ISO 20k GAQM p050-065

Service Continuity Plan Information

• Invoking procedures criteria and responsibilities during major service loss must be included in the service continuity plan
• Service availability targets when the service continuity plan is invoked must be included in the service continuity plan
• Service recovery requirements and the procedures for returning to normal working conditions must be included in the service continuity plan.
• Any results of service continuity tests can be documented in the plan as well
• Risks to service continuity can be documented in the Risk Register
• Reporting on a service continuity event, its impact, and when the service continuity plan was invoked can be done using the generic Report Template
• Opportunities for improvement can be recorded and implemented within the 10.2 CSI Register.xlsx improvements

Mandatory Documented Information

• Clause 10.1 addresses nonconformities and actions taken, using the 10.1 Nonconformities.xlsx template.
• Clause 10.2 deals with opportunities for improvement and implemented improvements, using template 10.2 CSI Register.xlsx
• The list of nonconformities results from internal audit findings, documented in a spreadsheet including a reference number, description, owner, due date, action log, completion date, and status.
• The CSI Register tracks improvement opportunities arising from processes, continual service improvement plans, risks, and other sources via a spreadsheet including a reference number, description, owner, due date, action log, completion date, and status.
• Internal Audits should occur yearly, or in multiple sessions, by qualified personnel with knowledge of ISO 19011 standards for internal audits of management systems, irrespective of external certification audits
• The setup for internal audits is detailed in the Internal audit program template, with the Audit Report as the deliverable

Management Reviews

• Management reviews should be held at least once a year, with twice a year preferred, to update top management on the state of SMS and services based on inputs from the risk register and measurements of processes/services
• Management reviews should give an executive summary rather than going into full detail

Implementing ISO/IEC 20000-1:2018 and Running the SMS

• Successfully running a service management system (SMS) means consistently integrating it into daily operations, where documented information supports the operational processes
• Phases to running the SMS includes planning, implementation, operation, evaluation, and continual improvement
• These phases run on the Deming Cycle (Plan-Do-Check-Act, PDCA) framework

Planning an SMS

• Developing an SMS is typically triggered by needed service change, resulting from internal needs to reorganize, reduce costs, increase revenue, customer feedback indicating dissatisfaction, competitors introducing innovation, or digital transformation goals
• Methodologies, such as Lean, Six Sigma, ITILs seven step continual improvement, can drive large and small-scale improvements necessary in the services and existing service management practices
• SMS is rarely developed when existing service management practices do not exist, instead builds of existing practices
• Actual planning activities are the most responsible for the implementation of an SMS
• Adequate time should be spent in the planning phase, starting with a high-level picture of the SMS

Service Requirements

• Service requirements is where the the SMS starts
• Clause 1.1 of ISO/IEC 20000-1 states that the SMS should meet service requirements and create value by asking stakeholders of the SMS, including customers, suppliers, employees, management, and supporting departments.
• Customers have requirements related to service performance, availability, and support.
• Suppliers need smooth interaction with the service provider.
• Employees require effective processes supporting their daily tasks.
• The value that the SMS and the services create for stakeholders, includes return on investment, effective support of business outcomes, job satisfaction and fulfillment of commercial goals.
• Service requirements and value creation involve talking to stakeholders and creating a list as part of practical activity.
• PDCA dictates that the planning phase is repeated.
• Service requirements must be prioritized with top management involvement, in accordance with Clause 5, accountability and ensuring all activities needed happen
• Top management can prioritize service requirements, develop service management policy, and maintain stakeholder relations
• The SMS needs a service management policy, service management objectives, and a service management plan, created and ensured by management
• The plan must contain information on how the SMS and services will be operated, measured, improved, and resourced
• The service management policy states the SMS needs, service management objectives describes goals, and service management plan how the SMS is achieved
• Top management is responsible for resources like people, information, finances, and tech for service management
• People in the SMS should be appropriately trained and experienced, assessed and updated regularly
• Information resource management and knowledge distribution for standards and ISO/IEC 20000 require knowledge management system (KMS) from simple to extensive

SMS within the Company

• The SMS does not exist in isolation from the rest of the company.
• Many parts of the company, like HR, finance, sales, facilities, should be stakeholders
• The SMS requires collaboration from other departments to align
• Governance by integration is required to run the process side of the SMS
• Governance requires responsibilities and effective process interaction
• Governance is accomplished with the following from ISO/IEC 38500: Evaluate, Direct and Monitor
• Responsibilities are allocated to the process manager or owner
• Top management requires reporting from process owners
• Incident and problem management must interact to exchange information
• Change management interacts with configuration, business relationship, and service level management.
• Processes should be documented to detail process outputs and inputs, clarifying staff influence on business outcomes.
• Awareness of communication should be given to staff
• Service desk agents must register service requests for implementation
• Agreed service levels must be verified to set customer expectations
• Processes can be based on existing ones even if undocumented, modifying based on service and stakeholder needs
• Pilot environments tests ensure expected results and require documentation and measurement with performance criteria and effectiveness

Planning Work

• Services use components from suppliers.
• ISO/IEC 20000 focuses on SMS with use of suppliers
• Distinctions are made between third party suppliers, customer acting as suppliers, and internal suppliers
• Clarifying component providers clarifies process interactions, service targets, and internal and external applications
• Service targets agreed with customers determines supplier service targets, resolving incidents quickly and running risk of exceeding customer SLA

Operating Stage

• Successfully implementing the initial planning stage means operating the SMS should be straightforward.
• Changes can impact organizations, updating docs, informing stakeholders, can use OCM org change management, such as John P. Kotter's eight step process
• Organizational change is ensured through shared understanding and support from top management through communication
• SMS requires continual focus on the activities and values generated
• Observe process effectiveness and address areas impacting improvement
• Roles and responsibilities must be reviewed and adapted when processes change, may require technical requirements for owner's role

Operating the Rest of the SMS

• Resources must available to support SMS
• Staff must be competent and adequately trained for SMS
• Changes to services cause changes to job descriptions that may trigger educational and hiring changes.
• Periodic SMS reviews ensure it adequately meets requirements, marketplace demands, and customer expectations

Periodic Reviews of the the SMS should include

• Service management policy
• Objectives and plan
• Review the organizational operations, alignment with the SMS, and adapt due to service level changes
• Implement a process for major changes, design, service transfers involving all requirements, assess risk, and project based approach.

Evaluating the SMS

• Evaluating the SMS is in clause 9
• Consists of the following three elements: Reporting, Management review and Internal audit.
• Clause requires that there is reports that analyse and monitor the SMS and service
• Commercial service management platforms are a resource that gathers data on incidents and analyses and reports performance
• Gathering data may require third party software that helps with processes and service
• Process performance should be measured, analyzed and reported
• Lean value is great by using data such reporting and aspects in planning process

Reports

• Reports are best in a graphical way
• Must have a meaningful and appropriate image that gives the message
• Top management needs generic data more than staff data
• Customer and supplier need appropriate data

Risks

• Risks should be reported on in various areas
• These can be created in risk to the SMS in general, to service availability and continuity, to information security, risks around service requirements, and risks regarding the use of suppliers

Management Review

• Management review is an opportunity to talk to the top level of management and show them status
• Have discussions of performance, resources, the SMS, improvement ect
• Review by organizations annually or quarterly

Audit Program

• An audit program is required to have a internal ISO/IEC 20000 audit done
• Setup a sample of the SMS is often helpful in that it save time
• Internal auditors cant be biased

Improving

• Improving is a process in the Deming Cycle
• Feedback should be fed into an continual improvement process that evaluates, prioritizes, and executes these improvement opportunities.
• Create a Kanban board to organize and allocated task
• Nonconformities and improvements are mentioned in the standard
• Items are items that need to be discussed in management reviews and should therefore should get top management attention.

ISO/IEC 20000 and the Deming Cycle

• The Deming Cycle is a closed loop
• Improvements that occur and feedback are recycled through it
• The Cycle goes in these phases: Implementing--> Operating-->Evaluating-->Improving

Certification

• The following are requirements of Organizations with a implementing standard of the ISO/IEC20000-1
• Efficiency
• Reducing costs
• Service equality
• Customer satisfaction improvements and value for services
• If requirements of the ISO/IEC 20000-1 are met then a external audit will be required for a certification
• Documented information is required for certain amounts, auditors need that information communicate to them that they need access to.
• Organizations shouldnt change the polish with the job to make it seem how its is, it an opportunity to improve