INFORMATION TECHNOLOGY MANAGEMENT PROCESSES

IT management processes are related to IT planning, ongoing management and management of IT projects. Planning for several years ahead considers the introduction of new information technologies that would meet the changing needs of the enterprise.

The task of ongoing IT management is to provide efficient, cost-effective, reliable service to other departments of the enterprise. IT project management ensures the timely implementation of information technologies that are vital for the enterprise. Many IT projects can last longer than a year.

Current IT management is carried out on the basis of an annual plan, which defines a set of ongoing projects, sets tasks for modernizing and replenishing equipment and software, and determines IT capacity and the number of service personnel.

The objectives of the ongoing IT management system are listed below.

Provide motivation and conditions for collaboration between users and IT specialists.

Provide efficient use IT resources in departments and prepare users to realize the potential of existing and new technologies.

Create conditions for the dissemination of technologies that meet the strategic needs of the enterprise.

Develop standards for the efficiency of using information technologies.

Prepare necessary information to make IT investment decisions.

When creating an ongoing IT management system, you need to consider the following factors:

A modern system of ongoing IT management must be adapted to information technologies that are qualitatively different from those that existed previously.

Ongoing management must distinguish between IT that is in different phases of development. Mature technologies should be monitored with an emphasis on maximizing their performance, while early-phase technologies need constant attention and support, like any research and development activity.

The performance of the current IT management system is determined by specific external and internal factors of the enterprise. These factors include: user IT expertise, geographical dispersion of the organization, stability of the management team, size and structure of the enterprise, relationships between various departments.

The organization of the current management system in the enterprise as a whole, as well as the principles underlying its construction, influence the current IT management system.

The ongoing IT management system depends on strategic decisions in the field of information technology in the enterprise, which is reflected in the portfolio of IT applications used.

Current management operational activities enterprises stimulate the effective use of IT and their development in the right direction. Although the structure of applications used every day is subject to change, overall operating costs are relatively constant in the short term. The problem of current management of transaction costs is related to their distribution over time.

The main incentive for the ever-expanding use of IT has been the emergence of users who can use it to solve their many problems. The accumulated experience suggests that it is user requests that generate new ideas for modernizing existing IT, expanding the capabilities of applications. Best result achieved when the management system is able to evaluate both the potential costs of new applications and their usefulness to the enterprise. Absence effective management IT development can cause explosive growth (often unprofitable and poorly managed), leading to unnecessary costs, or, conversely, restrain the introduction of promising technologies, which causes dissatisfaction among users. Both extremes undermine confidence in the IT governance system. Moreover, for many types of new user demand, it is much more difficult to determine the benefits than the costs. Very often, the current IT management system incorrectly compares the costs of IT implementation with the future results of its effective use.

The effectiveness of IT use is largely related to the human factor. As technologies change, so do the types of applications and user requirements. However, many users are quite conservative in their habits, find changes inconvenient and resist them. In the same direction, the often encountered poor attitude of users towards IT personnel, who are the initiator and agent of change, operates.

Changes in current IT management may also be caused by environmental factors. TO internal factors These include the emergence of new information needs, the expansion of office locations and the modernization of the enterprise itself. A well-organized ongoing IT management system can respond appropriately to these types of changes.

Another important aspect of the organization of current management is related to the geographical location of the enterprise and its size. As the number of branches of an enterprise grows and the number of personnel increases, significant changes in organizational structures are required. First of all, this applies to the current management system at the enterprise and, in particular, the current IT management system. The informal supervision and control of personnel typical of small enterprises is usually not suitable for larger enterprises with departments located in remote locations. In the same way, the evolution of relationships between functional departments and the IT department within the enterprise forces the restructuring of the system of ongoing IT management.

An important aspect that needs to be taken into account when creating an ongoing IT management system is organizational structure enterprises. An enterprise in which information processing is highly centralized may allocate costs to the IT department. Conversely, a decentralized enterprise, taking into account the profits received by its branches, can charge costs to divisions and for the activities of the central IT department, and even go to the creation of independent information centers who provide their services for a fee.

The current IT management system must be linked to the enterprise management system as a whole. It is ideal to have an enterprise development plan for several years, which would be driven by the overall business strategy, since the implementation of many large projects related to the implementation of IT can take more than a year.

The combination of the short-term horizon of ongoing IT management and the long-term challenges of technical innovation can create conflicts in the performance of ongoing enterprise management functions. The questions that arise can be divided into two groups:

To what extent should the structure of ongoing IT management be similar to the structure of ongoing management in other departments of the enterprise? How to manage IT if these structures are different? Can this situation persist for a long time?

How to strike a balance between solving the challenges of ongoing IT management and timely innovation?

Assessing the effectiveness of current IT management is usually based on monitoring the relationship between costs and actual results from IT implementation.

When analyzing the relationship between the current IT management system and the processes of current management and planning at the enterprise, the nature of the IT being implemented should be taken into account. If the developments are of a strategic nature, a close connection between these processes is needed, and any inconsistencies between them can create problems in the activities of the enterprise. Future IT investment proposals should be the subject of periodic reviews prepared by the IT function for senior management. The current IT management system, given the strategic role of these technologies, should encourage innovation, even if only one of the three will produce real results. Often the main problem is evaluating, comparing and stimulating proposals that come from different functional units.

Given the operational and support nature of IT Special attention should be devoted to the ongoing management of existing technologies, and, when strengthening, to closely monitor promising developments.

The current enterprise management system solves three categories of problems - managing results, personnel and processes.

Results management is aimed at optimizing specific performance indicators of the enterprise.

Personnel management focuses on hiring practices, methods of training and testing in the workplace, and procedures for assessing personnel qualifications.

Managing the processes occurring in an enterprise is associated with the creation and monitoring of certain protocols and procedures. This includes separation of responsibilities when forming a specific sequence of tasks, control of access to certain processes, etc.

All this needs to be taken into account and discussed when forming a system for ongoing IT management.

As the complexity of IT has increased in recent decades and the scope of its application has expanded, the role of information technology planning has become increasingly important.

Hardware and software continue to evolve very quickly. Therefore, constant interaction between the head of the IT department and the heads of functional departments of the enterprise is necessary to identify technological changes that are significant for the development of plans and pilot projects.

The development and implementation of IT continues to be hampered by a shortage of qualified specialists, including programmers, as a result of which it is necessary to set priorities in their use, as well as attract external sources of IT development and support.

Limited financial and management resources are another argument in favor of IT planning.

Strengthening the role of computer networks and data storage for the creation of corporate information systems. Increasing attention must be paid to the design of networks that provide data exchange and support applications that are used in different departments of the enterprise. No less important are the networks that establish connections between an enterprise and its consumers and suppliers. The role of Data Warehouses for multidimensional storage of aggregated actual and forecast data is increasing, necessary for analysts for decision making; data marts (Data Mart) - to concentrate data related to individual aspects of the organization’s activities and as close as possible to the end user; analytical data processing technologies (OLAP), containing flexible mechanisms for data manipulation and visual display and providing the ability to process queries “in real time” - at the pace of the user’s process of understanding the data.

Addiction various directions enterprise activities from IT. At many enterprises, the introduction of marketing, logistics and other software products opens up new prospects in their development. And if existing IT limits the ability of an enterprise to implement its strategies, then this problem becomes the leading one. The development of IT in an enterprise is associated with the development of new technologies, expanding the scale of their application and increasing the efficiency of their use.

Planning requirements at various stages of IT implementation:

1. At the first stage (identifying the required technology and planning investments), the costs of studying new technologies and investing in promising IT are determined.

2. The effectiveness of planning in the second stage (technological learning and adaptation) can be measured by the support that users will provide to the pilot projects. The result of this stage is a clarified need for the number and qualifications of personnel.

3. In the third stage (rationalization/management control), the goal of IT planning is to determine the optimal boundaries for application deployment in terms of the best balance of effectiveness and cost.

4. At the final stage (maturity/widespread technology transfer) of IT development, a controlled evolution of the technology occurs, when user training is completed and a system for ongoing technology management is created, long-term trends in its operation are planned.

Typically, an enterprise has different IT in all four phases of implementation, making uniformity in IT planning virtually impossible. Instead, IT professionals deal with a portfolio of technologies, each of which poses its own challenges.

Likewise, the approach to planning must be different among different departments within an enterprise, since each of them, as a rule, has varying degrees of familiarity with a particular technology.

As new information technologies are mastered, competition shifts, and enterprise development strategies change, the priority of various applications changes. Therefore, the IT planning process must take into account some specific assumptions regarding the nature and role of technological evolution:

Resource costs for planning. Financial and human resources involved in IT planning are diverted from other activities, particularly the development of new systems. To what extent it is advisable to divert resources from other areas of the enterprise is always a question.

Compliance of IT planning with the organizational culture of the enterprise. An important aspect of IT planning is that it is implemented within the specific cultural environment of the enterprise. Thus, if planning is actively supported by senior management, the same internal climate is established in user departments.

The strategic impact of IT. In some enterprises, IT plays a strategic role, while in others it plays a useful but secondary role. In this case, it is difficult to expect that senior management will devote much time to IT.

Underestimation of the role of IT. The choice of approach to IT planning is often complicated by the discrepancy between the opinions of heads of various departments and the real importance of IT in the current and, most importantly, in the future activities of the enterprise. In this case, the role of senior management is important for informed strategic decision making.

Two problems often arise:

Plans and strategies developed for IT are technically sound and meet the needs of users as they understand them today, but can be unproductive and even counterproductive if IT does not align with the enterprise strategy;

Plans that are developed “at the top” may be far from realistic approaches to implementing new IT. This can cause all sorts of difficulties and even lead to unrealistic expectations.

Too often, senior management believes there is no point in worrying too much about IT planning. Experts, understanding its strategic importance, are often unable to convey their opinions to the final decision makers.

Understanding the importance and status of the head of the IT department. The status of the head of the IT department should correspond to the role that IT plays or should play in the operational activities and in the process of forming the company's strategy. If, given the strategic importance of IT, the manager's status is low, it will be difficult for him to obtain from the upper echelon of management the information necessary for successful planning.

The closeness of the head of the IT department to senior management executives. In enterprises where many important decisions are made informally and where IT plays an important role, the IT manager must literally be close to management - “in the next office”, next to senior managers. Even with high status, it is difficult to be an active member of the management team unless you are directly involved in it.

As the size and complexity of the enterprise grows and IT applications expand, a planned process will help ensure the broad dialogue that is critical to developing a consensus as recommendations general about how to plan IT are almost always meaningless in a given situation. Even within one enterprise, there may be different planning practices in its divisions.

Most enterprises do not conduct IT audits. However, as part of enterprise internal audit, IT audit functions deserve serious consideration at the highest level of management.

The importance of this function increases with the development of inter-organizational systems and the growth of electronic fraud. It is becoming the front line of defense in an increasingly complex networked world. The following subject areas of IT audit can be distinguished.

Firstly, the creation and implementation of standards related to IT, their development and operational activities, and control over them. The development of standards is not a one-time event, but requires ongoing effort and attention.

Secondly, the application of standards in departments. The audit ensures timely recording of achievements in this area and analysis of unexpected situations, reduces the risk of fraud, and, consequently, loss of the enterprise. It also provides material for analyzing operational efficiency.

Thirdly, system design, so that subsequently created systems can be easily controlled and operational changes do not create problems. Such involvement clearly compromises the perceived independence of the audit mission, but it is a necessary trade-off with the real world.

Often, individual departments have to use completely different approaches to ongoing management as they are at different stages of implementation and use different combinations of technologies.

As IT goes into production, inefficiencies in individual operations can have serious consequences for the enterprise as a whole. This strengthens the role of audit, and the current IT management system itself needs further development.

Measurement and evaluation of IT processes. Well-organized theory and design practice

How to provide a comprehensive system for measuring information technology management processes? Who is the consumer of the measurement results and what are they used for? Let's try to find answers to these questions by combining coherent theory with advanced design practice.

IT processes

The current activities of IT departments can be represented as a system of interconnected IT management processes (IT processes). IT processes ensure the effective use of information technology to meet customer needs. "Efficiency" here means that:

• information technologies shape value for customers (benefit by increasing the productivity of business processes and/or reducing the restrictions on these processes);
• expenses information technologies are rational and controlled;
• risks related to the use of information technology are also controlled and reduced to an acceptable level.

Why and for whom measurement and evaluation are carried out

To ensure maximum efficiency, taking into account changing requirements, environmental influences and other factors, IT managers must evaluate processes and adjust their work. This means that managers need to be confident that the processes for which they are responsible are functioning optimally, and, if necessary, identify deviations in the operation of processes in a timely manner and initiate corrective actions.
In turn, managers who oversee the information technology management system from senior management or investors (that is, persons interested in the effective use of IT) want to be sure that current system IT management solves the tasks assigned to it.

Thus, measurement and evaluation of IT processes are carried out in the interests of two main groups of stakeholders (stakeholders):

• investors, customers, senior IT management, external regulators are interested in:
  • to what extent does the IT management system solve the assigned tasks ( effectiveness);
  • whether and how management mechanisms are provided to ensure the proper level of control and changes in the system in response to new requirements ( compliance);
• IT managers are interested in the current state of processes from the point of view of:
  • content and results of activities, as well as the scope of work ( productivity);
  • rational use of resources ( rationality / efficiency).

What and how to measure and evaluate

To meet the needs for measurement and evaluation in the IT management system, necessary tools– metrics and KPIs are developed, means of collecting and processing information about processes are implemented, the need to attract auditors and the evaluation criteria that they apply are determined. The content and means of measurement are determined by the person for whom they are performed (the consumer) and the decisions that must be made based on them (the purpose).

Effectiveness of IT processes

Effectiveness shows how well a given process (or group of interrelated processes) meets its purpose and achieves its goals. To develop metrics and controls aimed at measuring performance, it is important to distinguish between the concepts of purpose and goals:

• appointment determines the role of the process in the control system, that is, the answer to the question “ why is this process needed, what is it responsible for" The purpose of the process, as a rule, is more or less universal, that is, it changes little from company to company. Statements of purpose for IT processes can be found in standards and bodies of knowledge that offer process models (COBIT, ITIL®, ISO/IEC 20000);
• target process defines what the process must provide in a certain fixed period of time. Goals must meet SMART criteria (specific, measurable, achievable, relevant, time-bound). Unlike purpose, process objectives not only can, but should, be regularly verified and revised, which is the responsibility of the process owner.

When formulated correctly, performance measurement metrics can be directly formulated based on the purpose and objectives of the process. Performance can be measured and assessed at the level individual species activities, processes and management system as a whole.

Example 1: Managing incidents and user requests:
Purpose: ensuring the quality of IT services by quickly eliminating incidents and timely fulfillment of service requests.
Examples of goals:

• increasing the share of timely resolved incidents to 95%
• increasing the share of requests resolved on the first line to 50%

• share of incidents and requests resolved on time [%]
• average time to resolve incidents by impact level [hour]

• bring the level of customer satisfaction with the quality of IT services to 90%
• ensure timely generation of reports on IT services at the level of 100%

• integral indicator of the quality of IT services (calculated based on reports on the provision of IT services for the period) [%]
• level of customer satisfaction with the quality of IT services (calculated based on the results of a customer survey for the period) [%]

Degree of compliance of IT processes with requirements (compliance)

In addition to the ability of processes to realize their purpose, customers and investors are interested in the ability of processes and the IT management system as a whole to consistently generate results in the face of external and internal changes, as well as the ability to develop in response to new requirements. These capabilities are supported by the maturity of the IT management system. Maturity is expressed, first of all, in the levels of formalization and control applied to a particular activity. It is important to note that a certain level of maturity characterizes not the activity itself, but the management practice applied to it:

• process maturity– a characteristic that allows one to assess how thoroughly and formally the activities included in the process are controlled;
• management system maturity or organizational maturity characterizes the control practices in place in the organization regarding processes.

Maturity level assessments are usually performed using so-called maturity models. Maturity models can be independent bodies of knowledge or be part of other bodies of knowledge and standards. The most famous maturity models:

• Capability Maturity Model (CMM), developed by the Software Engineering Institute of Carnegie Mellon University. This model was adopted as the basis for the development of the process maturity model as part of COBIT (up to version 4.1 inclusive);
• ISO/IEC 15504 “Information technology – Process assessment”. This model was adopted as the basis for the development of the IT management process maturity model, which was included in the new fifth version of COBIT.

An example of assessing the maturity level of an ITIL process group is presented in the following figure:

Monitoring the degree of compliance can be carried out both by internal processes of the management system and by external auditors. In practice, it is important to find the right combination of internal and external controls to ensure the required objectivity, regularity and level of detail. For example, for one of our clients, a separate IT process was responsible for internal control, which was called “Monitoring and Evaluation”, and the effectiveness internal control verified by the involvement of external auditors.

Efficiency of resource use

The effectiveness of processes is ensured through the use of organizational resources spent on executing processes and ensuring their maturity. Controls—both specialized and general-purpose—use information, applications, infrastructure, and personnel. Rationality metrics characterize the number of errors that occur during the execution of a process, as well as the use of certain mechanisms to reduce labor costs.

The basic principle of ensuring and assessing the rationality of a management system can be formulated as follows: the cost of owning a management system and its control should not exceed the value generated as a result of the functioning of this system, taking into account controlled risks.

Process productivity

Productivity metrics characterize the amount of work to execute and control the process. This is very important factor both at the design stage and at the execution stage of the process. For example, when designing a change management process, it is important to understand what flow of changes is expected before writing into the process regulations " All changes are reviewed by CAB (Change Advisory Board, change management committee)" During the execution phase, changes to a process's input flow can affect performance, compliance, and efficiency. For example, an increase in the flow of incidents from 8,000 to 15,000 per month (due to the unsuccessful implementation of a new IT system) can significantly reduce the value of the performance metric " Share of incidents and user requests resolved on time" Therefore, productivity indicators should also be included in consideration when performing operational control and evaluation of processes.

Structure and principles of implementation of the measurement and evaluation system

The general structure of the measurement and evaluation system is presented below:

This structure determines the directions of measurement and assessment, as well as the consumers of measurement results, who are responsible for conducting assessments and making appropriate management decisions.

In practice, when implementing a measurement and evaluation system, it is important to follow a number of rules:

• develop the content and means of implementing the control and evaluation system, focusing on specific consumers and the management decisions they make;
• combine different areas of control and evaluation, providing a comprehensive view of the management system. Ignoring certain factors can lead to serious imbalances in decisions made. For example, focusing on process compliance without focusing on performance can lead to over-documentation and “process for process's sake.” And vice versa - attention only to results (without proper documentation, control, and so on) can lead to the fact that high results yesterday will be lost tomorrow (due to changes in personnel, changes in the flow of work and other factors);
• Regularly review the measurement and evaluation system to ensure that current management practices are appropriate to the objectives and conditions of the environment.

Compliance with these rules helps to plan and implement effective system information technology management, supported by adequate measurement and evaluation tools.

At a certain point in the company's development, IT management may be faced with a situation where resolving incidents takes too much time, users are dissatisfied with the services provided, and internal organization work is complete chaos. One of the options for solving these problems is the implementation of ITSM (Information Technology Service Management). As part of this post, with which we decided to open our blog on Habré, we will talk about what ITSM is and look at some of the capabilities of the ServiceNow platform.

What is ITSM?

A complete transition to a service basis will allow the IT departments of any company not only to turn from a costly department into a profit center, but also to offer their IT services outside of their own organization.

One of the main components of ITSM is the formalization of IT department processes. For each process, the sequence of work, the necessary resources and time costs, automation and quality control tools are determined. Once a process is defined, its performance and quality/cost ratio can be measured. At the same time, we note that the ITSM approach does not affect the details of technical process management, but is aimed at structuring internal work IT departments.

The implementation of ITSM also includes the formalization of work regulations for employees, the definition of areas of responsibility and authority of personnel, criteria for the quality of work and the formation of mechanisms for controlling and monitoring the state of processes, which helps to increase information security.

ITSM Implementation - ServiceNow

Behind last years ServiceNow has slightly changed the vector of development of its product, which now goes beyond IT. The service allows you to manage most business areas. The processes that a business uses for management are very similar to the processes that occur in an IT department. Only the tasks change, but the architecture of inter-element relationships and the relationship between the performer and the consumer remain the same. You can see the structure of the ServiceNow solution in this video:

IT Governance and Risk Management (GRC)

The first application is called ServiceNow Risk Management and provides a centralized process for identifying, assessing, responding to, and continuously monitoring enterprise and IT risks that could negatively impact the business. The application has a graphical interface for creating profiles and dependencies for risk mapping and modeling.

It also allows you to group risk reports into manageable categories and store all potential risks in a central location, allowing you to view summary information and quickly identify problem areas.

The second application is Policy and Compliance Management, and it provides a centralized process for creating and managing internal control policies, standards, and procedures. For example, the Compliance module contains overview information about compliance, as well as lists of official company documents and links.

Formal documents define policies, risks, controls, audits and other processes. Each document is attached to a specific record, and the corresponding lists in the record contain the individual terms of that document.

The third application of the GRC complex is Audit Management. It makes it possible to plan audit assignments, monitor implementation and provide reports to responsible persons. Engagement reporting ensures that the organization's risk and compliance management strategy is effective. The audit process includes creating, planning, scoping and conducting audit engagements, as well as reporting the results.

Thus. GRC in ServiceNow, as part of a powerful business automation platform, helps solve a large number of critical tasks by integrating with existing processes and sharing data with core management services.

Software development management (Agile Development)

The platform makes it possible to hold daily meetings (Daily Scrum) with team members to discuss current projects, planned work and difficulties. There is also the ability to maintain a product backlog, which is a list of user stories ordered by importance. The Product Backlog can be regularly reviewed and updated as new requirements arise and priorities change.

In addition to the product backlog, the solution provides the ability to work with a release backlog, which contains a list of stories that need to be completed to release the current version of the application being developed. Typically, the decision-making process is based on the timeline for releases, the importance of stories in the product backlog, and their complexity.

IT Infrastructure Management (IT Operations Management)

The main objective of implementing ITOM is to achieve visibility and control over various elements of the company's IT infrastructure for the purpose of easy and flexible management. This allows you to provide services according to SLA, use your IT infrastructure more efficiently, respond flexibly to external and internal needs, and better provide service and support.

ITOM also allows you to collect information from multiple sources, including all major elements of the IT infrastructure. This data can be analyzed and then provided as IT operations reports on parameters such as load, performance and user activity. This makes it easier to identify problems early, diagnose them and quickly resolve them.

The use of ITOM makes the use of IT investments transparent, allows flexible allocation of IT resources, prompt identification of problems and solutions to them, and efficient maintenance of infrastructure.

And these are just a few of the features that the ServiceNow platform provides. In the list of services provided you can find items such as

Probably most IT consultants are involved in improving IT processes. In Moscow alone there are thousands of such consultants [in Russia, probably, ten thousand specialists in IT processes can be counted. And there are hundreds of people capable of developing a meaningful IT strategy. And to order and for large enterprises, IT strategies, in my opinion, can be developed by about ten people throughout Russia]. But, despite all this, in an IT strategy, IT processes are usually given a rather modest place - from one slide to a couple of pages of detailed process design text.

IT processes within the IT strategy

Here are the components of IT processes typically considered as part of an IT strategy:

• IT process maturity levels: now and in 1-2 years;
• Levels of centralization of IT processes: is it necessary for an IT service that has a number of branches to make IT processes unified and centralized.

An attempt to combine both long-term strategy and detailed planning of specific IT processes within a single project is almost certainly doomed to failure. These are different projects, each of which will take a couple of months and require different people. It is better to do such projects independently of each other: first develop an IT strategy, and only then improve IT processes in accordance with this strategy.

It’s not an idle question: which IT process model should you use in your IT strategy? The following discusses the most well-known methodologies for analyzing and designing IT processes, as well as their applicability in IT strategies.

Methodologies for designing and controlling IT processes

There are quite a lot of methodologies for analyzing and designing IT processes, as shown in Fig. 1 presents only the main ones:

Rice. 1. History of the development of methodologies for IT processes

The first methodologies for IT processes were developed by IBM. Not everyone knows that IBM did not support ITIL v1 and v2, but both IBM, HP, and Microsoft specialists participated in the development of the third version of ITIL (you can check by looking at the list of authors of books on ITIL v3).

I studied all those discussed in Fig. 109 methodology, except for ISMA, this methodology has been outdated for twenty years. In my opinion, IBM's PRM IT development methodology is now the best. Both for designing IT processes and developing IT strategies. The problem is that this methodology is not publicly available. In addition, ITIL v3 has already become a de facto standard in Russia, and in many other countries.

Let's look at process methodologies in more detail.

COBIT methodology

The Control Objectives for Information and Relates Technology (COBIT) methodology was developed to control IT processes. International financial corporations built IT work control systems based on COBIT. Although these financial corporations went bankrupt during the 2007 crisis due to poor business practices and poor oversight of their brokers, it is unlikely that the COBIT methodology was to blame.

COBIT is currently being developed by the Information Systems Audit and Control Association (ISACA). COBIT (version 5) highlights processes for both support and planning for IT development (see Figure 2):

Rice. 2. Typical IT processes in COBIT

COBIT has many indicators for each of the IT processes:

• Maturity model;
• Critical Success Factors (KSF);
• Performance Indicators (KGI);
• Performance indicators (KPI).

COBIT: IT Process Maturity Model

To assess the current and required IT process maturity levels in 1-2 years, I would recommend using a maturity model based on COBIT v4 (see Table 1):

Table 1. Scale for assessing IT process maturity levels

This scale is convenient because of its simplicity and the fact that it is similar to grades in a Russian school. The scale is quite consistent [when assessing the maturity level in the COBIT version 4 scale, there were no consulting jokes like “if you don’t have a process mission,” then the maturity level will no longer be more than three. However, in version 5 everything has changed, the level of maturity of IT processes of many Russian organizations may be rated as extremely low] .

The COBIT methodology also states that your organization's IT process maturity level should be compared to other levels (see Figure 3).

Rice. 3. IT process maturity model

In your IT strategy, it is imperative to determine the required level of maturity of your organization’s IT processes in 1-2 years. To do this, in addition to the current level of IT process maturity, you need to determine what level of IT process maturity is needed specifically for your organization, so that it supports competitive advantages and the business strategy of your organization, and not the company from which you borrowed their IT processes.

COBIT: use in IT strategy

Here are my assessments of the applicability of COBIT in developing IT strategies:

1. In Russia, COBIT is used very rarely, especially for designing IT processes. The completeness of coverage of all IT work by the processes identified in COBIT is no higher than in ITIL. However, ITIL is more widespread in Russia, so I believe there is no point in using the COBIT process model itself in IT strategy;
2. The COBIT IT process maturity scale is useful for use in IT strategies [in my opinion, the scale is clearer in COBIT v4 than in v5. And also significantly less and “spends” on consulting orders to increase the maturity levels of IT processes in cases where you just don’t have the “vision” and “mission” of the process written]. An important advantage of the IT process maturity assessment scale is its simplicity, understandability, and intuitive compliance with the Russian school rating scale. Accordingly, I would recommend using the COBIT scale in your IT strategy when assessing the current and required maturity levels of IT processes.

The third version of the Information Technology Infrastructure Library (ITIL v3) methodology is now a de facto standard both in Russia and in many other countries of the world. There is both available literature on ITIL, as well as training and consulting.

The methodology was created at the initiative of the British government in 1989 (during the time of Margaret Thatcher). The impetus for its creation was the privatization and optimization of public services. In this wave, an attempt was made to optimize government institutions and compare them with companies operating successfully in market conditions. 20 years ago this was quite a revolutionary approach.

Most Russian CIOs have heard about ITIL, many have even been trained in ITIL. Therefore, we will look at the ITIL methodology quite a bit, trying to assess whether ITIL is worth using when developing IT strategies.

The main idea of ​​the ITIL methodology: The IT service provides information services to IT users. Services are provided in accordance with the agreed requirements for their quantity and volume. And users pay for the services they use.

For the beginning of the 90s, this idea was quite new. For Russian business The idea of ​​providing services both to external customers and to other departments by company divisions is still new. Try your accounting and HR department to check the quality and timeliness of their services. Or ask them about SLA.

Recently appeared and new area use in the ITIL methodology - for business, for example, to optimize the repair work of Russian Railways construction crews railways. The planning of these activities was optimized using ITIL.

In Fig. 4 presents a list of ITIL v3 processes, broken down by life cycle phases:

Rice. 4. ITIL v3 processes

ITIL: use in IT strategy

I would evaluate the applicability of ITIL in developing IT strategies as follows:

• ITIL in Russia, and in other countries, is used very often, especially when designing IT processes. However, the completeness of coverage of actual IT work by the IT processes identified in ITIL is not particularly high. IT support processes are discussed in detail, but the development of IT is rather poor. For example, there is simply no process for developing and maintaining an IT strategy in ITIL. And process groups in ITIL are, in my opinion, incompletely identified.
• Accordingly, if you used the ITIL methodology to automate your Help Desk (and this is very common), then it seems that it would be advisable to use ITIL in your IT strategy in order to plan the development of IT processes for a year or two. However, if you consider all ITIL processes in an IT strategy, it will take a lot of time, and it will dazzle your eyes. That is, in strategies that you yourself want to develop in another month, it hardly makes sense to consider all the processes. And process groups in ITIL do not cover the entire range of IT work, that is, it makes no sense to consider only IT process groups;
• There are different scales in ITIL used to assess the maturity levels of IT processes, incl. completely detailed or not entirely correct. For example, according to some questionnaires recommended on ITIL websites, it turns out that if you do not have a vision and mission for a specific IT process, then the level of maturity of this process will be below par. Actually, when developing an IT strategy, I would not recommend using ITIL recommendations to assess the maturity levels of IT processes.

PRM IT methodology

The Process Reference Model for IT (PRM IT) methodology is a very comprehensive and internally consistent IBM methodology. The list of PRM IT processes is shown in Fig. 5:

Rice. 5. PRM IT processes

While at IBM, I developed a number of IT strategies using the PRM IT methodology. In my opinion, the PRM IT methodology is more convenient and better both for developing IT strategies and for designing IT processes - it is the most complete. The methodology has a number of processes, and it covers significantly more IT work than ITIL and COBIT. However, this is undermined by the fact that IBM does not make this methodology publicly available.

PRM IT: use in IT strategy

I would evaluate the applicability of PRM IT in developing IT strategies as follows:

• The PRM IT model is very complete: 30 years of development and the lack of compatibility with previous methodologies still made it possible to develop a complete and understandable process methodology. But given that IBM does not distribute PRM IT process descriptions, in my opinion, only PRM IT process groups should be planned in an IT strategy.
• Rating scales for IT process maturity levels in PRM IT are likely to be unknown to the general public, and COBIT is likely to fall short.

In 1999, Microsoft began its own developments to adapt ITIL to the specifics of operating information systems based on its own technologies. The result was the recommendations outlined in the Microsoft Operations Framework (MOF) document library.

If everything is built on Microsoft and you have already implemented MOF, then IT processes can be planned based on the MOF methodology.

The MOF process model includes 21 service management functions grouped into four quadrants:

• Supporting;
• Operation (operating);
• Changes (changing);
• Optimization.

Rice. 6. MOF methodology

In my opinion, now in Russia 90% of process design is carried out on the basis of ITIL, and MOF is almost never used.

MOF: use in IT strategy

The completeness of MOF IT processes coverage of all IT work is low. Accordingly, it makes sense to use MOF in IT strategies only if your organization has been using MOF for a long time and significantly, and not ITIL or COBIT.

Comparison of process methodologies

• MOF is focused on supporting Microsoft products; it is hardly advisable to use this methodology to develop an IT strategy;
• COBIT is focused on control rather than planning the development of IT processes. In Russia, COBIT is significantly less widespread than ITIL. Accordingly, COBIT is unlikely to be used to develop IT strategies;
• ITIL is now the de facto IT process standard. Accordingly, there is a desire to use ITIL in IT strategies. However, in this case it is necessary to somehow highlight the processes (or groups of them) considered in the IT strategy; it will be difficult to plan the development of all 20-30 processes;
• PRM IT, in my opinion, is better suited than others for long-term IT planning as part of IT strategies. However, unlike ITIL, PRM IT is used only within IBM and for that company's customers.

In total, it turns out that none of the methodologies currently available in Russia is convenient for use in IT strategies. In my opinion, IT strategies should use a combination of well-known methodologies, namely:

• scale for assessing IT process maturity levels - from COBIT v4;
• groups of IT processes, the requirements for maturity levels of which you will coordinate with the business management of your enterprise - from PRM IT;
• the list of IT processes, if you are going to plan all of them, is better to take from ITIL v3. However, if you are doing both IT strategy and IT process planning for the first time, then I would not recommend trying to consider all IT processes at once, since you will not have enough for both jobs.

Analysis and design of IT processes within the framework of IT strategies

To analyze and design IT processes, it is necessary to determine the current and required levels of process maturity. The following example shows that such a seemingly simple task is easy to fail.

A very common form of assessing the existing and required maturity levels of IT processes (according to ITIL) is shown in Fig. 8:

Rice. 8. Assessments of the current and required maturity levels of IT processes in 1-2 years (according to ITIL)

However, from the figure it is completely unclear why there should be exactly these required levels of maturity, and not more or less.

Here is another example of a graph for assessing the maturity of processes (this is according to COBIT), no matter how beautiful it is, it is not clear where all the assessments came from, except for the current state (see Fig. 9, the codes indicate the names of COBIT processes, the correspondence between the codes and the names of the processes is shown in Fig. .2):

Rice. 9. Assessing the current and required maturity levels of IT processes (according to COBIT)

Such a chart can be valuable if it is done for your company by experienced consultants who have already done such assessments for hundreds of enterprises, and also have data on the IT process maturity levels for your industry and your competitors.

In my opinion, in the IT strategy it is necessary to plan the maturity levels of IT processes required in 1-2 years, based, first of all, on business requirements.

Based on the experience of the consulting projects I have completed, to assess how much a business needs something, it is better to use the simplest scale. It should also be relative, not absolute. For example, to assess how important a particular IT or business process is for a business, as well as information systems and IT services, I would recommend using the following scale:

• High business importance: this process is assumed to be more important to the business than others, for example, processes related to IT continuity;
• Medium importance for business: the majority of such processes. It is assumed that they should be no worse than those of your competitors and partners. This group often includes processes related to IT management (if you are not an IT company);
• Low importance for business: it is desirable that business representatives classify approximately a third of the processes in this category. For example, this could be the “ROI Analysis for IT Projects” process (if you don’t do this at all).

Here are my proposals for specific work detailing groups of IT work and the IT processes included in these groups [IT processes are taken from the PRM IT methodology, in the ITIL methodology a number of processes are missing, especially related to IT service management and IT planning] (see Table 2):

Table 2. Groups of basic IT processes that are appropriate for consideration in an IT strategy

The list of work performed, in my opinion, quite fully covers the main work of IT services. However, this is not a list of ITIL processes, but a more extensive list.

In Fig. Figure 10 is a simple strategic diagram showing the relationship between the importance of IT process groups to the business and their maturity. It is clear that the higher the importance for the business, the better the processes must be implemented (that is, the maturity level must be higher).

Rice. 10 Planning the required maturity levels of IT processes based on their importance to the business

Another type of strategic diagram for planning IT processes is shown in Fig. eleven.

U general director Your company should ask the current and expected importance of each of the IT areas for the business in 1-2 years, as well as the degree of business satisfaction with the current state of IT for each area (see Figure 11):

Rice. 11. Current and required state of IT areas in 1-2 years

This is most likely all you can really get from your company's business management. However, these assessments are not enough to plan specific IT improvement projects. However, the CIO can then assess the current state and required improvements, dividing each of the IT areas into different levels of responsibility.

• Automation: significant improvements in a number of IT processes are unrealistic without process automation, which at the same time will allow the introduction of the best international experience;
• Development of regulations: a number of processes, for example, IT strategy management, are hardly advisable to automate. In this case, you can write regulations for the execution of such processes.

IT Process Trends

Improving IT processes is now perhaps the most popular area for improving IT management. Here's a series modern trends on IT processes:

• Massive attention to improving IT processes;
• Widespread use of ITIL;
• Centralization of IT processes.

Improving IT processes is now one of the most interesting and popular areas of IT optimization.

In conditions market competition All big role The company’s ability to adapt to constantly changing external factors, market conditions, new technologies and services begins to play a role. For modern company An information system is the same as the nervous system for a person: it is information communications that allow you to manage a company and coordinate the interaction of various organs, as well as connecting it with the outside world. Therefore, the ability of IT departments to adapt to business conditions and provide business units with exactly the services they need at the moment becomes critical, helping to avoid wasted time and productivity losses due to system failures and downtime.

The IT manager's task is to create a mechanism for the functioning of his department that would best meet the changing requirements of employees and company management, which would enable all employees to realize the benefits that they receive from using the services of the IT department. Accurate knowledge of the structure, status, resources, functions and processes of the IT department allows the manager to rebuild management, adapting to moves, consolidation, division, merger of branches or, conversely, delegation of authority to subsidiaries or external service providers. Building a system based on a model generally accepted in the IT management environment will give your organization confidence in the reliability of the IT system as the basis of a modern dynamic business, allow you to confidently look into the future and be prepared for rapid and adequate changes in information technology in the interests of business development and growth efficiency. This will also optimize the costs of operating the system.

To build a flexible, adaptable system, it is necessary to automate such areas of IT management as management of network equipment, servers and corporate applications, data storage and security, fleet management personal computers, support service.

But first of all, this requires methods, technologies and means, allowing you to monitor the current state of the system, perform operational and long-term planning tasks, analyze the adequacy of changes made to the structure of the system and dynamically calculate the efficiency of the system as a whole. Exactly like this comprehensive solutions allow you to manage your business and maintain its stability, ensuring complete management of the IT infrastructure and maximum satisfaction of the needs of IS users. Such solutions allow you to raise the IT department to new heights, make it part of the business, and make a strategic contribution to the company’s activities; allow you to make the results of the IT department obvious to management and users of the system. They also provide the head of the IT department with a new range of opportunities: he can quickly and adequately assess the quality of the department’s work, existing costs, resources, and correctly plan the necessary changes.

Methods

The introduction of advanced information technologies requires all participants to have a clear understanding of the structure and functions of the system, the relationship of its components, a strict distribution of responsibilities and areas of responsibility, the availability of information about the state of the system as a whole and its components, the tasks performed by users, and those functions that are useful to them. most important.

How to combine so many disparate processes into a single model? How to formulate the functions of the system and employees? How to get information about the current state of the system? What criteria should be used when choosing the direction of system development? How to find the line between user needs and the capabilities of the system and IT department staff? All these issues must be resolved within the framework of a single paradigm of thinking, a single language with the help of which the IS architecture, functions and responsibilities, information and interfaces will be described. It should be a language that is equally understandable to IT department employees, users, and software and management system manufacturers. In other words, we need a common, accessible and accepted by all methodological basis IT management.

ITIL - Information Technology Infrastructure Library - became such a basis for many Western standards and solutions in the field of IT management. Almost all modern system software and control software developers draw terms and methods from there. What is ITIL?

Since 1986, the UK Government Communications Agency (CCTA) has worked to formalize and standardize the implementation and operation of a variety of IT systems across government departments as a non-profit programme. The experience accumulated in the process of this work was formulated in the so-called “IT infrastructure library”, but was not available to a wide range of IT specialists. Only 10 years later, the documentation combining these techniques, which by that time had turned into a 24-volume work, became available to everyone.

ITIL is a thorough description of the life cycle model of an IT organization, examples of implementation and commentary from experts. The ITIL approach is to divide the IT management process into several disciplines. Each discipline is aimed at solving certain functions, but in interaction with others. They cover areas such as Change Management, Problem Management, Configuration Management, Service Level Management, Capacity Management, Cost Management and many others. ITIL provides a structured approach to the development, implementation and operation of each discipline. The key concept here is service management; it is the focus of the entire methodology and integrates the remaining components to achieve the goal of fulfilling service agreements with users. Service management includes many procedures that allow you to quickly and effectively formulate, change and control service levels defined for each user according to predetermined criteria and parameters of the system.

Thanks to a detailed presentation of the principles and description real experience ITIL became very popular first in the UK and then throughout the world. Therefore, building solutions based on the principles described in ITIL allows you to set a single “language” that will be understandable to everyone and with the help of which the entire paradigm of IT enterprise management tools will be built.

Technologies

However, ITIL is not a product, a program, or a system; ITIL is a methodology. It will allow you to bring your systems to a single standard, ensure the efficient functioning of IT services, meet the needs of business users, and ensure stable and predictable development of the system. But to implement such a model, it will be necessary to formulate descriptions of the processes occurring in the information system, change existing ones or create new technologies that meet new, changing requirements for the reliability of IT systems for business. It is very important to introduce technologies that would automate the management processes themselves, simplify their integration and interaction necessary for managing all IS components in the enterprise. Only the implementation of such technologies will make it possible in the future to obtain a guaranteed effect from the reorganization of business processes, the introduction of corporate information systems, and enterprise, production, and inventory management systems.

A time when the IT department could afford to spend months testing various software, left. New, “fast” markets require an immediate response and the introduction of new tools. Time has become too precious to waste. The IT department must quickly select and implement the automation tools needed by business users, while minimizing the expenditure of its own time and resources on their development, configuration and implementation. Ideally, it should be like this: when implementing a change, data on the state and history of the IT infrastructure, events and problems in the system, and forecasts are automatically obtained from databases of configuration management processes, changes, user requests and problems. Based on this data, you can quickly assess what effect a new change can have, which systems it will affect, what it will affect, how much it will cost and what level of service it can provide to users.

Achieving this level of automation will be possible through a well-functioning mechanism for interaction between change management systems, configuration management, support services, problems and service levels, based on management tools for various system components.

When choosing a technology, it is necessary to formulate requirements for the tools that will implement control functions, describe interaction mechanisms, and interfaces. The quality and efficiency of system management within the framework of the model you have formulated depends on the degree of elaboration of this stage.

It should be noted that many software manufacturing companies system management- have in their portfolio of solutions components and technology blocks that implement certain functions formulated in ITIL. However, the greatest results in this area were achieved by Hewlett-Packard, which back in 1997 formulated its concept of IT management, including technologies and means of their implementation, called IT Service Management (ITSM). This concept examines the implementation of ITIL recommendations using the HP OpenView family of software tools. This solution, based on the ITIL framework, includes software modules for various functional purposes - from a tool for quickly drawing up service contracts (SLA Wizard) to a tool that monitors the impact of a failed resource on other services (Service Navigator).

Facilities

OpenView solutions can be divided into 3 groups.

• Network and system management tools. This is primarily a network management platform, Network Node Manager, with which numerous network equipment management components (Cisco Works, Optivity) are integrated. This also includes the OmniBack backup management system, elements for monitoring server and database performance (Database Pack, Performance Monitor).
• A single console for managing IS components, covering multiple components and allowing centralized control of a range of IS performance characteristics, prevention and analysis of failures (Vantage Point).
• Components that perform IT service management processes (ITSM, ServiceDesk).

An important element of the OpenView family is HP OpenView Service Desk. It focuses on service level management processes and is designed to optimize IT management processes (ITSM), user support processes (Help Desk), and the relationship between IT management and the company's business. Service Desk provides IT staff feedback with users, allows you to understand how business units use IS resources, which resources are more important to them, and what they are not satisfied with in the existing system.

Conclusion

The use and integration of these tools allows you to fully control the state information system and actually control it, having control levers for each component.

Combining all available management tools within a single technology gives you an understanding of the functions and tasks of the IT department and creates a business-oriented approach to IT management.

However, for the successful implementation of such solutions, it is necessary to initially adhere to a unified and comprehensive IT management methodology, which has already allowed many companies to reach new business frontiers.