T He Practical Impact Of ITIL 4 - ItSMF

Transcription

White PaperThe Practical Impact of ITIL 4The new practices

ContentIntro3The practical impact of ITIL 4’s changes4 Changes introduced by the ITIL 4 practices5Suggestions for commonly adopted processes/practices5Suggestions for less commonly adopted processes/practices9Suggestions from new processes/practices13The authors17

IntroSince the first ITIL 4 publication became available, much has been talked and writtenabout it. Most of this has been about explaining the new terms introduced in ITIL 4, suchas the “service value chain” and the “ITIL 4 management practices.” For adopters of theprevious ITIL v3/2011 version, these explanations might seem nebulous. It seems unclearwhat practical tips ITIL 4 has to offer for IT organizations that want to improve businessperformance and outcomes by increasing their level of IT service management (ITSM)maturity.This white paper series now helps to shed some light on this. The first white paperexplained the new ITIL 4 concepts. This second white paper focuses on the practicalimpact of the different ITIL 4 practices. It is intended to give the reader a quick overviewof relevant content without having to read the 34 PDF documents, some of which areextensive. It explains for each of the practices if there are any substantial changes compared to ITIL v3/2011 and why ITIL v3 experts should evaluate the practice inmore detail. It also explains how the transition from ITIL v3/2011 to ITIL 4 can be done.White Paper The Practical Impact of ITIL 43

The practical impact ofITIL 4’s changesThe obvious impact of ITIL 4 adoption on organizations is the need to think holistically – in terms of their ITSM capability asa whole, not just the processes. Plus, bringing in the concept of value co-creation and how each of your organization’sadopted ITIL processes/practices lead to better business outcomes. At a more detailed level, there are many potentialimpacts to consider within the 34 ITIL 4 Management Practice documents.Fig. 1: The 34 ITIL 4 management practicesGeneral managementpracticesArchitecture management Continual improvement(ITIL v3/2011: continual serviceimprovement)Information security managementKnowledge managementMeasurement and reportingOrganizational change management Portfolio management(Service portfolio management)Project management Relationship management(ITIL v3/2011: business relationshipService managementpracticesAvailability managementBusiness analysis Capacity and performancemanagement(ITIL v3/2011: capacity management) Change enablement(ITIL v3/2011: change management)(ITIL v3/2011: strategy managementfor IT services)Supplier management Workforce and talent management Infrastructure and platformmanagement Software development andmanagementmanagement)* Monitoring and event management(ITIL v3/2011: event management) Release management Strategy managementdeployment management)(Service asset and configurationRisk managementfor IT services)(ITIL v3/2011: release and IT asset managementProblem management(ITIL v3/2011: financial management Deployment managementIncident managementmanagement) Service financial managementTechnical managementpractices(ITIL v3/2011: release anddeployment management)Service catalog management Service configuration management(ITIL v3/2011: service asset and configuration management)new name change or splitunchanged naming unchanged namingbut content changes Service continuity management(IT service continuity management) Service design(ITIL v3/2011: design coordination) Service desk(Was an ITIL v3/2011 function)Source: AXELOS, „ITIL Foundation:ITIL 4 Edition“ (2019)Service level management Service request management(ITIL v3/2011: request fulfilment)Service validation and testingWhite Paper The Practical Impact of ITIL 44

Changes introducedby the ITIL 4 practicesSuggestions for commonly adopted processes/practicesFirst, there are the changes and additions to the commonly adopted processes/practices –these are changes to the capabilities that are already in place in most organizations. A goodexample of this is the inclusion of swarming in incident management. This type of changeoffers organizations the opportunity to question the status quo and whether the additionsto ITIL 4 will be beneficial to them.So, it’s important to fully understand what’s new in ITIL 4 – within each of your organization’sexisting processes/practices – and how any changes should affect the status quo (if at all).Then, decide on how best to progress with any improvement-based change – from pilotingswarming or machine-learning-based triage capabilities, say, for certain types of incident topotentially taking a “big bang” approach for the adoption of lower-risk changed capabilities.To help, an overview of the key changes to commonly adopted practices is shown below.These key changes are, of course, in addition to ITIL 4’s new focus on value creation andthe elevation from ITSM processes to practices.01 Change enablement02 Continual improvementThis practice contains new content onThis practice contains new content onDevOps Continual improvement applying to organization,Change automationprocesses, technologiesChange-related rolesContinual improvement actions Continual improvement cultureThe change in name recognizes that change management in many organizations relates to people, notThe name has changed from “continual service improve-technology change. There are many other differencesment” to encourage the improvement of more than justto appreciate too. In particular, related to the needs ofservices – because improvement could equally apply tomodern organizations – such as the necessity forthe organizational structure, practices/processes, andgreater agility – and how DevOps impacts ITIL’semployed technologies. Further the ITIL continualtraditional view of change management, including theimprovement process now has an additional step. Thisuse of automation whenever possible.is “take action.” It places a greater focus on the needto do something to elicit real improvement. The newAnother important change is that ITIL 4 talks toguidance also emphasizes that continual improvementproduct-focused organizations not having job titles andis more than simply a process and associated roles. Thatroles related to change enablement because it’sthere’s instead a need for a culture of continual improve-integrated with the roles of product developmentment, with the PDF offering advice on how best toteams. There’s also an emphasis on change enable-develop this.ment being “more about outcomes than theater” andalong with the Managing Professional “High Velocity IT”publication, the practice-level changes in ITIL 4 aredesigned to allow IT-related change to “move at thespeed of business.”White Paper The Practical Impact of ITIL 45

Fig. 2: Process “Management of continual improvement initiatives”Identifying tising, andapprovingimprovementopportunitiesImprovement recordsUpdated CIRImprovement recordsUpdated CIRApproved Measuring andevaluatingimprovementinitiatives resultsImprovement recordsUpdated CIRImprovement plansChange/project recordsBacklogsImprovement recordsUpdated CIRChange/project recordsPerformancemeasurementsImprovement recordsUpdated CIRPerformancemeasurementsLessons learntCopyright AXELOS Limited 202003 Deployment management04 Incident managementThis practice contains new content onThis practice contains new content onDevOps conceptsAutomation capabilitiesDeployment approaches SwarmingIncident management technologies Continual improvement of the practiceAs with release management below, this wasAs already mentioned, the concept of swarming has broken out of ITIL v3/2011’s release and deploymentbeen introduced. This is where incident handling ismanagement to reflect the differences betweencollaboration-based. There are no tiered supportreleases and deployments. Put simply, deploymentgroups and thus there’s no escalation between supportis “moving the technology around.” So, an organizationgroups. Instead, someone owns an issue through tomight do 1,000 deployments a day – using the DevOpsits resolution, with them bringing in the right people tocontinuous integration, continuous delivery, andhelp as needed. The benefits of swarming are varied.continuous deployment approach – but no releasesFor example, faster and cheaper issue resolution, moreuntil the business wants it available. This is whyengaged and motivated IT support personnel, anddeployment management is a technology managementbetter employee/customer experiences and businesspractice not a general management or service manage-outcomes. This type of change offers organizationsment practice. Along with the above changes tothe opportunity to question the status quo and whetherthe change enablement, release management, andthe new additions to ITIL 4 will be beneficial to them.service validation and testing practices, ITIL 4’sdeployment management practice is aimed at makingyour organization’s IT-related changes “better, faster,and cheaper” (plus safer).White Paper The Practical Impact of ITIL 46

05 Knowledge managementThis practice contains new content onThe SECI model of knowledge dimensionsIdentification of knowledge gapsKnowledge-related automation and toolingITIL 4 introduces new knowledge management concepts such as “absorptive capacity.” This is andefinition: “The purpose of the problem managementpractice is to reduce the likelihood and impact ofincidents by identifying actual and potential causesof incidents, and managing workarounds and knownerrors.” With problem identification both reactiveand proactive. ITSM practitioners will find that theproblem management guidance is now a more complete,and useful, ITIL/ITSM reference than it has ever been.organization’s “ability to recognize the value of newinformation, to embed it into an existing knowledge08 Release managementsystem, and to apply it to the achievement of businessThis practice contains new content onoutcomes.” This practice guidance PDF is also notice-DevOps conceptsably longer than others (at 45 pages), thanks to theRelease approachesdeep dive ITIL 4 takes in explaining how organizationsRelease automationsucceed with knowledge management. The intentionis to make knowledge management more practical thanNow separated out from ITIL v3/2011’s release andthe dated, more theoretical, content of ITIL v3/2011,deployment management process, this takes on boardwith the adopting organizations more successful asthe successes of DevOps and automation. With ITILa result.now sharing approaches such as blue/green releasesand feature flags along with reflecting the rapid rise incloud adoption. The split of release management from06 Monitoring and event managementdeployment management is important, with releaseThis practice contains new content onmanagement about making new and changed thingsMonitoring toolsavailable to users and not the deployment of theThe role of AItechnology. But, as with deployment management,Third-party service implicationsit’s still very much about IT-related change being able(e.g. cloud services)to “move at the speed of business.”An obvious complement here is “monitoring” becauseit was previously just the “event management” process.09 Service catalog managementWhile the ITIL v3/2011 Service Operation publicationThis practice contains new content ondid offer a range of monitoring-related guidance, it wasService offeringsspread throughout the book. Now it’s much easier forConsumer-focused service request catalogITSM practitioners to access and consume monitoringService catalog viewsguidance with ITIL 4. Plus, of course, the best practicenow better reflects the state of the art in monitoringThis is similar to the later ITIL v3/2011 Service Designand event management, especially in tooling and theguidance. For example, the practice success factorsadvancements that AI and automation bring.were there before, and the processes contain nothingradically new. However, there are two importantchanges to note. First, the guidance now refers to07 Problem managementservices and service offerings, i.e. the bundling ofThis practice contains new content onservice components to make the service catalogError control and problem controlentries business-focused rather than service-provider-Proactive incident preventionfocused. For example, everything a homeworker usuallyAutomation and toolingneeds could be a service offering rather than being listed as individual services. This is referenced fromITIL 4 has reintroduced error control and problemthe outset in stated purpose, “to provide a singlecontrol. This was in ITIL v2 but not in ITIL v3/2011.source of consistent information on all services andThere’s also more emphasis on incident prevention notservice offerings, and to ensure that it is available tojust on “the cure” post-issues. This is reflected in itsthe relevant audience.” The second is the concept ofWhite Paper The Practical Impact of ITIL 47

the (service) request catalog, with this a consumeris reflected in the practice’s three processes: userview of the service catalog. Although, and it will bequery handling, communicating to users, and servicewanted by many ITSM practitioners, there’s no mentiondesk optimization.of self-service best practices in this guidance PDF.12 Service level management10 Service configuration managementThis practice contains new content onThis practice contains new content onCloud servicesInfrastructure as codeOutsourcing servicesIntegration of CMDB with DevOps toolsA greater focus on utility and experienceThe impact of cloud servicesIn ITIL v3/2011 service level management was overlyThis is similar to the guidance in the ITIL v3/2011focused on warranty. In ITIL 4, there’s now moreService Transition publication in that it focuses on thebalance relative to utility and experience, including thecapturing and checking of configuration item (CI) data.expectations on monitoring and reporting on these. ITILSo, it doesn’t call out the more modern practice ofv3/2011 also assumed that every service was tailoredusing the configuration management database (CMDB)(to the customer) with the service level managementor configuration management system (CMS) to driveaspects tailored too. Now, ITIL 4 recognizes the needchange. With this instead covered in the High-velocityfor service level management capabilities for “out-of-IT Managing Professional publication in terms ofthe-box” services where tailoring is not permitted.“infrastructure as code.”For example, cloud services or outsourcing arrangements for smaller organizations. The new service levelThe High-velocity IT publication states that “If changesmanagement guidance is, as a result, far more reflec-are needed, the source is edited, not the target. Toolstive of real-world needs and the operations of exemplarsuch as Vagrant, Ansible, Puppet, and Docker supportorganizations.the whole process.” Hence, the IT infrastructurereflects the CMDB (or CMS) rather than the traditionalview of the CMDB reflecting the infrastructure. Where13 Service request managementchanges created within the CMDB are automaticallyThis practice contains new content onenacted within the infrastructure and, when there’s aService request catalogdifference between the two, the CMDB’s view of theWorkflow automationworld prevails.Service orchestrationWhile one of the shortest ITIL 4 practice PDFs, the11 Service desknew service request management guidance is moreThis practice contains new content onpractical than that in the academic-feeling ITIL v3/2011Omnichannel supportService Operation publication. A key addition is theService desk optimization(service) request catalog, as also covered in theThe need for better engagementservice catalog management practice. Plus, there’s anemphasis on the need for more automation, reflectingService desk is no longer an ITIL function, as it was inboth the ITIL 4 guiding principle and the increasedITIL v3/2011, and about incident management, requestinvestments in workflow automation and servicemanagement, etc. Instead, the ITIL 4 service deskorchestration within ITSM tools. As with the servicepractice is focused on engagement with end users andcatalog management guidance, there’s no self-servicedelivering better employee/customer experiences andsuccess guidance other than the statement thatbusiness outcomes. There’s a new emphasis on“Some service requests can be completely fulfilledomnichannel support within this practice and “query” isby automation, from submission to closure, allowingoffered as a new ITIL term, with this something that’sfor a complete self-service experience.”presented by an end user before it’s categorized. ThisWhite Paper The Practical Impact of ITIL 48

Suggestions for less commonly adoptedprocesses/practicesSecond, there are the existing ITIL processes/practices – that may or may not have beenrenamed – that might have yet to be adopted by your organization. These are likely to be theprocesses/practices that are outside of those that are commonly adopted, and there’s nothingto be refreshed, within your organization, here. Instead, it would be the new adoption of ITIL 4guidance and the associated capabilities. A good example is the capacity management process,which is now the capacity and performance management practice. Or financial management forIT services which is now service financial management.In both instances, establish whether the ITIL best practice guidance and/or local circumstanceshave changed sufficiently to convince your organization to now adopt the practice. In particular,that the benefits of practice adoption outweigh the cost of adoption. Importantly here, there’s aneed to recognize that for some practices the benefits will be realized across other ITIL processes/practices. For example, information security management or service financial management. Examples of changes in the less commonly adopted practices include:14 Availability managementthat explains the key differences an important addition.This practice contains new content onThere’s a clearer link between availability managementKey differences between service continuityand risk management – helped by the latter nowand service availability managementbeing its own ITIL 4 practice. The new availabilityRisk management linkagesmeasurement methods section is a big improvementAvailability measurement methodson the ITIL v3/2011 Service Design book, as is the newAutomation and Tooling section. With both making itThe new guidance states that almost every practiceeasier for ITSM practitioners to better understand “thecontributes to service availability, reinforcing the ITIL 4art of the possible.” Surprisingly, though, there’s noethos of combining practices to create value streams.mention of Site Reliability Engineering (SRE) here,It also states that “The line between service continuityalthough it’s covered in the High-velocity IT Managingand availability management is subtle,” with contentProfessional publication.White Paper The Practical Impact of ITIL 49

15 Capacity and performance managementlittle on capacity modeling – which was a big part ofThis practice contains new content onITIL v3/2011 guidance, but no longer needed (alongManagement-level, rather than technical,with the associated modeling tools) thanks to theperspectivesrapid scalability offered by cloud services. Given theCloud-based servicessimilarities between availability and capacity needs,Process alignment with the availability the two capacity and performance managementmanagement practiceprocesses sensibly map to the availability managementprocess structure. Such that, as with the availabilityHere the change in name, with the addition ofmanagement guidance, one is related to “control” “performance management,” is not a good indicatorand the other to “analyzing and improving.” Withinof the changes because performance managementthis process and activity guidance, there’s practicalwas already included in the ITIL v3/2011 capacitydetail related to both cloud-based services and formanagement process guidance. However, a bigthe operation of IT support in terms of the first tierdifference is that the new guidance is now at aof service support staff. “management level.” So, for example, there’s nowFig. 3: Process “Establishing capacity and performance control”CustomerrequirementsIdentifyingservice capacityand performancerequirementsInformationabout availableresourcesExisting serviceand componentsperformance dataAgreeing servicecapacity andperformancerequirementsAgreed servicecapacity andperformancerequirementsDeterminingcapacity city andperformancemetrics andreportsCapacity andperformancemeasurementrequirementsCapacity andperformancereporttemplatesCopyright AXELOS Limited 2020White Paper The Practical Impact of ITIL 410

16 Information security managementThis practice contains new content onRESILIA cyber security guidancethe continual review of the ongoing legitimacy ofprevious investment decisions in light of changingcircumstances.Security incident managementEmbedding security into value streams18 Relationship managementThis practice contains new content onAn important point to note is that this PDF is based onInternal and external stakeholder relationshipsAXELOS’s separate “cyber security and resilience”“Different-level” relationshipsguidance, RESILIA, which is a book, online resource,The relationship journeyand qualification in its own right. So, in some ways, itcould be treated as a new practice. A key concept isThis replaces the business relationship managementthe need to “protect, detect, and correct” and thatprocess in ITIL v3/2011. The changes recognize notinformation security controls should be balancedonly the need for relationships with all stakeholders,across ITIL 4’s four dimensions of service managementincluding internal teams and individual team members,(people, technology, partner, processes). Also, thatmanagers and executives, shareholders, customers,information security needs to be embedded into allend users, suppliers, and governments and regulators.elements of the ITIL service value system, becauseBut also, that there’s a need for relationships oninformation security has a role to play throughout the ITdifferent levels. The focus on both internal and externalservice delivery and support ecosystem, with thestakeholders is continued in the practice successpractice guide offering practical detail across each. Anfactors, with a separate success factor offered forimportant change with ITIL 4, versus to ITIL v3/2011, iseach, and processes. There’s also an overview of thethe inclusion of practical details on the security“relationship journey” which is based on the customerincident management process. Recognizing thejourney from the Drive Stakeholder Value Managingdifferences with the standard ITSM incident manage-Professional publication.ment practice.19 Service continuity management17 Portfolio managementThis practice contains new content onThis practice contains new content onHow to use recovery time objective and recoveryA wider focus than just IT servicespoint objectiveInvestment prioritization techniquesTesting of service continuity plansContinuous investment controlStrategic, tactical, and operational planningThis practice is different from ITIL v3/2011’s serviceIt’s one of the longer guidance PDFs at 45 pages,portfolio management process. Now, it’s more aboutwith the focus on service continuity and little practicalhow organizations should make investment decisionsguidance offered on wider business continuityand is wider than purely IT services. So, the guidance management (BCM). In terms of new content, there’shas been elevated from the myopic “Which servicesmore detail on how to use both recovery time objectiveshould we invest in?” to “What should we invest in?” –and recovery point objective and it repeats the newremoving silos to compare investments “acrosscontent related to “The line between service continuitystreams,” i.e. viewing services, projects, improvements,and availability management is subtle.” There’s alsoand other opportunities as competing for the samemore practical detail on the testing of service continuitybusiness resources. The guidance offers up twoplans and the use of the Business Continuity Institute’sexamples of techniques for prioritizing investments in(BCI’s) three levels of response and recovery planningterms of value – cost of delay and A/B testing. Thestructure: strategic, tactical, and operational (takenpractice’s new success factors need noting too. Thatfrom the BCI Good Practice Guidelines). Including whatportfolio management isn’t just about “ensuring soundeach of these plan types should cover.investment decisions.” Instead, it needs to also involveWhite Paper The Practical Impact of ITIL 411

20 Service design22 Service validation and testingThis practice contains new content onThis practice contains new content onDesign thinkingBetter managing risksService design activitiesRisk-based selective testingCustomer and user experienceContinual validation and testingThe name change here, from “design coordination,”Continuing with the naming from ITIL v3/2011 mightreflects the biggest change between the ITIL v3/2011give the impression that little has changed. However,process and ITIL 4 practice. Whereas the formerthere are two key points to note here. First, inguidance was focused on service coordination, understanding that this practice is very much aboutITIL 4 is now focused on design thinking – “a practicalmanaging risk, and taking a risk-based approachand human-centered approach that acceleratesto selective testing. Second, the need for continualinnovation.” This includes a series of servicevalidation and testing, with it not just a single activity design  activities: inspiration and empathy, ideation,at a certain point in time. Again, the new guidance prototyping, implementation, and evaluation. Throughis very much aimed at speeding up change but in abetter service design, ITIL 4 is promising that ITsuitably safe way.organizations (and those they serve) will get betterIT services and outcomes as a result.23 Strategy managementThis practice contains new content on21 Service financial managementDigital strategyThis practice contains new content onStrategy management in a VUCA environmentProcesses for external digital service providerThe Cynefin frameworkorganizationsPractical examples for external digital serviceThe breadth of this guidance is extended, with busi-provider organizationsness strategy and IT strategy now accompanied byAutomation and toolingdigital strategy. This aligns with the High-velocity ITManaging Professional publication and more practicalThis practice is, in the main, similar to the previoushelp will be included in the future “ITIL 4: Digital andversions of ITIL. So, there’s still the accountancy-typeIT Strategy” publication. An important addition isguidance related to direct and indirect costs, costwhat’s titled “strategy in a VUCA environment.” Wheredrivers, cost allocation, activity-based costing (ABC),VUCA stands for volatility, uncertainty, complexity,Capex and Opex, fixed and variable costs, andand ambiguity; with organizations needing to embed budgeting and charging. There are three servicecapabilities such as agility, innovativeness, complexityfinancial management processes, with practicalthinking, and resilience into their strategic manage-examples of process activities that importantly showment. In terms of adapting for VUCA, the guidancewhat’s needed for both an internal IT service providerincludes overviews of both the Cynefin frameworkand an external digital service provider organization.(for complexity) and the triple bottom line modelFor some ITSM practitioners though, there will be(for sustainability). There’s also a greater emphasis on“modern IT” financial management omissions tostrategy not being a one-off activity, with the inclusionthis practice. For example, none of the following topicsof a process called “ad hoc strategic decision-making”are included: cloud cost management, the managementfor extraordinary circumstances such as 2020’s globalof third-party costs in outsourcing, and servicepandemic.integration and management (SIAM) arrangements.White Paper The Practical Impact of ITIL 412

24 Supplier managementcovers. The change in tone of this revised practice –This practice contains new content onfrom control to outcomes – is set by part of theNon-IT supplier managementopening definition of purpose, “This includes creatingOutcome-based supplier managementcloser, more collaborative relationships with keySIAM (Service Integration and Management)suppliers to uncover and realize new value and reducethe risk of failure.” The practice success factors againHere there’s a move away from IT suppliers to suppliersleverage the ITIL 4 customer journey given that everyper se. There’s also content related to SIAM. Plus,supplier journey for your organization is a customerthere’s the link to the relationship management practice,journey. With a greater focus on effective integrationgiven that suppliers are one of the stakeholders itrather than simply contract management.Suggestions from new processes/practicesThird, there are the many new practices in ITIL 4 to consider. As shown in the earlier table,there’s much that’s new. For example, in the general management practices list, there are a variety of capabilities that would enhance the core service management practices alreadyadopted by your organization – business analysis, organizational change management andworkforce and talent management. Each of these practice PDFs allows the reader to quicklyunderstand what’s needed,

03 Deployment management This practice contains new content on DevOps concepts Automation capabilities Deployment approaches As with release management below, this was broken out of ITIL v3/2011's release and deployment management to reflect the differences between releases and deployments. Put simply, deployment