UEU Audit Kendali Sistem Informasi Pertemuan 13
UEU Audit Kendali Sistem Informasi Pertemuan 13
The Framework
Requirements
The business/customers
Service SDPs
Standards
Design Solution Architectures
Design
Agenda/Learning Objectives
• Primary goals, objectives and benefits of
Service Design
• Generic concepts and definitions
– Service Design Package
– Service Portfolio (and Service Catalogue)
– Service Provider & Supplier
– SLA, OLA, Contract
– Availability
Agenda/Learning Objectives
• Key Principles and Models
• Processes
– Service Level Management
– Service Catalogue Management
– Availability Management
– Information Security Management
– Supplier Management
– Capacity Management
– IT Service Continuity Management
Definition
• The Design of appropriate and innovative IT
services, including their architectures,
processes, policies and documentation, to
meet current and future agreed business
requirements
Primary Goals, Objectives &
Benefits
Service Design
Objectives
Functionality
Schedule Resource
Service Design Aspects
Technology &
Service
Architecture
Management Processes
Systems
Service Solutions Measurement
Service
Design
Business service a Business service b Business service c The business
Business Business Business
Business
Business Business
Business Business
Business
Process 3 Process 6 Process 9
Process 1 2
Process Process 4 5
Process Process 7 8
Process
SLAs Service
Service C D IT Services
SLAs
SLAs Service
Service A B
IT
Service Service Service
Strategy Transition Operation SKMS
Service
Portfolio
SCM SLM
Capacity SLAs
SLAs
Service SLAs
Architectures
Security
Improvement Availability
IT Service Continuity SLAs
Supplier SLAs
Measurement
SLAs
Support teams methods
Suppliers
Service Composition
Business Service Business Service A
Requirement Business Business Business
Process 1 Process 2 Process 3
Requirements/demand:
IT Service Policy/strategy
governance
Utility: compliance
Name, description, Service
purpose, impact, contacts
Warranty: SLAs/SLRs
Service levels, targets, assurance incl. Cost/prices
service hours, responsibility
Assets/resources:
Systems, assets, Infrastructure Environment Data Applications
components
Assets/capabilities: Support
Supplier
Resources, staffing, skills teams
Service Design Package (SDP)
• A Document defining all aspects of an IT
Service and its requirements through each
stage of its Lifecycle
• A Service Design Package is produced for:
– Each new IT Service
– Major change to an IT Service
– IT Service Retirement
Design Process Activities
Requiremen Design
appropriate
t collections services
Revision of all
Production and
design
mantainance
documents
Ensure alignment
with policies &
Risk
strategies assesment
Designing Service Solution
Business Business Business Business
requirements requirements requirements requirements Pilot/warranty Live
period operation
Design & Development
Project (Project team)
Strategy
SDP
Improvement
Design
Transition
SLA
SLR SLR SLR SLR SLR SLA
Pilot SLM Live
RFC Approved Approved for Approved Approved Approved Approved for Review &
released for design development for build for test for warranty live release Closure
Key Principles and Models
Service Design
The ‘4P’s of Service Management
• These are the ‘Major
Components’ of Service Processes
Management
• The design and subsequent
Implementation of Service
Management (and Peopl Produ
e ct
individual service) is about
preparing and planning
(designing) the effective and
efficient use of the four Ps
Partners
(7) Delivery Model Options
Service Design
Service Level Management
• The process of negotiating, agreeing and
documenting appropriate IT service targets
with the business, and then monitoring and
reporting on the service providers ability to
deliver the agreed level of service
Goal of SLM
• The goal of the Service Level Management process is
to ensure that an agreed level of IT service is
provided for all current IT service, and that future
service are designed and delivered to agreed
achievable targets
Objectives
• Define, document, agree, monitor, report and review the level of IT
services provided
• Provide and improve the relationship and communication with the
business and customer
• Ensure that specific and measurable targets are developed for all IT
services
• Monitor and improve customer satisfaction with the quality of service
delivered
• Ensure that IT and the customers have a clear and unambiguous
expectation of the level of service to be delivered
• Ensure that proactive measures to improve the level of service delivered
are implemented wherever it is cost-justifiable to do so
Key Activities
• Develop relationship with business, customers,
and stakeholders
• Determinate, Negotiate, Document,& agree
Requirements for new and changed services in
SLRs
• Develop & manage SLAs for Operational Service
• Review and revised underpinning OLAs in line
with SLAs
Key Activities
• Monitor and measure service performance
against SLA Targets
• Collate measure and improve Customer
Satisfaction
• Produce Service Reports
• Conduct Service Review and Instigate
improvements within an overall Service
Improvement Program/Plan (SIP)
Basic Concepts
Service Design
Service Catalogue Elements
Goal of SCM
• The goal of the SCM Process is to ensure that
a Service Catalogue is produced and
maintained containing accurate information
on all operational services and those being
prepared to be run operationally
Objective
• To manage the information contained within
the Service Catalogue and to ensure that it is
accurate and reflects the current details,
status, interfaces and dependencies of all
services that are being run or being prepared
to run in the live environment
Scope & Purposes
• Scope
– To provide and maintain accurate information on
all services that are being transitioned or have
been transitioned to the live environment
• Purpose
– To provide a single source of consistent
information on all of the agreed services and
ensure that it is widely available to those that are
approved to access it
Value to the Business
• The Services Catalogue provides a central source of
information on the IT services delivered by the
service provider organization:
– This ensures that all areas of the business can view an
accurate, consistent picture of the IT services, their details
and their status
– It contains a customer facing view of the IT services in use,
how they are intended to be used, the business processes
they enable, and the levels and quality of service the
customer can expect of for each service
Key Activities
• Agreeing and documenting a service definition with all relevant parties
• Interfacing with Service Portfolio Management on the contents of the
Service Portfolio and Service Catalogue
• Producing and maintaining a Service Catalogue and its contents, in
conjunction with the Service Portfolio (incl. Business and Technical Service
Catalogue aspects)
• Interfacing with Support Teams, Suppliers and Configuration Management
on interfaces and dependencies between IT services and the supporting
services, components and CIs contained within the Technical Service
Catalogue
• Interfacing with Business Relationship Management and Service Level
Management to ensure that information is aligned to the business and
business process
Key Performance Indicators
• The number of services recorded and managed
within the Service Catalogue as a percentage of
those being delivered and transitioned in the live
environment
• The number of variances detected between the
information contained within the Service Catalogue
and the “real world” situation
• Percentage increase in completeness of the Technical
Service Catalogue against IT components that
support the services
Service Catalogue Manager Role
• The Service Catalogue Manager has responsibility for
producing and maintaining the Service Catalogue. This
includes responsibilities such as:
– Ensuring that all operational service and all services being prepared
for operational running are recorded within the Service Catalogue
– Ensuring that all of the information within the Service Catalogue is
accurate and up to data
– Ensuring that all of the information within the Service Catalogue is
consistent with the information within the Service Portfolio
– Ensuring that the information within the Service Catalogue is
adequately protected and back-up
Challenges
• The major challenges facing the SCM process is that
of maintaining an accurate Service Catalogue as part
of a Service Portfolio, incorporating both the
Business Service Catalogue and the Technical Service
Catalogue as part of an overall CMS and SKMS
• In order to achieve this, the culture of the
organization needs to accept that the Catalogue and
Portfolio are essentials sources of information that
everyone within the IT organization needs to use and
help maintain
Capacity Management
Service Design
Definition
• The process responsible for ensuring that the
capacity of IT services and of the IT
infrastructure is able to deliver agreed service
level targets in a cost- effective and timely
manner
• Capacity Management processes and planning
must be involved in all stages of the service
lifecycle from strategy and design through
transition and operation to improvement
Goal and Purposes
• Goals
– To ensure that justifiable IT capacity in all areas of IT,
always exist and is matched to the current and future
agreed needs of the business, in a timely manner
• Purpose
– To provide a point of focus and management for all
capacity and performance related issues, relating to both
services and resources
Objectives
• To produced and maintain an appropriate and up to date Capacity Plan,
which reflects the current and future needs of the business
• To provide advice and guidance to all other areas of the business an IT on
all capacity and performance related issues
• To ensure that service performance achievements meet or exceed all of
their agreed performance targets, by managing the performance and
capacity of both services and resources
• To assist with the diagnosis and resolution of performance and capacity
related incidents and resources
• To assess the impact of all changes on the Capacity Plan and the
Performance and Capacity of all Service and resources
• To ensure that proactive measures to improve the performance of services
are Implemented wherever it is justifiable to do so
A ‘Balancing Act’
Implement
ation Tuning
Storage of
Capacity
Demand
Management Data Management
Applicatio
Modelling
n Sizing
8 Key Activities
Tuning
Implementation Analysis
Monitoring
Resource SLM
exception
Utilisation
thresholds
SLM Resource Utilisation
thresholds Exception reports
Capacity
Management
Database
8 Key Activities
Inputs Outputs
Service Design
Definition
• The process of ensuring that the level of service
availability delivered in all services is matched
to the current and future agreed needs of the
business cost effectively
• The availability management process, (just like
capacity management), must be involved in all
stages of the service lifecycle from strategy and
design through transition and operation to
improvement.
Availability Management
• Goal
– To ensure that the level of service availability
delivered in all services is matched to or exceeds the
current and future agreed needs of the business, in
a cost effective manner
• Purpose
– To provide a point of focus and management for all
availability related issues, relating to both services
and resources, ensuring that availability targets in all
areas are measured and achieved
Objectives
• To produce an availability plan, which reflects the
current and future needs of the business
• To provide advice and guidance on all availability
achievements meet or exceed the agreed targets
• Assist with availability related incidents and problems
• To assess the impact of all changes on the Availability
Plan
• To ensure that proactive measures to improve the
availability of services are implemented wherever it
is cost justifiable to do so
Scope
• The scope of the Availability Management process
covers the design, implementation, measurement,
management and improvement of IT service and
component availability
• Availability Management is completed at 2 inter-
connected Levels: Service Component
Availability Availability
•Involves all aspects of •Involves all
services availability and
unavailability and the impact aspects of
of component availability, or component
the potential impact of
component unavailability on availability and
service availability
unavailability
Key Principles & Concepts
• Service Availability is at the core of business
success
• Better to design ‘Availability In’ than bolt it on
• The Vital Business Function (VBF)
– The business critical elements of the business
process supported by an IT service
4 Aspects of AM
•The ability of service, component or CI to perform its agreed
Reliability
•A measure of how long a service, component or CI can perform its agreed
function without interruption
•It is often measured and reported as Mean Time Between Failures (MTBF)
•The ability of a third party supplier to meet the terms of their contract
Serviceability •Often this contract will include agreed levels of availability, reliability
and/or maintainability for a supporting service or component
The Overall Process
Reactive Proactive
Activities Activities
•The monitoring, measurement, analysis and •Involve the proactive planning, design,
management of all events, incidents and and improvement of availability
problems involving unavailability •Producing recommendations, plans and
•These activities are principally involved
documents on design guidelines and
within the operational roles, and are to criteria for new and changed services
ensure that all agreed service targets are •The continual improvement of service and
measured and achieved
•Most of these activities are conducted within reduction of risk in existing services
wherever it can be cost justified
the Operations stage of the lifecycle and are
•These are key aspects to be considered
linked into the monitoring and control
activities, event and incident management within the service design stage of the
processes lifecycle
Key Activities
• Determining the availability requirements from the business
for a new or enhanced IT service
• Formulating the availability and recovery design criteria for
the IT components underpinning a service
• Defining the targets for availability, reliability and
maintainability for the IT Infrastructure components that
underpin the IT service
• Establishing measures and reporting of availability, reliability
and maintainability that reflects the business, user and IT
support organization perspectives
• Producing and maintaining an Availability Plan which
prioritizes and plans IT availability improvements
• Monitoring of all aspects of availability, reliability and
maintainability of IT services and the supporting components
Techniques to Support the Process
Component Failure Impact Analysis (CFIA)
Service Design
Service Continuity Lifecycle
Definition
• The goal of ITSCM is to support the overall
Business Continuity Management process by
ensuring that the required IT technical and
service facilities can be resumed within
required, and agreed, business timescales'
Scope and Purpose
• Scope
– ITSCM focuses on those event which the business
consideration significant enough to be considered a
disaster
– Less significant event will be dealt with as part of the
incident Management process. What constitutes a disaster
will vary from organization to organization
• Purpose
– The purpose of ITSCM is to maintain the necessary on
going recovery capability within the IT service and their
supporting components
Objectives
• Develop and maintain IT Service Continuity & IT recovery plans that
support the overall Business Continuity Plans (BSPs) of the organization
• Complete regular Business Impact Analysis (BIA)
• Conduct risk assessment & management exercise
• To ensure that appropriate continuity and recovery mechanisms are
put in place to meet or exceed the agreed business continuity targets
• To Asses the impact of all change on the IT Service Continuity Plans
and IT recovery plans
• To negotiate and agree the necessary contracts with supplier for the
provision of the necessary recovery capability to support all continuity
plans in conjunction with the Supplier Management process
Recovery Options
Do nothing
• Accommodation and utilities only
• Includes power and communications
Manual/clerical backup
• Own or 3rd party Standby site
• Recent application and data archives required
Reciprocal arrangement
• Equipment available
Immediate Recovery
Value to the Business
• ITSCM provides an invaluable role in
supporting the Business Continuity Planning
process
• The ITSCM should be driven by business risk as
identified by Business Continuity Planning and
ensuring that the recovery arrangements for
IT service are aligned to identified business
impacts, risk and needs
ITSC Manager Role
• Service Continuity manager has responsibility for
ensuring that the aims of Service Continuity
Management are met
• Includes such tasks and responsibilities as:
– To implement and maintain the ITSCM process
– To Perform Business Impact Analyses for all existing
and all new service
– Performing risk assessment and risk management to
prevent disasters where cost justifiable and where
practical
Information Security Management
Service Design
Definition
• The goal of the ISM process is to align IT
security with business security and ensure
that information security is effectively
managed in all services and service
management activities
• ISM needs to be considered within the overall
Corporate Governance Framework
Objectives
• The security objective is met when:
– Information is available and usable when required,
and the system that provide it can appropriately
resist attacks and recover from or prevent failures
(availability)
– Information is observed by or disclosed to only
those who have a right to know (confidentiality)
– Information is complete, accurate and protected
against unauthorized modification (integrity)
Scope
• The ISM process should be the focal point for all IT security
issues and must ensure that an information Security Policy is
produced, maintained and enforced that covers the use
misuse of all IT systems and services
• ISM needs to understand the total IT and business security
environment, including:
– The Business Security Policy and plans
– The current business operations and its security requirements
– Legislative requirements
– The obligations & responsibilities with regards to security contained within
SLAs
– The business & IT risks and their management
Information Security Policy
• ISM activities should be focused on &driven by an overall ISM
Policy and set of underpinning specific security policies
• All security policies should have the full support of top
executive IT management and top executive business
management, and should be reviewed and where necessary
revised on at least an annual basis
• These policies should be widely available to all customers &
users and their compliance should be referred to in all SLRs,
SLAs, contracts and agreements
• The ISM Policy should cover all areas of security, be
appropriate, meet the needs of the business
Information Security Policy
• ISM Policy should include....
use and misuse of IT assets policy
an email policy
an internet policy
an anti-virus policy
Service Design
Goal of Supplier Management
• The goal of Supplier Management process is
to manage suppliers and the services they
supply, to provide seamless quality of IT
service to the business, ensuring value for
money obtained
Scope and Purpose
• Scope
– This process should include the management of all
suppliers and contracts needed to support the
provision of IT services to the business
• Purpose
– The purpose of this process is to obtain value for
money from suppliers and to ensure that suppliers
perform to the targets contained within their
contracts and agreements while conforming to all of
the terms and conditions
Objectives
• Obtain value for money from supplier and contracts
• Ensure that underpinning contract and agreements with
suppliers are aligned to business needs and support and align
with agreed in SLRs and SLAs, in conjunction with SLM
• Manage relationship with suppliers
• Manage supplier performance
• Negotiate and agree contracts with suppliers and manage
them through their lifecycle
• Maintain a supplier policy and a supporting Supplier and
Contract Database (SCD)
The Process
• The Supplier Management Process should include Categorization
– Implementation and enforcement of the supplier policy & maintenance
– The maintenance of a Supplier and Contract Database
(SCD)
– Supplier and contract, evaluation and selection Evaluation
– The development, negotiation and agreement of contracts
– Contract review, renewal and termination
– The management of suppliers and supplier performance Establish new
– The agreement and implementation of service and
supplier improvement plan
Management &
– The maintenance of standard contracts, terms and
performance
conditions
– Management of contractual dispute resolution
Renewal &
termination
The Process
• All Supplier Supplier & Contracts
Management Supplier Strategy & Policy Database (SCD)
process activity
should be driven by Supplier categorization &
maintenance of SCD
a supplier strategy
and policy from
Evaluation of new Supplier &
Service Strategy contracts
• In order to achieve
Supplier
consistency and Establish new Supplier & Suoo &
Reports
effectiveness in the contracts Information
implementation of
the policy an SCD Supplier & contracts
should be management & performance
established
Contract renewal and/or
termination
Learning Objectives
• Primary goals, objectives and benefits of
Service Design
• Generic concepts and definitions
– Service Design Package
– Service Portfolio (and Service Catalogue)
– Service Provider & Supplier
– SLA, OLA, Contract
– Availability
Learning Objectives
• Key Principles and Models
• Processes
– Service Level Management
– Service Catalogue Management
– Availability Management
– Information Security Management
– Supplier Management
– Capacity Management
– IT Service Continuity Management
Testing Your Knowledge
Service Design
Question #1
A. Capacity Management
B. Portfolio Management
C. Service Level Management
D. Supplier Management
Question #2
A. 1 and 2 only
B. All are correct
C. Only 3 is correct
D. 2 and 3 only are correct
Question #5
Which of the following is not a valid stage within the
ITSCM Lifecycle?
A. Testing
B. Initiation
C. Implementation