itil service capability - alc training · the text in this courseware is onbased the official itil...

Creating a culture of excellence using best practice Copyright © ALC Group Pte Ltd 2014

ITIL® Service CapabilityPlanning, Protection & OptimisationDiagrams used in Workbook

ITIL® is a Registered Trade Marks of Axelos Limited. Sections of the ITIL®Reference Manuals have been reproduced under licence from Axelos Limited

All material copyright of ALC Education and Consulting Pty Ltd unless otherwise indicated.

The text in this courseware is based on the Official ITIL Best Practice Publications, AXELOS MATERIAL 2011 EDITION: ITIL Service Strategy, ITIL

Service Design, ITIL Service Transition, ITIL Service Operation, ITIL Continual Service Improvement


Service Lifecycle

2

Each volume of the core is represented in the Service Lifecycle:

Service Strategy represents policies and objectives.

Service Design, Service Transition and Service Operation are progressive phases of the Lifecycle that represent change and transformation.

Continual Service Improvement represents learning and improvement.

The architecture of the ITIL Core is based on a Service Lifecycle.

Copyright © AXELOS Limited 2014 Reproduced under license from AXELOS

Continualservice

improvement

Service transition

Servicestrategy

Service Operation

Servicedesign

Day 1 Slide 31


• Service Strategy (Concepts)– Strategy Generation– Service Portfolio Management– Demand Management– IT Financial Management

• Service Design– Service Catalogue Management– Service Level Management– Capacity Management– Availability Management– Service Continuity Management– Information Security Management– Supplier Management

Service Lifecycle ‐ Process

• Service Transition– Transition Planning & Support– Change Management– Service Asset & Configuration

Management– Release & Deployment Management– Service Validation & Testing– Evaluation– Knowledge Management

• Continual Service Improvement– Service Measurement– Service Reporting– Service Improvement

• Service Operation‒ Event Management‒ Incident Management‒ Request Fulfilment‒ Problem Management‒ Access Management

• Service Desk‒ Technical Management‒ IT Operations Management‒ Application Management

Day 1 Slide 32


‘soft assets’ ‘tangible assets’

1. Capabilities & Resources are both assets...2. Each department in an organisation has them...3. Service Providers take Resources and with their capabilities create services

that produce value for their customers

Resources need to be coordinated, controlled and deployed to produce value, otherwise they are assets with no real intrinsic value.


Service Management as a Practice Day 1 Slide 35


• What is a Service?

• …with ownership – Costs and Risks

• …without ownership – Costs and Risks

Definition of a Service – Value Proposition

Activity 1

Activity 2

Activity 3

Service Provision $

Service A

Service B

Service C

Service Provision $Activity 1

Activity 2

Activity 3

ServiceProvision

Org Unit

$

Activity 1

Activity 2

Activity 3

ServiceProvision

Org Unit

$

Org Units(Internal)

Activity 1

Activity 2

Activity 3

Service Provision $

Activity 1

Activity 2

Activity 3

Service Provision $

Activity 1

Activity 2

Activity 3

Service Provision $

Activity 1

Activity 2

Activity 3

Service Provision $

Org Units(External)

Activity 1

Activity 2

Activity 3

ServiceProvision

Org Unit

$

Day 1 Slide 37


• Value of a service: Utility & WarrantyFrom the Customer’s perspective, value has two aspects:– Utility – fitness for purpose

• WHAT the customer gets (e.g. ability to process more)

– Warranty ‐ fitness for use• HOW the service is delivered (e.g. available when needed / sufficient capacity as required)


OUTCOME based

definitions


UTILITY

OR

AND

AND

WARRANTY

T/F

T/F

Fit forpurpose?

Fit for use? T/FValue created

T: TrueF: False

Performance supported?

Constraints removed?

Available enough?

Capacity enough?

Continuous enough?

Secure enough?

Day 1 Slide 38


• Value of a service: Utility & Warranty– Utility increases possible gains– Warranty reduces performance variations

– Customer concerns• When the warranty of a service is not aligned with the utility


Copyright © AXELOS Limited 2014. Reproduced under license from AXELOS

Avg1 Avg2 Performance

RelativeProbability Utility

Effect

UTILITY

Performance

RelativeProbability

WarrantyEffect

WARRANTY

Day 1 Slide 39


Simple Process model

Processes across the Lifecycle

Transformation Activities +Feedback mechanism + Self-correction actions = a “closed-loop” system


Day 1 Slide 45


The Process ModelProcess Owner has responsibility to ensure process objectives are met

Process can span organisational and geographic boundariesCopyright © AXELOS Limited 2014. Reproduced under license from AXELOS

Processes across the Lifecycle Day 1 Slide 46


The implementation of ITIL Service Management as a practice is about preparing and planning the effective and efficient use of the ‘four Ps’:

– People – Processes – Products (services, technology and tools) – Partners (suppliers, manufacturers and vendors)

4 Ps – Key Principles


People

Products/technologyProcesses

Partners/suppliers

Day 1 Slide 58


So what specifically does PP&O do??

Supporting the Service Lifecycle

Process Areas Description

Business Relationship

Management

focuses on understanding how services meet customer

requirements.

Capacity Management Cost-justifiable IT capacity to meet current and future demands

Availability Management Level of service availability matches or exceeds agreed levels

IT Service Continuity

Management

Resumption of service within agreed timescales

Information Security

Management

Information security managed in alignment with business

security

Demand Management To minimise idle capacity by understanding requirements

Day 1 Slide 59


Unused capacity is permitted if it provides higher level of assurance (i.e. conscious idle capacity)Insufficient capacity limits service growth and impacts performance

CONSUMPTION MUST STIMULATE DEMAND…a PULL system, made complex through challenges of synchronising the two.


Demand Management

Service consumptionproduces demand Customer

assetsServiceassets

Present demand

Respond with supply

Service uilisationconsumes capacity

Day 2 Slide 5


The matching of demand and capacity requires a STUDY of the (Customers) Patterns of Business Activity (PBA)


Demand Management

Pattern ofbusinessactivity

Businessprocess

Serviceprocess

Demandmanagement

Capacitymanagement

plan

Incentives andpenalties to influence

consumption

Demand pattern

Service belt

Delivery schedule

Day 2 Slide 6


Pattern matching using PBAs and UPs provides a systematic approach to understanding and managing demand from customers (note: both PBAs and UPs need to be CI’s (change controlled)

User Profile Applicable PBA

Senior Executive

(UP1)

Extensive travel,

high technical

assistance need…

Office based staff

(UP2)

Mid level delay on

assistance, High

paperwork

volume….

Customer

assistance process

(UP3)

High seasonal

variation, mid level

transaction

volume…

PBA Code

14E

9D

17F

9D

23A

21A

PBA 9DActivity Level

(1 to 5)

Remote site customer

interaction4

Data storage requirement 1

Network bandwidth

requirements3

Manage sensitive

informationn/a


Demand Management Day 2 Slide 11


Triggers Inputs Outputs

A request for a new or changed Service

Initiative to create a new service, or to change an existing service

User Profiles

A new Service created by a strategic initiative

Service models need to be validated and associated PBA need to be defined

PBA (documented within Customer and Service Portfolios)

Service models, PBA or UPs need to be defined

Customer, Customer Agreement and Service Portfolios

Demand policies for over-utilisation of resources

Unexpected demand exceeding capacity and breaching SLAs

Charging models too ensure chargeback is as was anticipated

Demand policies for over or under-utilisation of the Service

Changes to the PBA forecast Chargeable items will need to be validated

Documentation of options for offerings that can be used to create Service Packages

Service improvement opportunities

Demand Management Day 2 Slide 13


Capacity Management Process

Iterative process

cycleThis document is crucial. It is more than hardware and software assessments; it is an investment plan.


Capacity Management Day 2 Slide 27


Service Capacity Management - Concept

Time

Current Performance delivery and requirement

SLA

SLR

SLR

SLA

SLR SLA Trend

Service Capacity Management may prompt an early upgrade to keep pace with predicted trend

Business Capacity Management understands and should inform expected actual demand

Component Capacity Management will allow us to determine if we need to procure new resources or if we can use under-utilized components from other services

Incident/Problem/Change



Capacity Management Process Activities


Capacity Management

Tuning

AnalysisImplementation

Monitoring

Serviceexception

reports

Resourceutilisationexception

reportsResourcethresholds

Servicethresholds

Capacitymanagementinformation

system (CMIS)

Day 2 Slide 38


Inputs1.Business Information2.Service and IT information3.Component performance and capacity information4.Service Performance issues5.Financial information6.Change information7.Performance information8.CMS relationship info.9.Workload information

Outputs1.CMIS2.Capacity Plan3.Service Performance information and reports4.Workload analysis and reports5.Ad hoc capacity and performance reports6.Forecast and predictive reports7.Thresholds, alerts & events

Triggers

•Service Breaches•Exception reports•Capacity and performance review results

•New/changed services•Trending and modelling results

•Changes to SLAs, OLAs, UCs, designs and strategies



Business continuitymanagement (BCM)

IT service continuitymanagement (ITSCM)

Lifecycle

BCM ITSCMInitiation

Businesscontinuity strategy

Businesscontinuity plans

Ongoingoperation

Invocation

Continuityevent

Ongoing operation

Implementation

Requirementsand strategy

Policy settingScope definitionInitiate a project

Business impact analysisRisk assessmentIT service continuity strategy

Develop IT service continuity plansDevelop IT plans, recovery plansand proceduresOrganization planningRisk reduction and recoveryimplementationInitial testing

Education, awareness and trainingReview and auditTestingChange management

Key activities

Policies/Principles/Basic Concepts

Business focus tasks

ITSCM focus tasks


IT Service Continuity Management Day 2 Slide 62


Stage

Initiation

Business Focus

Policy Setting

Sets out the management intention and objective. Needs to be done first and communicated

(Terms of Reference) Command and control structure; as well as defining when and how to carry out BIA, RA, etc.

TOR & Scope

Money, human resources, identify training requirements. Decision whether to include external consultants or keep the study in house.

Allocate Resources

Agree project and quality plans

BCM and ITSCM should be run as projects. Use recognized methodology

Define project and org structure

Allows for project control, definition of milestones and how to deal with any variances



Stage

Requirements and Strategy

Business Impact AnalysisAssessment of loss due to the loss of a service

(income, additional costs, reputation, goodwill, competitive advantage, safety, regulatory, market share (short and long term), political.

IT Service Continuity Management

Business Focus

Day 2 Slide 64


Stage


Business Impact AnalysisProduces a graph that shows anticipated business impact

High impact in the short term

Less impact so less emphasis on high availability

NOTE: An assessment is only as accurate as the time at which is was taken!



Business Focus

Day 2 Slide 65


Stage


Risk AnalysisAssessment of level of threat and the organisationvulnerability to the threat

M_o_RManagement of Risk



Business Focus

Communicate

Implement

Identify

AssessPlan

M_o

_R a

ppro

ach

Ris

k m

anag

emen

tpr

oces

s gu

ide

M_o_R principles

Embed and review

Day 2 Slide 66


Stage


Business FocusITSCM Focus

IT Service Continuity StrategyFrom the BIA and RA a balanced approach towards risk reduction, recovery or continuity options has to be defined

Risk response measuresUPS, Fault tolerant systemsRAID Arrays and disk mirroring

Off site storageAll vital data, documents and records



Inputs1.Business information2.IT information3.Business Continuity Strategy4.Service Information (service catalog & portfolio)5.Financial analysis of costs (components, ROI) etc.6.Change details7.CMS detail8.Testing schedules from Availability9.Supplier/partner info.

Outputs1.Revised ITSCM policy and strategy

2.ITSCM plans

3.BIA results

4.Risk Analysis reports and analysis

5.ITSCM testing schedule

6.ITSCM test scenarios

7.ITSCM test reports and reviews

Triggers

•New or changed business needs or services

•New/changed targets•Major incidents for assessment whether to invoke

•Periodic BIA, RA, Plan maintenance

•CAB involvement

•Changing VBF, changing business models



Copyright © AXELOS Limited 2014 Reproduced under license from AXELOS.

Monitor, measure,analyse, report and review

service andcomponent availability

Investigate all serviceand component

unavailability and instigateremedial action

Proactive activities

Risk assessmentand management

Risk assessmentand management

Implementcost-justifiable

countermeasures

Review all new andchanged services andtest all availability andresilience mechanisms

Continual review and improvement

Availabilitymanagementinformation

system (AMIS)

Availabilitymanagement

reports

Availabilityplan

Availabilitydesign criteria

Availabilitytesting

schedule

Reactive activities

Availability Management

The Availability Managementprocess

Day 3 Slide 8


So much of a good availability process depends on measurement

What to measure and how to report it depends on the activity and the audience

Business perspective considers availability in regard to its contribution towards VBFs

User perspective considers availability in relation to frequency, duration and scope of impact of non-availability

IT Service Provider considers availability with respect to IT Service and components regarding availability, reliability and maintainability


Copyright © AXELOS Limited 2014. Reproduced under license from AXELOS.

Day 3 Slide 15



REACTIVE Availability Management Expanded incident life-cycle


Day 3 Slide 19


Detect

The time at which the service provider organisation is made aware of an incident.

Tools play a critical role here to both detect and potentially automated resolution.




Day 3 Slide 20


Diagnose

The time at which the diagnosis to determine the underlying cause is finished.

Diagnostics capture can extend incident down‐time, but provides valuable information.

Availability ManagementAvailability Management



Day 3 Slide 21


Repair

The time at which the failure has been repaired.

Careful analysis of OLAs and third party contracts is required to ensure that repair time does not become a common point of SLA breach.




Day 3 Slide 22


Recover

The time at which component recovery has been completed.

Recovery requirements should be documented and integrated into a set of recovery plans.




Day 3 Slide 23


Restore

The point at which normal business service is resumed.

And the only point that an incident can be put forward for closure.

Service verification procedures can be developed for “wide scope” incidents to ensure that the service has been restored to the expected level.






Day 3 Slide 24


REACTIVE Availability Management Service Failure Analysis (SFA)

Structured approach to identify underlying causes of service interruptions.

SFA often done in conjunction with Problem Management and can utilise other availability management techniques.

Goes beyond just technical and can incorporate support organisation, processes, procedures and tools.



Day 3 Slide 25


Identify which IT service or component is to be analysed

The availability plan can even specify a number that should be carried out each year

Need an IT Service provider and/or business sponsor

Scope defines explicitly what is included and what is excluded from the SFA

SELECT OPPORTUNITY

SCOPE ASSIGNMENT




Day 3 Slide 26


End-to-end view is required to gain the full benefit

A virtual SFA team should be formed as part of the planning –drawn from different areas of the organisation (and even suppliers)

Hypothesis are likely scenarios that can be tested, they provide focus and can lead to early conclusions

PLAN ASSIGNMENT

BUILD HYPOTHESIS




Day 3 Slide 27


All available data needs to be assigned for analysis amongst the SFA team

Interviews can provide quick win opportunities and should involve business representatives and end users

Key individuals from the IT Service Provider should also be interviewed

ANALYSE DATA

INTERVIEW KEY PERSONNEL




Day 3 Slide 28


Following analysis and interviews the team should be in a position to document findings and initial conclusions

Initial recommendations should also be made. Many will be obvious, but a key reason to get people from across the organisation into the team is to generate innovative ideas

FINDINGS AND CONCLUSIONSRECOMMENDATIONS

Availability ManagementREACTIVE Availability

Management Service Failure Analysis (SFA)


Day 3 Slide 29


The final report with its summary to be presented to the sponsor/s.

Must show where the loss was being incurred and how the recommendations will combat this

Validation is a comparison of what the result from the SFA was against the initial (before) perspectives

REPORT

VALIDATION




Day 3 Slide 30


PROACTIVE Availability Management



Day 3 Slide 34



The entry level point for proactive availability management is the procurement and development of components that have stringent availability and reliability.

Without good base products investment at higher levels of availability will be wasted.

BASE PRODUCTS TECHNOLOGY AND COMPONENTS



Day 3 Slide 35



Systems management should provide the monitoring, diagnostic and automated error recovery to enable fast detection and speedy resolution of potential and actual IT failure.

Service Management ProcessesWell designed and implemented processes support higher levels of availability (availability, incident, problem, change)

SYSTEMS MANAGEMENT

EFFECTIVE SERVICE MANAGEMENT



Day 3 Slide 36



Elimination of Single Points of Failure (SPoFs)

Provision of alternative components

Built in redundancy

Definitive spares

Rapid recovery techniques

HIGH AVAILABILITY DESIGN



Day 3 Slide 37


PROACTIVE Availability Management Redundancy looks to improve availability by using duplicate components

However, do not limit to standard technology components – need to consider environments (data centers, power supplies, air conditioning, etc.) and support systems – even third party elements

Level of availability designed in most be appropriate to business needs and within available budgetSPECIAL SOLUTIONS WITH

REDUNDANCY



Day 3 Slide 38


PROACTIVE Availability Management Business availability cannot generally be expressed in technical terms

Definition of the VBFs

Definition of downtime

Business impact from loss

Required service hours

Specific security requirements

Service recovery requirements

Availability management needs to interpret and translate these into availability targets and conditionsSPECIAL SOLUTIONS WITH

REDUNDANCY… (continued)



Day 3 Slide 39



Discovering availability requirements is an ongoing process

Determine business impact from loss of serviceCapture business and IT requirementsUnderstand any external serviceability requirementsEstimate costs involved and whether they are justifiedDetermine the likely costs from a loss of serviceIncorporate agreed cost-justified measures into agreements and contracts

SPECIAL SOLUTIONS WITH REDUNDANCY… (continued)



Day 3 Slide 40



Two perspectives for design activity

DESIGNING FOR AVAILABILITY

Technical design and alignment of internal and external agreements to meet agreed availability

DESIGNING FOR RECOVERY

Focus on the ability to quickly recover from a failure (i.e. definitive spares)




Day 3 Slide 41



SECURITY MANAGEMENT

Availability Management is actively involved in carrying out the Security Policy

Security must be balanced in its depth as there is a natural flow on to potentially impact availability




Day 3 Slide 42



Used to predict the impact on an IT Service due to the failure of a component within the technology

New and existing services

Identifies single points of failure

Provides valuable input for IT Service Continuity Management


COMPONENT FAILURE IMPACT ANALYSIS



Day 3 Slide 43


PROACTIVE Availability Management BASIC COMPONENT FAILURE IMPACT ANALYSIS Blank space where the CI

does not affect the service in any way

“X” where failure of the component causes the IT service to be lost

“A” where there is an alternative CI that can provide the service

“M” where the alternate CI needs manual intervention



Day 3 Slide 44



ADVANCED COMPONENT FAILURE IMPACT ANALYSIS

CI CI weighting Probability of

Failure

Recovery

time

Recovery

procedures

Device Independence Dependency

A 100% <2 hours Verified None

B 5% <2 hours Verified CI # SE33

x 5% <4 hours Not verified All

Weighting is the Relative importance of the component(e.g. single switch that supports all users has a factor of 100%)

MTBF(could use color coding or low/med/high)

Recovery(base on recent results or tests (poor/good/superb))

Procedures(indicator that procedures are in place)

Independence(check that redundant units are configured and working as expected)

Dependency(whether the failure of one CI will impact another)

Availability Management Day 3 Slide 45


PROACTIVE Availability Management FAULT TREE ANALYSIS

BASIC EVENTS

RESULTING EVENTS

CONDITIONAL EVENTS

TRIGGER EVENTS

BOOLEAN FunctionsAND-gate – simultaneous events

OR-gate – one or more events

Exclusive OR-gate – only one event

Inhibit gate – when the condition is NOT met



Day 3 Slide 46


PROACTIVE Availability Management Risk Analysis and Management

Identify and Quantify Risks

Determine justifiable countermeasures

Applicable for existing or proposed infrastructure, service configurations, service design and support teams (internal and external)

Identify and asses the level of risks based on value of assets and threats and vulnerabilities of the assets.

Identification, selection and adoption of countermeasures to a level appropriate to the asset and the impact to the service of its loss



Day 3 Slide 48


Inputs1.Business information2.Impact information3.Risk analysis4.Service Information (Portfolio, Catalog, SLM)5.Financial information6.Change/release info7.Configuration info8.Service targets9.Component details10.Technology info11.Trends, performance, failure info

Outputs1.AMIS and the PSO2.Availability Plan3.Design criteria4.Service and component availability, reliability, maintainability reports5.Revised risk analysis6.Monitoring and management requirements7.Test schedules8.Preventative maintenance schedules9.Details of techniques to enhance availability

Triggers

•New or changed business needs or services

•New/changed targets•Service/Component breaches

•Reviews, reports, forecasts, plans•Request from SLM on availability targets

•Recognition of a risk or impact on a VBF

Availability Management Day 3 Slide 53


INFORMATION SECURITY MANAGEMENT SYSTEM (ISMS)


Information Security Management Day 3 Slide 69


INFORMATION SECURITY PROCESSInformation Security Management


Day 3 Slide 75


INFORMATION SECURITY CONTROLS

Detection

Security Measures can be implemented at different stage

Not all security issues are of a technical nature (human or procedural errors)

Security Incident LifecycleMeasures

Preventative – access rights, identify who is seeking access, access control (only allowing those with rights access)Reductive – regular backups, testing and maintenance of contingency plansDetective – monitoring and virus checking softwareRepressive – blocking ports/addresses, locking out an accountCorrective – roll back, restore, back-out

Information Security Management


Day 3 Slide 76


Inputs1.Business & IT information2.Corporate governance and business security profiles3.Risk analysis & reports4.Details of security events5.Change information6.CMS details7.Details of partners and suppliers requirements

Outputs1.Overall information security policy & specific policies

2.Information relating to security as part of SMIS

3.Revised security assessment process and reports

4.Security audits/reports

5.Security test schedules and plans (including penetration test details)

6.Reviews and reports of breaches and corrective actions

7.3rd party management policy

Triggers

•New or changed governance guidelines or business security policy

•New/changed corporate risk management processes

•New/changed business needs or services

•Revision to IT plans and strategies•Service or component security breaches

•Periodic reviews and revision•Notification of change of risk, business process or VBF

•Request from other areas for assistance

Information Security Management Day 3 Slide 77


• Evaluation Criteria for tools for process implementation:– Tools lead to:

• Increased productivity• Cost savings• ….. and as a result increased productivity

ITSM Tool Evaluation Process

Evaluation Criteria for Technology

Identifyrequirements

Identify products

Selection criteria

Short listing

Evaluate products

Scoring

Rank the products

Select product


Day 4 Slide 4


Service Design – Implementation

How do we keep themomentum going?

What is the vision?

Where are we now?

Where do wewant to be?

How do we get there?

Did we get there?

Business vision, mission,goals and objectives

Baselineassessments

Measurabletargets

Service and processimprovements

Measurementsand metrics


Day 4 Slide 7


– Business Culture Maturity

– Process Maturity• Aligned with the Software Engineering Institute (SEI) Capability Maturity Model Integration (CMMI)

Service Design – Process Implementation


Day 4 Slide 9


– Architecture design = overall “blueprints” for development and deployment of IT infrastructure

• Fundamental organisation of a system, described through components and their relationships to each other and the environment and principles guiding design and evolution

Designing Technology Architectures

Enterprise architecture – the process of translating business vision and strategy into effective enterprise change, by creating, communicating and improving key principles and models that describe the enterprise’s future states and enable its evolution. (Gartner)


Day 4 Slide 22


Designing Technology ArchitecturesService – translates applications, infrastructure, organisation and support activities into a set of services

Application – Blueprint for development and deployment of individual apps

Data/Information – Logical and physical data assets

IT Infrastructure – structure, functionality, geographic distribution of hardware, software, comms.

Environmental – access, lighting, temperature, power, etc


Day 4 Slide 23


Designing Technology Architectures

Management Architectures need to be ….

BUSINESS ALIGNED, not TECHNOLOGY

DRIVENCopyright © AXELOS Limited 2014. Reproduced under license from AXELOS.

Day 4 Slide 24

itil service capability - alc training · the text in this courseware is onbased the official itil...

Documents