(cid:8)(cid:11)(cid:8)(cid:9)(cid:28)(cid:1)(cid:10)(cid:16)(cid:23)(cid:26)(cid:18)(cid:14)(cid:16)(cid:1)(cid:7)(cid:16)(cid:24)(cid:18)(cid:17)(cid:20) M ANA T G S E E M (cid:6)(cid:4)(cid:5)(cid:5)(cid:1)(cid:16)(cid:15)(cid:18)(cid:25)(cid:18)(cid:21)(cid:20) B E N T P R (cid:27)(cid:27)(cid:27)(cid:3)(cid:13)(cid:16)(cid:24)(cid:25)(cid:2)(cid:19)(cid:12)(cid:20)(cid:12)(cid:17)(cid:16)(cid:19)(cid:16)(cid:20)(cid:25)(cid:2)(cid:22)(cid:23)(cid:12)(cid:14)(cid:25)(cid:18)(cid:14)(cid:16)(cid:3)(cid:14)(cid:21)(cid:19) T A C C U T DORP E CI ITIL® Service Design London: TSO Published by TSO (The Stationery Office) and available from: Online www.tsoshop.co.uk Mail, Telephone, Fax & E-mail TSO PO Box 29, Norwich, NR3 1GN Telephone orders/General enquiries: 0870 600 5522 Fax orders: 0870 600 5533 E-mail: [email protected] Textphone: 0870 240 3701 TSO@Blackwell and other Accredited Agents Customers can also order publications from: TSO Ireland 16 Arthur Street, Belfast BT1 4GD Tel: 028 9023 8451 Fax: 028 9023 5401 © Crown Copyright 2011 This is a Crown copyright value added product, reuse of which requires a Licence from the Cabinet Office Applications to reuse, reproduce or republish material in this publication should be sent to The Efficiency & Reform Group Service Desk, Cabinet Office, Rosebery Court, St Andrews Business Park, Norwich, Norfolk NR7 0HS Tel No: (+44) (0)845 000 4999, E-mail: [email protected] or complete the application form on the Cabinet Office website, Licensing section. Copyright in the typographical arrangement and design is vested in The Stationery Office Limited. Applications for reproduction should be made in writing to The Stationery Office Limited, St Crispins, Duke Street, Norwich, NR3 1PD. The Swirl logo™ is a trade mark of the Cabinet Office ITIL® is a registered trade mark of the Cabinet Office PRINCE2® is a registered trade mark of the Cabinet Office M_o_R® is a registered trade mark of the Cabinet Office P3O® is a registered trade mark of the Cabinet Office MSP® is a registered trade mark of the Cabinet Office MoV™ is a trade mark of the Cabinet Office MoP™ is a trade mark of the Cabinet Office The OGC Official Product endorsement logo™ is a trade mark of the Cabinet Office OGC (former owner of Best Management Practice) and its functions have moved into the Cabinet Office part of HM Government – www.cabinetoffice.gov.uk First edition Crown Copyright 2007 Second edition Crown Copyright 2011 First published 2011 ISBN 9780113313051 Printed in the United Kingdom for The Stationery Office Material is FSC certified and produced using ECF pulp. Sourced from fully sustainable forests. P002425498 c70 07/11 Contents List of figures v 4.5 Capacity management 157 4.6 IT service continuity management 179 List of tables vii 4.7 Information security management 196 Foreword viii 4.8 Supplier management 207 Preface ix 5 Service design technology-related activities 227 Acknowledgements x 5.1 Requirements engineering 229 1 Introduction 1 5.2 Management of data and 1.1 Overview 3 information 239 1.2 Context 5 5.3 Management of applications 244 1.3 ITIL in relation to other publications 6 Organizing for service design 251 in the Best Management Practice 6.1 Organizational development 253 portfolio 7 6.2 Functions 253 1.4 Why is ITIL so successful? 9 6.3 Roles 256 1.5 Chapter summary 9 6.4 Responsibility model – RACI 270 2 Service management as a practice 11 6.5 Competence and training 270 2.1 Services and service management 13 7 Technology considerations 273 2.2 Basic concepts 20 7.1 Service design tools 275 2.3 Governance and management systems 25 7.2 Service management tools 277 2.4 The service lifecycle 28 8 Implementing service design 281 3 Service design principles 33 8.1 Business impact analysis 283 3.1 Service design basics 35 8.2 Service level requirements 283 3.2 Service design goals 44 8.3 Risks to the services and processes 284 3.3 Balanced design 44 8.4 Implementing service design 284 3.4 Identifying service requirements 45 8.5 Measurement of service design 288 3.5 Identifying and documenting business requirements and drivers 47 9 Challenges, risks and critical 3.6 Design activities 48 success factors 291 3.7 Design aspects 49 9.1 Challenges 293 3.8 The subsequent design activities 71 9.2 Risks 294 3.9 Design constraints 72 9.3 Critical success factors and key 3.10 Service-oriented architecture 73 performance indicators 294 3.11 Service design models 74 Afterword 297 3.12 Service design inputs and outputs 82 Appendix A: The service design package 301 4 Service design processes 83 Appendix B: Service acceptance criteria 307 4.1 Design coordination 86 4.2 Service catalogue management 97 4.3 Service level management 106 4.4 Availability management 125 iv | Contents Appendix C: Process documentation Appendix K: Typical contents of a template 311 recovery plan 351 C.1 Process framework 313 K.1 Generic recovery plan 353 K.2 Supporting information 354 Appendix D: Design and planning documents and their contents 315 K.3 Recovery procedure 356 D.1 Design and architectural documents Appendix L: Procurement documents 357 and standards 317 Appendix M: Risk assessment and D.2 IT plans 317 management 361 Appendix E: Environmental M.1 Definition of risk and risk architectures and standards 319 management 363 Appendix F: Sample service level M.2 Management of Risk (M_o_R) 363 agreement and operational M.3 ISO 31000 364 level agreement 325 M.4 ISO/IEC 27001 365 F.1 Sample service level agreement 327 M.5 Risk IT 366 F.2 Sample operational level agreement 330 Appendix N: Related guidance 369 Appendix G: Service catalogue example 333 N.1 ITIL guidance and web services 371 Appendix H: The service management N.2 Quality management system 371 process maturity framework 337 N.3 Risk management 372 H.1 Initial (level 1) 339 N.4 Governance of IT 372 H.2 Repeatable (level 2) 339 N.5 COBIT 372 H.3 Defined (level 3) 340 N.6 ISO/IEC 20000 service management series 373 H.4 Managed (level 4) 341 N.7 Environmental management and H.5 Optimizing (level 5) 341 green/sustainable IT 373 Appendix I: Example of the contents N.8 ISO standards and publications for IT 374 of a statement of requirements N.9 ITIL and the OSI framework 374 and/or invitation to tender 343 N.10 Programme and project management 375 Appendix J: Typical contents of a N.11 Organizational change 375 capacity plan 347 N.12 Skills Framework for the Information J.1 Introduction 349 Age 376 J.2 Management summary 349 N.13 Carnegie Mellon: CMMI and eSCM framework 376 J.3 Business scenarios 349 N.14 Balanced scorecard 376 J.4 Scope and terms of reference of the plan 349 N.15 Six Sigma 377 J.5 Methods used 349 Appendix O: Examples of inputs and J.6 Assumptions made 349 outputs across the service lifecycle 379 J.7 Service summary 349 Abbreviations and glossary 383 J.8 Resource summary 350 J.9 Options for service improvement 350 Index 429 J.10 Costs forecast 350 J.11 Recommendations 350 List of figures Figure 1.1 The ITIL service lifecycle 3 Figure 3.14 Design constraints driven by strategy 72 Figure 1.2 ITIL’s relationship with other Best Figure 3.15 External influences on solution Management Practice guides 8 design 73 Figure 2.1 Conversation about the definition Figure 4.1 Service design – the big picture 85 and meaning of services 14 Figure 4.2 Design coordination activities 90 Figure 2.2 Logic of value creation through Figure 4.3 Types of service in a service services 18 catalogue 100 Figure 2.3 Sources of service management Figure 4.4 A two-view service catalogue 102 practice 19 Figure 4.5 A three-view service catalogue 103 Figure 2.4 Examples of capabilities and resources 21 Figure 4.6 The service level management process 110 Figure 2.5 Process model 21 Figure 4.7 Multi-level SLAs 111 Figure 2.6 The service portfolio and its contents 24 Figure 4.8 Availability terms and measurements 130 Figure 2.7 Architectural layers of an SKMS 26 Figure 4.9 The availability management Figure 2.8 Plan-Do-Check-Act cycle 27 process 131 Figure 2.9 Integration across the service Figure 4.10 The expanded incident lifecycle 136 lifecycle 30 Figure 4.11 The structured approach to SFA 139 Figure 2.10 Continual service improvement and the service lifecycle 31 Figure 4.12 Relationship between levels of availability and overall costs 142 Figure 3.1 The business change process 36 Figure 4.13 Component failure impact analysis 146 Figure 3.2 Scope of service design 37 Figure 4.14 Fault tree analysis – example 148 Figure 3.3 The four Ps 40 Figure 4.15 Risk assessment and management 149 Figure 3.4 Service composition 41 Figure 4.16 Capacity management Figure 3.5 The IT steering/strategy group 43 sub-processes 162 Figure 3.6 Project elements in a triangulated Figure 4.17 Capacity management overview relationship 45 with sub-processes 163 Figure 3.7 The service relationships and Figure 4.18 Capacity must support business dependencies 46 requirements 164 Figure 3.8 Aligning new services to business Figure 4.19 Capacity management takes requirements 50 particular note of demand pattern 164 Figure 3.9 Enterprise architecture 56 Figure 4.20 Ongoing iterative activities of Figure 3.10 Architectural relationships 58 capacity management 168 Figure 3.11 Integrated business-driven Figure 4.21 Lifecycle of IT service continuity technology management 62 management 181 Figure 3.12 Change management example: Figure 4.22 Graphical representation of change authorization model 67 business impacts 184 Figure 3.13 The metrics tree 70 vi | List of figures Figure 4.23 Elements of an ISMS for managing IT security 199 Figure 4.24 Information security management process 202 Figure 4.25 Security controls for threats and incidents 203 Figure 4.26 Supplier management – roles and interfaces 209 Figure 4.27 Supplier management process 214 Figure 4.28 Supplier categorization 216 Figure 5.1 Requirements – workshop techniques 232 Figure 6.1 Example of a service design organization structure for a small organization 255 Figure 6.2 Example of a service design organization structure for a large organization 256 Figure 7.1 Service management tool evaluation process 279 Figure 8.1 Implementation/continual service improvement approach 285 Figure 8.2 Cultural maturity assessment 286 Figure 8.3 Process maturity framework 287 Figure M.1 The M_o_R framework 364 Figure M.2 ISO 31000 risk management process flow 365 Figure M.3 ISACA Risk IT process framework 367 List of tables Table 2.1 The processes described in each core Table G.1 Service catalogue example 339 ITIL publication 29 Table H.1 PMF level 1: initial 340 Table 3.1 Enterprise architecture frameworks 57 Table H.2 PMF Level 2: repeatable 340 Table 3.2 An example of a simple RACI matrix 65 Table H.3 PMF Level 3: defined 340 Table 3.3 RACI matrix – sample change Table H.4 PMF level 4: managed 341 management authority matrix based on authorization procedure 68 Table H.5 PMF level 5: optimizing 341 Table 3.4 Main sourcing structures (delivery Table L.1 Procurement documents 359 strategies) 75 Table 3.5 Advantages and disadvantages of sourcing structures (delivery strategies) 77 Table 3.6 Comparison between conventional (‘waterfall’) and RAD approaches 80 Table 3.7 Service design inputs and outputs by lifecycle stage 81 Table 4.1 CSI approach for design coordination implementation 88 Table 4.2 Examples of risks and threats 186 Table 4.3 Example set of recovery options 189 Table 5.1 Requirements engineering – tacit and explicit knowledge 236 Table 5.2 Requirements engineering: examples of explicit and tacit knowledge 236 Table 5.3 Requirements template 237 Table 5.4 Examples of application portfolio attributes 245 Table A.1 Contents of the service design package 303 Table B.1 Examples of service acceptance criteria 309 Table E.1 Building/site 321 Table E.2 Major equipment room 321 Table E.3 Major data centres 322 Table E.4 Regional data centres and major equipment centres 323 Table E.5 Server or network equipment rooms 324 Table E.6 Office environments 324 Foreword Back in the 1980s no one truly understood IT There is an associated qualification scheme so that service management (ITSM), although it was clear individuals can demonstrate their understanding that it was a concept that needed to be explored. and application of the ITIL practices. So whether Hence a UK government initiative was instigated you are starting out or continuing along the ITIL and ITIL® was born. Over the years, ITIL has evolved path, you are joining a legion of individuals and and, arguably, is now the most widely adopted organizations who have recognized the benefits of approach in ITSM. good-quality service and have a genuine resolve to improve their service level provision. It is globally recognized as the best-practice framework. ITIL’s universal appeal is that it ITIL is not a panacea to all problems. It is, however, continues to provide a set of processes and a tried and tested approach that has been proven procedures that are efficient, reliable and to work. adaptable to organizations of all sizes, enabling I wish you every success in your service them to improve their own service provision. management journey. In the modern world the concept of having a strategy to drive the business forward with adequate planning and design transitioning into Frances Scarff day-to-day operation is compelling. Once the Head of Best Management Practice business has decided the IT service strategy, it Cabinet Office is necessary to design services that are capable of meeting the agreed requirements. Knowing the direction that you are travelling is of vital importance but meaningless unless you confirm (design) the mode of travel. This publication shows you how to ensure that the strategic vision set out in service strategy can be achieved and explains the processes and procedures that will enable you to do this. The principles contained within ITIL Service Design have been proven countless times in the real world. We encourage feedback from business and the ITSM community, as well as other experts in the field, to ensure that ITIL remains relevant. This practice of continual service improvement is one of the cornerstones of the ITIL framework and the fruits of this labour are here before you in this updated edition. Preface ‘Quality in a product or service is not what the All IT service providers, whether internal or supplier puts in. It is what the customer gets out external, are part of a value network and fill a and is willing to pay for.’ Peter Drucker critical role in the service lifecycle by integrating best practices for service design and the service This is the second book in the series of five ITIL lifecycle into innovative services for the business core publications containing advice and guidance customer. ITIL Service Design provides the around the activities and processes associated with knowledge and skills required to assemble the best the five stages of the service lifecycle. The primary combination of service assets to produce effective, purpose of the service design stage of the service measurable, scalable and innovative services lifecycle is to design service solutions that meet the that can be used along the path towards service current and future needs of the business. Therefore excellence. the accurate identification, documentation and agreement of customer and business requirements Any IT service provider who is expected to are fundamental to the production of good service deliver quality to the business customer must solution designs. have the capability to design services that meet the customer’s expectations, and then go on to Service design takes the outputs from service exceed those expectations. The guidance in this strategy, the preceding stage of the service publication will help organizations to do just that. lifecycle, and uses them to ensure that the solution designs produced are consistent with the overall Contact information IT service provider strategy. The trigger for this design activity is the production of a change Full details of the range of material published proposal for a new business requirement by the under the ITIL banner can be found at: activities within the service strategy stage of the www.best-management-practice.com/IT-Service- lifecycle. Service design takes this new business Management-ITIL/ requirement and, using the five aspects of design, If you would like to inform us of any changes that creates services and their supporting practices that may be required to this publication, please log meet business demands for functionality, security, them at: performance, reliability and flexibility. Service design produces a service design package (SDP) www.best-management-practice.com/changelog/ that enables the build, test and release activities of For further information on qualifications and service transition, and the operation, support and training accreditation, please visit improvement activities of service operation and continual service improvement to occur. www.itil-officialsite.com Services are assets that deliver value to the Alternatively, please contact: business, the customers and their assets as they APM Group – The Accreditor Service Desk are used within their business processes. How well Sword House services are designed with the customers’ needs Totteridge Road and assets in mind will predict the value that can High Wycombe be derived from the delivery and operation of the Buckinghamshire services. In the absence of service design, services HP13 6DG will evolve informally, often without taking full UK account of the business needs and overall view. Tel: +44 (0) 1494 458948 Email: [email protected]