An Introductory Overview of ITIL - very useful for you (IT management process)
ITIL (IT Infrastructure Library) provides a framework of “best practice”
guidance for IT Service Management and is the most widely used and accepted approach to IT Service Management in the world. This pocket guide has been designed as an introductory overview for anyone who has an interest or need to understand more about the objectives, content and coverage of ITIL. Whilst this guide provides an overview, full details can be found in the actual ITIL publications themselves.
CO
MP
L
ISS IMEN
UE TA
RY
The IT Infrastructure Library
An Introductory
Overview of ITIL®
Version 1.0a
Written by: Colin Rudd itEMS Ltd
Contributor: Gary Hodgkiss CGE&Y
Edited by: Alison Cartlidge Xansa
Published by: itSMF Ltd
Webbs Court
8 Holmes Road
Earley
Reading RG6 7BH
United Kingdom
Tel: +44 (0)118 926 0888
Fax: +44 (0)870 706 1531
e-mail: [email protected]
© Copyright itSMF, 2004
This version first published April 2004
Minor updates published July 2004
Based on other copyright material with the permission of the copyright owners.
The itSMF would like to thank the contributors to an extensive international
quality review process for their comments.
ITIL® is a registered trademark and a registered community trademark of the
Office of Government Commerce (OGC) and is registered in the U.S. Patent
and Trademark Office.
© Crown copyright material reproduced with the kind permission of OGC and
the Controller of Her Majesty’s Stationery Office (HMSO).
1
About this guide
ITIL (IT Infrastructure Library) provides a framework of “best practice”
guidance for IT Service Management and is the most widely used and accepted
approach to IT Service Management in the world. This pocket guide has been
designed as an introductory overview for anyone who has an interest or need
to understand more about the objectives, content and coverage of ITIL. Whilst
this guide provides an overview, full details can be found in the actual ITIL
publications themselves.
This guide describes the key principles of IT Service Management and
provides a high-level overview of each of the core publications within ITIL:
I Service Delivery
I Service Support
I ICT Infrastructure Management
I Planning to Implement Service Management
I Application Management
I The Business Perspective
I Security Management.
This guide reinforces the key ITIL message that IT services are there solely to
support the business and its efficient and effective operation.
The advice contained within this guide is neither definitive nor prescriptive,
but is based on ITIL best practice. The use of ITIL is applicable and is of benefit
to all IT organisations irrespective of their size or the technology in use.
2
Contents
About this Guide 2
Contents 3
1 Introduction 4
2 What is IT Service Management? 6
3 Why Implement Service Management? 8
4 The ITIL Framework 10
5 Service Delivery 13
6 Service Support 16
7 ICT Infrastructure Management 19
8 Planning to Implement Service Management 22
9 Application Management 25
10 The Business Perspective 28
11 Security Management 31
12 Related Standards and Complementary Books 34
13 Summary 36
14 Further Guidance and Contact Points 39
3
1 Introduction
In recent years it has become increasingly recognised that information is the
most important strategic resource that any organisation has to manage. Key to
the collection, analysis, production and distribution of information within an
organisation is the quality of the Information Communication Technology
(ICT) systems and IT services provided to the business. It is essential that we
recognise that ICT systems are crucial, strategic, organisational assets and
therefore organisations must invest appropriate levels of resource into the
support, delivery and management of these critical IT services and the ICT
systems that underpin them. However, these aspects of IT are often overlooked
or only superficially addressed within many organisations.
The key issues facing many of today’s senior Business Managers and IT
Managers are:
I IT and business strategic planning
I Integrating and aligning IT and business goals
I Acquiring and retaining the right resources and skill sets
I Implementing continuous improvement
I Measuring IT organisation effectiveness and efficiency
I Reducing costs and the Total Cost of Ownership (TCO)
I Achieving and demonstrating Value For Money (VFM) and Return on
Investment (ROI)
I Demonstrating the business value of IT
I Developing business and IT partnerships and relationships
I Improving project delivery success
I Outsourcing, insourcing and smart sourcing
I Using IT to gain competitive advantage
I Delivering the required, business justified IT services (i.e. delivering what
is required, when required and at an agreed cost)
I Managing constant business and IT Change
I Following the sun and offshore operations
I Demonstrating appropriate IT governance.
4
The challenges for IT managers are to co-ordinate and work in partnership
with the business to deliver high quality IT services. This has to be achieved
while reducing the overall TCO and often increasing the frequency, complexity
and the volume of Change. The main method of realising this goal is the
operation of effective processes and the provision of appropriate, value for
money services. To achieve this, the correct processes need to be developed and
implemented with in-built assessment and improvement mechanisms. IT
management is all about the efficient and effective use of the four Ps, people,
processes, products (tools and technology) and partners (suppliers, vendors
and outsourcing organisations).
People
Processes Products
Partners
Figure 1: The Four P’s
Management therefore needs to develop joint strategies and plans for all four
areas within Figure 1. However, many organisations, in the past and still today,
recognise the four Ps but do not use them for maximum advantage. All too
often products are bought to manage areas of technology and then the
processes, partners and people’s roles are engineered to fit the technology and
its limitations. The people and processes issues must be addressed first and
this is one of the core principles of ITIL.
5
2 What is IT Service Management?
What do people mean when they refer to “Service Management”?
Different people use the term in different contexts. Some use it to refer
specifically to just the content of the Service Delivery and Service Support ITIL
books while others use it to include all of ITIL. In reality, Service Management
should refer to any aspect of the management of IT service provision and
therefore should include the whole of ITIL and not be limited to just two of the
core modules. This is the definition and interpretation of the Service
Management term used throughout this guide and is a core principle of ITIL.
Another core principle of ITIL and IT Service Management is the provision of
quality Customer service. This is achieved by ensuring that Customer
requirements and expectations are met at all times. The satisfaction of business
and Customer requirements is fundamental to the whole of ITIL and there are
a number of key activities that are vital to the success of ITIL processes within
this area:
I Documenting, negotiating and agreeing Customer and business quality
targets and responsibilities in Service Level Agreements (SLAs)
I Regular assessment of Customer opinion in Customer feedback
and Customer Satisfaction Surveys
I IT personnel regularly taking the ‘Customer journey’ and sampling
the ‘Customer experience’
I IT personnel taking the Customer and business perspective and always
trying to keep Customer interactions as simple and enjoyable as possible
I Understanding the ICT infrastructure.
Tip:
To keep interactions as simple and enjoyable for the Customer as
possible use language that they understand and don’t use technical IT
terms.
6
ITIL recognises that there is no universal solution to the design and
implementation of an optimised process for the management and delivery of
quality IT services. Many experts, authorities, leading practitioners and
exponents within the IT industry have contributed to the development of ITIL
and the result is a framework that provides a “common sense”, structured
approach to the essential processes involved. ITIL has been developed to be
process driven and yet scalable and sufficiently flexible to fit any organisation
from Small, Medium Enterprises (SMEs) to global Multi-National
Organisations.
Each organisation whether an internal service provider or an external third
party service provider should adopt the guidelines, principles and concepts of
ITIL and adapt them to fit their own unique environment – “adopt and
adapt”.
IT management must recognise the importance of their role in underpinning
the operation of the business. They must co-ordinate and work in partnership
with the business, facilitating growth, rather than letting the technology and
IT dictate and drive the business. It is essential therefore that the issues and
expectations of business managers are closely aligned with the objectives and
deliverables of IT management. Therefore IT processes must be developed
based on their ability to deliver true business benefit.
The only way of achieving this is to design, plan and implement IT services
using ICT infrastructure and management processes that deliver the
information and solutions required by the business. The more effective
organisations of today design the people’s roles, partner’s roles and the
processes first and then configure the technology to support and automate
them. In the truly efficient organisations these roles and processes are aligned
to the business, the business requirements and the business processes. This
ensures that the business and IT management processes and systems have
aligned targets and goals.
ITIL provides “best practice” guidelines and architectures to ensure that IT
processes are closely aligned to business processes and that IT delivers the
correct and appropriate business solutions. ITIL is not a standard, nor is it
rules or regulations and therefore neither tools, processes or people can be
deemed “ITIL compliant”. Processes and organisations can be assessed
against BS 15000, the IT Service Management standard. However, neither
tools nor individuals can be certified against BS 15000. Further information
about BS 15000 is contained in section 12 of this guide.
7
3 Why Implement Service Management?
One of the main objectives of ITIL is to assist IT service provider organisations
“to improve IT efficiency and effectiveness whilst improving the overall
quality of service to the business within imposed cost constraints”.
The specific goals of IT are to develop and maintain IT services that:
I Develop and maintain good and responsive relationships with the
business
I Meet the existing IT requirements of the business
I Are easily developed and enhanced to meet future business needs,
within appropriate time scales and costs
I Make effective and efficient use of all IT resources
I Contribute to the improvement of the overall quality of IT service
within the imposed cost constraints.
Benefits realised by many IT organisations through implementing ITIL and
processes based on “best practice” guidelines are:
I Continuous improvement in the delivery of quality IT services
I Reduced long term costs through improved ROI or reduced TCO
through process improvement
I Demonstrable VFM to the business, the board and stakeholders,
through greater efficiency
I Reduced risk of not meeting business objectives, through the
delivery of rapidly recoverable, consistent services
I Improved communication and better working relationships
between IT and the business
I The ability to absorb a higher rate of Change with an improved,
measurable rate of success
I Processes and procedures that can be audited for compliance to
“best practice” guidelines
I Improved ability to counter take-over, mergers and outsourcing.
8
Examples of some of the savings made by organisations include:
I Over 70% reduction in service downtime
I ROI up by over 1000%
I Savings of £100 million per annum
I New product cycles reduced by 50%.
However, care must be taken when developing IT Service Management within
an organisation. It is easy to view and interpret ITIL as bulky and bureaucratic
and as a result implement processes that inhibit Change rather than facilitate
it. It is important that ITIL is implemented with an “adopt and adapt”
approach so that effective and appropriate processes are put in place. This can
only be achieved where business driven metrics, Critical Success Factors
(CSFs) and Key Performance Indicators (KPIs) are put in place to measure the
success of the process implementations and their continuous improvement.
Quality and the measurement of quality, in business related terms, is yet
another core principle of ITIL.
9
4 The ITIL Framework
ITIL provides comprehensive “best practice” guidelines on all aspects of
“end-to-end” Service Management and covers the complete spectrum of
people, processes, products and the use of partners. ITIL was initially designed
and developed in the 1980s but has recently been revised and updated to bring
it in line with modern practices, distributed computing and the internet. ITIL
is the most widely used management approach to the delivery and support of
IT services and infrastructure, world-wide. ITIL and its constituent modules
were scoped and developed within an overall framework.
Figure 2: The ITIL Framework
Figure 2 shows the overall environment and structure within which the
modules were produced. It illustrates the relationship that each of the modules
has with the business and the technology. From the diagram it can be seen
how The Business Perspective module is more closely aligned to the business
and the ICT Infrastructure Management module is more closely aligned with
the technology itself. The Service Delivery and Service Support modules
provide the heart of the process framework.
10
These seven modules constitute the core of ITIL. Its recent revision has
improved the structure of ITIL, and the new scope, contents and relationships
of the various modules are in essence as follows.
Service Delivery: covers the processes required for the planning and
delivery of quality IT services and looks at the longer term processes associate
with improving the quality of IT services delivered.
Service Support: describes the processes associated with the day-to day
support and maintenance activities associated with the provision of IT
services.
ICT Infrastructure Management (ICT IM): covers all aspects of
ICT Infrastructure Management from identification of business requirements
through the tendering process, to the testing, installation, deployment, and
ongoing operation and optimisation of the ICT components and IT services.
Planning to Implement Service Management: examines the
issues and tasks involved in planning, implementing and improving Service
Management processes within an organisation. It also addresses the issues
associated with addressing Cultural and Organisational Change, the
development of a vision and strategy and the most appropriate method of
approach.
Application Management: describes how to manage applications from
the initial business need, through all stages in the application lifecycle, up to
and including retirement. It places emphasis on ensuring that IT projects and
strategies are tightly aligned with those of the business throughout the
application lifecycle, to ensure that the business obtains best value from its
investment.
The Business Perspective: provides advice and guidance to help IT
personnel to understand how they can contribute to the business objectives
and how their roles and services can be better aligned and exploited to
maximise that contribution.
Security Management: details the process of planning and managing a
defined level of security for information and IT services, including all aspects
associated with reaction to security Incidents. It also includes the assessment
and management of risks and vulnerabilities, and the implementation of cost
justifiable countermeasures.
11
Figure 3 illustrates the scope of each of the core ITIL modules together with the
main deliverables from each of the individual processes, as shown within each
of the individual process boxes. The lines between processes indicate where the
deliverables of each process are principally used outside of their own process
area.
The Business Planning to Implement SM
Business Business Vision Culture, People
Strategies & Continuity & Strategy & Training
Plans Plans Plans
Business Business Programme & Objectives,
Requirements Security Policy Project Plans CSFs & KPIs
Service Delivery Service Support
Business Perspective
SIP Configuration
ICT Business Business Service Quality Plan Change,
Plans & Requirements Financial Plan Release &
Communication Service Continuity Plan other Service
Capacity Plan Support Plans
Procurement Supplier & Availability Plan
Policies Contract
Policies
Security Management
Applications Management Security ICT Infrastructure Management
Policies
Application Applications ICT Design & ICT Strategies
Strategy Architecture Security Architecture & Plans
Strategy
& Plans Business Cases
Development Applications Evaluation,
Programme Policies SoR’s & ITTs Feasibility
Studies
Figure 3: The Deliverables and Interfaces
Each of the separate modules is expanded in the following sections.
12
5 Service Delivery
The Service Delivery module of ITIL covers the more forward-looking delivery
aspects of service provision and consists of Service Level Management, Financial
Management for IT Services, Capacity Management, IT Service Continuity and
Availability Management. These processes are principally concerned with
developing plans for improving the quality of the IT services delivered.
Business, Customers and Users
Queries Communication
Enquiries Updates
Reports
Service Level
Management
SLAs, SLRs,
OLAs
Availability Requirements Service reports
Management Targets Service Catalogue
Achievements SIP or CSIP
Exception reports
Audit reports
Availability Plan
Design criteria Capacity
Management
Targets/Thresholds
Reports
Audit reports Financial
Capacity Plan Management
CDB for IT Services
Targets/Thresholds
Capacity Reports Financial Plan
Schedules Types & models
Audit reports Costs & Charges
Reports IT Service
Budgets & Forecasts Continuity
Audit reports
Management
IT Continuity Plans
BIA & Risk Analysis
Alerts and Control centres
Exceptions DR contracts
Changes Reports
Audit reports
Management
Tools & IT
Infrastructure
Figure 4: The Service Delivery Processes
Figure 4 illustrates how Service Level Management (SLM) provides the major
interface to the business and it also shows the major deliverables from each of
the Service Delivery processes.
13
The SLM process negotiates, documents, agrees and reviews business service
requirements and targets, within Service Level Requirements (SLRs) and
Service Level Agreements (SLAs). These relate to the measurement, reporting
and reviewing of service quality as delivered by IT to the business. The SLM
process also negotiates and agrees the support targets contained in
Operational Level Agreements (OLAs) with support teams and in
underpinning contracts with suppliers, to ensure that these align with
business targets contained within SLAs.
The other major roles of the SLM process are the production and maintenance
of the Service Catalogue, which provides essential information on the complete
portfolio of IT services provided, and the development, co-ordination and
management of the Service Improvement Programme (SIP) or Continuous
Service Improvement Programme (CSIP), which is the overall improvement
plan for continuous improvement in the quality of IT services, as delivered to
the business.
Financial Management for IT Services provides the basis for running IT as a
business within a business and for developing a “cost conscious” and “cost
effective” organisation. The principle activities consist of understanding and
accounting for the costs of provision of each IT service or business unit and the
forecasting of future expenditure within the IT Financial Plan. There is also
another optional, but preferred activity, the implementation of a charging
strategy, which attempts to recover the IT costs, from the business, in a fair and
equitable manner.
SLM demonstrates the level of service being delivered to the businesses day in
and day out. As long as the service meets the business’ specified requirements,
when cost models or a charge back mechanism are implemented under
Financial Management, you can show the financial value of those services.
This provides a baseline for assessing the financial viability of a service or
adjusting charges in line with changing service requirements i.e. in general, a
better service costs more money.
14
The Capacity Management process ensures that adequate capacity is available
at all times to meet the requirements of the business by balancing “business
demand with IT supply”. In order to achieve this, a Capacity Plan
closely linked to the business strategy and plans is produced and reviewed on
a regular basis. This covers the three principle areas of Business, Service and
Resource Capacity Management (BCM, SCM and RCM). These three areas
comprise the activities necessary for ensuring that the IT capacity and the
Capacity Plan are kept in line with business requirements. The common
activities used within these areas are Performance Management, Workload
Management, Demand Management and Application Sizing and Modelling.
IT Service Continuity produces recovery plans designed to ensure that,
following any major Incident causing or potentially causing disruption of
service, IT services are provided to an agreed level, within an agreed schedule.
It is important for each organisation to recognise that IT Service Continuity is
a component of Business Continuity Planning (BCP). The objective of IT
Service Continuity is to assist the business and BCP to minimise the
disruption of essential business processes during and following a major
Incident. To ensure that plans are kept in line with changing business needs
Business Impact Analysis, Risk Analysis and Risk Management exercises are
undertaken on a regular basis together with the maintenance and testing of all
recovery plans.
Availability is a key aspect of service quality. Availability Management is
responsible for ensuring that the availability of each service meets or exceeds
its availability targets and is proactively improved on an ongoing basis. In
order to achieve this, Availability Management monitors, measures, reports
and reviews a key set of metrics for each service and component, which
includes availability, reliability, maintainability, serviceability and security.
15
6 Service Support
The Service Support component of ITIL deals more with the day-to-day
support and maintenance processes of Incident Management, Problem
Management, Change Management, Configuration Management and
Release Management plus the Service Desk function.
Business, Customers and Users
Management Incidents Communication
Queries Updates
Tools Enquiries
Work-arounds
Incidents Incidents Service
Desk Changes
Incident
Management Customer
Survey Releases
Reports
Problem
Management
Service reports
Incident statistics Change
Audit reports Management
Problem statistics
Trend analysis Release
Problem reports Management
Problem reviews Change schedule
Diagnostic aids CAB minutes Configuration
Audit reports Change statistics Management
Change reviews
Audit reports Release schedule
Release statistics
Release reviews
Secure library CMDB reports
Testing standards CMDB statistics
Audit reports Policy/standards
Audit reports
Incidents Problems Changes Releases CIs
Known Errors Relationships
CMDB
Figure 5: The Service Support Processes
16
Figure 5 illustrates that the Service Desk function provides the major interface
to the business and it also shows the major deliverables from each of the
Service Support processes.
The Service Desk provides a single, central point of contact for all Users of IT
within an organisation, handling all Incidents, queries and requests. It
provides an interface for all of the other Service Support processes.
Incident Management is responsible for the management of all Incidents from
detection and recording through to resolution and closure. The objective of
Incident Management is the restoration of normal service as soon as possible
with minimal disruption to the business.
The goal of Problem Management is to minimise the adverse impact of
Incidents and Problems on the business. To achieve this, Problem
Management assists Incident Management by managing all major Incidents
and Problems, while endeavouring to record all workarounds and ‘quick fixes’
as Known Errors where appropriate, and raising Changes to implement
permanent structural solutions wherever possible. Problem Management also
analyses and trends Incidents and Problems to proactively prevent the
occurrence of further Incidents and Problems.
A single centralised Change Management process, for the efficient and
effective handling of Changes, is vital to the successful operation of any IT
organisation. Changes must be carefully managed throughout their entire
lifecycle from initiation and recording, through filtering, assessment,
categorisation, authorisation, scheduling, building, testing, implementation
and eventually their review and closure. One of the key deliverables of the
process is the Forward Schedule of Change (FSC) a central programme of
Change agreed by all areas, based on business impact and urgency.
17
The Release Management process takes a holistic view of Changes to IT
services, considering all aspects of a Release both technical and non-technical.
Release Management is responsible for all legal and contractual obligations
for all hardware and software in use within the organisation. In order to
achieve this and protect the IT assets, Release Management establishes secure
environments for both hardware in the Definitive Hardware Store (DHS) and
software in the Definitive Software Library (DSL).
Configuration Management provides the foundation for successful IT Service
Management and underpins every other process. The fundamental deliverable
is the Configuration Management Database (CMDB), comprising one or
more integrated databases detailing all of the organisation’s IT infrastructure
components and other important associated assets. It is these assets that
deliver IT services and they are known as Configuration Items (CIs). What
sets a CMDB apart from an ordinary asset register are the relationships, or
links, that define how each CI is interconnected and interdependent with its
neighbours. These relationships allow activities such as impact analyses and
‘what if?’ scenarios to be carried out. Ideally the CMDB also contains details of
any Incidents, Problems, Known Errors, and Changes associated with each CI.
18
7 ICT Infrastructure Management
ICT Infrastructure Management (ICT IM) looks at the challenges associated
with the management of the ICT infrastructure and covers overall
Management and Administration, Design and Planning, Technical Support,
Deployment and Operations.
Security Management Business
Customers Users
Applications Management Service Support
Service Delivery
Business Perspective
Strategies, Plans & Requirements Business Solutions
ICT IM
Policy Strategy Plan Prove Deploy Operate Obsolete
Design & Planning Deployment Operations
Technical Support
ICT IM Management & Administration
Partners Technology
Figure 6: The Major ICT IM Interfaces
ICT IM processes are closely associated with the ICT infrastructure on which
the IT services run. They are all about managing the four Ps (see Figure 1) but
concentrate on those areas of IT most closely related to the actual tools and
technology as illustrated in Figure 6. The ICT IM processes are responsible for
managing a service through each of the stages in its lifecycle, from
requirements, through design, feasibility, development, build, test,
deployment, operation and optimisation to retirement. The operation and
optimisation stages are the responsibility of the ICT Operations processes and
are responsible for ensuring that all operational events are appropriately
managed and that all operational service targets are achieved.
19
