ITRM Service PortfolioCatalog Guillermo Trevino ITRM Graduate Technology

ITRM - Service Portfolio/Catalog Guillermo Trevino ITRM- Graduate Technology Assistant Texas A&M University 05/22/2012

What is the mission of the Information Technology Risk Management group? According to the Network & Information Security (NIS) webpage: “ITRM administers ISAAC and Information Security Awareness Training, and works to meet mandatory requirements for State and Federal Laws”. http: //nis. tamu. edu/About/NIS/ITRM. php

According to the latest ITRM Values and Vision Retreat: “Information Technology Risk Management’s purpose is to support Information Technology compliance and risk management by providing expertise and a framework of policies, guidelines, and tools to the university community in areas such as information security, web accessibility and project management”. Latest Update: 05/09/12 S: CISShareitrmITRMTeam. Building

What kind of expertise? 1) Generating and coordinating IT Policies a) b) c) Texas A&M Rules & Standard Administrative Procedures (SAPs) State and Federal Laws and Regulations Networking Procedures and Guidelines 2) Information Security Awareness, Assessment, and Compliance (ISAAC) a) b) Local and State (TAC 202) (Federal? ) Security Standards Risk assessment and reporting 3) Web Accessibility 1) 2) Texas Administrative Code (TAC 206) Testing, remediation, and training a) Project Management Office a) b) Texas Administrative Code (TAC 216) Project management tools, services, and training http: //nis. tamu. edu/About/NIS/ITRM. php

Do we provide IT Services? • IT Services can be defined as: “the full management- maintenance and operation of the IT infrastructure”(Foundations, p. 15). In other words, ITRM plays a critical role in the operation of the Texas A&M University- IT infrastructure by providing services that ensure the proper access and use of resources. Latest Update: 05/09/12 S: CISShareitrmITRMTeam. Building

How can we manage IT Services? • ITRM Leadership has decided to use The Information Technology Infrastructure Library (ITIL) approach in order to manage the services provided. • ITIL is a set of best practices observed and implemented in the IT service industry. • ITIL suggests generating a service portfolio with all services that were/are/will-be offered by the organization. This portfolio consists of three sections: 1. Retired Services 2. Service Catalog 3. Pipeline Services (Dreams) Foundations of IT Service Management based on ITIL

What is a service portfolio? According to ITIL V 3 Foundations Handbook: “The service portfolio represents the ability and readiness of a service provider to serve customers and Market Spacers. It represents all the resources presently engaged or being released in various phases of the Service Lifecycle”.

How can a service portfolio benefit my organization? • A service portfolio helps to clarify the following questions: o Why should a customer buy these services? o Why should they buy these services from you? o What are the pricing or chargeback models? o What are my strengths and weakness, priorities, and risk? o How should my resources and capabilities be allocated? ITIL V 3 Foundations Handbook

What is a service catalog? According to the ITIL Service Design framework a service catalog is defined as follows: “A database or structured document with information about all live IT services, including those available for deployment. The service catalogue is the only part of the service portfolio published to customers, and is used to support the sale and delivery of IT services. The service catalogue includes information about deliverables, prices, contact points, ordering and request processes”.

How can a service catalog benefit my organization? • Provides clarity on what services are available and how to obtain them. • The process of generating a service catalog allows the organization to reflect about the customer perspective. • The process of generating a service catalog provides the opportunity to decompose services into components. It helps to identify gaps and redundancies as well as areas of improvement. • Provides an entry point for service level and customer expectation.

Consequences of not having a service portfolio/catalog • Over-commit or under-deliver • Obsolete services still consuming resources • Wasted resources from overbuilding • Business expectations missed Service Portfolio Mgmt & Service Catalog ITIL V 3

Service Portfolio vs Service Catalog Portfolio Catalog • Describes services in business values (customer’s perspectives) • Provides a brief description of the services offered • For internal use only • For external/internal use • Specifies what the services are; how services are bundled/packaged; what benefits they deliver • Does not provide specifics about the service

How can a service portfolio/catalog benefit my organization? • Provides an entry point for service level and customer expectation (“be on the same page”). Communication and maturity levels: customer and supplier (source: ITSMF)

Example of a Service Catalog http: //www. its. nc. gov/service. Catalog/default. aspx

Defining ITRM Services 1) List all the services provided individually and the beneficiaries.

Defining ITRM Services ITRM Job Title/ Responsibilities Breakdown (source: ITRM Org. Chart)

Defining ITRM Services with a Marketing Mindset • • • What is our business? Who is our customer? What does the customer value? Who depends on our services? How do they use our services? What are they valuable to them?

Item Description 1. ITRM Group • ITRM group providing the service 2. Service Name • The term by which the service is referred by internal/external customers. 3. Service Description • Name using non-technical terms (anybody should be able to understand) 4. Service Owner • Person(job title) within the organization who manages this service (e. g. planning, budget, decision-making). 5. Service Collaborators (s) • Person(s) within the organization who provide support to the service (e. g. in charge of a component). 6. Beneficiary • Name of the Internal/External customer. 7. Service Category • Mission Critical: continuous availability; generates revenue; external customer are direct users; interconnected with other services. Business Critical/Operational: internal services that affects revenue or overall efficiency of the organization. •

Service Level Agreement (SLA) vs Operational Level Agreement (OLA) • SLAs and OLAs are IT formal/informal contracts. Item • • Participants Defines SLA • • IT Owner of the business process OLA • • Services to be delivered • (Service Catalog) Quality/level of the services All IT supporting groups IT vendors Internal provision of IT services • Type of Agreement • External • Internal • Type of Language • Business • Technical

ITIL 1. List Services 2. Define & Classify Services 3. Generate Services Catalog

Summary • Moving forward with The Information Technology Infrastructure Library (ITIL) approach. • Introduction to service portfolio/catalogs. • Benefits of having a service portfolio/catalog. • Information and steps required to generate a service catalog. http: //www. csrandthelaw. com/tags/risk-management/