servicenow knowledge 2016 - eyfile/ey... · page 2 servicenow knowledge 2016 introduction to...

ServiceNowknowledge 2016Resiliency Navigator: an integratedapproach to resiliency point of view

May 2016

ServiceNow knowledge 2016

Agenda

• Introduction to resiliency• Integrated solution to resiliency• Aligning the business from end to end• EY and ServiceNow’s Resiliency Navigator• EY resiliency team’s culture of helping clients• Getting started with the Resiliency Navigator• Business and information technology (IT)

executives see value• Appendix A: EY resiliency case studies• Appendix B: Team biographies• Appendix C: Enablers and accelerators


Introduction to resiliency

Resiliency is the process of making sure that critical infrastructure elements are designed to minimize disruption to business functionsand mitigate the productivity impact. Unfortunately, resiliency methodologies may contain significant gaps, thereby increasingoperational risk. As a result, regulatory focus has shifted to include both business and technology resiliency capabilities to better identifythe risk of dependencies across resources, assets and technology.

Regulatory community focusResponse plans:• Businesses invest in developing “documentation to support the

response process” rather than testing operating documents• Response plan and testing appear to occur in silos within the line of

business or function• Impact analysis does not reveal the severity of dependencies across

resources, assets and technologyProof of capability:• Businesses (environments) do not conduct true integrated testing

that forces business, operations and technology to come togethersimultaneously to determine gaps and risks

• Tests seem to focus on short timelines (0–4 days) and not on tiered0–30 business days to understand impact on productivity,consumers, and resiliency of the enterprise

Enterprise risk definitions and severity ratings arenot consistently applied

Resiliency testing and analysis reports withinsufficient confirmation data

Inconsistent method to understand resiliency, suchas misaligned top-tier application RTOs

Inability to confirm validity of severity ratingchanges

Industry risk trends


Integrated solution to resiliency

Effective resiliency management involves a shift from isolated technology focal areas to a broader, enterprise-wide operational effort,incorporating critical key business functions. Regulatory and industry resiliency challenges call for a more robust, integrated solution, thatleverages existing configuration management databases (CMDB), enabling risk identification with the enterprise resiliency framework.

Cons

iste

ntan

dre

peat

able

resi

lienc

ym

etho

dolo

gyan

dpr

oces

ses

Business rules are systematically integrated acrossall resiliency calculations through an easy-to-usedashboard

Making certain resiliency processes remainaligned with business rules

Business riskalignment

Reduced resource requirements due to automatedtesting and reporting functionality

High business impact to execute resiliencytesting and reporting

Bidirectionalvalidationcapabilities

Risk rating definition and thresholds are set at theenterprise level and automated during resiliencytesting and reporting

Applying a consistent resiliency risk-rating methodology

Accuracy ofresiliencyplanning

Risk ratings require supporting documentation andmanagement rating approval signatures

Providing document confirmation for eachresiliency rating

Entrymanagement

Challenge Integrated resiliency solution Value add


Aligning the business from end to end

Effective technology and business resiliency management requires defined linkages between all business functions and the “technologyservice provider” to support that function. Insufficient mapping of business functions with the technical counterparts could result inresiliency being defined vertically, with the potential of incorrect reporting of varying risk-rating methodologies. As displayed below, anintegrated resiliency solution can enable an organization to understand more than just its risk exposure, including its operational risk.

• Provides a view into the technology enablement layer as a service compositethat provides an end-to-end service

• Ability easily to integrate leading practices, such as ITIL V3, COBIT 5 andquality-of-service concepts

• Various solutions providing risk ratings under differing methodologies• Systems produce reports and dashboards in silos based on the

solution’s ability to integrate with other systems

Skill

Quantity

People

Criticality Rating

LocationRequirements

Manual Procedures

Operating Methods

Procedures

Criticality Rating

Communications

Service Operations

Application Services

Technology

Criticality Rating

Infrastructure

Facilities

Transport

Assets

Criticality Rating

Equipment

Governance,risk and

complianceinformation

Businesscontinuity

information

Disasterrecovery

information

Technicalconfigurationinformation

Governance,risk and

complianceinformation

Businesscontinuity

information

Disasterrecovery

information

Technicalconfigurationinformation


EY and ServiceNow’s Resiliency Navigator

The Resiliency Navigator analyzes service,application, technology, financial, governance, riskand compliance information based on customizablebusiness rules and draws meaningful conclusions tohelp organizations strengthen and manage their ITenvironment. The Resiliency Navigator, coupled withthe powerful visualization and scenario modelingcapabilities of ServiceNow, can help you reduce thecomplexity of your IT infrastructure.


EY resiliency team’s culture of helping clients

Our team understands that resiliency comes down to maintaining a minimal business impact from unusual business conditions. Ourapproach is collaborative in nature — working with business lines to determine their goals, while assessing technology capabilities toconfirm the goals are achievable across all interdependencies, both internal and external to the organization regardless of the industry.

• Provides a single solution to enter all of the riskratings of all “service provided” components

• Allows for all business areas to rate their riskunder a consistent methodology

• Iterative updates allow for users to see howchanges affect overall risk ratings immediately

Aut

omot

ive

Understand the “health” of your risk programs

Operational and technology resiliency mapping and analysis

Fina

ncia

l

Hea

lth

care

Continuous improvement and validation

• Review the programs that enable responsecapability including business continuity, disasterrecovery, incident response andcrisis management

• Link the risk definitions and business functionexposures with the program and compliance andstandards guidelines (regulatory and industryleading practices)

• Review response capability with respect tounusual business conditions

• Iterative reconciliation of service performanceagainst resiliency ratings

• Integrate disaster recovery failover test results toidentify desired to achievable recoverytimeline challenges

• Map failure mode probability• Implement resiliency improvements

• Establish clear linkage between a business function and the servicesprovided to support that function:• Establish risk and resiliency index• Map the people, assets and resource needs, and

the interdependencies• Identify operational endurance to sustain productivity

• Identify the technology application service suites:• Identify the application services and underlying components• Map all interdependencies and validate resiliency variables• Perform scoring and identify mismatch of components across tiers

• Automated ranking of critical components• Identification of resource risks associated with high-risk-

ranked assets• Customizable mapping of dependencies across resources, assets

and business functions

• Immediately integrate lessons learned fromreporting findings

• Conduct preliminary reports to identifyregulatory and operational gaps

• Provides increased accountability forimprovement integration

Insu

ranc

e

Indu

stri

es

How ServiceNowcan help you


Getting started with the Resiliency Navigator

The Resiliency Navigator is able seamlessly to integrate with existing ServiceNow functions and leverage existing data to execute aconsistent risk-rating methodology. Identifying critical key business functions is the first step to getting started, followed by collectingbusiness requirements based on enterprise-level risk rating definitions. The Resiliency Navigator then uses all of this information throughthe CMBD platform for provide risk ratings to all components, which then can be leveraged to map resource and asset requirementsbased on business needs or risk criticality.

Business functions identify risk ratings oftheir components

Map business functions to operatingstructures and assets

Resources

People

Map resources and asset requirementsbased on need

Identify resiliency scoreand dependencies

Disaster recovery information

Configurationinform

ation

Bus

ines

sco

ntin

uity

info

rmat

ion

Governance, risk and compliance

Performance dashboardand reports


Business and IT executives see value

• Accuracy of data entry and riskrating accountability

• Certainty or providingconsistent functionality tobusiness functions

• Ability to seize benefits intechnology breakthroughs toreduce IT costs

• Consistent risk-ratingframework for managingresiliency reviews and reporting

Value to CIO• Long-term saving opportunities

through consecutiveimprovement

• Shortened analysis andreporting schedules withincreased accountability

• Centralized mechanism tomeasure resiliency improvementresults and value

• Ability to better understandreturn on investment ofresiliency funding andtechnology investments

Value to CFO• Regulatory compliance and

increased internal reportingfunctionality

• Centralized methodology with astandardized resiliencydefinition and risk-ratingprocess

• Alignment of business rules withthe resiliency program

• Improved response capability ofthe business environment

Value to C-suite


Appendix AEY resiliency case studies


Case studyDisaster recovery program, application services resiliency, and operational endurance review

Client Client issue Key elements of work Benefits to client

Americanmultinationalfinancialservicescorporation

• While this was a disaster recoveryprogram review, the focus was onresiliency and maturity of theenvironment, specifically the in-scope application services.

• Absence of application andinfrastructure dependency mappingto provide end-to-end resiliency andrecoverability

• Complex and mature environmentwith HA across sites

• Application in formation stored inmultiple repositories but dataquality and currency remain abig challenge

• Lack of consistency, completenessand quality of existing technicalrecovery documentation acrossthe landscape

• Lack of a more granular and robustBIA process, including capturing therequirements for recoverypoint objectives

Disaster recovery program, application services resiliency andoperational endurance review• EY used resiliency mapping methodology as the base to evaluate

the resiliency and improvement opportunities for the applicationservices environment across data centers

• Mapped the end-to-end application service, along with upstreamand downstream dependencies, via a series of cross-functionalmeetings that included application service owners

• Used the EY BURN Enabler Tool to analyze data from TAI, SIMS,DNA and other sources, and Operations data based on interviewsto perform a resiliency analysis

• Mapped the entire technology stack to HA configurations toidentify gaps and opportunities

• Conducted a resiliency analysis of 23applications and identified potential riskof not being able to meet the desiredRTO of the primary application, based onthe dependency mapping analysis andrecovery tier mismatches

• Identified opportunities for improvementbut found several that need to beexecuted by teams or areas other thanenterprise disaster recovery, but impactthe resiliency and recovery capabilities

• Established a governance and oversightmechanism that enables the cleararticulation of requirements, raisesconcerns for discussion, and obtainsdirect feedback from key stakeholdersabout resiliency and operationalendurance issues

• Established a framework to link criticalbusiness applications and supporting riskand severity ratings through to thetechnical components


Case studyBusiness resiliency mapping


Top 20 globalbank

• No central repository,categorization or catalog of assets(including type, function anddependency)

• Business owners did not identifydependencies or productivity lossimpacts over time to understandtrue risk exposure

• Resource requirements (facility,seating, equipment) were notmaintained by area and relocation,causing oversubscription or criticalassets were not identified due toassumptions that another groupwould make the asset available

• Client was unable toeffectively identify areas ofdeficiency

Business resiliency mapping• Employed our proprietary Resiliency Analysis Model to map the

four critical lines of business and conducted an analysis• Mapped the business process value chain and supporting people,

resource and asset requirements• Mapped the recovery timeline to the asset availability, volumes

and dependencies to calculate variances and establish resiliencyscores and validated against data collected by the BIA

• Established a framework to conduct tabletop tests to confirmgaps and areas of risk exposure

• Defined options to provide effective staffing and resource(facilities, transport, equipment, etc.) availability in tieredtimeline to support resiliency for 30 business days

• Client had a prioritized risk-and-resiliency-rated matrix of businessfunctions with recovery or asset gapsand potential risk exposure points

• Business owners were able tounderstand workload transfer capabilityand corresponding productivity changesover the duration of “planned foroutage” serving as a resourceshortage guide

• Business was able to focus on specificbusiness functions to bolster access toasset and resource requirements andoptions based on tiered timeline through30 days


Case studyBusiness resiliency capability assessment


Top 10insurance firm

• Operations in each region andcountry worked in isolation,managing and contracting theirown resources and assets

• No single program structure tosupport and promote consistencyacross the global enterprise

• Heavy investment in real estate andsupporting equipment, forcing thebusiness to rely on moving peopleinstead of the workload across thelandscape

• Regional operations center did notcommunicate with local offices todefine workload volumes andabsorption needs

• Each region and location performedtesting in isolation

Business resiliency capability assessment• EY performed program assessment review based on a resiliency

framework, culminating in two country-level tabletop tests• Mapped critical business functions and corresponding

risk exposures• Reviewed information and granularity of the BIA and identified

desired recovery timelines, which were then validated againstthe asset launch to operability timelines

• Established a resiliency framework to identify recoveryvariances and exposures by function and asset, includingincremental requirements based on a tiered timeline

• Established a framework for a table-top test and conductedtest to verify and confirm gaps in the current program

• Established an opportunities for improvement road map

• Risk office had a stratified opportunitiesfor improvement and a resiliencyimprovement deployment road map usedto obtain funding and support fromthe board of directors

• Business owners became aware of majorgaps and specific actions to take to makecertain there was adequate support forhigh risk locations, based on theresiliency index

• Enterprise crisis management wasprovided a single view of all assetrequirements, forecasted utilization, andassociated productivity loss rates for a35-day business cycle

• Program was extended to mapping thetechnology resiliency supporting thebusiness functions reviewed


Appendix BTeam biographies


BackgroundDan Stavola is an executive director in Ernst & Young LLP’s Strategic Technology Advisory Servicespractice, where he is responsible for the design and delivery of infrastructure and operations-basedadvisory services. As a practice leader and IT operations professional with more than 24 years ofexperience, Dan has worked with leading global financial services firms in the design and delivery of ITperformance improvement programs, leveraging his deep industry knowledge and the pragmaticapplication of industry standards and leading practices.Selected experience:• Served as the engagement lead and principal architect of a multiyear major IT transformation

program. Focused on improving IT operations performance, the program consisted of current stateoperational assessment and base line, rationalization of all dimensions of IT resulting in costrationalization, operating model redesign, IT optimization across the IT organization and agoverning continuous improvement program.

• Served as the engagement lead in a data center consolidation of a banking and capital markets firmacquisition. The project included pre- and post-merger support, rationalization of technology andinvestment governance, as well as migration and consolidation of IT operations and application andinfrastructure technologies.

• Served as the engagement lead and principal architect of a program risk management office for ahighly complex data center separation for a banking and capital markets firm divestiture. Theproject included both project risk governance, investment protection and post-separationoperational risk management

BackgroundPaul Sussex is a principal in the IT Advisory Services practice of Ernst & Young LLP. Paul works oncomplex IT transformation programs, helping clients improve how their IT capability adds value to theirbusiness, delivers efficiently and manages risk. Paul has extensive experience in IT infrastructure andoperations, identity and access management (IAM), IT service management and IT risk managementdisciplines. Paul has more than 20 years of professional services experience working with Fortune 100®

companies in the financial services industry.Selected experience:• Engagement lead for an IT Service Management transformation program for a major financial

service company resulting in more than $250 million in cost savings. Paul led a global team toidentify business and technical requirements and defined an IT strategy to transform the ITorganization from a product-orientated to a services-oriented provider. Developed a leading practiceIT process framework and supporting metrics to promote standardized processes, toolconsolidations and operational efficiencies.

• Engagement leader for a post-merger IT integration program for a major financial services companyintegrating IT infrastructure and operations. Designed, help implement and led programmanagement functions to manage network, desktop and application integration (with zero clientinterruption) of more than 120,000 end-user devices in five countries.

• Led a project team to assess IAM infrastructure, processes and capabilities. The team also definedthe future state operating model and multiyear road map to achieve maturity objectives, decreaserisk and reduce overall cost.

Biographies

Paul SussexPrincipalTechnology StrategyTel: +1 212 773 2802Email: [email protected]

Dan StavolaExecutive DirectorEnterprise Service AutomationTel: +1 212 773 5767Email: [email protected]


BackgroundLuke Miller is a manager in Ernst & Young LLP’s Advisory Services practice with more than 13 years ofindustry experience with a focus on technology strategy and transformation, risk and resiliency, andbusiness continuity and disaster recovery planning and deployment. His career has spanned multiplelines of business within the financial services environments, where he has participated in disasterrecovery failover tests, risk and resiliency assessments. In addition, Luke is able to combine hisbackground and experience in infrastructure and data center architecture to deploy effective risk andresiliency models.Selected experience:• Senior consultant responsible for assisting a global bank with the most extensive branch network in

the US designing and developing a strategy for a data center facilities risk and resiliency model andframework. Primary focus was on developing the framework, scoring methods, and designing theoperational model to be used by the global business continuity and risk group.

• Senior consultant for several private equity firms performing IT audits with specific focus ondisaster recovery strategy and planning, including scripting and auditing the test failover of theenvironment. Performed IT audit according to the EY disaster recovery audit and fail-over risk andresiliency methodology using a 40-point validation program. Developed all required audit scoringand management reports for review and sign-off by the applicable risk and audit associates.

• Supported the design and development of an operating model focused on improving the overallresiliency of shared services to mitigate risks and failure points. Developed the operating modelprocesses and subprocesses, including the deployment and sustainability guide.

BackgroundNazir Vellani is a senior manager in Ernst & Young LLP’s Advisory Services practice and has more than22 years of technology and business consulting experience with a proven ability in business process re-engineering, risk and resiliency, business continuity, disaster recovery strategy and planning, ITstrategies and transformation, cost optimization and cloud computing focusing on leveraging currentand emerging technologies for the financial and high-tech service industries.Selected experience:• His recent project work includes teaming with the CIO and the senior executive team at a

multinational financial services company to design and develop the enterprise level risk andresiliency operating model and business continuity program in alignment with the objectives set bythe risk office. Provided program oversight for the development of the enterprise businesscontinuity program strategy to obtain regulatory and audit compliance in Latin America and Asia-Pacific.

• Nazir has experience as a program director responsible for evaluating, developing and advising on anenterprise-level resiliency program focused on establishing operational endurance and designingsupporting applications and infrastructure environments for resiliency, including responding toextreme cybersecurity breaches and events.

• He has served as an engagement director responsible for evaluating and establishing a strategy for athree-year $48 million operational resiliency program with a focus on linking the business processrisk index with the underlying application services technology architecture.

Biographies

Nazir VellaniSenior Manager

Tel: +1 212 773 5606Email: [email protected]

Luke MillerManagerFinancial Services AdvisoryTel: +1 212 773 3208Email: [email protected]


Biographies

BackgroundBen Winfrey is a manager in Ernst & Young LLP’s Financial Services Organization with more than eightyears of industry experience in technology strategy and transformation, business continuity anddisaster recovery planning and deployment, and isolated recovery services. Ben has participated acrossmultiple industry lines including Insurance, retail banking, and the trading environments, where he hasparticipated in IT audits, disaster recovery failover tests, and risk and resiliency reviews andassessments. Using his prior infrastructure and operations experience, Ben has participated in designfor resiliency exercises using regulatory and industry leading standards including FFIEC, OCC, FINRA,ISO 27001, 22301, ITIL V3, and COBIT5.Selected experience:• Leading a project to design, develop and deploy a framework to evaluate capital markets test criteria

to meet and respond to a current MRA from the OCC to include governance, policies, collateral andan enablement tool to determine test criteria

• For a top-five retail bank, supported the design and development of an IT resiliency operating modelto establish a tiered quality of service framework to support and enable overall service delivery andoperations. Focused on defining the target state resiliency thresholds and developing the standardoperating procedures and supporting process guides.

• Supported IT and business continuity and disaster recovery audit exercises, including the review anddevelopment of the risk control matrix, scoring method and validation of effective test controlsaligned with the GAAS principles. Supported the development of a standard audit toolkit andbusiness continuity and disaster recovery audit operating model and methodology for a largeinsurance firm located in Peoria, IL

• Designing an isolated recovery services strategy framework to prove the sequencing andcertification method required to restore T0 and T1 enablement layers from an extreme dataloss condition

Ben WinfreyManagerFSO Technology StrategyTel: +1 212 773 3000Email: [email protected]


Appendix CEnablers and accelerators


EY’s resiliency enablers

Business function alignment

Resources and technology supportingcomponent alignment

Resiliency accelerator

EY and ServiceNow Resiliency NavigatorSix Sigma mapping and FMEAmethodologies

EY | Assurance | Tax | Transactions | Advisory

About EYEY is a global leader in assurance, tax, transaction and advisoryservices. The insights and quality services we deliver help buildtrust and confidence in the capital markets and in economies theworld over. We develop outstanding leaders who team to deliver onour promises to all of our stakeholders. In so doing, we play acritical role in building a better working world for our people, forour clients and for our communities.

EY refers to the global organization, and may refer to oneor more, of the member firms of Ernst & Young Global Limited,each of which is a separate legal entity. Ernst & YoungGlobal Limited, a UK company limited by guarantee, does notprovide services to clients. For more information about ourorganization, please visit ey.com.

Ernst & Young LLP is a client-serving member firm ofErnst & Young Global Limited operating in the US.

© 2016 Ernst & Young LLP.All Rights Reserved.

1605-1927776ED None

This material has been prepared for general informational purposesonly and is not intended to be relied upon as accounting, tax or otherprofessional advice. Please refer to your advisors for specific advice.

ey.com

servicenow knowledge 2016 - eyfile/ey... · page 2 servicenow knowledge 2016 introduction to...

Documents