NYC Workshop: Improving the Business Value of your Service Management Program

IMPROVING THE BUSINESS VALUE OF YOUR SERVICE MANAGEMENT PROGRAM

David Mainville CEO, Cofounder – Navvia

December 13, 2012

December 13, 2012 Copyright 2013, Navvia -‐ a division of ConsulQng-‐Portal 2

Time Session 12:00 – 12:30 Vendor IntroducQons

12:45 Workshop begins 14:00 15 Minute Break 15:30 15 Minute Break 17:00 Workshop ends


Company Overview

ConfidenQal

ServiceNow Triple Play

© 2012 ServiceNow All Rights Reserved 4

• Consolidate mulQple systems onto one global pla\orm to drive standards and improve processes

• One system of record for reporQng of Qme and dimension based metrics

ConsolidaQon

• Interact with IT through a Slick Service Catalog • Leverage flexible workflow engine • Google/Amazon user experience

TransformaQon

• Using workflow and Runbook to automate your the most common requests

• Automate on and off boarding, password resets, server reboots, Provision/Decommission of VM, etc.

AutomaQon

ConfidenQal

S Y S T E M S

RUN BOOK / SYSTEMS MGMT

Owner Tool A U T O M A T I O N

STR

ATEG

Y

DESIG

N

OP

ER

ATIO

NS SERVICE DESK

Owner Tool

INCIDENT

Owner Tool

PROBLEM

Owner Tool

REQUEST

Owner Tool

IT GRC

Owner Tool

IT COST

Owner Tool

PROJECT PORTFOLIO

Owner Tool

SERVICE PORTFOLIO

Owner Tool

IT ASSET & CONTRACTS

Owner Tool

SERVICE CATALOG

Owner Tool

SERVICE LEVEL

Owner Tool

SOFTWARE DEV LIFECYCLE

Owner Tool

© 2012 ServiceNow All Rights Reserved www.service-‐now.com | 5

BROWSER

MOBILE

PUBLIC CLOUD

Owner

REPORTING

Owner Tool

WORKFLOW

Owner Tool

SELF-‐SERVICE

Owner Tool

COLLABORATION FEED

Owner Tool

Process and Technology Landscape

PRIVATE CLOUD

Owner

VIRTUALIZATION

Owner

DISCOVERY

Owner Tool

TR

AN

SITIO

N

MOBILITY

Owner

CHAT

Owner Tool

CHANGE

Owner Tool

KNOWLEDGE

Owner Tool

CONFIG MGT / CMDB

Owner Tool

RELEASE

Owner Tool

ConfidenQal

P L A T F O R M

I T M A N A G E M E N T A P P S B U S I N E S S A U T O M A T I O N A P P S

Content Management Email Workflow Chat Live Approvals NoQficaQon Search AnalyQcs IntegraQons

IT TransformaLon Cloud PlaNorm


IT Asset and Contract

Service Level

Service Catalog

Sohware Dev Lifecycle

IT Governance

IT Cost

Project and Por\olio

Service Por\olio

Workflow

Resource management

Self-‐service

Business request

management

Request

Incident

Problem

Manage Docs

Field Service

CMDB

Change

Release

Discovery

Runbook AutomaQon

Knowledge

D E S I G N T R A N S I T I O N O P E R A T E B U I L D S T R A T E G Y

ConfidenQal

© 2011 ServiceNow All Rights Reserved www.service-‐now.com | 7

ConfidenQal © 2012 ServiceNow All Rights Reserved 8

ConfidenQal © 2012 ServiceNow All Rights Reserved 9

ConfidenQal

ServiceNow Workflow & Runbook AutomaLon


Benefits

•  Automate, capture and standardize defined processes

•  Empower first line technicians to perform both routine & complex tasks

•  Reduce risk of human error

Why ServiceNow? •  Graphical interface with point and

click creation

•  Trigger automated processes directly from chat sessions

•  Zero touch automation

Features

•  Library of pre-defined process packs

•  Service catalog integration for demand capture

•  Automatic documentation and audit trails

Dan Pellegrini Area Sales Director (413) 548-4558

Logicalis Overview

CORPORATE OVERVIEW V1.0 - COPYRIGHT LOGICALIS 2012 12

About Logicalis n  Logicalis is an international provider of integrated IT

solutions and services, focusing on communications and collaboration; data center; professional and managed services.

n  $1.4 billion in revenues.

n  Operations in Europe, USA, Latin America and Asia Pacific.

n  Over 3,000 employees worldwide

n  Over 6,000 corporate and public sector customers.

n  Debt free with $50+ million in bank financing available

n  Backing of $5 billion parent company, Datatec (LSE: DTC)

n  Over 30 offices nationally (US Headquarters in NYC)

CORPORATE OVERVIEW V1.0 - COPYRIGHT LOGICALIS 2012

Logicalis International Footprint

13

Market Position #1 HP Enterprise Partner, Top 3 IBM Business Partner, Cisco Gold partner

Revenues:

$435m

Employees:

730

Market Position #1 ICT Integrator in the region, Present in Brazil, Argentina, Bolivia, Chile, Colombia, Ecuador, Peru, Paraguay and Uruguay

Revenues:

$500m

Employees:

1,175

Market Position Present in UK & Germany, UK Top 3 Cisco Gold Partner, UK #1 IBM System i & z Partner, UK #2 IBM Business Partner, UK Top 5 HP Partner

Revenues:

$350m Employees:

575

Market Position Present in Australia, Singapore, Taiwan, Malaysia, China & Hong Kong Cisco Gold Partner

Revenues:

$125m Employees:

495

Data Centres

North America West Chester Phoenix

South America São Paulo (Brazil)

Europe Slough (UK) Bracknell (UK)

Asia Pacific Shanghai (China) Cyberjaya (Malaysia) Sydney (Aus)

Managed Service Centres

North America West Chester Phoenix

South America São Paulo (Brazil) Buenos Aires (Argentina)

Europe Slough (UK) Cologne (Germany)

Asia Pacific Shanghai (China) Cyberjaya (Malaysia)

North America South America Europe Asia Pacific


Access to industry’s best R&D – by design

14

n  Logicalis has built strong strategic partnerships with the world’s most respected technology solutions and services vendors

n  Our role is to act as our customers advocate and advisor n  Multi-vendor relationships allows us to choose the right solution for our customers n  The $15 billion+ annual R&D budgets of these vendors provide the building blocks of

our solutions and services portfolios n  We achieve the highest level of accreditations and retain the highest quality expertise


Integration Infrastructure and Software Solutions

■  Data Centre & Virtualisation ■  Unified Communications

and Collaboration ■  Communications Networks

■  Business Analytics ■  Consulting Services ■  Professional Services

International Solutions & Services Framework

Cloud Services

Unified Communications and Collaboration ■  UC aaS ■  Video aaS ■  Collaboration aaS ■  Hosted UC ■  VDesk aaS ■  Consulting Services

Data Centre ■  Data Centre Hosting ■  Managed Hosting ■  IaaS ■  PaaS ■  VMaaS ■  VDIaaS ■  Consulting Services

Security ■  Infrastructure Security ■  SIEM ■  MDM ■  Application Firewalls ■  AAA ■  Consulting Services

Managed Services

Remote Infrastructure Management and Support Services

■  Communications Networks ■  Unified Communications ■  Computing

■  Storage ■  Virtualisation ■  Maintenance


OPERATE/OFFER Cloud solutions

§  IaaS §  Cloud Platform §  Cloud Solutions

Logicalis “Integrated Practices”

CONSULT Help customers define their IT/Cloud strategy. §  Private versus public §  ITIL/ITSM §  High level cloud strategy and architecture consulting

MANAGE Help customers manage their cloud strategy §  Full Managed Service offerings §  Remote infrastructure management §  Service Desk §  ITSM

DESIGN/BUILD Help customers build their private clouds.

§  Detailed private cloud design §  Infrastructure build out §  Application re-engineering §  Implement Operational and Management

tools §  Network design and build out

16


Integrated Practice Alignment

17

Integrated Practice

Communication & Collaboration Solutions

Unified Communication

Network Solutions

BYOD

Cloud and Data Center Solutions

Private Cloud / DC Solutions

Data Center Solutions

Manage/Cloud Services

Data /Storage Solutions

Backup/Archive Solutions

Data Optimization

Cloud Storage

Application Solutions

ITSM

ITSM

App Dev (vFabric)

Big Data

Cloud/hosted On-Premise

Compute Models

Service/Solution Continuum


ITSM Practice Segments

18

Service Desk •  Remote Level 1 & 2

desktop support •  First point of Contact

Tool-Set •  Service Now •  Dedicated or shared

models

Process •  Design services •  Assessment services


Logicalis Service Desk

14 Years in operation 24 x 7 x 365 Availability Over 120+ Agents ITIL Certified Management Members of Help Desk Institute (HDI) Wide variety of industry certifications Support contracts with over 675 companies Over 850,000 Incidents Per Year


Logicalis Service Desk

n  Single Point of Contact §  Dispatch and routing §  Customer Branded Call Pick-up

n  Level 1 and Level 2 Desktop Support Services §  On-site (dedicated) or remote (shared) models §  Guaranteed Service Level Agreements (SLAs)

n  Application-specific support §  With training and system access

n  Seamless escalation to Managed Services

n  Break-fix support

Service Offerings


Tool Offerings and Features n  Service-Now: ITSM tools set

§  MS instance- Built based on our Managed Services model, very limited customization used mostly by our MS customers.

§  Service-Desk instance- Good flexibility with some limitations, geared for customers that are looking to implement their own processes but cannot hit the minimum seat levels dictated by Service-Now for a dedicated instance.

§  Customer owned Instance- Fully customizable, can utilize our managed Services IP but is more likely to be based off of customer requirements. (minimum of 35 licenses).

n  Nimsoft: CI monitoring tool set §  A SaaS offering that monitors the key processes and utilizations of CI resources to

give a proactive view on performance and availability by the CI.

n  IT optimizer §  Virtual ITIL Training §  Repository for processes documentation §  Correlates processes to COBIT and ITIL framework to help with audits.


Reporting - Analysis


ITSM Process

Process development in partnership with Navvia: §  Process maturity assessments §  Process development & documentation §  Help gage organizations commitment to process

improvement §  Document and layout processes to be automated

with ServiceNow §  ITIL training and certification §  Hold workshops to get stake holders on the same

page


Our Company

25 Copyright 2012, Navvia - a division of Consulting-Portal

Helping organizations Navigate IT and Business Process Complexity Via our tools and services

ITSM Consulting u ITSM BPM Tools

26

Consulting Services

When you need the help we are here!

•  Virtual Consulting - access to ITSM and Process help when you need it

•  Onsite Consulting - From strategy through to process assessments, design and implementation

•  ITSM Tool Implementation

•  Onsite ITSM Education - a robust curriculum of ITSM courses delivered on-premise

Copyright 2012, Navvia - a division of Consulting-Portal

Navvia BPM Platform

A powerful business process management tool for your service management program

SURVEY LEARN VERIFY DESIGN

27 Copyright 2012, Navvia - a division of Consulting-Portal

http://navvia.com/tools/test-drive/

IMPROVING THE BUSINESS VALUE OF YOUR SERVICE MANAGEMENT PROGRAM


Welcome to today’s session David Mainville CEO and Co-‐founder of Navvia

•  33 years of Service Management experience

•  Over 17 years of ITSM & ESM consulQng experience

•  Lead architect of the Navvia Business Process Management (BPM) applicaQon

•  Twiper @mainville


Welcome and introducQons

•  Your name

•  Your company

• What you hope to get from this session


The workshop format…


I’ve got a lot of slides… But interacQon is much beper!

Let’s use the slides as a catalyst to foster an open discussion!

The workshop format…


We’ll start each secQon with a brief presentaQon /

demonstraQon to get things going…

We’ll wrap up each section with an open discussion… We will capture the discussion and share it with the attendees…

WHAT’S WRONG WITH TODAY’S SERVICE MANAGEMENT PROGRAMS?


Why do you think ITSM programs fail?



There is no need for process, we’ll just implement “out of the box”….

…It takes too long & it is hard work

…We can never get anyone to agree

The last project that focused on process failed…

…We tried to implement ITIL and that didn’t work

Our management is not supporQve…

…It’s SaaS, just turn it on

We’ll just do a “lih and shih” from our old tool…


The world’s most successful brands


Achieve Business Outcomes through Consistent Processes

Many programs are stuck in the weeds!


ITSM

We’re not the only ones who think so…


“Process maturity is a good thing to focus on and measure, but it is a means to an end... Businesses care about IT process maturity in so far as there is a demonstrable link to improving service outcomes”.

Gartner Inc.

ITSM / ITIL is a body of knowledge….



Four Steps to ITSM Success


Market – sell the value of ITSM

Assess – as a catalyst for change

Design – to drive business value

Governance – with an eye on CSI

MARKET – SELL THE VALUE OF IT SERVICE MANAGEMENT


Are you having trouble selling the value of ITSM?


Has your management said… Not another word abut

ITIL! I don’t want to hear about Process!

6 months to implement change?

Just slam it in!

2012-‐12-‐13 Copyright Navvia -‐ a division of ConsulQng-‐Portal 45

Good ideas sell themselves

Why do we need to sell the value of ITSM?


Selling starts with inspiraQon


hpp://www.ted.com/talks/simon_sinek_how_great_leaders_inspire_acQon.html

“Start With Why – How Great Leaders Inspire Everyone to Take AcQon” – Simon Sinek

Everyone has their own perspecQve

People need to know why…they need to know “what’s in

it for me”...


Everyone has their own perspecQve


Shouldn’t IT just work? I’ve got a business to run and services to deliver

How do I demonstrate that IT is aligned to the business?

I&O is consuming 60% of my budget, I can’t afford an ITSM project

I haven’t got Qme for process, it just means more work!

The CEO The CIO

The IT Manager The Technical Staff

The Universal Translator

ITSM Means

CEO: Beper Services, Faster

CIO: Clear Proof of Alignment

Manager: Reduced I&O

Costs

Technician: Fewer 3AM

Calls

Selling the value of ITSM Wrong Way Right Way

•  Communicate your program in an email and expect people to jump onboard

•  Create a rich communicaQon program focusing on why ITSM – build targeted messages for each group of stakeholders

•  Build your processes in isolaQon then publish to a SharePoint site

•  Collaborate across the organizaQon & foster buy-‐in by emphasizing why these processes are criQcal to success

•  Quote ITIL “chapter and verse” and let people know when their wrong

•  ITIL is the what & how – communicate the why in the language of your company – ITIL is guidance not LAW

•  Promise the moon and the stars then under deliver on your first project

•  Explain why the program is essenQal, then lay out a plan that is realisQc and holds the line on scope creep

•  Focus on the tool because the vendor says its “out of the box”

•  Focus on why the business outcomes are criQcal then translate to requirements that CAN be tailored in the tool


Where should the focus be?


Design -‐ Business Outcomes

Business Outcomes Requirements Processes Tools and

Technology

Start Here

Not Here


Some other techniques to consider

Dr. Robert Cialdini, Scientific American Article, 2001


There are 6 principles you can use in selling ITSM

�  Reciprocity – People want to know the “WIIFM” �  Scarcity - People want what they don’t have �  Authority - People follow expert advice �  Commitment – People do what they promise �  Consensus - People follow the lead of others �  Liking – People do things for those they like & respect

The Science of Persuasion


•  Too many ITSM programs have he wrong focus

•  Business Outcomes should drive everything

•  Map outcomes to requirements, processes and ulQmately tools & data

•  The world’s best companies have learned how process drives value


In Summary…


•  Is your company involved in an ITSM program?�

•  Do you have trouble selling your ITSM program?�

•  Have you clearly defined the WHY?�

•  Are their some things you have done well in respect to selling the program?�

ASSESSMENTS – AS A CATALYST FOR CHANGE


What is the value of an ITSM Assessment?



Management is too focused on the score…

…We never did anything with the results

…People are afraid to hear the truth

We’ve got too much on out plate already…

…There is no value in an assessment

…We already know what’s wrong, why assess things?

Service management assessments •  Open a dialog with your

ITSM stakeholders •  Provide you an opportunity

to communicate the why •  Are a catalyst for making

improvements •  Provide a baseline to

measure success •  Are an important part of CSI


Assessments -‐ communicate the value •  Kickoff Event

–  Live and in person, don’t shy away from travelling to your stakeholders

•  Webinars –  Recorded and live to keep the

informaQon flowing

•  During Interviews and Workshops –  Never miss the opportunity to

sell the why

•  ValidaQon sessions and final report are your opportunity to shine


Service management assessments

Strategy &

Roadmap

QuesQonnaires

Interviews Workshops

ObservaQons


Why use surveys? •  They allow you to touch

more people •  Can be used as a quick

“check-‐up” •  They can be designed to help

diagnose specific areas –  A single process –  A tool roll-‐out –  Knowledge of a process

•  They can be automated


Sample process scoring

Copyright 2013, Navvia -‐ a division of ConsulQng-‐Portal

Overall Assessment

00.5

11.5

22.5

33.5

44.5

5Problem Management

Change Management

Configuration Management

Service Desk

Availability Management

Capacity Management

Service Level Management

Security Management

Potential Conforms Average ScoreIndividual Process Assessment

§  IdenQfies which aspect of a specific process requires apenQon

§  A graphic representaQon of the health of the individual process

§  Establishes a baseline

Configuration Management

00.5

11.5

22.5

33.5

44.5

5People

ProcessTechnology

Potential Conforms Average Score

Overall Process Assessment §  A graphic representaQon of the health of all

assessed processes §  IdenQfies which processes require apenQon

December 13, 2012 65

Get out and talk to people! •  Interviews, workshops

and onsite observaQons –  Another opportunity to “sell”

–  Come prepared –  Use standard “open-‐ended” quesQons

–  Get people to talk –  Apend “process” meeQngs –  Visit the service desk –  Ask for tool demos –  Validate your findings


2012-‐09-‐17 Copyright ConsulQng-‐Portal 2012 67

Conduct your analysis

Benefit N

Finding NImplication N

Implication 2Implication 1

Finding 3

Finding 2Recommendation

Benefit 2Finding 1

Benefit 1

The assessment roadmap


Current �State�

Future�State�

Quick Wins �

Process�Enhancement �

Technology�Deployment �

Organizational�Change�

Assessments -‐ management report


In Summary… •  It’s not about the score •  Assessments are an

opportunity to communicate value and drive change

•  QuesQonnaires are only ne small part of an assessment

•  Spend Qme with people. Ask quesQons and make observaQons

•  Base recommendaQon on findings and observaQons



•  Have you ever conducted an ITSM assessment?�

•  Did you find it to be of value?�

•  What came out of the assessment?�

•  What would you do differently?�

DESIGN – TO DRIVE BUSINESS VALUE


What challenges have you had with process design and implementa?on?



Can’t get people to agree on the process…

…there is nothing wrong with what we have

…let’s just implement out of the box

Processes are too bureaucraQc…

…Nobody follows the process

…Resistance to change

Process Design & ImplementaQon


• Business requirements • Roles & responsibiliQes • AcQviQes & tasks • Controls & metrics • And more…

• Tool and data Requirements

•  IntegraQon • User interface • Use cases • And more

• Training plan • Role based training • Tool training • Ongoing cerQficaQon • Work instrucQons & procedures

Design Deploy Develop

Process Design Timeline

Simultaneous process & technology

Process Path

Technology Path

Process & Technology - You can’t do one without the other!


Who Needs to be Involved?

December 13, 2012 77

Core Team

S.M.E.’s

Stakeholders

Steering Commipee

Copyright 2013, Navvia -‐ a division of ConsulQng-‐Portal

Design -‐ Don’t start from scratch •  What are you doing today from a

process perspecQve?

•  Are there templates or standards you can leverage?

•  What is being employed in other areas of your organizaQon?

•  Can you leverage other programs (ISO, Six Sigma…)


Process ≠ Procedure A process focuses on the what and the who:

•  Technology independent •  Cross-‐funcQonal •  Business focus

A procedure focuses on the how:

•  Technology specific •  Role specific •  Provides work instrucQons

Process says to “create Incident” and the procedure shows how to do it


Anatomy of a Process


Inputs The objects or data

required to complete the acQviQes

AcQviQes The specific steps

required to convert inputs to outputs

Outputs The desired work

products or data. May be input to another process.

Controls The policies and guiding principles defining how the process will operate

Measurements The acQviQes and metrics to ensure the process meets requirements

Best pracQces, by their very nature, are absent of your company's organizaQon, business, cultural and technology requirements

To realize the full benefits, organizaQons must re-‐introduce their own reality


Design -‐ Don’t try this on your own •  Processes built in a vacuum, in

isolaQon, will not get adopQon

•  People need to understand “why”

•  Do you understand your stakeholders requirements?

•  Are you actually making things beper for people?

•  Balance consensus with ge|ng things done


Process Design ArQfacts


“It’s seldom the tool that’s the problem”


Mapping Process to the Tool


Don’t be a technophobe •  “Out of the box” doesn’t work

for everyone

•  Map business outcomes to tool and data requirements

•  IdenQfy the mandatory fields, define pick lists, figure out the triggers

•  Make sure you are capturing the right data to produce metrics

Copyright 2013, Navvia -‐ a division of ConsulQng-‐Portal 86 December 13, 2012

Detailed requirements


Don’t forget to validate •  IteraQve process design

•  Use of “show & tell” sessions

•  Watch out for scope creep

•  Validate ohen and get sign off against requirements

•  Be wary of “I didn’t agree to that…”


Remember to educate •  Training fosters adopQon of

the processes

•  Build an educaQon curriculum and plan that addresses all your stakeholders

•  Consider various training formats from CBT to instructor led

•  Consider using people involved in the process to do the training

Copyright 2012, Navvia -‐ a division of ConsulQng-‐Portal 89

•  Awareness and introductory training

•  FoundaQonal training •  Advanced process training

for SME’s •  Roles based training on the

processes and tools •  Advanced tool training for

administrators and developers

2012-‐09-‐17 Copyright ConsulQng-‐Portal 2012 90

Typical training and courses

In Summary… •  Don’t design your

processes in isolaQon •  Get the right people

involved •  Balance consensus

building with execuQon •  Simultaneous process &

technical design •  Gather the requirements

to tailor the tool •  Don’t forget to educate



•  What is the sate of your process design?�

•  Do you have standardized documentation for your processes?�

•  Is their a reluctance to define and document processes? Why?�

•  Do you formally gather requirements before tailoring your tools?�

GOVERNANCE – WITH AN EYE ON CONTINUAL IMPROVEMENT


Do you see value in an ITSM governance program?



We have plenty of metrics – nobody looks at them…

…That is the auditors job, they’ll tell us what's wrong

…Not our culture to hold people accountable

People never respond to requests, keep having to chase them…

…Not sure what the value is

…We don’t have Qme for that, overly bureaucraQc

Governance Remains Weak


Only 28% of respondents have implemented / enforce governance, compared to 28.4% in 2011

!Source: 2012 ITSM Industry Survey

Why ITSM Governance?

•  Maximize value from the organizaQons significant investment in IT

•  Support complex regulatory requirements –  Sarbanes-‐Oxley, Basel-‐II

•  Third party cerQficaQons –  ISO20000, SAS70…

•  ConQnual Service Improvement


ITSM Governance Frameworks •  ITIL version 3

–  Provides guidance on the processes

•  COBIT version 4.1

–  Widely accepted by the IT audit community

–  Defines controls, processes and audit tests (evidence)

•  ISO20000

–  Defines a standard for a Service Management System


Our experience shows that the best approach is to use a combina?on of frameworks for ITSM governance

ITSM Governance Roles •  Prescrip?ve role assigns

authority and accountability •  Audit role reports on

compliance to process owners, execuQves and directors

•  Coordina?on role assigns and coordinates the governance tasks

•  Monitor role tracks governance reporQng for the audit role

•  User/Provider roles execute the governance tasks


An ITSM “Program Office” or “Governance Board” is the ideal place to center your

governance ac?vi?es

An ITSM Governance Approach

EVIDENCE

TASKS

CONTROLS

PROCESS CHANGE MANAGEMENT

AI6.1 STANDARDS & PROCEDURES

AI6.2 ASSESSMENT & AUTHORIZATION

AI6.3 EMERGENCY CHANGES

Task 1 Provide Evidence of Change Mgmt. System

Emergency Change Categories

Emergency Change Reports

Task 2 Provide Evidence of Emergency Change

Handling

Documented Emergency Procedures

Review of Emergency Changes

AI6.4 TRACKING AND REPORTING

AI6.5 CHANGE CLOSURE

& DOC


ITSM Governance & Service Delivery


Actual Service Levels

Desired Service Levels

�  Ungoverned processes “wear down” over Qme

�  The result is service variability versus consistency

�  More effort to manage / less customer saQsfacQon

Governance and CSI


Assess Design & Govern

ITSM Governance & Service Delivery

Ask yourself…are we ge|ng value from our ITSM iniQaQve?

•  Resolving incidents quicker?

•  Ge|ng to the root cause of problems?

•  Pu|ng reliable businesses services into producQon faster?

•  MiQgaQng the risk of changes?

•  Are our customers ge|ng the service they require?


Achieving ITSM Governance

•  Define your processes •  IdenQfy the Control ObjecQves

•  Assign Accountability for Control ObjecQves

•  Require evidence of compliance

•  Measure and report on process compliance


Related Reading


Defines the standard for a Service Management System

(part 1&2)

Guidance for Service Managers on the Use of COBIT to support ITIL &

ISO/IEC 20000

How to use COBIT Controls to support ISO/

IEC 20000

How to use COBIT Controls to support ITIL

V3

hpp://www.itgovernance.co.uk/ hpp://www.isaca.org/ hpp://www.isaca.org/ hpp://www.isaca.org/

ISO/IEC 20000 COBIT to ISO/IEC 20000 COBIT User Guide COBIT to ITIL V3

Governing a Cloud ApplicaQon

Requirement Comment

Data ClassificaQon Is the Data being stored public, internal, confidenQal, restricted or highly restricted?

Physical Security Does the vendor meet all security standards for datacenter access?

AuthenQcaQon What are the policies and technology are in place to limit access to data to right people?

AuthorizaQon Who at the vendor site is authorized to access the data, what controls are in place?

Audit Logging What security logs are maintained by the vendor / what is logged by the system?

ConfidenQality What policies / technology exist to ensure company data is kept confidenQal – is Payment Card (PCI) or Personally IdenQfiable InformaQon (PII) stored in the cloud applicaQon?

Virus ProtecQon What policies and technologies are in place to ensure the data remains virus free?

Security Config Has the vendors infrastructure been configured to ensure against vulnerabiliQes – is it audited?

Patch Mgmt. What policies / technology is in place to ensure criQcal updates are applied in a Qmely manner?

Physical Config. How is our data segregated from the vendors other clients?


QuesQons to ask your Cloud or SaaS vendor

Governing a Cloud ApplicaQon


Requirement Comment

Disaster Recovery What policies and technology are in place to address a disaster and support resumpQon of service (failover, backups, offsite storage, backup faciliQes…)

Human Resource Security

What policies and pracQces are in place to ensure the vendors personnel are a)trained in security pracQces and b) have been adequately screened (background checks)

Compliance What audit protocols / pracQces does the vendor have in place to ensure compliance to their internal policies and processes

Sohware Config Mgmt.

What policies, pracQces and technologies exist to ensure the vendor has adequate control over their source code libraries and that there is a separaQon of duQes between development and producQon

Insurance / Risk What levels of coverage does the vendor have to protect from IdenQty Theh, Cyber-‐ExtorQon, Cyber-‐Terrorism, InformaQon Asset Network Security, Web Content, Errors and Omissions, Network Business InterrupQon

Financial Risk Is the cloud vendor viable? What protecQons exist if they were to become in solvent?

CommunicaQons What policies and pracQces are in place by the vendor to communicate security incidents?

Data RetenQon How long does the vendor retain the data, how is it protected, how can the data be extracted from the cloud applicaQon if the contract is terminated

QuesQons to ask your Cloud or SaaS vendor

Cloud Security Alliance SM


hpps://cloudsecurityalliance.org/

Security Guidance for CriQcal Areas of Focus in Cloud

CompuQng

Cloud Controls Matrix v1.1 -‐ Fundamental security principles to guide cloud vendors and to assist prospecQve cloud customers in assessing the overall security risk of a cloud provider.

In Summary…

•  Define the controls, policies & standards then make people accountable

•  Define your governance organizaQon and structure

•  Define the controls & frameworks you are required to report against

•  Governance is key to CSI •  Governance of cloud applicaQons

means extending your controls to your vendor –  Remember, you are sQll

accountable



•  Have you implemented governance around your ITSM processes?�

•  How is governance viewed in your organization? Is their resistance?�

•  Do you have metrics in place for your processes?�

•  Are your metrics actionable & do you perform CSI based on them?�

SESSION WRAP-‐UP


Summary


ITSM�Success�

Market � Assess�

Design � Govern �

Thank You!!David Mainville

[email protected]

Twiper: @mainville

navvia.com/resources

February 19, 2013 Copyright 2013, Navvia -‐ a division of ConsulQng-‐Portal 113

NYC Workshop: Improving the Business Value of your Service Management Program

Technology

t e g y owner tool

t i o n s t r

n s i t i o n o p e

t e g y d e s i g n

t e b u i

n operations

pnp s p p s

auto e