Appendix A_SOW_OPG IT Consulting Services_EN.pdf

Appendix A

IT AUDIT

OFFICE of the PROSECUTOR GENERAL

TABLE OF CONTENTS

Table of Contents

1 List of abbreviations, terms, and definitions

2 Introduction

2.1 Project team

3 OPG's IT AUDIT

3.1 Context

3.2 Purpose

3.3 Expected result

3.4 Requirements for conducting

3.5 Scope of work

3.6 Duration and location

4 DEVELOPMENT OF OPG’s IT STRATEGY

4.1 Purpose

4.2 Expected result

4.3 Development requirements

5 ITSM IMPLEMENTATION

5.1 Purpose

5.2 Expected result

5.3 Implementation requirements

6 CONDUCTING TRAINING FOR IT EMPLOYEES

6.1 Topics and materials for training

6.2 Training formats

7 SERVICE DESK IMPLEMENTATION

7.1 Purpose

7.2 Expected result

7.3 Implementation Requirements

8 DEVELOPMENT OF IT DOCUMENTS

1 LIST OF ABBREVIATIONS, TERMS,

AND DEFINITIONS

Abbreviation, term

Definition

BCP Business Continuity Plan

Big Data Technologies for efficient storage, processing, and analysis of large volumes of information

CI/CD Continuous integration/continuous delivery

CMDB Configuration Management Database

DRP Disaster Recovery Plan

ІТ Information technologies

ITIL Information Technology Infrastructure Library

ITSM IT Service Management

RPO Recovery Point Objective

RTO Recovery Time Objective

SLA Service Level Agreement

IISS Integrated information security system

OPG, Recipient Office of the Prosecutor General

SW Software

2 INTRODUCTION

Office of the Prosecutor General (hereinafter referred to as the OPG or

Recipient) performs the functions established by the Constitution of Ukraine to protect human rights and freedoms, the general interests of society and the state.

These functions include:

1) support of public prosecution in court;

2) organization and procedural management of pre-trial investigation, resolution of other issues in criminal proceedings in accordance with the law, supervision of covert and other investigative and detective actions of law enforcement agencies;

3) representation of the state's interests in court in exceptional cases and in accordance with the procedure established by law.

The main legislative acts regulating the activities of the Office of the Prosecutor

General in Ukraine include the following:

1. Constitution of Ukraine of June 28, 1996, No. 254 /96.

2. Law of Ukraine No. 1697-VII of 14.10.2014 "On the Prosecutor's

Office".

3. Law of Ukraine No. 113-IX of 19.09.2019 "On Amendments to Certain

Legislative Acts of Ukraine concerning Priority Measures to Reform the

Bodies of the Prosecution Office".

4. The Criminal Procedure Code of Ukraine dated 13.04.2012, No. 4651-

VI.

The submitted document outlines the technical requirements for a comprehensive project aimed at assessing the current state and development of

Information Technologies (in the future referred to as IT) in the OPG. The primary objective of the project is to enhance the efficiency, security, and innovativeness of

IT, aligning with the strategic goals of the OPG.

Within the scope of this project, special emphasis is placed on conducting an audit of existing IT systems. The audit involves a meticulous analysis of the current

IT environment, identifying potential risks, and uncovering opportunities for improvement. This encompasses evaluating technical resources, data security, and the effectiveness of IT processes. The rationale behind the audit is rooted in the necessity to ensure an elevated level of compliance with modern IT standards and to adapt to the evolving demands of the digital era.

The project's goal is not only to identify and address weaknesses in IT systems but also to formulate a strategic plan that will guide IT development in the OPGuntil the conclusion of 2027. This plan will encompass recommendations for optimizing

IT processes, enhancing their efficiency, and integrating the latest technological solutions.

Additionally, the project encompasses the implementation of ITSM (IT Service

Management), developing a Service Desk (support services) to elevate service quality for internal and external users, and creating relevant IT documentation along with training programs for IT personnel. These initiatives are designed to ensure the stability and reliability of the IT infrastructure, as well as the efficiency of information systems, elevate personnel competencies, and uphold a high standard of information security.

2.1 PROJECT TEAM

It is anticipated that a team of skilled independent experts will be engaged in the project on behalf of the Contractor.

Brief characteristics of the roles that the team of experts will perform:

1. Team leader: The team leader provides overall project management.

His/her expertise should cover most of the areas to be evaluated. This is an expert who can conduct feasibility studies, market research and gap analysis, and able to implement advanced IT technologies in the relevant area.

2. Business analyst: an expert who is familiar with the legal framework governing the activities of OPGs and prosecutorial authorities, and who is familiar with workflows, international legal assistance, and standards and general requirements applicable to IT to perform the necessary functions of the OPG’s IT Department.

3. System architect: an expert who is familiar with system tools and package specifications, experienced in designing and developing large-scale systems, and possesses an understanding of potential implementation limitations on various hardware and communication platforms.

4. Information security specialist: an expert with experience in the field of information security, namely: in building information infrastructure development processes for information security, in building IISS, in developing methodology and documentation in accordance with IT security regulations, and in passing information security audits

5. Hardware and equipment specialist: an expert with knowledge of the equipment used, including hardware and communications equipment, understanding of equipment requirements and maintenance, expertise in assessing hardware construction architecture, and skills in resource utilization and optimization.

6. Data analyst: an expert who is familiar with database management systems, understands the principles and procedures of data storage, transformation, and processing.

7. Developer: an expert skilled in software development tools and programming languages, possessing experience in large-scale system development. The developer is proficient in performance optimization, compatibility, and documentation, and follows best practices in software development.

8. Financial analyst: an expert with proficiency in the financial aspects of information systems life cycle management and is skilled in conducting market research, performing technical and economic analyses and develop budget estimates.

9. ITSM specialist: an expert who has deep knowledge in the field of ITSM, including the development and implementation of IT service management processes. The expert should be able to work with ITIL and ISO/IEC 20000 standards, as well as have experience in implementing ITSM tools.

10. IT training instructor: an expert who has the skills to develop and conduct training programs for IT employees, has professional training skills and understands the specifics of the IT industry for effective transfer of knowledge and skills to personnel.

11. Service Desk implementation specialist: an expert in Service Desk development and implementation, has experience in working with user support systems, is familiar with global best practices and systems for user service and IT incident resolution.

3 OPG'S IT AUDIT

3.1 CONTEXT

Since the commencement of the full-scale unprovoked military aggression by the Russian Federation against Ukraine, the OPG has encountered an unprecedented workload affecting prosecutor's offices and units, along with an increased risk of losing materials in criminal proceedings, posing significant challenges to the delivery of justice.

To alleviate this burden, the OPG decided to automate internal processes and digitize criminal proceedings. Consequently, since the beginning of the invasion, a number of projects have been launched to implement information systems and increase the resilience of the existing infrastructure, mainly thanks to international technical assistance initiatives.

Due to the pressing nature of these projects and their pivotal influence on the stability and efficiency of justice, they are frequently fast-tracked, posing risks of ignoring the broader context of IT development within the OPG.

Considering the aforementioned, it is recommended to undertake an IT audit to assess the current state and needs of the OPG in terms of IT.

3.2 PURPOSE

The audit aims to gather, analyze, summarize, and evaluate information regarding the present condition of infrastructure development, technologies, information systems, IT services, and processes. It also encompasses the examination of regulatory documentation and the organizational structure of IT departments, intending to pinpoint key IT needs and developmental directions for the OPG's IT. Furthermore, the audit should identify primary consumers of IT services and assess their satisfaction levels with the quality of these services.

3.3 EXPECTED RESULT

According to the results of the audit, based on the analysis of all existing components, processes and documents related to the IT systems and processes of the

OPG, an "Analytical report" document with conclusions on the current state and recommendations for the further development of the IT of the OPG should be prepared and handed over to the customer.

3.4 REQUIREMENTS FOR CONDUCTING

The audit should be conducted using appropriate information-gathering methods, such as reviewing the OPG's IT systems, conducting interviews, reviewing and analyzing documents, and familiarizing oneself with the organizational structure of IT and the current business processes of IT services at the OPG.

The methodology for conducting and evaluating the audit results should be based on the approaches defined in ISO 9000 (quality management standard), ISO

20000 (IT service management standard), COBIT (G23 approach to information technology management), ISO 22301 (business continuity standard).

The audit should give recommendations on the gradual harmonization of the current state of information security in the OPG with NIST SP 800-53 Rev. 5

"Security and Privacy Controls for Information Systems and Organizations" (a standard for information security for information systems and organizations from the National Institute of Standards and Technology, USA), without violating the requirements of the current IISS.

The audit should include an analysis of business processes for existing IT services and a determination of the fit with the organizational structure. The audit should assess possible changes needed to support the development of the OPG's IT.

The auditor should prepare a detailed report on the current state of the OPG's

IT and recommendations for its improvement and development based on the audit.

The audit's preliminary findings will be discussed with all stakeholders to obtain feedback, the result of which should serve as an additional source of information for preparing the Analytical Report. The Analytical Report should include an examination of opportunities and risk analysis in the primary areas of the audit with specific recommendations for improving the OPG's IT processes and systems.

3.5 SCOPE OF WORK

1. General high-level analysis of the information systems infrastructure.

Inspection and assessment of the technical equipment of the IT (Data

Centre) of the OPG, namely: hardware, communication infrastructure, and hardware system architecture. Inspection of server and network equipment, data storage systems, and information security tools at the hardware level in terms of configuration, sufficiency to maintain business continuity, and compliance with information security requirements.

2. Analyzing the state of information systems and assessing compliance with the requirements and tasks they face by collecting information from key stakeholders. In-depth analysis of the systems that, in the opinion of the representatives of the OPG, require special attention and improvement.

Documentation of the functionality that needs to be improved, development of recommendations, and possible ways of implementation.

3. High-level analysis of the IT architecture, subsystems functions, and software modules in use. Conformity checks on elements, approaches, compatibility, possible gaps, and risks, including security, maintenance, load, and scaling risks.

4. Analysis of integrations, including with external systems and services, and their compatibility. Identification of data and services, approaches to organizing information exchanges and security measures.

5. Analysis of the organizational structure of the IT Department of the OPG:

staffing, positions, vacancies, roles, job descriptions, and processes.

Determine the need for training for the unit's employees to improve their professional development (qualifications).

6. Assessment of the level of services provided by the IT Department.

Analyze regulatory documents and procedures, working documents and processes in the IT Department. Gathering feedback from other units of the OPG. Analysis of the results and providing recommendations for improving the level of services.

7. Evaluation of the processes of development, testing and implementation of changes in the productive environment. Checking the availability of multiple environments for the ability to develop and test software separately from operation. Evaluation of the overall approach to the availability and effectiveness of automatic system delivery and deployment to environments (CI/CD).

8. Validation of support processes and analysis of existing support service, existing ticketing system, problem statistics: closed tickets, open tickets, current tickets, average closing time, average response time. Verification of service level agreements, their analysis and compliance with the ticketing system, support service response time and response time, resolution of incidents and problems.

9. Verification of the availability and relevance of the IISS: cybersecurity, data security, data privacy based on documents and procedures in accordance with security standards, adopted instructions and recommendations (if any).

10. Preparation of an analytical report on the current state of the IT of the OPG with recommendations on the plan for the development of IT systems and processes, which should include an assessment of the need to improve existing systems or implement new solutions and the results of financial analysis for each proposed solution. Additionally, the Analytical Report should contain recommendations for improving existing or implementing new processes for the provision of services by the OPG IT Department.

3.6 DURATION AND LOCATION

It is expected that the total duration of the audit will not exceed 8 months from the date of signing the Agreement.

4 DEVELOPMENT OF OPG’S IT

STRATEGY

4.1 PURPOSE

An IT strategy serves as a comprehensive plan for the phased evolution of IT of OPG over several years, considering various development scenarios to maximize the value IT brings to the organization. This IT strategy aligns all existing IT infrastructure assets, including networking equipment, computing and storage solutions, virtualization platforms, cybersecurity, and more, with the organization's evolving needs for new services and assets. Implementing the strategy enables IT departments of OPG to evolve cohesively, considering all aspects of the strategy.

This reduces the cost associated with acquiring and administering new assets, enhances cost predictability, and minimizes downtime of IT services.

The purpose of the strategy is to define the directions for ongoing OPG’s IT development, to ensure continuous compliance with functional needs of OPG and modern requirements for information systems, to develop ways to optimize the IT architecture, to improve existing and introduce new information systems, and to increase the resilience of the IT infrastructure following the principles of the state policy of digital development.

4.2 EXPECTED RESULT

The result of the development should be a document containing the OPG’s IT strategy, prepared and submitted to the Recipient. The document should have a phased action plan with deadlines for the stages of the new strategy.

In case of deficiencies and/or the need for revision, the Contractor shall make appropriate changes and submit them to the Recipient for approval. The work is considered completed after the IT strategy is approved by the Recipient.

4.3 DEVELOPMENT REQUIREMENTS

Developing an IT strategy requires a comprehensive approach, considering the key functions and objectives of the organization. The following requirements provide a framework for developing an effective IT strategy that will ensure that the

OPG makes optimal use of all its resources to fulfill its statutory functions.

1. The target state of IT in the perspective of the end of 2027:

a. Infrastructure:

i. Provision of reliable and fast computing and network infrastructure using modern equipment.

ii. Implementation of advanced cyber security technologies to protect the privacy of data and systems.

iii. Deploying mobile solutions to provide access to systems and data anywhere.

iv. Provision of backup communication channels.

v. Availability of backup data processing centers.

b. Systems:

i. Improvement of existing systems and introduction of new ones to meet the needs of functional OPG’s divisions.

ii. Development and implementation of integrated IT platforms for effective interaction of all departments.

iii. Using automated systems to standardize and optimize work processes.

c. Working with data:

i. Ensuring efficient data storage, processing, and analysis.

ii. Establishing an effective data management system, including storage, processing, and analysis.

iii. Using Big Data and analytical tools to improve decisions and strategies.

iv. Ensuring compatibility of different databases and systems.

2. Target state of IT management:

a. Organizational structure:

i. Development of a flexible organizational structure that supports rapid change and innovation.

ii. Creation of a single IT management center for coordination of all IT initiatives.

iii. Training and development of personnel to work with the latest information technologies.

iv. Regular evaluation of personnel.

b. Services and processes:

i. Service approach: focus on quality service for both individual users and units of OPG, as well as pre-trial investigation bodies that work with the OPG’s systems. Continuous improvement of services.

ii. Implementation of standards for IT process management, for example ITIL or ISO/IEC 20000

c. IT audit:

i. Conducting regular IT audits to assess the effectiveness of IT processes.

ii. Monitoring and evaluation of implementation of recommendations of previous IT audits.

3. Target role of IT in the organization:

a. Development of mechanisms for effective interaction of IT with other divisions of OPG.

b. Positioning of IT as one of the key elements in implementing the organizational mission and strategy of OPG.

c. Integrating systems and sharing data with other law enforcement agencies to ensure effective cooperation.

4. The transition plan from the current model to the target model:

a. Development of a detailed plan with clear stages and deadlines for implementing IT changes.

b. Development of a clear roadmap for the transition from the current model to the target model.

c. Implementation of a monitoring system to track progress and identify potential problems early.

d. Ensuring the ability to adapt the plan considering changes in technologies and operational environment.

e. Implementation of changes in stages, with constant monitoring and adjustment of the plan.

f. Active involvement of all stakeholders in the process of planning and implementing changes.

5. Feedback and update:

a. Development of mechanisms for collecting feedback from employees and making timely updates to IT systems.

6. Strategic planning and risk assessment:

a. Development of a long-term IT infrastructure development plan, considering possible risks and changes in technologies.

Regardless of the timing of strategic requirements planning, IT strategy must be regularly reviewed and updated to reflect the most current technology and market trends. It is important to maintain some flexibility in strategic planning so that you can easily adapt to the changes that occur.

5 ITSM IMPLEMENTATION

5.1 PURPOSE

Building an ITSM should ensure effective and systematic management of IT resources and services, which in turn contributes to the better performance of the organization’s key functions.

ITSM (IT Service Management) is a set of procedures and practices aimed at designing, creating, delivering, supporting, and managing IT services. They are based on the principles of best practices such as ITIL and include aspects such as incident, request, change, problem management, as well as service level and IT asset management.

The goal of implementing ITSM for OPG is to improve the efficiency, reliability and security of IT systems and services that are critical to the delivery of key organizational functions.

The main aspects of this goal include:

• standardization of IT processes and procedures to ensure efficient and cost-effective management of IT resources;

• integration of ITSM implementation with the OPG's IT strategy to support the delivery of the organization’s functions;

• positive impact of ITIL best practices on IT security, stability of IT systems and risk management to protect confidential information and ensure compliance with regulatory requirements;

• flexible management of changes in the IT environment, which facilitates innovation and adaptation to the changing requirements of the OPG's activities;

• use of metrics and indicators to continuously monitor and improve the quality of IT services.

• As a result of the Executor's construction of ITSM processes in the

Recipient's organization, the following is expected:

• Implementation results for IT:

• optimization of work of IT employees;

• improving the quality of services provided;

• objective evaluation of the quality of IT services and the operation of the

IT service according to key performance indicators;

• improving user interaction;

• optimizing the number of user requests and reducing the cost of processing one request;

• use of accumulated experience;

• reduction and management of IT security risks, improvement of cyber security;

• centralized control of IT resources and their use.

• Implementation results for users:

• improvement of service quality and user satisfaction;

• reduction of IT-related downtime;

• addressing any IT requests to the centralized support service;

• the ability to track the fulfillment of your requests;

• guaranteed fulfillment of requests in accordance with the agreed service level.

5.2 EXPECTED RESULT

The result of the implementation of ITSM will be the deployment of the IT process management automation system taking into account the application of ITIL best practices and regulatory and methodological documentation developed by the

Contractor in accordance with the separate list below.

The following processes should be set up in the PMO:

• Configuration management process and CMDB.

• Service level management process.

• Service catalogue management process.

• Service Desk function as part of the processes:

o request management;

o incident management;

o service request management (including access requests).

• Change management process.

• Problem management process.

• Knowledge management process.

• The list of documentation that must be created during the implementation of the project:

• Report on the results of the survey of existing activities (processes).

• Conceptual project documents on process implementation.

• Terms of reference for automating IT management processes.

• Description of the technical equipment complex.

• Process regulations in system terms:

o configuration management;

o service level management;

o service catalog management;

o appeal management;

o incident management;

o service request management (including access control);

o change management;

o problem management;

o knowledge management.

• Description of roles by processes.

• Operational instructions for roles in processes.

• Administrators' instructions on the processes.

• Initial report (initial results and project work plan).

• ITSM business process review report and recommendations.

5.3 IMPLEMENTATION REQUIREMENTS

Implementation of ITSM for OPG is aimed at effective management of IT services that support the core functions of the organization. Key requirements for

ITSM implementation:

1. Consideration of an IT strategy that reflects the mission and goals of OPG.

2. Define the role of IT in supporting the key processes of OPG.

3. Implement ITIL standards for IT service management.

4. Adaptation of ITIL standards to the specifics and OPG’s needs.

5. Development of IT service life cycle management processes, from planning to decommissioning.

6. Monitoring and evaluation of the effectiveness of IT services provided.

7. Establishing procedures for managing requests and incidents.

8. Implementation of a request management system for rapid response to user problems and requests.

9. Ensure a high level of cybersecurity and data protection.

10. Developing policies and procedures for information security management.

11. Ensure integration of new IT systems with existing technologies.

12. Developing a system for measuring the performance of IT services.

13. Regular reporting on the effectiveness and quality of IT services.

14. Development of instructions and manuals for end users.

15. Analyzing trends and innovations to keep IT services up to date.

If there are prerequisites on the part of the Recipient that prevent the implementation of ITSM processes, the Contractor shall report these prerequisites and agree to postpone the implementation of this process with the formation of recommendations within the IT strategy for further steps on the part of the Recipient.

6 CONDUCTING TRAINING FOR IT

EMPLOYEES

Training for the IT employees of OPG is essential to ensure that IT operations are efficient, secure and compliant with ITIL guidelines and ITSM processes. These methodologies are key to IT service management and can significantly improve IT operations in OPG. Training IT specialist is critical for several reasons:

1. Information security: Given the importance and confidentiality of the information handled by the OPG, employees should be familiar with the latest cybersecurity practices.

2. Awareness of the latest technologies: the rapid development of the IT sector requires constant updating of employees' knowledge and skills.

3. Data processing efficiency: learning modern tools for processing and analysing big data can significantly increase productivity.

4. Compliance with regulatory and legal requirements: regularly updating knowledge about IT-related legislative changes is important for the compliance of OPG activities with the requirements of the law.

5. Improving the efficiency of IT operations: ITIL and ITSM training will help standardize processes, which contributes to more efficient management of IT resources.

6. Improving service quality: adopting best practices will ensure a higher quality of IT services provided within the organization.

7. Risk mitigation: ITIL and ITSM knowledge will help reduce the risks associated with cybersecurity and data loss.

8. Adaptation to change: training will help IT employees better adapt to new technologies and changes in the work environment.

6.1 TOPICS AND MATERIALS FOR TRAINING

The following training topics are mandatory for IT employees:

1. ITIL and ITSM fundamentals: an introduction to basic principles and practices.

2. IT Service Management: techniques for effective IT service management, including planning, delivery and support.

3. Request and incident management theory: effective management of incidents and requests for IT support.

4. Service requests theory.

5. Service management processes and service catalogue theory.

6. Configuration and asset management theory: techniques for tracking and managing IT assets.

7. Change and release management theory: processes and practices for managing changes in IT infrastructure.

8. Problem management theory.

9. Knowledge management theory.

10. Regular service improvement: methods for continuous improvement of IT services.

11. Cybersecurity in the context of ITSM: the basics of cybersecurity integrated into IT service management.

12. Involvement of key users:

a. introduction to ITSM.

b. training materials on how to use the ITSM.

c. instructions for working in the ITSM.

6.2 TRAINING FORMATS

The Contractor may offer the following training formats for the Recipient's IT employees:

• workshops and seminars: short-term events to introduce specific topics;

• online courses and webinars: flexibility and availability of materials for self-study;

• certification programs: employees’ development and obtaining recognized certificates.

Given the rapid pace of development of the IT industry, the training of IT specialists should be regular and adapted to the current needs and challenges faced by the OPG.

7 SERVICE DESK IMPLEMENTATION

7.1 PURPOSE

Building a Service Desk in OPG is a key element in improving the efficiency of IT support and IT service management in the organization. The need to implement the service is justified by the following:

• single point of contact for all IT requests and issues, which improves coordination and incident resolution;

• automation of request processing and fast problem resolution reduces system downtime and increases employee productivity;

• fast and efficient resolution of user support requests increases the overall satisfaction of the organization's personnel;

• controlled access to IT systems and effective incident management.

Service Desk is an IT service responsible for providing services to users. It is the center for receiving all user requests and monitors the status of services. Service

Desk is responsible for the quality of user requests to IT services, fully controls and records the time of incident resolution, monitors the progress of the incident, informs the client about the status of incident resolution, and informs IT management.

After implementing the Service Desk, the Recipient shall receive the following:

Implementation results for IT:

• increased efficiency of IT employees;

• improving the quality of services provided;

• improved user experience;

• objective assessment of the quality of IT services and the work of the IT service by key performance indicators;

• building a system of continuous IT improvement based on user feedback on requests;

• optimizing the number of user requests and reducing the cost of processing one request;

• use of accumulated experience;

• reducing and managing IT security risks, improving cybersecurity;

• centralized control of IT resources and their use.

Implementation results for users:

• addressing any IT requests to the centralized support service;

• improved service quality and user satisfaction;

• reduction of IT-related downtime;

• the ability to track and evaluate the fulfillment of your requests;

• guaranteed fulfillment of requests in accordance with the agreed service level.

7.2 EXPECTED RESULT

As a result of the Service Desk implementation, the following ITSM processes should be set up in OPG:

• request management;

• incident management;

• service request management.

An IT management system with a configured Service Desk function shall be deployed, in which the IT service is distributed among three support lines (item 10 of the list, subsection 7.3 "Implementation Requirements").

The Contractor shall also prepare and provide documentation on the implementation of ITSM (subsection 5.2 "Expected result").

7.3 IMPLEMENTATION REQUIREMENTS

When implementing Service Desk, the following requirements should be taken into account (in accordance with ITIL and ITSM standards):

1. Define current requirements and expectations:

a. analysis of current IT processes and identifying user needs.

b. developing a clear mission and goals for the Service Desk that align with the overall IT strategy of the PIU.

c. identifying and cataloging all IT services supported by the Service

Desk.

d. developing KPIs for the Service Desk.

2. Planning of resources and IT infrastructure:

a. identifying the resources required (personell, equipment, software).

b. planning the physical and virtual infrastructure of the Service Desk.

c. creating a Service Desk implementation plan.

d. effective resource allocation and personnel management.

3. Cybersecurity requirements:

a. implementation of policies and measures to ensure data protection.

b. consideration of information security requirements and compliance with the relevant laws of Ukraine.

4. Development of procedures and work instructions:

a. creation of documentation with work procedures in accordance with

ITIL/ITSM standards.

b. development of instructions for Service Desk employees on handling appeals.

5. Training and development of IT personnel:

a. organization of trainings for Service Desk personnel.

b. implementation of a culture of continuous learning and improvement.

6. Implementation of IT solutions for Service Desk:

a. selection and installation of appropriate application management software.

b. automation of routine processes.

7. Testing and implementation:

a. testing Service Desk processes before full launch.

b. gradual implementation with the possibility of adjustment based on the received feedback.

8. Monitoring and continuous improvement:

a. KPI tracking and responding to issues and challenges.

b. continuous analysis and optimization of Service Desk processes.

9. The Service Desk function should include IT management processes

(section 7.2 "Expected result").

10. The service should be divided into 3 lines of support according to the principle of division of powers:

a. The first line (Service Desk) - a Service Desk specialist analyses

(classifies) the received request from the user and creates an incident or service request related to the request, after which he/she starts to resolve

it. If the first line cannot resolve the request, the task is sent to the second line of support.

b. The second line (IT Specialist) provides a more in-depth level of technical support by involving specialist(s) with a narrow specialization in solving a particular problem. If the second line specialists cannot solve the problem, it is transferred to the third line of

IT support.

c. Third line (Expert) provides involvement of the most highly qualified specialists with an expert level of knowledge who perform tasks received from the previous lines of support. These experts are also responsible for researching and solving unfamiliar problems.

Implementation of the Service Desk is a long-term process that requires regular updates and adaptation to the changing conditions and needs of OPG, as well as consideration of the peculiarities of the legal system of Ukraine.

8 DEVELOPMENT OF IT DOCUMENTS

According to the ITIL principles, an organization should develop documentation of its IT processes and management practices. Below is a list of documents grouped by process and priority.

General management

1. Documents with the highest priority:

a. IT architecture documentation: diagrams of different levels, etc.

b. Information security policy.

c. Access management policies and procedures.

d. Policy and internal standards for password protection.

e. Release procedure.

f. Documents describing the reporting system of different levels and key performance indicators: templates (examples) of reports.

g. Documents describing work with suppliers and contractors: templates

(examples) of typical contracts, agreements, SLAs.

2. Other mandatory documents:

a. Risk register.

b. Vulnerability management policies and procedures.

c. IT project management procedures.

d. IT project register.

e. IT budgets.

Service management

1. Documents with the highest priority:

a. Data classification and categorization procedures.

b. Change request and approval procedure.

c. Incident detection and resolution procedure.

d. Event detection and notification procedure.

e. Catalog of IT services.

f. Business Continuity Plan(s) (BCP).

g. Disaster Recovery Plan(s) (DRP) including RPO and RTO.

h. Service Desk Function Statement, Function Structure.

i. Documents regulating the service management process: templates and actual agreements on the level of service provision to users.

2. Other mandatory documents:

a. Data management policy.

b. Data tagging procedure.

c. Change request form.

d. Incident reporting.

e. Log of events.

f. Configuration Elements Database (CMDB).

g. Business impact analysis and recovery planning procedure.

h. BCP and DRP testing procedure and reports.

i. Backup plans and schedule.

j. Backup test protocols.

k. SLA performance reporting.

l. Complaints Management Policy/Procedures.

m. Procedure describing the testing process.

n. Test protocols.

Technical documentation

1. Mandatory documents:

a. Procedure for managing/installing software updates.

b. Software version control procedure, including a diagram and description of the development life cycle.

The Contractor shall provide the Customer with consulting assistance in the development or completion of the documents specified in the above list if the audit reveals their absence or non-compliance with the standards.

Consulting assistance includes reviewing, providing recommendations and approving drafts of documents to be prepared and submitted by the Customer to the

Contractor during the contract period and until all previous stages of a project are completed. In other words, it is believed that the development of documents is not a separate stage and does not provide for a general increase in the contract term but is a parallel process with other stages and can be started immediately after the audit

(stage 1) and will continue until the final implementation of the Service Desk system

(stage 5).