ITRM - Service Portfolio/CatalogITRM - Service Portfolio/Catalog

Guillermo TrevinoITRM- Graduate Technology Assistant

Texas A&M University

05/22/2012

According to the Network & Information Security (NIS) webpage:

“ITRM administers ISAAC and Information Security Awareness Training, and works to meet mandatory

requirements for State and Federal Laws”.

What is the mission of the Information Technology Risk Management group?

http://nis.tamu.edu/About/NIS/ITRM.php

According to the latest ITRM Values and Vision Retreat:

“Information Technology Risk Management’s purpose is to support Information Technology compliance and risk

management by providing expertise and a framework of policies, guidelines, and tools to the university community

in areas such as information security, web accessibility and project management”.

Latest Update: 05/09/12S:\CISShare\itrm\ITRM\TeamBuilding

1) Generating and coordinating IT Policies a) Texas A&M Rules & Standard Administrative Procedures (SAPs)

b) State and Federal Laws and Regulations

c) Networking Procedures and Guidelines

2) Information Security Awareness, Assessment, and Compliance (ISAAC)

a) Local and State (TAC 202) (Federal?) Security Standards

b) Risk assessment and reporting

3) Web Accessibilitya) Texas Administrative Code (TAC 206)

b) Testing, remediation, and training

a) Project Management Officea) Texas Administrative Code (TAC 216)

b) Project management tools, services, and training

What kind of expertise?

http://nis.tamu.edu/About/NIS/ITRM.php

• IT Services can be defined as:

“the full management- maintenance and operation of the IT infrastructure”(Foundations, p.15).

In other words, ITRM plays a critical role in the operation of the Texas A&M University- IT infrastructure by providing services that ensure the proper access and use of resources.

Do we provide IT Services?

Latest Update: 05/09/12S:\CISShare\itrm\ITRM\TeamBuilding

• ITRM Leadership has decided to use The Information Technology Infrastructure Library (ITIL) approach in order to manage the services provided.

• ITIL is a set of best practices observed and implemented in the IT service industry.

• ITIL suggests generating a service portfolio with all services that were/are/will-be offered by the organization. This portfolio consists of three sections:1. Retired Services

2. Service Catalog

3. Pipeline Services (Dreams)

How can we manage IT Services?

Foundations of IT Service Management based on ITIL

According to ITIL V3 Foundations Handbook:

What is a service portfolio?

“The service portfolio represents the ability and readiness of a service provider to serve customers and Market Spacers. It represents all the resources presently engaged or being released in various phases of the Service Lifecycle”.

• A service portfolio helps to clarify the following questions:

oWhy should a customer buy these services?oWhy should they buy these services from you?oWhat are the pricing or chargeback models?oWhat are my strengths and weakness, priorities, and

risk?o How should my resources and capabilities be

allocated?

How can a service portfolio benefit my organization?

ITIL V3 Foundations Handbook

According to the ITIL Service Design framework a service catalog is defined as follows:

What is a service catalog?

“A database or structured document with information about all live IT services, including those available for deployment. The service catalogue is the only part of the service portfolio published to customers, and is used to support the sale and delivery of IT services. The service catalogue includes information about deliverables, prices, contact points, ordering and request processes”.

• Provides clarity on what services are available and how to obtain them.

• The process of generating a service catalog allows the organization to reflect about the customer perspective.

• The process of generating a service catalog provides the opportunity to decompose services into components. It helps to identify gaps and redundancies as well as areas of improvement.

• Provides an entry point for service level and customer expectation.

How can a service catalog benefit my organization?

• Over-commit or under-deliver

• Obsolete services still consuming resources

• Wasted resources from overbuilding

• Business expectations missed

Consequences of not having a service portfolio/catalog

Service Portfolio Mgmt & Service Catalog ITIL V3

Service Portfolio vs Service Catalog

Portfolio Catalog

• Describes services in business values (customer’s perspectives)

• Provides a brief description of the services offered

• For internal use only

• For external/internal use

• Specifies what the services are; how services are bundled/packaged; what benefits they deliver

• Does not provide specifics about the service

How can a service portfolio/catalog benefit my organization?

• Provides an entry point for service level and customer expectation (“be on the same page”).

Communication and maturity levels: customer and supplier (source: ITSMF)

Example of a Service Catalog

http://www.its.nc.gov/serviceCatalog/default.aspx

1) List all the services provided individually and the beneficiaries.

Defining ITRM Services

Defining ITRM Services

ITRM Job Title/ Responsibilities Breakdown (source: ITRM Org. Chart)

Job Title/Responsibilities Alison Winslow

Susan Cook

Debra Dandridge

Don Gilman

David Sustaita

James Smith

Zach Cox

Syed Akbar

Amanda Boyd

Brittany Olsen

Kyle Boatsman

Guillermo Trevino

Crystal Han

Full TimeParticipants

Ocassional Contributors

Total

*Senior IT Manager x 1 0 1IT Manager x 1 0 1IT Regulatory Compliance Management x x x x x x x x x 9 0 9ISAAC Program x ● x x ● ● ● 3 4 7IT Policy Analyst x x x 3 0 3Lead IT Policy Analyst x x x 3 0 3IT Policy & Practice Administration ● x ● ● ● ● 1 5 6Senior IT Policy Analyst x 1 0 1Senior IT Associate x 1 0 1ITRM Technology Assistant x 1 0 1ITRM Administrative Assistant x 1 0 1ISAAC Technology Assistant x 1 0 1Project Management x x x ● ● ● ● 3 4 7Web Accesibility x ● x x ● ● 3 3 6

● Ocassional Contributorsx Core Function

• What is our business?

• Who is our customer?

• What does the customer value?

• Who depends on our services?

• How do they use our services?

• What are they valuable to them?

Defining ITRM Services with a Marketing Mindset

ItemItem DescriptionDescription

1. ITRM Group • ITRM group providing the service

2. Service Name • The term by which the service is referred by internal/external customers.

3. Service Description • Name using non-technical terms (anybody should be able to understand)

4. Service Owner • Person(job title) within the organization who manages this service (e.g. planning, budget, decision-making).

5. Service Collaborators (s)

• Person(s) within the organization who provide support to the service (e.g. in charge of a component).

6. Beneficiary • Name of the Internal/External customer.

7. Service Category • Mission Critical: continuous availability; generates revenue; external customer are direct users; interconnected with other services.

• Business Critical/Operational: internal services that affects revenue or overall efficiency of the organization.

Service Level Agreement (SLA) vs Operational Level Agreement (OLA)

• SLAs and OLAs are IT formal/informal contracts.

Item SLA OLA

• Participants • IT • Owner of the business

process

• All IT supporting groups

• IT vendors

• Defines • Services to be delivered (Service Catalog)

• Quality/level of the services

• Internal provision of IT services

• Type of Agreement

• External • Internal

• Type of Language

• Business • Technical

ITILITIL

Summary

http://www.csrandthelaw.com/tags/risk-management/

• Moving forward with The Information Technology Infrastructure Library (ITIL) approach.

• Introduction to service portfolio/catalogs.

• Benefits of having a service portfolio/catalog.

• Information and steps required to generate a service catalog.