IT Governance – Leveraging ITIL® v2/v3 for Governance Success Greg Charles, Ph.D. VP and Senior Advisor, Global Customer Success Group Western U.S. ITIL, Governance & Best Practices Lead CA, Inc. May 2008

Governance Compliance IT Governance Defined as: The management of risk & compliance. “The overall methodology by which IT is directed, administered and controlled” Governance Compliance April 16, 2017 Copyright © 2008 CA

Three Pillars of IT Governance April 16, 2017 Copyright © 2008 CA

Managing Ever-Increasing Complexity April 16, 2017 Copyright © 2008 CA

The Business World View Black Box SAP Identity Manager PSFT Siebel Network Load Balancer Firewall Portal Mainframe Router Switch Database Web Servers Applications End User Web Services Databases 3rd Party applications April 16, 2017 Copyright © 2008 CA

The Cruel Reality Source: Gartner Screen Scrape Message Queue Sockets Download File Transaction ORB CICS Gateway APPC RPC Sockets Application Source: Gartner April 16, 2017 Copyright © 2008 CA

Addressing These Challenges: Improving Engagement and Efficiency WHAT IS ENGAGEMENT? Doing the Right Things WHAT IS EFFICIENCY? Doing Things Right IT’s ability to partner with the business to maintain alignment and maximize return from IT investments IT’s ability to make the best use of its people, budgets and assets April 16, 2017 Copyright © 2008 CA

Obstacles Prevent Effective Engagement $ $ $ Overwhelming Demand: Unstructured capture of requests and ideas No formal process for prioritization and trade-offs Reactive vs. proactive IT and Biz Divide Business thinks in IT services – IT delivers in technology terms Costs disassociated with services IT Seen as Black Box: Business lacks visibility Poor customer satisfaction April 16, 2017 Copyright © 2008 CA

Disparate Systems Reduce Efficiency No Single System of Record for Decision-Making IT Management systems siloed Relevant Metrics Hard to Obtain Disparate Systems Costly to Maintain and Upgrade April 16, 2017 Copyright © 2008 CA

IT Governance Landscape April 16, 2017 Copyright © 2008 CA

How to Improve Engagement? Structured IT Governance Process Integrated Demand Management Capture, catalog, and prioritize all demand Manage service requests from help desks Match resources to highest-value initiatives Comprehensive Portfolio Management Services, projects, assets, applications Systematic evaluation and prioritization Map controls to compliance requirements 100% visibility into strategic initiatives A single invoice to the customer for all services Business Intelligence for the BRM Visibility into all services that support LOB Detailed cost invoices April 16, 2017 Copyright © 2008 CA

How to Improve Efficiency? Comprehensive Management Empower the PMO Automate, enforce, and report on process compliance World-Class Project Execution Leverage best practices across entire project portfolio Rapid time to value Comprehensive Resource Management Drive maximum utilization of in-house and outsourced resources Capture time and allocate staff for any type of investment Advance Resource Mgmt capabilities Scalable, Transparent Status Capture Capture time and cost of all activities in a single repository for charge-backs and reporting Capture asset costs through integration with Asset Management Solution April 16, 2017 Copyright © 2008 CA

Approaches Currently In Use Business As Usual - “Firefighting” Legislation - “Forced” Best Practice Focused April 16, 2017 Copyright © 2008 CA

Best Practices Quality & Control Models ISO 900x COBIT® TQM EFQM Six Sigma COSO Deming etc.. Process Frameworks ITIL® Application Service Library Gartner CSD IBM Processes EDS Digital Workflow Microsoft MOF Telecom Ops Map etc.. •What is not defined cannot be controlled •What is not controlled cannot be measured •What is not measured cannot be improved April 16, 2017 Copyright © 2008 CA

ITIL® v2 to v3 Introduction to ITIL Planning To Implement Service Management Service Management Service Support Delivery T h e B u s i n The Business Perspective Application Management ICT Infrastructure Management T e c h n o l o g y Security Management Introduction to ITIL Software Asset Management Small-Scale Implementation April 16, 2017 Copyright © 2008 CA

ITIL® v2 Service Support Model The Business, Customers or Users Monitoring Tools Difficulties Queries Enquiries Communications Updates Work-arounds Incidents Incidents Service Desk Customer Survey reports Changes Incident Management Customer Survey reports Problem Management Releases Service reports Incident statistics Audit reports Change Management Problem statistics Problem reports Problem reviews Diagnostic aids Audit reports Change schedule CAB minutes Change statistics Change reviews Audit reports Release Management Release schedule Release statistics Release reviews Secure library’ Testing standards Audit reports Configuration Management CMDB reports CMDB statistics Policy standards Audit reports Problems Known Errors Cls Relationships Incidents Changes Releases CMDB April 16, 2017 Copyright © 2008 CA

ITIL® V2 Service Delivery Model Business, Customers and Users Queries Enquiries Communications Updates Reports Availability Management Service Level Management Availability plan AMDB Design criteria Targets/Thresholds Reports Audit reports Capacity Management SLAs, SLRs OLAs Service reports Service catalogue SIP Exception reports Audit reports Requirements Targets Achievements Capacity plan CDV Targets/thresholds Capacity reports Schedules Audit reports Financial Management For IT Services Financial plan Types and models Costs and charges Reports Budgets and forecasts Audit reports IT Service Continuity Management IT continuity plans BIS and risk analysis Requirements defined Control centers DR contracts Reports Audit reports Management Tools Alerts and Exceptions Changes April 16, 2017 Copyright © 2008 CA

IT Governance and ITIL® Version 3 April 16, 2017 Copyright © 2008 CA

Service Strategies Service Strategy Process Strategy Generation  IT Financial Management  Service Portfolio Management  Demand Management Organizational Development & Design Implementing Service Strategy April 16, 2017 Copyright © 2008 CA

Service Design Service Management Blueprint Service Design Principles Service Design Process Service Portfolio Design Service Catalogue Mgmt Service Level Mgmt Capacity Mgmt Availability Mgmt Service Continuity Mgmt Information Security Mgmt Supplier Mgmt Service Design Technology Service Design Implementation April 16, 2017 Copyright © 2008 CA

Service Transition Service Transition Principles Service Transition Process Change Management Service Asset & Configuration Mgmt Knowledge Management Service Release Planning Performance and Risk evaluation Acquire Assets, Build and Test Release Service Release Acceptance Test and Pilot Deployment, Decommission and Transfer April 16, 2017 Copyright © 2008 CA

Service Operation Service Operation Principles Service Operation Process Event Management Incident Management Request Fulfillment Problem Management Access Management Common Service Operation Activities IT Operations (Console, Job Scheduling etc.) Mainframe Support Server Mgmt and Support Desktop Support, Middleware Mgmt, Internet/Web Mgmt Application Mgmt Activities IT Security Organization Service Operation Service Desk Technical Management IT Operations Management Application Management Service Design Implementation April 16, 2017 Copyright © 2008 CA

Continual Service Improvement Continual Service Improvement Principles Continual Service Improvement Process Measurement and Control Service Measurement Service Assessment and Analysis Service Level Management Organizing for Service Continual Improvement April 16, 2017 Copyright © 2008 CA

The Business / Customers Requirements IT Governance (Demand, Risk & Control, Service Portfolio, Project Financial Mgmt, Business Relationship Mgmt, and Process Management) Service Strategy Strategies Policies Resource and constraints Objectives from Requirements Service Design Solution Designs Architectures Standards SDPs Improvement actions & plans Continual Service IT Governance (New Product Development, Project Mgmt, Resource Mgmt, Financial Mgmt, and Demand Mgmt) Service Transition Transition Plans Tested solutions SMKS Service Catalogue Service Portfolio IT Governance (Demand, Resource, Process Mgmt, and Project Mgmt) IT Governance (Resource Mgmt, Project Mgmt, and Process Management) Service Operation Operational services Operational Plans IT Governance (Process Mgmt, Project Mgmt, and Bus Relationship Mgmt) April 16, 2017 Copyright © 2008 CA

US Securities & Exchange Commission IT Governance Model COBIT® Sarbanes- Oxley US Securities & Exchange Commission Audit Models COSO Service Mgmt. App. Dev. (SDLC) Project Mgmt. IT Planning IT Security Quality System Quality Systems & Mgmt. Frameworks ISO CMMi Six Sigma ITIL® BS 15000 ISO 20000 ASL ISO 17799 PMI PMBOK PRINCE2 TSO IS Strategy IT OPERATIONS April 16, 2017 Copyright © 2008 CA

COBIT® (Control Objectives for IT) Focused on IT Standards and Audit, COBIT® is jointly “owned/maintained” by ITGI and ISACA (Information Systems Audit and Control Association) Based on over 40 International standards Supported by over 150 IT Governance Chapters www.itgi.org www.isaca.org Best Practices: Industry and CA best practices are applied to all of our solutions to maximize standardization and quality April 16, 2017 Copyright © 2008 CA

The COBIT® Cube 4 Domains 34 Processes 318 Control Objectives (Business Requirements) 4 Domains 34 Processes 318 Control Objectives ____ 215 in COBIT® 4.0 April 16, 2017 Copyright © 2008 CA

Acquisition & Implementation COBIT® Domains - Summary Acquisition & Implementation (AI Process Domain) Planning & Organization (PO Process Domain) Monitoring (M Process Domain) Delivery & Support (DS Process Domain) April 16, 2017 Copyright © 2008 CA

Theory – ITIL® / COBIT® / etc. Technology – CA and others How to Make IT a Reality? Key Success Factors Theory – ITIL® / COBIT® / etc. Process Guidelines for Best Practices Provides the theory but not always defines the process Education is an important component Convert theory to process that is applicable to the unique needs of the organization Training & Education Tool configuration Technology – CA and others Provide the technology that enables & automates the process Repeatability, compliance & notifications Implement processes impossible without technology April 16, 2017 Copyright © 2008 CA

Making IT Easier Customer maturity isolates appropriate transition point, blueprint & ROI April 16, 2017 Copyright © 2008 CA

Tools to Aid Success Maturity Model Solution Sheets Transitional Maturity ROI Tool Process Model Assessments Profilers Blueprints April 16, 2017 Copyright © 2008 CA

Governance: Meeting Customer Needs Leveraging Best Practices ITIL®, COBIT®, COSO, ITAM, ITSM, Six Sigma, etc. Best Practices: Industry and CA best practices are applied to all of our solutions to maximize standardization and quality April 16, 2017 Copyright © 2008 CA

The Result Business-IT Integration April 16, 2017 Copyright © 2008 CA

IT Governance – Leveraging ITIL® v2/v3 for Governance Success Greg Charles, Ph.D. VP and Senior Advisor, Western U.S. ITIL, Governance & Best Practices Lead, Global Customer Success Group CA, Inc. May 2008