Building up an IT Service Management System through the ISO 20000 Certification

This process of obtaining certification requires the following actions: analyze the current status and cases of NDSL service management system based on SOP, establish plans to apply the analysis results, establish an improved NDSL service management system based on ISO 20000, establish ISO 20000/9001/10002 application strategies and implementation plans, and distribute roles for settling down ISO 20000-based NDSL service management system among organizations.

Furthermore, other important steps in this process include: conduct education and training for NDSL service operating personnel, including the overview of IT service management, ISO 20000 framework, understanding of the requirements of the ISO 20000 standard, the internal auditor training, and the maintenance of ISO 9001/ISO 10002 certification, build up ISO 20000 processes (support and core processes) by establishing and operating an ISO management system for NDSL services, upgrade ISO 10002 operating system, and monitor, verify, internally audit, and take corrective actions for the management system.

First, consult regarding the ISO 20000 standards and certification information, to establish and implement a system that meets the requirements of the standard.

Second, apply for certification. Though varying between certification agencies, the documents required for application generally include an application form, questionnaire, and contract. As there are certain requirements to be met for applying for certification, an application may be rejected if the requirements were not met.

Third, a preliminary screening is performed before regular review for the following purposes: to understand the company's operation and the subject or service to be reviewed, and to shorten the screening period accordingly and substantiate of the screening program, to check the applicant's preparation and to save the applicant's cost and efforts and the reviewer’s time by rejecting inadequate applications, and to provide the reviewed with opportunities to correctly understand and practice the standards. The preliminary examination focuses on verifying whether the quality system is substantially operating.

Fourth, the documentary review plays an important part in the quality system certification system, unlike in the general product certification system. As the concept of system certification system scheme is for a company to prove through third parties whether it documents and maintains all aspects of its products and/or services and complies with its quality standards, a service manual that describes all aspects of the system can be considered similar to a constitution of a country. In addition, at the time of quality manual review, related procedures or guidelines may be requested in order to avoid unnecessary delay in the screening that may occur if a reviewer does not understand the system properly.

Fifth, on-site examination is scheduled between the applicant and the certification authority when it is verified that the applicant’s quality system conforms to the requirements of the international standard (ISO 20000) quality system.

Sixth, the certificate is issued when no nonconformity is found in all the reviews and examinations or when all the detected nonconformities are resolved. The certification expires usually in three years, after which it can be renewed through recertification examination or through follow-up examination without recertification examination.

Seventh, the follow-up examination is conducted to make sure that the system is still effective and continually improved.

This process defines the risk assessment conducted for the purpose of ensuring the availability and continuity of the information system by assessing the risk of services through the information system or its assets, and accordingly establishing and applying proper risk mitigation measures for the corresponding risk.

Major process steps include identifying the information assets, evaluating their value, assessing their risks, and the follow-up management. The identification activity is to identify the information assets related to NDSL services. The evaluation activity is to identify the importance and characteristics of the information assets, and evaluate their value based on their confidentiality, integrity and availability. Next, the risk assessment activity is to understand the risk, which has a potential and major impact on the asset, and to analyze its likelihood and its impact on the information asset. Lastly, the follow-up management is to decide DOA based on the evaluation result and take proper improvement measures for DOA items.

This process aims at defining services to be provided, determining the target level for the defined services, managing the services to achieve the target level, and maintaining and improving the quality of IT services at the determined or higher level.

Major process steps: First, prepare SLAs through service catalog preparation, management object selection, understanding the current capability level and defining the service level, and to consult with the client about them. Second, monitor and report the service level. This activity is to monitor the services based on the determined SLAs, to collect reliable data, prepare the monthly service level report, to conduct the service review meeting based on the prepared SLA report to evaluate the service level, and collect the customer’s opinions about the service. Last, improve the services. This step is intended to identify matters that may adversely affect service quality, to take measures to improve those matters, and to reflect the SLASs redefined through this activity in the service level management after consultation with the client.

This process is to understand a proper level of availability of NDSL services and to continuously monitor their availability to ensure the availability target agreed with the client. It also includes proper improvement activities, to achieve the agreed availability target.

Major process steps: Availability planning sets the target value for service availability to maximize the availability of IT services and meet the business needs, and to establish the management plan. Next, availability data monitoring and report checks whether the established availability level is met, to conduct the maintenance activities predefined according to the availability management plan, and to report the results. Lastly, availability improvement implements the availability improvement plans established at the time of setting the target for improving the system and service availability, and to implement the improvement plans if, as a result of regular analysis, it deems necessary to improve the availability. If there is no need for availability improvement, regular analysis shall be conducted based on the collected information.

This SOP aims at prompt recovery and improvement to achieve the continuity target defined for the level of NDSL services. When a disaster happens, the level of service continuity agreed with the client shall be guaranteed through prompt response and recovery activities. Also, even when normal access is blocked, the service continuity plan, the emergency contact network, and the configuration management database shall be available.

Major process steps: Planning establishes improvement plans by carrying out performance tests for the service continuity and analyzing and reviewing the matters found necessary to be improved as a result of the test. Performance testing carries out tests according to the performance test plan, analyzes the results, prepares the report, and establishes improvement plans based on the analysis results. Lastly, emergency recovery recovers the system and services according to the service recovery procedure using backup files, and resumes normal services.

This process aims at managing the budget and accounting activities for IT services provided by the Information Service Center. The IT financial management refers to the budget and accounting activities required for providing IT services. Namely, it is the budgeting and accounting for all elements of the IT services such as IT assets, shared resources, overhead, services provided by the outside suppliers, workforce, insurance, and licenses.

Major process steps: Budgeting establishes a plan for the expenses required for providing IT services and seeks its approval. Budget execution and accounting monitors the difference between the budget and the actual expenses spent for the business, and identifies the cause of any difference.

This process is to ensure that the business requirements for the current and future capacity and performance will be cost-effectively provided, by predicting future business requirements and continuously monitoring and improving the system resources. It includes monitoring the performance and capacity of IT services and of IT elements that support those services, understanding the current demand for the IT resources, and predicting future needs. It also includes managing the demand for resources and establishing the capacity management plan to estimate required IT resources, in relation with other service management processes.

Major process steps: Capacity planning ensures that the current and future business requirements for IT services are properly reviewed and the capacity sufficient for supporting those services are planned and implemented in a timely manner. Monitoring and analysis monitors the management items defined to meet the target service rate, derives matters to be improved through the capacity trend analysis and regular analysis of accumulated data, and estimates the capacity of new services by reviewing and modeling new technology application plans for the new services. Lastly, the improvement task establishes the required capacity improvement plan, and reviews the progress and result of the plan.

This process is to provide stable information system services by protecting tangible and intangible assets such as hardware, software, operation personnel, management system, and management policies. It includes establishing the standardized policy and procedures for the information system security, blocking unauthorized access to the communication network to ensure data security, and controlling the access to the facilities and unauthorized access by trespassers.

Major process steps: Establishing the information security policy defines the objects of information security for the related IT services and technology infrastructure, assesses the potential risks, and documents the information security policies/guidelines to comply with the customer security policy and guidelines. Operation of the information security education defines the objects of security education, the education plan, and main contents of the security education, and the security accident investigation and countermeasures inspect and audit the information security and define countermeasures against the security violation. Lastly, the follow-up management step establishes plans to improve the problems identified during the information security operation and defines the actions to be taken to implement the plans.

This process aims at improving the reliability of the Information Service Center by promptly and accurately resolving customer complaints about NDSL, and reducing and preventing future complaints from arising by improving the quality of administrative services.

Major process steps: Voice of Customer (VOC) reception and identification process describes how to receive, process and identify the customer complaints. VOC handling describes the procedure for investigating causes of the complaints, reviewing the complaints and establishing countermeasures against the complaints. VOC follow-up management is to manage the records about VOC handling and to analyze VOCs regularly. Lastly, customer satisfaction monitoring checks the validity of the corrective measures taken and conducts post-management.

This process is to ensure the NDSL information system operates efficiently, by maintaining a seamless relationship with suppliers who supply and maintain all hardware, packages, and development software required for providing NDSL services. This process requires the service provider and the suppliers to understand their own responsibilities and duties, the service provider to manage the suppliers so as to ensure stable provision of high-quality services, and the service providers to be committed to their responsibilities to the service provider.

Major process steps: Defining the requirements defines the product requirements for IT infrastructure, taking into consideration the market trend, customer demands, SLAs and availability requirements, and selects suitable products. Supplier selection reviews the criteria for selecting the suppliers based on the defined requirements, evaluates/selects the suppliers, and enters into contracts with them through internal approval. Delivery and operation support the delivery/installation after the adaptation test is completed according to the contracts, and monitor whether the contract terms including product performance and maintenance are fulfilled. Lastly, follow-up management ensures that the service provider shall carry out the operation management after the contract period ends and have the suppliers promptly correct the errors arising during the operation management.

This process is to minimize the impact of various incidents arising from NDSL services, by effectively handling them, systematically managing the results, and therefore recovering normal service functions as soon as possible. In this process, the priority of an incident to be handled is determined based on the level of its impact on the services, with the focus on prompt service recovery rather than on identification of the causes. The faults for which causes remain unidentified shall be transferred to the fault management process, and all incidents shall be recorded in compliance with this process.

Major process steps: Reception and recording register all incidents reported to the service desk by phone or e-mail, including those detected through the operator's inspection and monitoring activities. Classification and initial support classify the received incidents based on the defined criteria, and carry out initial actions after comparing them with the records about the previous incident handling and the known errors. Investigation and diagnosis investigate the incident to ensure prompt service recovery and suggest a fundamental or a tentative solution. Resolution and recovery resolve the incident according to the derived solution, and restore service to normal conditions. Lastly, closing and follow-up management close the incident, notify the customer of the resolution, and confirm with the customer that normal service has been restored.

This process is to suggest solutions to the faults for which causes have not been identified, among those arising during the service operation, and to provide the procedure required for fault analysis and prevention. It shall be managed separately from the incident management process. All identified faults should be recorded, and potential faults should be reduced through prevention activities. The fault management process shall also include known-error management and management of the suggested solutions.

Major process steps: Reception and registration receive the request for handling a fault as the fault is identified, register it to the fault DB, determine its priority, and assign a person in charge. Cause analysis analyzes the fundamental cause of the fault and derives a solution. Lastly, the sharing and closing step registers the derived solution to the DB and shares it.

This process aims at managing and controlling each component of the NDSL system to ensure effective and efficient NDSL services. It involves checking, recording, and reporting all components within the scope of configuration management, to ensure efficient management of the components and provision of accurate information about them.

Major process steps: Establishing the configuration management plan defines and plans the goal, objectives, scope, policies, procedures, and technical situations for configuration management. Configuration control ensures that only the approved and identifiable components are managed through the configuration control and reflected in the configuration management database. In this controlled environment, no components without an official document like approved change request can be added, modified, replaced, or removed. Lastly, configuration audit and improvement checks whether each component is actually present in the system, and continuously reviews and audits whether it is correctly recorded in the configuration management database.

This process is to continuously improve the information system operation by efficiently and promptly handling all changes according to the standardized methods and procedures and thus minimizing the impacts of the changes on the service quality. It includes clearly defining and documenting the changes of services and infrastructure, recording and classifying all change requests, evaluating risks, impacts and business benefits, reviewing actions taken to make changes happen and those taken after the changes are implemented, and utilizing the review results as the basis of release scheduling.

Major process steps: Change request reception receives change requests after clarifying the details of the change requests. Change review and classification classifies the types of the change requests and reviews their content. Performing the change notifies the related personnel/organization of the change plan and performs the change. Follow-up management checks the validity of corrective actions taken and performs the post-management.

This process is to protect the IT operation environment and the IT services by releasing and verifying the hardware and the related software required for completing the changes to IT environment, under the release manager's control. It involves identifying the roles and responsibilities of the release manager and the person in charge of each step, defining the release policy, installing the hardware/software according to the release type, and devising recovery plans and test methods.

Major process steps: Release planning defines the objects to be released, establishes release plans, and requests for the release. Releasing reviews and approves the release plan, and performs the change. Release verification prepares the checklist for verifying the release and verifies the validity of the change/release. Lastly, follow-up management checks the validity of the corrective actions taken and performs the post-management.