Attachment 0025 DESMF.pdf

Department Of

Defense (DoD)

Enterprise

Service

Management

Framework

Edition III

04 Mar 16

REVISION HISTORY

Date Edition Major Enhancement(s) Revision Primary Contact

Nov 13 II Incorporated DoD Component input to create

DoD level framework and align with Joint

Information Environment

Karen Gomez (301) 225-8140

Karen.Gomez5.civ@mail.mil

Mar 16 III More emphasis on Risk Management

ITSM Office Stand-Up Guidance

Service Quality Management

IT Performance Management

Process Capability Assessments

Entitlement Management represented in the

Access Management process (AcM)

POC Appendix

Karen Gomez (301) 225-8140

Karen.Gomez5.civ@mail.mil mailto:Karen.Gomez5.civ@mail.mil

EXECUTIVE SUMMARY

Driving toward service excellence is a virtuous goal for organizations today; this is due in part because it is proven that a proactive service environment is less expensive to run than a reactive service environment. This document provides guidance to standardize the management of Information Technology (IT) services across the Department of

Defense (DoD) organizations and is the embodiment of the integration of various best practices, frameworks and standards that define a Department-wide service management approach. It is a ‘service oriented’ framework that focuses on creating and managing services throughout the service lifecycle. It aligns and integrates processes for service management and defines processes at a high level, describing the what, not the how. This approach enables cross-functional teams the ability to create and improve processes in the common pursuit of service excellence.

More in-depth process specific guidance will be provided in supplemental companion documents located on the

DoD CIO Information Technology Service Management (ITSM) Community of Practice (CoP) portal.

How to use the Department of Defense Enterprise Service Management Framework (DESMF)

There is no DoD standard terminology for much of the content within the DESMF. Therefore, it is necessary to know the definitions of a few key terms used in the document.

Service is a means of delivering value comprised of people, processes and technology perceived by

Customers and Users as a self-contained, single, coherent entity that enables them to achieve mission objectives and functions (Source: ISO 20000, COBIT 5, ITIL V2, V3, & 2011)

Policies help with governance and are formally documented management expectations and intentions.

Policies are used to direct decisions and to ensure consistent and appropriate development and implementation of processes, standards, roles, activities, IT infrastructure, etc.

Process is a structured set of activities designed to accomplish a specific objective. A process is made up of discreet interconnecting activities that draw upon inputs, controls, and enablers (normally tools) to produce a defined output(s). A process may draw from any of the roles, responsibilities, tools and management controls required to reliably deliver the outputs and is comprised of specific procedures to accomplish this activity

Procedure is a document containing steps that specify how to perform process steps. Procedures are defined as a part of processes. As such, a change to a procedure does not necessarily change a process, just as a change to a process does not necessitate a policy change.

The DESMF is the authoritative framework used to address services and processes that are owned and managed by the DoD. The DESMF includes:

Guidance on IT Service alignment with the DoD mission

Processes – Department-wide processes defined at a high level and guidance to establish authoritative

Service Owners, Process Owners and Process Managers, etc.

Purpose and Scope – The purpose and scope of each process in the lifecycle

Metrics – Recommendations on the use of metrics as actionable items

Process Workflow Guidance - Mapped activities and supporting explanation

Roles and Responsibilities – Defined responsibilities of related ITSM roles

Service Quality Management Approach – Describes the approach to establish, implement, and maintain service quality

IT Performance Management Guidance – Describes an approach which consists of activities that focus on up-front planning and aligning IT with defined goals

Process Capability Assessment Information – Defines an approach to evaluate and measure the competency of a process to meet its intended purpose and outcomes

The DESMF is not:

A Concept of Operations (CONOPS)—CONOPS for processes are developed separately from this document, but uses this framework to align the efforts

An Implementation Plan – While this document contains steps for process design work at a high level, it is not meant as a detailed project plan or as an overall ITSM implementation plan.

Do not let the number of pages within the DESMF overwhelm you. This document is specifically designed to provide as much content as possible, divided into usable and manageable sections.

Section 1 provides the background for DESMF.

Section 2 provides guidance to organizations considering standing up their own ITSM Office.

Section 3 introduces organizational considerations for ITSM.

Section 4 introduces the important topic of Risk Management.

We recommend that anyone responsible for leading an ITSM effort or participating in ITSM activities read all of sections 5 – 8, which provide guidance on Quality, Performance and Assessments, Common Process Controls, Roles and Responsibilities and General Steps for DESMF Process Design, respectively.

Sections 9 – 10 contain domain, process and supporting functions content. A reader may want to focus on his or her specific area of responsibility, knowing that additional content is always available for review in electronic format.

Sections 11 – 13 contain References, Acronyms and a Glossary. Hyperlinks are in the reference section for easy access for those who view the DESMF electronically.

The appendices provide more detail on specific topics.

With each new edition of the DESMF, content will be added, removed, or modified based on DESMF reviews and feedback. As with any framework referenced within the DESMF, take the information that is required and aligned with your specific environment, along with anything that may prove helpful, and be aware that additional information is available to you should you require more in depth information.

CONTENTS

........................................................................................................................................................................................i

Revision History ........................................................................................................................................................... ii

Executive Summary ..................................................................................................................................................... iii

1 Background

1.1 Purpose and goal

1.2 SCOPE OF DESMF

1.3 ALIGNMENT WITH DoD STRATEGIC DOCUMENTS

1.3.1 DOD STRATEGIC MANAGEMENT PLAN

1.3.2 DOD INFORMATION ENTERPRISE STRATEGIC PLAN & DOD IT ENTERPRISE STRATEGIC

ROADMAP (ITESR)

1.3.3 DoD CIO CAMPAIGN PLAN

1.3. 4 CC/S/A STRATEGIC PLANS

1.3.5 BENEFITS OF DESMF AND EXPECTED OUTCOMES

1.3.6 CRITICAL SUCCESS FACTORS (CSFS) FOR FRAMEWORK ADOPTION

1.3.7 GUIDANCE AND IMPLEMENTATION PRINCIPLES

1.3.8 UTILIZING THE FRAMEWORK FOR PROCESS IMPROVEMENT

2 ESTABLISHING AN IT SERVICE MANAGEMENT OFFICE

2.1 Purpose

2.2 ITSMO MANAGEMENT PRACTICES

2.2.1 ITSM OFFICE PRACTICE AREAS

2.2.2 AUTHORITY

2.2.3 ITSM OFFICE SCOPE

2.2.4 ITSM OFFICE FUNCTIONS & RESPONSIBILITIES

2.3 ITSMO COMMUNICATIONS PLAN

2.4 STAKEHOLDER REGISTRY

2.5 COMMUNICATION CHANNEL ANALYSIS

2.6 REQUEST PROCEDURES

2.7 IT GOVERNANCE PRACTICE

2.8 IT PROCESS ARCHITECTURE PRACTICE

2.8.1 ITSM PROCESS REFERENCE ARCHITECTURE

2.9 CONTINUAL SERVICE IMPROVEMENT (CSI) PRACTICE

2.10 ASSESSMENT PRACTICE

3 ORGANIZATIONAL CONSIDERATIONS

3.1 ORGANIZATIONAL CHANGE MANAGEMENT (OCM)

3.2 ORGANIZATIONAL GOVERNANCE

3.3 IT GOVERNANCE

3.3.1 COMPLIANCE

3.3.2 RISK MANAGEMENT

3.3.3 PERFORMANCE MEASUREMENT

3.3.4 RESOURCE MANAGEMENT

4 RISK MANAGEMENT

5 QUALITY, PERFORMANCE AND ASSESSMENTS

5.1 SERVICE QUALITY MANAGEMENT

5.1.1 PHASE 1: “PLAN” - QUALITY APPROACH

5.1.2 PHASE 2: “DO” - ESTABLISH AND EXECUTE THE QUALITY APPROACH

5.1.3 PHASE 3: “CHECK” - MONITOR AND REPORT SERVICE QUALITY

5.1.4 PHASE 4: “ACT” CORRECT AND CONTINUALLY IMPROVE

5.2.1 APPROACH TO PERFORMANCE MANAGEMENT

5.2.2 TECHNICAL AND NON-TECHNICAL IT PERFORMANCE MANAGEMENT

5.2.3 PROCESS PERFORMANCE METRICS

5.2.4 METRIC AND MEASURES ATTRIBUTES

5.3 PROCESS CAPABILITY ASSESSMENTS

5.3.1 PROCESS CAPABILITY ASSESSMENT TOOL (PCAT)

5.3.2 CAPABILITY LEVELS

6 COMMON PROCESS CONTROL

6.1 COMMON PROCESS CONTROL ACTIVITIES

6.2 ESTABLISH PROCESS FRAMEWORK

6.3 MONITOR, MANAGE AND REPORT

6.4 EVALUATE PROCESS PERFORMANCE

7 ROLES AND RESPONSIBILITIES

7.1 EXECUTIVE SPONSOR

7.2 DOMAIN OWNER

7.3 SERVICE OWNER

7.4 SERVICE MANAGER

7.5 PROCESS OWNER

7.6 PROCESS MANAGER

7.7 PRODUCT OWNER

7.8 SUBJECT MATTER EXPERT (SME)

7.9 OTHER ROLES AS REQUIRED

7.10 GUIDANCE ON RACI DEVELOPMENT

8 GENERAL STEPS FOR DESMF PROCESS DESIGN

8.1 DEFINE SCOPE AND OBJECTIVES

8.2 VALIDATE THE CURRENT ENVIRONMENT

8.3 DEVELOP HIGH-LEVEL PROCESS DEFINITION

8.4 DEFINE ROLES AND RESPONSIBILITIES

8.5 DOCUMENT DETAILED WORK FLOW FOR EACH HIGH LEVEL ACTIVITY

8.6 BUILD THE PROCESS

8.7 DEVELOP APPROPRIATE METRICS AND SUPPORTING MEASURES

8.8 DEFINE AND DOCUMENT COMMUNICATIONS PLAN, KNOWLEDGE TRANSFER AND TRAINING

REQUIREMENTS

8.9 IDENTIFY & IMPLEMENT QUICK WINS

8.10 FINALIZE PROCESS GUIDE

9 DESMF DOMAIN STRUCTURES

9.1 SERVICE STRATEGY (SS) DOMAIN

9.1.1 STRATEGY GENERATION MANAGEMENT (SGM)

9.1.2 BUSINESS RELATIONSHIP MANAGEMENT (BRM)

9.1.3 DEMAND MANAGEMENT (DM)

9.1.4 FINANCIAL MANAGEMENT FOR IT SERVICES (FM)

9.1.5 SERVICE PORTFOLIO MANAGEMENT (SPM)

9.1.6 SERVICE CATALOG MANAGEMENT (SCM)

9.2 SERVICE DESIGN (SD) DOMAIN

9.2.1 DESIGN COORDINATION (DC)

9.2.2 AVAILABILITY MANAGEMENT (AvM)

9.2.3 CAPACITY MANAGEMENT (CapM)

9.2.4 INFORMATION SECURITY MANAGEMENT (ISM)

9.2.5 IT SERVICE CONTINUITY MANAGEMENT (ITSCM)

9.2.6 SERVICE LEVEL MANAGEMENT (SLM)

9.2.7 SUPPLIER MANAGEMENT (SUP)

9.3 SERVICE TRANSITION (ST) DOMAIN

9.3.1 TRANSITION PLANNING AND SUPPORT (TPS)

9.3.2 ASSET MANAGEMENT (AM)

9.3.3 Change Management

9.3.4 CHANGE EVALUATION (EVAL)

9.3.5 CONFIGURATION MANAGEMENT (CfM)

9.3.6 KNOWLEDGE MANAGEMENT (KM)

9.3.7 RELEASE AND DEPLOYMENT MANAGEMENT [RDM]

9.3.8 SERVICE VALIDATION AND TESTING (SVT)

9.4 SERVICE OPERATIONS (SO) DOMAIN

9.4.1 ACCESS MANAGEMENT (ACM)

9.4.2 EVENT MANAGEMENT (EM)

9.4.3 INCIDENT MANAGEMENT (IM)

9.4.4 PROBLEM MANAGEMENT (PM)

9.4.5 REQUEST FULFILLMENT (RF)

9.5 CONTINUAL SERVICE IMPROVEMENT (CSI) DOMAIN

9.5.1 Purpose

9.5.2 Scope

9.5.3 BENEFITS AND EXPECTED OUTCOMES OF CSI

9.6 DOMAIN RELATIONSHIPS TABLE

10 SUPPORTING FUNCTIONS

10.1 ROLES AND RESPONSIBILITIES WITHIN FUNCTIONS

10.2 SERVICE DESK

10.2.1 PURPOSE

10.2.2 SCOPE

10.2.3 BENEFITS AND EXPECTED OUTCOMES OF A SERVICE DESK

10.2.4 RELATIONSHIP TO OTHER FUNCTIONS

10.2.5 RELATIONSHIP TO PROCESSES

10.3 APPLICATION MANAGEMENT

10.3.1 Purpose

10.3.2 Scope

10.3.3 Benefits and Expected Outcomes of Application Management

10.3.4 RELATIONSHIP TO OTHER FUNCTIONS

10.3.5 RELATIONSHIP TO PROCESSES

10.4 ENGINEERING

10.4.1 PURPOSE

10.4.2 SCOPE

10.4.3 BENEFITS AND EXPECTED OUTCOMES OF ENGINEERING

10.4.4 RELATIONSHIP TO OTHER FUNCTIONS

10.4.5 RELATIONSHIP TO PROCESSES

10.4.6 Additional Resources

10.5 IT OPERATIONS

10.5.1 PURPOSE

10.5.2 SCOPE

10.5.3 BENEFITS AND EXPECTED OUTCOMES OF IT OPERATIONS

10.5.4 RELATIONSHIP TO OTHER FUNCTIONS

10.5.5 RELATIONSHIP TO PROCESSES

10.6 TECHNICAL MANAGEMENT

10.6.1 PURPOSE

10.6.2 SCOPE

10.6.3 BENEFITS AND EXPECTED OUTCOMES OF A TECHNICAL MANAGEMENT FUNCTION

10.6.4 RELATIONSHIP TO OTHER FUNCTIONS

10.6.5 RELATIONSHIP TO PROCESSES

11 REFERENCES

11.1 BODIES OF KNOWLEDGE & COLLABORATION

11.2 GOVERNMENT ISSUANCES OR INTELLECTUAL PROPERTY

12 ACRONYMS

13 GLOSSARY

APPENDIX A: “DESMF - A JOURNEY IN MANAGING SERVICE – DISA PERSPECTIVE”

APPENDIX B: ISO/IEC 20000 STANDARDS INFORMATION

APPENDIX C: DOD ARCHITECTURE FRAMEWORK (DODAF)

APPENDIX D: DOCTRINE, ORGANIZATION, TRAINING, MATERIEL, LEADERSHIP AND EDUCATION, PERSONNEL, FACILITIES AND POLICY (DOTMLPF-P)

APPENDIX E: NIST – RISK MANAGEMENT FRAMEWORK (RMF) APPLIED TO INFORMATION

SECURITY MANAGEMENT (SEC)

APPENDIX F: THE ENHANCED TELECOM OPERATIONS MAP (ETOM)

APPENDIX G: SERVICE RISK MANAGEMENT

Appendix H: POC for DESMF Edition III

DESMF Edition III Page 10

1 BACKGROUND

There are many IT management frameworks available for guidance throughout DoD and private industry.

However, the Department lacked an integrated framework that encompasses best practices from multiple frameworks, provides guidance to establish the structure, documentation, and roles and responsibilities to plan, implement, monitor and improve ITSM.

The Defense Information Systems Agency (DISA) commissioned a study from the Open Geospatial Information

Services (GIS) Consortium, Inc. to define the role of Enterprise Service Management for DISA. The study recommended the adoption of a recognized framework for guiding principles in Information Technology

Service Management (ITSM) initiatives. Based on that recommendation, DISA established the ITSM Office

(ITSMO) as an organizational change agent to lead the Agency in process improvement for governance, processes, and technologies to improve the delivery of IT services.

The DISA ITSMO utilized internal DISA expertise, conducted Domain specific workshops and topic related focus groups to create the DISA Enterprise Service Management Framework, Edition I. In May 2013, based on

DoD CIO guidance, DISA and a cross-component working group drafted the Department of Defense Service

Management Framework (DESMF) Edition II which was subsequently published and signed by the DoD CIO on

April 8, 2015.

1.1 PURPOSE AND GOAL

The purpose of the DESMF is to provide guidance on the application of best practices to plan, implement, monitor, and improve service management initiatives and improve the holistic management of all IT services across the DoD. Process initiatives and service implementation efforts should align with the framework.

Supporting this purpose, the document will:

Define the best practices that drive the implementation of the framework

Define the overall structure of the DESMF, to include Domains and processes covering the entire lifecycle of IT Service Management

Provide a general overview of processes in terms of purpose, scope, benefits, lexicon, and roles and responsibilities

Define the controls framework required to meet compliance with the agreed standards

Define the recommended interfaces between the Domains and the processes

Recommend a set of milestones for process implementation and service improvements

The goal of the DESMF is to provide a framework to successfully align the delivery of IT services with the mission of the Department. Successful ITSM integrates the contributions of people, processes, and technology that result in a combined effort to promote new ideas, effectiveness, and efficiencies by standard methods and practices that deliver value to mission partners. The DESMF will assist with efficient and effective industrialization of IT and the consumerization of IT services for value. The use of and compliance within this framework provides a strong foundational structure and approach that can be used by Combatant Commands/Services/Agencies (CC/S/A’s) to deliver quality services to DoD.

To better understand the purpose of the DESMF, it is necessary to understand the difference between a standard and a framework.

For example, ISO/IEC 20000 is a standard and consists of a set of minimum requirements to audit an organization against effective ITSM. The standard promotes the adoption of an integrated process approach to effectively manage numerous linked activities. The core components of the standard contained within two documents are Part

1, which includes requirements specified in “shall” statements that must be adhered to when seeking certification and Part 2, which includes “should” statements that a service provider should consider. More information about ISO/IEC 20000 can be found in the appendix.

A framework is used by an organization as a structure in which to align efforts and establish a minimum level of competency, as well as continually mature and improve. It provides a structure from which an organization can plan, implement, and measure.

The DESMF is based on several frameworks, methodologies, and standards. The flexibility of the DESMF is the ability to adopt and use existing best practices for specific processes and functions within the DoD. Best practices

DESMF Edition III Page 11 and norms may come from bodies of knowledge such as the Information Technology Infrastructure Library

(ITIL), COBIT, the Capability Maturity Model Integration (CMMI), Six Sigma, the enhanced Telecom

Operations Map (eTOM – Business Process Framework), ISO/IEC 20000, ISO/IEC 27001, Total Quality

Management (TQM) etc. Each has a particular area of emphasis but also brings consistency and the ability to measure and improve performance. A common mistake is to assume that the frameworks and standards are exclusive of each other and that all the parts of each must be implemented. The DESMF combines aspects of multiple frameworks and standards, provides a uniform and common language, and outlines guidance to improve effectiveness and efficiency.

1.2 SCOPE OF DESMF

The scope of the DESMF applies to all IT products and services provided by the DoD, and the ITSM processes that support those services. Service implementations and process efforts should align to the DESMF as the authoritative reference framework.

As the DESMF matures and incorporates additional best practices executed throughout the DoD and industry, the aim is to research, develop, incorporate, publish, and promote an authoritative and up-to-date DoD accepted process architecture and service management practices for strategic, tactical, and day-to-day use by the DoD to enable better decision support and quality service delivery.

1.3 ALIGNMENT WITH DOD STRATEGIC DOCUMENTS

As a means to ensure the DESMF contains the strategic elements necessary to provide a focused and purposeful service management framework, key DoD strategic plans and initiatives have been considered and referenced.

The following DoD level strategic baseline documents provide the required strategic alignment and baseline of key strategic concepts considered throughout this framework.

As depicted in the figure below, DoD Strategy Alignment originates from the Executive Branch’s National

Security Strategy (NSS) from which the Chairman of the Joint Chiefs of Staff develops the National Military

Strategy (NMS). Once received, the Secretary of Defense uses the NMS and the Quadrennial Defense Review

(QDR) Report to develop the DoD Strategic Management Plan (SMP) which is then used to produce the more detailed DoD Information Enterprise (IE) Strategic Plan, the DoD CIO Campaign Plan, and the DoD IT

Enterprise Strategy and Roadmap (ITESR). Short descriptions of the DoD IE Strategic Plan, the DoD ITESR, the

DoD CIO Campaign Plan, and the CC/S/A Strategic Plans are provided in the paragraphs below.

DESMF Edition III Page 12

FIGURE 1.3: DoD STRATEGIC ALIGNMENT

1.3.1 DOD STRATEGIC MANAGEMENT PLAN

The DoD Strategic Management Plan (SMP) establishes specific business goals that directly support the Strategic

Goals of the National Military Strategy (NMS). It articulates the goals and objectives of the DoD business domain, while ensuring unity of effort across the enterprise. Key concepts of the DoD Strategic Management Plan are: (1) total force readiness, (2) financial management, (3) information security, (4) agility, (5) improved processes, and (6) increased performance across the Department.

1.3.2 DOD INFORMATION ENTERPRISE STRATEGIC PLAN & DOD IT ENTERPRISE

STRATEGIC ROADMAP (ITESR)

The DoD IE Strategic Plan and the DoD ITESR together, form the basis for a broad approach to achieving the

DoD Joint Information Environment (JIE). These plans articulate how the DoD will strengthen its IT enterprise through integrated and interoperable frameworks to sustain US military might and status as the preeminent war fighting organization in the world. Key concepts in these plans are: (1) information and knowledge as a strategic asset, (2) interoperable infrastructure, (3) synchronized and responsive operations, (4) identity and cybersecurity, (5) optimized investments, (6) agility and interoperability of the Management, Information

Technology, and Cybersecurity workforce.

1.3.3 DOD CIO CAMPAIGN PLAN

The DoD CIO Campaign Plan supports the Department's Strategic Management Plan (DoD SMP) and provides the requirements necessary for the DoD CIO, to "build agile and secure information technology capabilities to enhance combat power and decision making while optimizing value.” It provides guidance to operate and defend the JIE, which enables the DoD to employ warfighting and support capabilities. The JIE is a secure environment, comprised of shared IT infrastructure, enterprise services, and single integrated and secure process architecture to achieve full spectrum superiority, improve mission effectiveness, increase security, and realize IT efficiencies.

DESMF Edition III Page 13

The key concept is to enable a unified IT infrastructure and supporting services which are fully integrated, interoperable, secure, and uses a centralized approach across all organizations within the Department.

1.3. 4 CC/S/A STRATEGIC PLANS

Alignment with the overall DoD strategy and direction is imperative for all CC/S/A across the Department.

CC/S/A include each of the Military Services. As an example, the objectives of the DISA Strategic Plan target is to provide for a Joint Information Environment (JIE) that optimizes the use of the DoD IT assets by converging communications, computing, and enterprise services into a single joint platform that can be leveraged for all

Department missions.

Attainment of the JIE will reduce total cost of ownership, reduce the attack surface of networks, and enable mission partners to more efficiently access the IT resources for their missions. A collaborative JIE enables information sharing and interdependent enterprise services that are seamless, interoperable, efficient, and responsive to warfighter requirements.

CC/S/A Strategic Plans should support and be aligned to the DoD SMP, the DoD IE Strategic Plan, the DoD

ITESR, and the DoD CIO Campaign Plan.

The DESMF in turn, provides a framework and common structure to enable the delivery and support of services to accomplish the mission of the Department.

1.3.5 BENEFITS OF DESMF AND EXPECTED OUTCOMES

Provides a single, definable, repeatable, and scalable documented framework for recommended best practices

Clearly identifies roles and responsibilities for ITSM

Adopting characteristics of a standard service management framework enables organizations to provide higher service quality and availability levels, improve alignment between service provider and mission areas, and improve management of changes to ensure security and capability of the information enterprise

Enables better decision making at all levels by identifying relationships and information items exchanged by all processes throughout the Service Management lifecycle

Services supporting the war fighter and/or mission partner will be implemented faster, more efficiently, and with higher quality

Services will be measured transparently and will be traceable through the component and Agency level strategies to those of the DoD

The costs associated with the entire service lifecycle are understood

Compliance and subsequent auditing will be stabilized through repeatable processes

Better understanding of the importance of IT services and the value derived from each service both from the provider as well as the mission partner perspective

Supports ability of IT to measure and thus improve internal performance in provisioning IT services

Improved mission partner satisfaction through a more professional, efficient approach to service delivery and support

Secure information and data exchange

Enhanced ability to mature and increase performance based on information and knowledge feedback into processes and services

Cost effectiveness and efficiency are realized by identifying duplications for upgrade or removal

1.3.6 CRITICAL SUCCESS FACTORS (CSFS) FOR FRAMEWORK ADOPTION

The successful adoption of the framework depends upon the following CSFs:

Form a guiding coalition – Create a forum to provide guidance on enhancing and maintaining the DESMF

Create vision – Clearly identify the gap that this initiative is trying to close between the use of current process frameworks and the future consolidated framework

Communicate the vision – Create a directed training and communications plan for the adoption of the DESMF

Create short term wins – Identify, mitigate, and report on issues related to how services are currently provided http://www.itilnews.com/ITIL_-_IT_Service_Management_-_Do_you_believe_the_hype.html

DESMF Edition III Page 14

Create Key Performance Indicators (KPIs) – KPIs are required to measure each CSF

Align KPIs – KPIs are required to align with mission partner and DoD goals and plans

1.3.7 GUIDANCE AND IMPLEMENTATION PRINCIPLES

The basic lexicon for the DESMF is taken from ITIL®.

Rationale: ITIL® is the most widely used framework in the world to support service management as related to

ITSM. A single ITSM lexicon is necessary to ensure proper communications related to the DESMF.

Implications: The various branches of the DoD should maintain a cooperative approach to defining, accepting, and socializing this terminology.

Each process should have a single Process Owner, accountable for process quality and integrity.

Rationale: Divided ownership creates a less optimized process and increases the likelihood of overlapping responsibilities or gaps, and areas of the process being measured.

Implications: The various reporting structures within the C C / S / A should allow f o r a s i n g l e o wn e r o f e a c h p r o c e s s . O n e wa y t o i mp l e me n t i s t o a l l o w for a matrix authority environment.

Processes and services should be designed with sufficient flexibility to ensure that not only the current needs of the warfighter are addressed, but that future needs in technology and capacity are anticipated and accounted for as part of the service lifecycle.

Rationale: Warfighter requirements change rapidly in a cyber-environment and current processes must support agile service development and implementation.

Implications: Principles of agile development and understanding of concepts such as capacity on demand needs be applied to all areas of support and development.

With the understanding that particular procedures and work instructions differ between and even within CC/S/A, there should be consistent processes.

Rationale: In order to provide proper governance and measure the overall effect of implementing the DESMF, it is necessary to have consistent processes.

Implications: The various branches of the DoD should maintain a cooperative forum to continually improve the overall framework.

1.3.8 UTILIZING THE FRAMEWORK FOR PROCESS IMPROVEMENT

The steps below are a high level perspective (not intended to be all-inclusive) of how to implement an ITSM or process improvement effort in an organization where this is a new or ongoing initiative. These steps correlate to the

DESMF in the recommendation of creating Domains in order to aggregate and integrate tightly coupled processes in order to more easily manage and communicate progress. The Domains are areas of decision support and should be used dynamically to support service agility and performance. The Domains are groupings of related processes that represent five stages of the service lifecycle; Service Strategy, Service Design, Service

Transition, Service Operations, and Continual Service Improvement. The DESMF provides guidance; however it is up to the organizations discretion as to how to adopt best practices and adapt them to work in their specific environment.

DEFINE OUTCOMES FOR IMPLEMENTATION

o Define CSFs and KPIs for each process o Create the process implementation roadmap – this is the overall plan to identify the order of the process implementations and how the implementation should occur

CREATE GOVERNANCE STRUCTURE AND ALIGN WITH DOMAINS

o Define the Area of Responsibility (AOR) for each Domain o Define the Governance workflow o Develop the Governance Communications Plan o Develop the process architectures for the Pilot, Initial Operating Capabilities (IOC), and Full

Operational Capabilities (FOC) support organizations required and align with current and future-state organizations for ownership

DESMF Edition III Page 15

DEFINE ORGANIZATIONAL PROCESS OWNERSHIP

o Identify areas best suited for ownership of processes o Identify Process Owners o Create the implementation roadmap to ensure Process Owners are available to give guidance to other Process Owners at appropriate phases of implementation

CREATE A TRAINING PLAN

o Develop framework training requirements o Identify required training levels

• Domain Owner

• Process Owner

• Process Manager

• Service Owner

• Service Manager

• General Staff

• Other Stakeholders as necessary

DETERMINE RISK STRATEGY

o Define criteria for decisions o Identify risk assessment processes o Define risk register o Identify risk mitigation activities

DEFINE COLLABORATIVE RELATIONSHIPS

o ITSM Office o Project Management o Development Organization(s) o Operations Organization(s) o Other organizations as necessary

The Navy ITSMO has developed and published a guide that provides a comprehensive approach to planning, designing, developing, and deploying ITSM capabilities with recommended phases, activities, tasks, and work products. The audience for this development guide is the integrated process teams, partner organizations, programs, process design and implementation teams. The ITSM Implementation Roadmap consists of eight phases from defining the organization’s ITSM strategy, to initial inception of the project, through deployment and operation of the new or updated capability.

For more information on the ITSM Lifecycle and supporting work products, contact the Navy ITSMO at

ITSMO@navy.mil or visit the Navy ITSMO portal at https://www.milsuite.mil/wiki/Process_Architecture mailto:ITSMO@navy.mil https://www.milsuite.mil/wiki/Process_Architecture

DESMF Edition III Page 16

2 ESTABLISHING AN IT SERVICE MANAGEMENT OFFICE

Within large organizations, IT Service Management (ITSM) typically begins as a set of disparate efforts to help guide, manage, and improve IT service delivery and support. The Department of Defense (DoD) is no exception -it is a large and geographically dispersed organization with subordinate services and CC/S/As executing unique missions on a global scale under the National Command Authority. Many groups within the DoD are well underway in IT Service Management (ITSM) initiatives, and are realizing the value of formal and informal structures to align their approaches to the DESMF.

Some organizations position the ITSMO with authority and responsibility to execute and implement ITSM, other organizations stipulate the ITSMO is an advisory and support office to support ITSM adoption and champion

Continual Service Improvement (CSI). The perspective of this excerpt is that the ITSMO does not have direct operational authority within an organization. An organization should have a single office/authority/method from which to obtain their service management training, artifacts, templates etc.

Whether an informal committee or formal organization, the IT Service Management Office (ITSMO) serves as an enabler and catalyst – facilitating process, technology, and service ownership, informing and training the larger organization, and ultimately driving improvements. The end state of all ITSM initiatives should be effective, efficient, and secure IT services.

An ITSMO serves to:

Champion end-to-end standards-based IT

Collect, assemble, and distribute service management knowledge throughout the organization

Monitor and improve processes and services using defined metrics and consistent approach

Drive shared ITSM capabilities (e.g. ticketing tools, CMDB)

The ultimate goal of any ITSMO should be to ensure that delivered IT services are fit for purpose, fit for use, stable, secure, reliable and fully support the DoD mission and objectives in concert with the vision for a Joint

Information Environment (JIE), where interoperability across programs and systems reduces operational inefficiencies and management costs.

An ITSMO at the highest Enterprise level in the DoD is chartered as an integral part of the JIE. Its role would be as stated in the Purpose paragraph of this document. To achieve benefits from improved ITSM practices, the

Military Services and major commands are encouraged to establish ITSMOs at the appropriate level for their mission or leverage already established ITSMOs. When considering the establishment of an ITSMO, there is no single solution; rather, it must fit the needs of the organization in alignment with the organization’s mission objectives.

2.1 PURPOSE

The purpose of an ITSMO is to coordinate and govern the development and execution of a customer-focused, organization-wide approach to IT Service Management - one that drives improved service quality and interoperability across DoD organization networks to support the JIE strategic goals and efficiency initiatives via standard ITSM processes. Specifically, ITSMOs are usually charged with some or all of the following responsibilities:

Creating, maintaining and publicizing a Service Management System (SMS) as defined by ISO/IEC-

20000 in support of organizational IT objectives

Coordinating the development and maintenance of a mission-aligned IT service catalog and associated service level targets

Coordinating and supporting the execution of IT processes

Providing shared services, such as ITSM tools or service reporting

Establishing an ITSM process architecture with appropriate implementation guidance

Prioritizing and aligning ITSM development and improvement activities

Managing change while implementing a service management culture

Measuring and demonstrating ITSM value to mission stakeholders

Championing Continual Service Improvement (CSI) and coordinating improvements

DESMF Edition III Page 17

2.2 ITSMO MANAGEMENT PRACTICES

The ITSMO is charged with overseeing and aligning organizational ITSM capabilities and initiatives across the organization in support of enterprise goals and objectives. In doing so, the ITSMO will establish a standardized approach to service management through the adoption and implementation of a SMS

(see Notional SMS figure below). ITSMO focus areas should include but are not limited to:

Ensuring alignment between IT services and DoD operational mission objectives: Realize direct linkage between the IT services delivered and the needs of end-users to ensure IT delivers defined and measurable value to the supported mission

Drive efficiency and interoperability across DoD IT organizations and programs in support of JIE goals and objectives: Advocate defined, measurable IT services and standardized service management practices across the enterprise to improve interoperability of programs and systems

Coordinate the development and improvement of required ITSM competencies: Establish consistent visibility into the mission/business perspective of IT performance, with the mechanisms in place to inform future IT investment decisions and management actions to improve overall service quality

To accomplish these goals, the ITSMO should create a SMS detailing specific practice areas that focus on discrete aspects of IT Service Management. A practice area is a discrete grouping of ITSM capability to foster focus, training, and consensus within the larger ITSM lifecycle. Each practice area should contain usable artifacts and deliverables in the form of templates, guides, primers and other tools that stakeholders can leverage. Each practice area should be under the leadership of SMEs for that area, who are available to assist the organizations with governance, assessment, process architecture, and organizational change management disciplines.

FIGURE 2.2: NOTIONAL SERVICE MANAGEMENT SYSTEM (SMS)

DESMF Edition III Page 18

2.2.1 ITSM OFFICE PRACTICE AREAS

Appointment is typically made from the sponsoring authority for the Director of the ITSMO. The Director functions within the scope of delegated authority to ensure resources are available for each ITSMO practice area.

The number of resources will vary within each organization, and in some cases individuals may perform in more than one practice area; however, ideally each practice area is led by one or more government personnel who provide oversight for SMEs assigned to the practice area. The practice areas and their nominal descriptions are listed in the table below:

Practice Area

Description

ITSMO Management

Serves as the facilitator for organizational ITSM implementation and governance

Operates the ITSM governing board which, in turn, can sanction the creation and chartering of subordinate boards, working groups and committees as required either on a permanent basis or as temporary entities depending on need.

Manages stakeholder communications (plans, strategies and channels) to include governance bodies.

Develops training and awareness programs.

Facilitates mentoring and training of ITSM teams.

Directs and coordinates ITSMO practice area activities in support of stakeholder requirements.

Execute organizational change management activities and champion the ITSM value proposition across the enterprise.

IT Governance

Applies international frameworks, standards, and best practices (e.g., ISO/IEC

38500) that ensure senior leadership intent, direction and policy expectations for

IT are met, performance is measured, and that resources and risks are identified and managed.

IT Process Architecture

Develops, sustains, and improves enterprise ITSM process architecture.

Defines minimum standards and conventions for the process architecture.

Conducts process architecture reviews with ITSM design and implementation teams.

Facilitates integration and prioritization of ITSM initiatives via an Implementation

Roadmap, and supports integration of processes throughout the ITSM lifecycle.

Supports the provisioning of ITSM tools (i.e., a ticketing system, CMDB and monitoring capabilities) and a shared reporting service.

Continual Service

Improvement

Provides guidance related to quality and capability improvement methods, process capability assessments, and other disciplines related to service management in segmented environments.

Assessment

Develops, sustains, and improves an international standards-based (e.g., ISO/IEC

20000) process capability assessment model and supporting toolset.

Develops and provides assessor guidance and training.

Provides IT Risk Management guidance, tools and templates.

ITSM Strategic

Communications

Develops stakeholder engagement strategies to identify key communication themes and messages.

Develops outreach tactics, techniques and procedures to establish a baseline awareness and understanding of the ITSMO among stakeholders and end-users.

Develops, sustains, and improves a strategic communications plan

Facilitate the creation of repositories (i.e. SharePoint) for the collection of process and service documentation. The overarching goal is to get the right information to the right people at the right time in the right format using the

DESMF Edition III Page 19

TABLE 2.2.1: ITSM OFFICE PRACTICE AREAS

It is critical to develop clarity regarding roles within the ITSMO. Well-defined leadership structures and reporting relationships are essential in seamlessly integrating the ITSMO into the hierarchy of the organization.

Cross-functional and supporting roles should also be defined in concert with the organizational structure.

2.2.2 AUTHORITY

The ITSMO functions under the authority contained in a charter that is signed by the highest level possible within the chain-of-command. In so doing, the ITSMO acts on behalf of the chartering authority to execute all ITSM activities defined within the scope of the charter.

2.2.3 ITSM OFFICE SCOPE

The scope of activities for the ITSMO usually includes the development and management of an integrated service management ITSM process reference architecture and establishment of a quality management system. It includes the oversight and alignment of ITSM development and improvement activities in support of that process architecture.

The ITSMO champions the identification and designation of ITSM Process and Service Owners and provides guidance, direction, and oversight to ensure consistency and alignment with the policies, standards, and guidance established by the office.

2.2.4 ITSM OFFICE FUNCTIONS & RESPONSIBILITIES

Key functions and associated responsibilities include, but are not limited to:

ITSM Strategy o Establish an organizational ITSM strategy and roadmap o Facilitate the identification and assignment of roles and responsibilities in support of the strategy

Governance o Establish, execute, and refine governance over ITSM resources and efforts o Conduct regularly scheduled ITSMO Governance Board meetings with assigned board members to provide direction, facilitate decision making, receive exceptions and proposals, and communicate status o Identify, assign, and delegate authority to subordinate ITSM governance boards, working groups and committees

Strategic Communications o Manage organizational change management through communications with members, stakeholders, and governance bodies o ITSM advocacy support through the development of training and awareness program and facilitate mentoring and training of ITSM teams o Champion the ITSM value proposition across the organization

Service Quality o Establish a quality management approach that defines the plan and methodology for achieving quality in all provisions of services and processes o Develop and execute quality and performance standards to monitor and report the health of the

IT services o Coordinate or conduct assessments of processes and services o Oversee and support execution of CSI efforts in compliance with process architecture, quality, and performance management

Process Architecture o Develop enterprise ITSM process reference architecture, define minimum standards, and conventions for that process architecture o Conduct process architecture reviews with ITSM design and implementation teams right medium. This practice area utilizes any existing Knowledge Management database structure to warehouse and disseminate stakeholder communication products and services. However, if a functional Knowledge Management process area does not exist, this practice area attempts to handle it on a sufficient scale to accommodate all users.

DESMF Edition III Page 20 o Facilitate integration and prioritization of ITSM initiatives via an Implementation Roadmap, and ensure interoperability o Support the selection and maintenance of ITSM tools, such as ticket tracking systems, infrastructure and application management and monitoring tools o Provide reporting on the health of IT processes and services which may include issue resolution if the issue brought forth is a process issue o Provide templates to promote standardization and consistency in support of ITSM efforts

(requirements doc, CONOPS, design docs, SOPs, charter, project plan, etc.)

2.3 ITSMO COMMUNICATIONS PLAN

To effectively communicate and manage organizational change, the ITSMO should develop a comprehensive communications plan that addresses baseline messaging for internal and external stakeholders. All ITSMO communications should be predefined and crafted to ensure consistency and standardization of informational products. The messaging should be divided into two distinct groups:

Core messages consist of general information that establishes a foundation of understanding to include

ITSM objectives, and how they will impact stakeholders, for example:

o ITSMO strategic vision and mission statement o ITSMO approach to IT Service Management initiatives and training o ITSMO portfolio of products and services

Key themes are critical advisory messages communicated to stakeholders, or targeted segments, to provide additional detail about ongoing initiatives and how they affect the stakeholder community, for example:

o ITSM strategy development capabilities o ITSMO Governance of enterprise IT artifacts o Training for Service Owners, Service Managers, o Process Owners and Process Managers o Strategic Communication of the ITSM value proposition o IT Service Quality capabilities o ITSM process reference architecture establishment, updates, policies and standards

2.4 STAKEHOLDER REGISTRY

A thorough review of existing and potential ITSMO stakeholders should be undertaken to identify key stakeholders with vested and continuous engagement in ITSMO activities from other stakeholder communities who have expressed an interest but are less engaged with ITSMO activities, products, or services. The resulting segregation of an ITSMO stakeholder registry enables efficient and effective targeting of stakeholder segments based on strategic engagement and interest.

2.5 COMMUNICATION CHANNEL ANALYSIS

Once stakeholders have been identified and appropriately segregated, a detailed channel analysis should be performed and aligned with the overall communications strategy. A thorough channel analysis will chronicle available outlets for strategic communications products as suggested in the table below.

http://www.itgi.org/About-Governance-of-Enterprise-IT.html

DESMF Edition III Page 21

TABLE 2.5: STRATEGIC COMMUNICATIONS CHANNEL ANALYSIS

2.6 REQUEST PROCEDURES

Request Procedures should describe the steps required to submit, process, and manage various requests to the

ITSMO. Any ITSMO stakeholder should be able to submit a request for information or services which are, ideally, available through a published catalog and tracked from submission to completion.

2.7 IT GOVERNANCE PRACTICE

A key practice area within the ITSMO is IT Governance. The ITSMO must be able to offer guidance and assistance to organizations seeking to design and implement a governance structure that meets their organizational needs for positive control and oversight of the enterprise.

IT Governance is a compilation of all governance activities, people, governance bodies, policies, documentation, templates, strategy, charters, and models in a holistic framework that provides visibility and positive command and control of the organization. Many of the components are built during creation of the strategy, operating guide development, and project execution activities. The figure below illustrates an example of components.

It is important for project team leaders to understand that establishing governance is more than creating a charter;

there are multiple moving parts, initiatives, and artifacts that have to be created and managed to fully achieve IT governance within an organization.

Method Communication Channels

Direct Communications

Email

Telecommunications

Scheduled Meetings

Governance Board Meetings

Awareness, Education and Training Sessions

Conferences/Trade Shows

Publications

DoD Periodicals

Potential Press Releases in other Publications

Websites

Portals

APAN, milSuite, etc.

DESMF Edition III Page 22

FIGURE 2.7: EXAMPLE OF IT GOVERNANCE COMPONENTS

2.8 IT PROCESS ARCHITECTURE PRACTICE

The IT Process Architecture practice develops, sustains, and improves the organization’s ITSM process reference architecture to enable and maintain the alignment of the IT processes and services in support of the organization’s mission. The practice defines minimum standards and conventions for that process architecture and conducts process architecture reviews with ITSM design and implementation teams. It also facilitates integration and prioritization of ITSM initiatives via an Implementation Roadmap, and supports integration of the processes throughout the ITSM Lifecycle. The Process Architecture team of ITSMO SMEs assists the organization with selection, adoption, training, and employment of IT Process Architecture principles and artifacts.

2.8.1 ITSM PROCESS REFERENCE ARCHITECTURE

The ITSM process reference architecture should be developed and used to describe how the organization’s functions and service providers work together to manage IT services in support of the mission. The key activities usually associated with this architecture practice are:

Developing and maintaining an ITSM Process Reference Architecture to enable centralized planning and decentralized development and execution of processes. The model should contain the following components:

o Complete list of ITSM processes defined for the organization o Process purpose, scope, and outcomes for each o Activity level details, workflows and diagrams o Information work products (inputs and outputs) o Process roles and skills o Roles/Responsibility RACI o Metrics (CSFs supported by KPIs) o Functional tool requirements

DESMF Edition III Page 23

Developing and maintaining an ITSM Glossary

Developing and maintaining an ITSM Implementation Roadmap for the ITSM Lifecycle

Developing standardized process development artifacts, templates, and training materials that support the lifecycle and planned roadmap

Provide training and guidance to ITSM design and implementation teams and stakeholders

Establishing process architecture review criteria and conducting Process Architecture Reviews to assess development efforts and provide recommendations for alignment

2.9 CONTINUAL SERVICE IMPROVEMENT (CSI) PRACTICE

The CSI Practice area in an ITSMO contains a Service Quality Management approach as well as IT Service

Performance Management guidance. This guidance supports the organization in seeking to baseline services and implement service quality improvement. The service quality maxim “if you can’t measure it, you can’t manage it” rings true for the delivery of quality services to the customer, and this practice area helps stakeholders define, gather and analyze appropriate…