ISO 20k GAQM p024-033

• Chapter provides guidance to implement and document the requirements of ISO/IEC 20000-1.
• Explains ways to conform and refers to document templates from the ISO/IEC 20000-1:2018 Documentation Toolkit based on the standard's text.
• Guidance often exceeds the standard's requirements, based on general good practices.
• The risk register in the documentation Toolkit is more extensive than strictly required, benefiting the organization and integrating management systems.
• Mandatory documentation is explicitly mentioned in the standard as available.
• Non-mandatory documentation is mentioned in phrases like "the organization shall determine" without explicit availability requirements, but is in the Toolkit.
• Documenting non-mandatory items benefits the organization, and auditors often seek evidence of conformance.

Clause 4

• Template: 4.3 Scope.docx
• The only mandatory documented info is the scope statement (Clause 4's requirements).
• Scope statement: single sentence with organization's name, service types, locations, and possibly customers.
• Toolkit document: includes intro, terms, definitions, policies, organization chart, scope statement, and future scope changes.
• The toolkit is more extensive, with useful but non-mandatory information

Non-mandatory Documented Information

• Clause 4.1: Issue Tracker (4.1 Internal and External Issue Tracker.xlsx template).
• Clause 4.2: Interested Parties (4.2 Interested Parties.xlsx template).
• Determining relevant internal and external issues can result from SWOT and/or PESTLE analyses.
• SWOT analysis is an overview of internal Strengths and Weaknesses, and external Opportunities and Threats.
• The Internal and External Issues Tracker template is a more detailed version, registering issues with follow-up actions and owners.
• Issues may become risks or improvement opportunities, linking to respective registers.

Interested Parties

• Interested parties can be internal groups (HR, Finance, Sales, Security) or external (customers, suppliers, regulatory bodies).
• The interface between organization and interested party is a contact person or system.
• The reason why the party is interested is based on requirements for SMS and services.
• PESTLE analysis examines Politics, Economy, Social, Technological, Legal, and Environmental aspects.
• Political aspects: Government policies, wars, terrorism, intercountry relationships, bureaucracy.
• Economic aspects: Local economy, taxes, international trade, seasonality.
• Social aspects: Brand, company/tech image, ethical and cultural issues, media views, demographics.
• Technological aspects: Emerging technologies, competitor technology; development, market readiness.
• Legal aspects: Current/future legislation, regulatory bodies, competition law, and industry regulations.
• Environmental aspects: Environmental regulations, ecology, and sustainability.
• SWOT and PESTLE produce a list of issues/factors, positive/negative, internal/external, in a simple list.

5.2 Clause 5

• Mandatory Documented Information:
  • Clause 5.2: Service Management Policy (Template: 5.2 SM Policy.docx).
• The service management policy is concise, stating commitment to service management and establishing a framework of service objectives.
• Policy commits to fulfilling ISO/IEC 20000-1 requirements and continual SMS/services improvement.
• The template may be altered to reflect the service management principles used in an organization.
• Ensure the policy is available to relevant parties.
• Non-mandatory Documented Information:
  • Clause 5.3: Roles, Responsibilities, and Authorities (Template: 5.3 RRA.docx).

5.3 Clause 6

• Mandatory Documented Information:
  • Clause 6.1: Risks (Template: 6.1 Risk Register.xlsx & 6.1 Risk Register - Basic.xlsx).
  • Clause 6.1: Impact of Risks (Template: 6.1 Risk Register.xlsx & 6.1 Risk Register - Basic.xlsx).
  • Clause 6.1: Risk Acceptance Criteria (Template: 6.1 Risk Management Framework.docx).
  • Clause 6.1: Risk Management Approach (Template: 6.1 Risk Management Framework.docx).
  • Clause 6.2: Service Management Objectives (Template: 6.2 SM Objectives.docx).
  • Clause 6.3: Service Management Plan (Template: 6.3 SM Plan.docx).
• Risk management in ISO/IEC 20000-1 isn't a heavy process. Documenting is limited to risks related to the org, not meeting service requirements, and other parties in service lifecycle.
• Includes the impact upon customers for the SMS and services needs to be determined, together with a risk acceptance criterion
• Additional risks identified elsewhere might also include service availability, service continuity and information security risks..
• Two provided Risk Register Templates: basic or extended (containing more info, also for risk management in ISO/IEC 27001).
• The risk register provided is a general operational risk management tool.
• Roles, responsibilities, and authorities for running the SMS in practice can be in the job descriptions of personnel.
• To highlight specific roles/responsibilities/authorities/qualifications explicitly, use the template document.
• In a straightforward spreadsheet:
  1. Date risk opened.
  2. Name of risk.
  3. Description.
  4. Reference number.
  5. Date of last update.
  6. Relevant ISO standard (20000-1 in this case).
  7. Owner of risk (the person who acts).
  8. Management review (indicator of whether management has reviewed).
• Impact rated on a 1 (Low) to 5 (High) scale if risk happens.
• Likelihood rated on a 1 (Low) to 5 (High) scale.
• Risk = Impact x Likelihood, scale of 1 to 25.
• Risk level: High, Medium, or Low (based on item 11).
• Treatment is the chosen approached: Accept (do nothing), Reduce (implement controls), or Transfer (someone else accepts the risk).
• Action plan: log of risk treatment activities.
• Due date: date risk should be treated.
• Completion date: actual treatment completion date.
• Status: open or closed.
• Post-action plan impact (same as Impact), recalculated after treatment, should be lower than original unless risk is accepted.
• Post-action plan likelihood (same as Likelihood), recalculated after treatment, should be lower unless accepted.
• Post action plan risk (same as Risk), recalculated after treatment, should be lower unless accepted.
• Post action plan residual risk level (same as Risk Level), recalculated after treatment, should be lower unless accepted.
• Risk acceptance criteria and approach can be documented; the exact details vary across organizations.
• Template provided: the Risk Management Framework, tailorable to the organization's needs.
• Risk management has a broad area.
• ISO/IEC 20000-1 has low IT demands.
• A lot of literature how to handle risk management, although it goes beyond ISO/IEC 20000-1.
• International Standard for Risk Management: ISO 31000 (approaches in ISO 31010).
• Necessary documented information is optional from ISO/IEC 20000-1 perspective.

Service Management Objectives

• Defined as part of annual performance objectives, set at various levels, based on service management policy framework.
• Should be SMART: Specific, Measurable, Attainable, Realistic, and Time-bound.
• Template: free-form doc with with high-level service management objectives to translate into objectives for specific functions internally.
• High-level objectives should communicated.
• The service management plan is a high-level doc describing how to run SMS and supply services, that it is operated by those parties and controls to ensure necessary conditions..
• Mention Contracts, SLA's, performance indicators and controls

Technology

Describes the technology is needed to run the SMS.

Measurements and Improvements

This section documents the measurements taken of the SMS and the services to verify that everything is running optimally.

5.4 Clause 7

• Documented info on measurements are used for audit, and input from the improvement process.

Mandatory Documented Information

• Clause 7.2: Competence (Template: 7.2 Competence.xlsx).
• Clause 7.5: Processes (Template: 7.5 Process Template.docx).
• Clause 7.5: Procedures (Template: 7.5 Process Template.docx).
• Clause 7.6: Knowledge (Template: N/A).
• List of services: list of your services in scope of the SMS.
• Limitations: list of limitations (geographical scope, staff hours, finances, customer requirements).
• Obligations: list of obligations (policies, standards, legal, regulatory, contractual requirements, and how these obligations apply to the SMS and the services).
• Authorities/responsibilities for SMS and its services are in the Roles, Responsibilities, and Authorities document.
• Resources: list of resources (personnel, knowledge management system, documentation, servers, and desktop computers.
• List of resources needed to run the SMS.

Approach for Parties for the service lifecycle

• Other parties involved in the service lifecycle used to provide services can be described.
• Determine the need from competence personnel.
• Competence ranges from Skills to abilities. It can be obtained via internal or external training.
• Use internal or external training, self-study consultation from documented processes
• Organization maintains form training database (template: spreadsheet, employee, name, hiring date, training and completion date)).
• Columns distinguish "required" versus "non-required" courses, followed outside of curriculum.

Processes

• All standard needed processes documented and process template toolkits.
• All Elements describe the clause

Procedures

• You procedures can be written as step-by-step instructions or screenshot.
• Templates contain sections described

Knowledge

• Knowledge exists in many forms.
• Since this has a broad area, no template has been provided.
• Organization makes sure knowledge is documented.

Non-mandatory documented information

• Clause 7.4: Communication Plan (Template: 7.4 Communication Plan.xlsx).
• Clause 7.5.1: Documented info determined by the org as necessary for SMS effectiveness (Template: NA).
• Clause 7.5.3: Doc'd information of external origin the org needs for planning/operation of SMS (Template: NA).
• Clause 7.5.4: Processes of the organization's SMS (Template: 8 Process Template).
• Clause 7.5.4: Records required as evidence to requirements of standards the SMS (Template: NA).
• The communication plan is an overview of what takes place and why.
• Template has examples for communication plan, which needs to be reviewed regularly.
• Other documents of internal/external origin relevant to the organization's particular SMS are not mentioned in the standard.
• All process used in the SMS needs to be documented, discussed and in detail are are mentioned in the tool kit
• Section 7.5.4 requires to give your records to show illustrate conformity to requirements.
• However this can be shown in minutes, presentation, and risk.

Explore frameworks like SWOT and PESTLE for strategic planning. Understand internal/external factors impacting organizations. Learn about service management policies and risk management.