sometimes provided as an extension to the intermediate recovery provided by a third-party recovery provider. Some organizations will provide their own facilities within the organization, but not on an alternative site to the one used for the normal operations. Others implement their own internal second locations on an alternative site to provide more resilient recovery. Where there is a need for a fast restoration of a service, it is possible to ‘rent’ floor space at the recovery site and install servers or systems with application systems and communications already available, and data mirrored from the operational servers. In the event of a system failure, the customers can then recover and switch over to the backup facility with little loss of service. This typically involves the re-establishment of the critical systems and services within a 24-hour period. Immediate recovery This option (also often referred to as ‘hot standby’, ‘mirroring’, ‘load balancing’ or ‘split site’) provides for immediate restoration of services, with no loss of service. For business critical services, organizations requiring continuous operation will provide their own facilities within the organization, but not on the same site as the normal operations. Sufficient IT equipment will be ‘dual located ‘in either an owned or hosted location to run the compete service from either location in the event of loss of one facility, with no loss of service to the customer. The second site can then be recovered whilst the service is provided from the single operable location. This is an expensive option, but may be justified for critical business processes or VBFs where non-availability for a short period could result in a significant impact, or where it would not be appropriate to be running IT services on a third party’s premises for security or other reasons. The facility needs to be located separately and far enough away from the home site that it will not be affected by a disaster affecting that location. However, these mirrored servers and sites options should be implemented in close liaison with Availability Management as they support services with high levels of availability. Additional Information: N/A Transition to Next Slide:
• #55: Purpose: The Service Continuity Manager, as the ITSCM process owner, has responsibility for ensuring that the aims of Service Continuity Management are met. Key Message: This includes such tasks and responsibilities as: To implement and maintain the ITSCM process in accordance with the overall requirements of the organization’s Business Continuity Management process. To represent the IT services function within the Business Continuity Management process To perform Business Impact Analysis for all existing and all new services Performing risk assessment and risk management to prevent disasters where cost justifiable and where practical Assessing potential service continuity issues and invoking the Service Continuity Plan if necessary and managing the Service Continuity Plan while it is in operation, including fail-over to a secondary location and restoration to the primary location Performing post mortem reviews of service continuity tests and invocations and instigating corrective actions where required Ensure that all IT service areas are prepared and able to respond to an invocation of the continuity plans, while maintaining a comprehensive IT testing schedule, including the testing of all continuity plans in line with business requirements and after every major business change Communicate and maintain awareness of ITSCM objectives within the business areas supported and IT Service areas Undertake regular reviews, at least annually, of the Continuity plans with the business areas to ensure that they accurately reflect the business needs Negotiate and manage contracts with providers of third party recovery services Assessing changes for their impact on service continuity and Continuity Plans, and attending CAB meetings when appropriate Additional Information: N/A Transition to Next Slide:
• #57: Purpose: The goal of the ISM process is to align IT security with business security and ensure that information security is effectively managed in all service and Service Management activities’ Key Message: ISM needs to be considered within the overall corporate governance framework. Corporate governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring the objectives are achieved, ascertaining the risks are being managed appropriately and verifying that the enterprise’s resources are used effectively. Information security is a management activity within the corporate governance framework, which provides the strategic direction for security activities and ensures objectives are achieved. It further ensures that the information security risks are appropriately managed and that enterprise information resources are used responsibly. The purpose of ISM is to provide a focus for all aspects of IT security and manage all IT security activities. Additional Information: N/A Transition to Next Slide:
• #58: Purpose: The term ‘information’ is used as a general term and includes data stores, databases and metadata. The objective of information security is to protect the interests of those relying on information, and the systems and communications that deliver the information, from harm resulting from failures of availability, confidentiality and integrity. Key Message: For most organizations, the security objective is met when: Information is available and usable when required, and the systems that provide it can appropriately resist attacks and recover from or prevent failures (availability) Information is observed by or disclosed to only those who have a right to know (confidentiality) Information is complete, accurate and protected against unauthorized modification (integrity) Business transactions, as well as information exchanges between enterprises, or with partners, can be trusted (authenticity and non-repudiation). Prioritization of confidentiality, integrity and availability must be considered in the context of business and business processes. The primary guide to defining what must be protected and the level of protection has to come from the business. To be effective, security must address entire business processes from end to end and cover the physical and technical aspects. Only within the context of business needs and risks can management define security Additional Information: To achieve effective information security governance, management must establish and maintain an Information Security Management System (ISMS) to guide the development and management of a comprehensive information security programme that supports the business objectives. Transition to Next Slide:
• #61: Purpose: Executive management is ultimately responsible for the organization’s information and is tasked with responding to issues that affect its protection. In addition, boards of directors are expected to make information security an integral part of corporate governance. All IT service provider organizations must therefore ensure that they have a comprehensive ISM policy(s) and the necessary security controls in place to monitor and enforce the policies. Key Message: The Information Security Management process and framework will generally consist of: An Information Security Policy and specific security policies that address each aspect of strategy, controls and regulation An Information Security Management System (ISMS), containing the standards, management procedures and guidelines supporting the information security policies A comprehensive security strategy, closely linked to the business objectives, strategies and plans An effective security organizational structure A set of security controls to support the policy The management of security risks Monitoring processes to ensure compliance and provide feedback on effectiveness Communications strategy and plan for security Training and awareness strategy and plan. An Information Security Management System (ISMS), containing the standards, management procedures and guidelines supporting the information security policies. The framework or the ISMS in turn provides a basis for the development of a cost-effective information security program that supports the business objectives. It will involve the Four Ps of People, Process, Products and technology as well as Partners and suppliers to ensure high levels of security are in place. ISO 27001 is the formal standard against which organizations may seek independent certification of their ISMS (meaning their frameworks to design, implement, manage, maintain and enforce information security processes and controls systematically and consistently throughout the organizations). Performing security risk analysis and risk management in conjunction with Availability and IT Service Continuity Management Additional Information: N/A Transition to Next Slide:
• #62: Purpose: The Information Security Manager must understand that security is not a step in the lifecycle of services and systems and that security cannot be solved through technology. Rather, information security must be an integral part of all services and systems and is an ongoing process that needs to be continuously managed using a set of security controls, as shown in the figure. Key Message: The set of security controls should be designed to support and enforce the Information Security Policy and to minimize all recognized and identified threats. The controls will be considerably more cost-effective if included within the design of all services. This will ensure the continued protection of all existing services and that new services and access to them are in line with the policy. Security measures can be used at a specific stage in the prevention and handling of security incidents, as illustrated in Figure 4.28 . Security incidents are not solely caused by technical threats – statistics show that, for example, the large majority stem from human errors (intended or not) or procedural errors, and often have implications in other fields such as safety, legal or health. Additional Information: N/A Transition to Next Slide:
• #63: Purpose: The Security Manager has responsibility for ensuring that the aims of Information Security Management are met. This include such tasks and responsibilities as: Key Message: Developing and maintaining the Information Security Policy and a supporting set of specific policies, ensuring appropriate authorization, commitment and endorsement from senior IT and business management. Communication and publicizing of the Information Security Policy to all appropriate parties Ensuring that the Information Security Policy is enforced and adhered to Identifying and classifying IT and information assets (Configuration Items) and the level of control and protection required Assisting with Business Impact Analysis Performing security risk analysis and risk management in conjunction with Availability and IT Service Continuity Management Designing security controls and developing security plans Developing and documenting procedures for operating and maintaining security controls Monitoring and managing all security breaches and handling security incidents, taking remedial action to prevent recurrence wherever possible Reporting, analysis and reduction of the impact and volumes of all security incidents in conjunction with Problem Management Promoting education and awareness of security Maintaining a set of security controls and documentation and regularly reviewing and auditing all security controls and procedures Ensuring all changes are assessed for impact on all security aspects including the Information Security Policy and security controls and attendance at CAB meetings when appropriate. Performing security tests Participating in any security reviews arising from security breaches and instigating remedial actions Ensuring that the confidentiality, integrity and availability of the services are maintained at the levels agreed in the SLAs and conform to all relevant statutory requirements Ensure that all access to services by external partners and suppliers is subject to contractual agreements and responsibilities Act as a focal point for all security issues Additional Information: N/A Transition to Next Slide:
• #66: Purpose: The Supplier Management process ensures that suppliers and the services they provide are managed to support IT service targets and business expectations. Key Message: The main objectives of the Supplier Management process are to: Obtain value for money from supplier and contracts Ensure that underpinning contracts and agreements with suppliers are aligned to business needs, and support and align with agreed targets in SLRs and SLAs, in conjunction with SLM Manage relationships with suppliers Manage supplier performance Negotiate and agree contracts with suppliers and manage them through their lifecycle Maintain a supplier policy and a supporting Supplier and Contract Database (SCD). Additional Information: N/A Transition to Next Slide:
• #68: When dealing with external suppliers, it is strongly recommended that a formal contract with clearly defined, agreed and documented responsibilities and targets is established and managed through the stages of its lifecycle, from the identification of the business need to the operation and cessation of the contract: Identification of business need and preparation of the business case: Produce a Statement of Requirement (SOR) and/or Invitation To Tender (ITT) Ensure conformance to strategy/policy Prepare the initial business case, including options (internal and external), costs, timescales, targets, benefits, risk assessment. Evaluation and procurement of new contracts and suppliers: Identify method of purchase or procurement Establish evaluation criteria – for example, services, capability (both personnel and organization), quality and cost Evaluate alternative options Select Negotiate contracts, targets and the terms and conditions, including responsibilities, closure, renewal, extension, dispute, transfer •Agree and award the contract. Establish new suppliers and contracts: Set up the supplier service and contract, within the SCD and any other associated corporate systems Transition of service Establish contacts and relationships. Supplier and contract categorization: Assessment or reassessment of the supplier and contract Ensure changes progressed through Service Transition Categorization of the supplier Update of SCD Ongoing maintenance of the SCD. Manage the supplier and contract performance: Management and control of the operation and delivery of service/products Monitor and report (service, quality and costs) Review and improve (service, quality and costs) Management of the supplier and the relationship (communication, risks, changes, failures, improvements, contacts, interfaces) Review, at least annually, service scope against business need, targets and agreements Plan for possible closure/renewal/extension. End of term: Review (determine benefits delivered, ongoing requirement) Renegotiate and renew or terminate and/or transfer.
• #69: Purpose: Key Message: When dealing with external suppliers, it is strongly recommended that a formal contract with clearly defined, agreed and documented responsibilities and targets is established and managed through the stages of its lifecycle, from the identification of the business need to the operation and cessation of the contract: Identification of business need and preparation of the business case: Produce a Statement of Requirement (SOR) and/or Invitation To Tender (ITT) Ensure conformance to strategy/policy Prepare the initial business case, including options (internal and external), costs, timescales, targets, benefits, risk assessment. Evaluation and procurement of new contracts and suppliers: Identify method of purchase or procurement Establish evaluation criteria – for example, services, capability (both personnel and organization), quality and cost Evaluate alternative options Select Negotiate contracts, targets and the terms and conditions, including responsibilities, closure, renewal, extension, dispute, transfer •Agree and award the contract. Establish new suppliers and contracts: Set up the supplier service and contract, within the SCD and any other associated corporate systems Transition of service Establish contacts and relationships. Supplier and contract categorization: Assessment or reassessment of the supplier and contract Ensure changes progressed through Service Transition Categorization of the supplier Update of SCD Ongoing maintenance of the SCD. Manage the supplier and contract performance: Management and control of the operation and delivery of service/products Monitor and report (service, quality and costs) Review and improve (service, quality and costs) Management of the supplier and the relationship (communication, risks, changes, failures, improvements, contacts, interfaces) Review, at least annually, service scope against business need, targets and agreements Plan for possible closure/renewal/extension. End of term: Review (determine benefits delivered, ongoing requirement) Renegotiate and renew or terminate and/or transfer. Additional Information: N/A Transition to Next Slide:
• #70: Purpose: Key Message: The Supplier Management process attempts to ensure that suppliers meet the terms, conditions and targets of their contracts and agreements, whilst trying to increase the value for money obtained from suppliers and the services they provide. All Supplier Management process activity should be driven by a supplier strategy and policy from Service Strategy. In order to achieve consistency and effectiveness in the implementation of the policy, a Supplier and Contracts Database (SCD) should be established, as illustrated in the slide, together with clearly defined roles and responsibilities. Ideally the SCD should form an integrated element of a comprehensive CMS or SKMS, recording all supplier and contract details, together with details of the type of service(s) or product(s) provided by each supplier, and all other information and relationships with other associated CIs. The services provided by suppliers will also form a key part of the Service Portfolio and the Service Catalogue. The relationship between the supporting services and the IT and business services they support are key to providing quality IT services. Additional Information: This information within the SCD will provide a complete set of reference information for all Supplier Management procedures and activities: Supplier categorization and maintenance of the Supplier and Contracts Database (SCD) Evaluation and set-up of new suppliers and contracts Establishing new suppliers Supplier and Contract Management and performance Contract renewal and termination. The first two elements within the above list are covered within the Service Design stage. The third element is part of Service Transition, and the last two are part of the Service Operation stage and are covered in more detail in those publications. Transition to Next Slide:
• #71: Purpose: The Supplier Manager has responsibility as the process owner for ensuring that the aims of Supplier Management are met. Key Message: This includes tasks such as: Providing assistance in the development and review of SLAs, contracts, agreements or any other documents for third party suppliers. Ensuring that all IT supplier processes are consistent and interface to all corporate supplier strategies, processes and standard terms and conditions Maintaining and reviewing a Supplier and Contracts Database (SCD) Ensuring that any underpinning contracts, agreements or SLAs developed are aligned with those of the business Reviewing lead suppliers processes to ensure that any sub-contracted suppliers are meeting their contractual obligations Performing contract or SLA reviews at least annually and ensuring that all contracts are consistent with organizational requirements and standard terms and conditions wherever possible Updating contracts or SLAs when required, ensuring that the Change Management process is followed Maintaining a process for dealing with contractual disputes, and ensuring that any disputes are dealt with in an efficient and effective manner Monitoring, reporting and regularly reviewing supplier performance against targets, identifying improvement actions as appropriate and ensuring these actions are implemented Ensuring changes are assessed for their impact on suppliers, supporting services and contracts and attendance at CAB meetings when appropriate. Additional Information: N/A Transition to Next Slide: