IT

Service Management
fo r
Service Oriented
Architecture
ITSM SOA ITIL ISO 20000
email - support@e-janco.com

Web sites http://www.e-janco.com - http://www.it-toolkits.com -- http://www.itproductivity.org

Version 3.4

August 2007

Copyright 2007 - 2008 M. Victor Janulaitis

Copyright 2007 - 2008 Janco Associates, Inc.
ALL RIGHTS RESERVED
This product is NOT FOR RESALE or REDISTRIBUTION in any physical or electronic format.
The purchaser of this template has acquired the rights to use it for a SINGLE Disaster
Recovery Plan unless the user has purchased a multi-use license. Anyone who makes an
unlicensed copy of or uses the template or any derivative of it is in violation of United States
and International copyright laws and subject to fines that are treble damages as determined by
the courts. A REWARD of up to 1/3 of those fines will be paid to anyone reporting such a
violation upon the successful prosecution of such violators.
The purchaser agrees that derivative of this template will contain the following words within the
first five pages of that document. The words are:
2001 - 2008 Copyright Janco Associates, Inc. ALL RIGHTS RESERVED
All Rights Reserved. No part of this book may be reproduced by any means without the prior
written permission of the publisher. No reproduction or derivation of this book shall be re-sold
or given away without royalties being paid to the authors. All other publishers rights under the
copyright laws will be strictly enforced.

Published by:

Janco Associates Inc.

11 Eagle Landing Court
Park City, UT 84060
435 940-9300
e-mail - support@e-janco.com

Publisher cannot in any way guarantee the procedures and approaches presented in this book are being used
for the purposes intended and therefore assumes no responsibility for their proper and correct use.
Printed in the United States of America

ISBN13 978-1-881218-09-8

HandiGuide is a registered trademark of M. Victor Janulaitis.

ITIL is a Registered Trade Mark, and a Registered Community Trade Mark of the Office of Government
Commerce, and is registered in the U.S. Patent and Trademark Office

NOTE: With the edit replace function of Microsoft WORD replacing ENTERPRISE
with the name of your enterprise along with adding the enterprise logo are the first
step in customization of this template.

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Table of Contents

Enterprise Information Technology

Policies/Standards/Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
1

Table of Contents
TABLE OF CONTENTS ............................................................................................................................... 1
SERVICE-ORIENTED ARCHITECTURE ..................................................................................................... 7
Definition ................................................................................................................................................... 7
XML ....................................................................................................................................................... 7
SOA Infrastructure ................................................................................................................................ 7
SERVICE MANAGEMENT STANDARDS ................................................................................................... 9
IT Service Management ............................................................................................................................ 9
Best Practices for IT Service Management............................................................................................. 10
ITIL .......................................................................................................................................................... 12
ISO/IEC 20000 ........................................................................................................................................ 16
SERVICE REQUEST POLICY ................................................................................................................... 18
Policy Statement ..................................................................................................................................... 18
Goal ......................................................................................................................................................... 18
SERVICE REQUEST STANDARD ............................................................................................................. 19
Overview ................................................................................................................................................. 19
Standard .................................................................................................................................................. 19
Service Request Process .................................................................................................................... 19
Problem Resolution Process ............................................................................................................... 20
Scheduled Service Request ................................................................................................................ 20
Service Request Management ............................................................................................................ 20
Responsibility .......................................................................................................................................... 21
Management & Functional IT Heads .................................................................................................. 21
Functional IT Representative (Help Desk Personnel) ......................................................................... 21
Help Desk Best Practices .................................................................................................................... 21
HELP DESK POLICY ................................................................................................................................. 23
Policy Statement ..................................................................................................................................... 23
Goal ......................................................................................................................................................... 23
HELP DESK STANDARDS ........................................................................................................................ 24
Overview ................................................................................................................................................. 24
Standard .................................................................................................................................................. 24
General Support .................................................................................................................................. 24
Maintenance Support .......................................................................................................................... 24
Triage .................................................................................................................................................. 24
Metrics ................................................................................................................................................. 25
Roles and Responsibilities ...................................................................................................................... 25
Help Desk ............................................................................................................................................ 25

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Table of Contents

Enterprise Information Technology

Policies/Standards/Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
2

HELP DESK PROCEDURES ..................................................................................................................... 26

Overview ................................................................................................................................................. 26
Procedures .............................................................................................................................................. 26
Service Request Help Desk Priority Matrix & Process Flow Charts .................................................... 27
Help Desk Triage ................................................................................................................................ 28
P1 Tickets............................................................................................................................................ 29
P2 Tickets............................................................................................................................................ 30
P3 Tickets............................................................................................................................................ 31
P4 Tickets............................................................................................................................................ 32
HELP DESK SERVICE LEVEL AGREEMENT .......................................................................................... 33
Overview ................................................................................................................................................. 33
Service Level Agreement ........................................................................................................................ 34
Help Desk Availability .......................................................................................................................... 34
Call Priorities ....................................................................................................................................... 34
Acknowledgment Times ...................................................................................................................... 36
Acknowledgments Achieved ............................................................................................................... 36
Resolution Times ................................................................................................................................ 36
Resolutions Achieved on Time............................................................................................................ 37
Metrics ................................................................................................................................................. 37
Support Scope ........................................................................................................................................ 38
Desktop Support ................................................................................................................................. 38
Network Support ................................................................................................................................. 38
Technology Standards ........................................................................................................................ 39
User Guidelines ....................................................................................................................................... 40
Employing the Help Desk .................................................................................................................... 40
Training ............................................................................................................................................... 40
Problem Reporting .............................................................................................................................. 40
Ticket Closure ..................................................................................................................................... 40
CHANGE CONTROL STANDARD ............................................................................................................ 41
Overview ................................................................................................................................................. 41
Standard .................................................................................................................................................. 41
Support ................................................................................................................................................ 41
Security and Back-up .......................................................................................................................... 42
Ownership Transfer ............................................................................................................................. 42
Testing ................................................................................................................................................. 42
Documentation .................................................................................................................................... 43
Responsibility .......................................................................................................................................... 43
Functional IT Heads ............................................................................................................................ 43
CHANGE CONTROL QUALITY ASSURANCE STANDARD.................................................................... 44
Overview ................................................................................................................................................. 44
Standard .................................................................................................................................................. 44
Testing ................................................................................................................................................. 44
Test Script Development ..................................................................................................................... 45
Responsibility .......................................................................................................................................... 47
Project Manager .................................................................................................................................. 47
Functional IT Heads ............................................................................................................................ 47

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Table of Contents

Enterprise Information Technology

Policies/Standards/Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
3

Developer ............................................................................................................................................ 47
Client/Sponsor ..................................................................................................................................... 48
Planning and Finance ......................................................................................................................... 48
CHANGE CONTROL MANAGEMENT WORKBOOK ............................................................................... 49
Overview ................................................................................................................................................. 49
Standard .................................................................................................................................................. 49
Change Request Form ........................................................................................................................ 49
Business and IT Impact Questionnaire ............................................................................................... 50
Change Management Certification Form ............................................................................................ 50
User Approval Form ............................................................................................................................ 50
DOCUMENTATION STANDARD ............................................................................................................... 51
Overview ................................................................................................................................................. 51
Standard .................................................................................................................................................. 52
Core Application Documentation......................................................................................................... 52
Other Application Documentation ....................................................................................................... 52
Responsibility .......................................................................................................................................... 53
Functional IT Heads ............................................................................................................................ 53
Client ................................................................................................................................................... 53
Audit .................................................................................................................................................... 53
VERSION CONTROL POLICY ................................................................................................................... 54
Policy Statement ..................................................................................................................................... 54
Goal ......................................................................................................................................................... 54
VERSION CONTROL STANDARD ............................................................................................................ 55
Overview ................................................................................................................................................. 55
Standard .................................................................................................................................................. 55
Change Environment .......................................................................................................................... 55
Test Environment ................................................................................................................................ 56
Production Environment ...................................................................................................................... 56
Quality Metrics..................................................................................................................................... 56
Access Control .................................................................................................................................... 57
Documentation .................................................................................................................................... 57
Version Releases ................................................................................................................................ 57
Definitions................................................................................................................................................ 58
Environments ...................................................................................................................................... 58
Testing ................................................................................................................................................. 58
Operations Status ............................................................................................................................... 58
Responsibility .......................................................................................................................................... 59
Project Sponsor ................................................................................................................................... 59
Project Manager .................................................................................................................................. 59
Developers .......................................................................................................................................... 59
System Testers ................................................................................................................................... 59
Application Administrator .................................................................................................................... 59
Users ................................................................................................................................................... 59

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Table of Contents

Enterprise Information Technology

Policies/Standards/Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
4

INTERNET, E-MAIL AND ELECTRONIC COMMUNICATION .................................................................. 60

Overview ................................................................................................................................................. 60
Appropriate use of Equipment............................................................................................................. 60
Internet Access.................................................................................................................................... 60
Electronic Mail ..................................................................................................................................... 60
Retention of E-Mail on Personal Systems .......................................................................................... 61
E-mail and Business Records Retention ............................................................................................ 61
Copyrighted Materials ......................................................................................................................... 63
Ownership of Information .................................................................................................................... 63
Security ............................................................................................................................................... 63
Internet and Electronic Communication Policy ....................................................................................... 64
Policy ................................................................................................................................................... 64
E-Mail ...................................................................................................................................................... 68
Policy ................................................................................................................................................... 68
E-mail - Employee Acknowledgement ................................................................................................ 71
TRAVEL AND OFF-SITE MEETINGS SECURITY .................................................................................... 72
Data and Application Security ............................................................................................................. 72
Minimize Attention ............................................................................................................................... 73
Public Shared Resources .................................................................................................................... 73
Off-Site Meeting Special Considerations ............................................................................................ 73
BLOG AND PERSONAL WEB SITES POLICY......................................................................................... 75
Policy ....................................................................................................................................................... 75
Rights to content ..................................................................................................................................... 76
Option for More Restrictive License Terms ......................................................................................... 76
Attribution ............................................................................................................................................ 76
Guidelines ............................................................................................................................................... 77
Personal Website and Blog Guidelines Non ENTERPRISE domains ................................................. 79
Security Standards .................................................................................................................................. 80
SENSITIVE INFORMATION POLICY ........................................................................................................ 82
Policy ....................................................................................................................................................... 82
Secure Network Standards ..................................................................................................................... 82
Install and Maintain a Network Configuration Which Protects Data ................................................... 82
Modify Vendor Defaults ....................................................................................................................... 85
Protect Sensitive Data ......................................................................................................................... 85
Protect Encryption Keys, User IDs, and Passwords ........................................................................... 87
Protect Development and Maintenance of Secure Systems and Applications ................................... 88
Manage User IDs to Meet Security Requirements.............................................................................. 90
Restrict Physical Access to Secure Data Paper and Electronic Files ................................................. 91
Regularly Monitor and Test Networks ..................................................................................................... 92
Monitor All Access to Network Resources and Sensitive Data ........................................................... 92
Test Security Systems and Processes ............................................................................................... 93
Email and Business Records Retention .................................................................................................. 94
Maintain an Information Security Policy .................................................................................................. 94

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Table of Contents

Enterprise Information Technology

Policies/Standards/Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
5

SERVICE LEVEL AGREEMENT FOR [THE APPLICATION] ................................................................... 95

Overview ................................................................................................................................................. 95
SLA.......................................................................................................................................................... 95
Internal IT SLAs .................................................................................................................................. 95
External SLA ....................................................................................................................................... 97
APPENDIX ................................................................................................................................................ 100
Change Control Request Form ............................................................................................................. 101
Business and IT Impact Analysis Questionnaire................................................................................... 106
Internet Use Approval Form .................................................................................................................. 121
Internet Access Request Form ............................................................................................................. 124
Internet & Electronic Communication - Employee Acknowledgment (short form) ................................ 125
Blog Policy Compliance Agreement ...................................................................................................... 126
Sensitive Information Policy Compliance Agreement ........................................................................... 127
E-mail - Employee Acknowledgement (short form)............................................................................... 128
WHATS NEW ........................................................................................................................................... 129
Version 3.4 January 2008 .............................................................................................................. 129
Version 3.3 August 2007 ................................................................................................................ 129
Version 3.2 October 2006 .............................................................................................................. 129
Version 3.1 April 2006 .................................................................................................................... 129
Version 3.0 February 2006............................................................................................................. 129
Version 2.2 ........................................................................................................................................ 129
Version 2.1 ........................................................................................................................................ 130

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Service-Oriented Architecture

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
7

Service-Oriented Architecture
Definition
Service-Orient Architecture (SOA) is an Information Technology and system
architecture design approach built around computer services and components
that reused and recombined easily using a standard interface.
In an SOA, software and application components advertise themselves on a
network offering a service to other software and components. A customer
service system could provide a look-up that a credit application and financial
management system could use. That is in contrast with a traditional approach
were each of the three applications would have to create the same function that
conformed to each individual application architecture.
In the SOA architecture once a component is created it can be used by any
application in the enterprise.

XML
Marketing literature makes SOA a synonym for Web services via the extensible
markup language XML. XML is a key enabling technology for SOA, but XML
alone does not make an enterprises application architecture service-oriented.
Web service technology via XML is not the only implementation path for SOA,
rather it is quickly becoming the easiest.

SOA Infrastructure
The infrastructure necessary to support SOA includes both the business
operations and the information technology components. SOA as well as
traditional IT Application support require an efficient and effective IT
infrastructure. To that end the policies, procedures, standards and templates
required to support that are defined within this document.
IT Service Management is the basis for the infrastructure for the enterprise. The
policies and procedures to support SOA and tradition IT applications include:

Service Request Policy defines the resources to support the

implementation of new services and existing services within SOA and
traditional IT applications.

Service Request Standard the level of service that is provided in the

SOA development, implementation, and operation of SOA components
and traditional IT applications.

Help Desk Policy how the SOA resources and traditional IT

applications are supported by the IT function.

Help Desk Standards the level of service and metrics used to support
SOA and traditional IT application within the IT function of the enterprise.

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Service Management Standards

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
13

ITIL 3.0 is structured around core of Service. ITIL v3 has five components:

Service Strategy

Service Design

Service Transition

Service Operation

Continual Service Improvement

This template is in compliance with the ITIL v3.0 standard and has a service
focus.
The processes that are addressed in that standard are:

Access Management
Availability Management
Capacity Management
Evaluation
Event Management
Financial Management (aka Service Economics)
Information Security Management
Knowledge Management
Problem Management
Release and Deployment Management
Request Fulfillment
Service Asset and Configuration Management
Service Catalog Management
Service Continuity Management
Service Level Management
Service Portfolio Management

13

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Help Desk Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
30

P2 Tickets

Assign Ticket to
Analyst or Lead
within 15 min.

P2 Call Logged Ticket Opened

Analyst or Lead
Acknowledges
customer within 30
min.

No

Reminder Page
Automatically sent
to Analyst or Lead

Yes

Analyst assess
problem

Yes

Analyst or Lead
Acknowledges
Customer within 2
hrs.
No

Reprioritize
/ Hold

Yes

Notify
Management,
Notify Lead (if
applicable)

Reassign

No

No

Customer
Acknowledges
Problem Solution

Resolution within
4 hrs.

Set Ticket Status

to Resolved

No

Yes

Notify
Management AutoEscalate To Next
Support Level

Analyst => Lead

Lead => Management

Resolution within
an additional 2 hrs.
(6 hrs. total)

Yes

No

Close Ticket

Auto-Escalate to
Management
(Management may
escalate to SWAT)

30

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Change Control Quality Assurance Standard

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
44

Change Control Quality Assurance Standard

Overview
Quality is defined as the efficient and effective development,
deployment, and support of defect-free products and services that
meet, or exceed, the needs of the clients, users, and business. All IT
products and services must conform to client, user, and business
requirements in order to be considered quality offerings.

Standard
Testing
The end user actively participates in application testing prior to user
acceptance. Department personnel should specify the test criteria
and evaluate test results. The purpose of testing is to prove that the
product performs to user defined system specifications.
M

Unit Test

M
M

Product Test

M
M

M
M

Integration
Test

Unit Testing - The testing of individual

program modules. There must be at least
one unit test for each program function. Unit
tests are normally designed and executed by
the programmer/analyst who designed and
coded the program being tested.
Product Testing - The testing of all modules
within a single application to ensure that all
modules function together properly.

Integration Testing - Testing the product as a

whole. The purpose of integration testing is
to test the integration of product components
with each other and the integration of the
entire product into the existing environment.

M
M

Release

User
Acceptance

Acceptance Testing - Serves to verify the

"production readiness" of the product from
the perspective of those who will use or
support the product.

ENTERPRISE-IT defines the four stages of the test as:

44

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Travel and Off-Site Meetings Security

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
72

Travel and Off-Site Meetings Security

Protection of ENTERPRISE data and software is often is
complicated by the fact that it can be accessed from remote
locations. As individuals travel and attend off-site meetings with
other ENTERPRISE employees, contractors, suppliers and
customers - data and software can be compromised.
It is the responsibility of all users, data owners and data managers to
ensure that adequate controls exist per the Internet and Information
Technology Security Manual or special requirements as established
by the Audit Department or the Internet and Information Technology
Security group. Enforcement of these controls is imperative in order
to provide the best environmental security possible.
In addition to that the following procedures should be followed.

Data and Application Security

Do not take your PC on trip unless it is absolutely necessary. If you
need to take a PC, minimize the data and programs that are on the
PC.
Use unique user names and passwords for files on the PC.
Use an external storage device for data and programs. The external
storage device data should be encrypted.
Use biometrics and other techniques, such as removable storage
devices (when possible). This should help to limit risks to
ENTERPRISE if the PC is lost or stolen. Do not store the external
storage or key device with the PC.
Do not automatically save user names and passwords on the PC.
Do not leave your PC, PAD or printed documents unattended. If you
have to leave them in your hotel room, be aware that can be a major
breach in security see if there is a safe that you can put them in.
When attending an offsite meeting, the organizer should provide a
facility where you can check you equipment and reports in which is
secure and guarded.
When using remote printing send a test page before you send
secure data. Be in the location where the printer is printing. If there
are any paper jams retrieve all of the pages. After the jam clear see
what comes out next.
When you are finished with report that contains secure data, keep it
with you until it can be disposed of properly.
At the end of the trip consider sending sensitive reports back to your
office via an express delivery services like FedEx or UPS.

72

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Service Level Agreement for [The Application]

Enterprise Information Technology

Policies/Standards/Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
99

Reporting Problems
Error messages or other application or system problems appear when there is a
anomaly in an application or when inappropriate actions have been taken by the
user. In order for IT to respond effectively to any application or system problems,
users must report error messages or problem conditions accurately, in sufficient
detail, and in a timely fashion to the Help Desk.

Sample Metrics
On the following pages a sample SLA metric report is provided. Note: The report
was generated with Zinnote in Word format and could also be generated in
HTML format (see other documents for additional metrics)

99

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Appendix

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
109

User Environment
Provide the following information for each department that uses the application:
Department name
How the application is used (example: Department A inputs customer information, Department B enters billing etc.)
Primary contact (i.e. primary user or department head name)
Number of people in department that use the application
What attribute best describes the users that have access to this application:
Public
Customers and Employees
Groups of Employees
Specific Employees
Other __________

Department Name

Purpose or Use

Primary Contact

Number
of Users

User Attribute
Public
Customers
Employees
Groups of Employees
Specific Employees
_______________
Public
Customers
Employees
Groups of Employees
Specific Employees
_______________
Public
Customers
Employees
Groups of Employees
Specific Employees
_______________
Public
Customers
Employees
Groups of Employees
Specific Employees
_______________
Public
Customers
Employees
Groups of Employees
Specific Employees
_______________
Public
Customers
Employees
Groups of Employees
Specific Employees
_______________
Public
Customers
Employees
Groups of Employees
Specific Employees
_______________

109

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Appendix

Enterprise Information Technology

Policies/Standards/Procedures

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
110

User Environment Continued

How would the data generated by this application be classified?

Sensitive
Confidential
Internal Use
Public

Describe the ownership to the data:

Not defined _____________________________________________________________________

Multiple owners _________________________________________________________________

Group owners __________________________________________________________________

Individual owner _________________________________________________________________

Describe the Environment: _____________________________________________________________________

__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________

110

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Whats New

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
129

Whats New
Version 3.4 January 2008

Update Blog and Personal Web Site Policy

Updated to meet Sarbanes-Oxley requirements

Updated Blog and Personal Web Site Compliance Agreement
Added section on Rights to Content
Add Best Practices Section

Version 3.3 August 2007

Added section on Service Management Standards including ITIL and

ISO 20000

Updated process flow charts

Version 3.2 October 2006

Updated section on e-mail, Internet and Electronic Communications

Updated Blog Policy Acknowledgement Form

New Forms
1. Internet Usage Policy Employee Acknowledgement (short form)
2. E-Mail Usage Policy Employee Acknowledgement (short form)

Version 3.1 April 2006

Corrections to errata

Defined Service-Oriented Architecture

Added Service Level Agreement Policy Template (application)

Version 3.0 February 2006

Sensitive Information Policy

Sensitive Information Compliance Agreement

Blog and Personal Web Site Policy

Blog Policy Compliance Agreement

Version 2.2

129

Enterprise Information Technology

Policies/Standards/Procedures

Place ENTERPRISE logo here

Section:
Name:
Owner:

ITSM SOA Template

Whats New

Effective Date:
Revised Date:
Page:

1/1/2008
12/8/2007
130

Version 2.1

Internet, E-Mail and Electronic Communication Policy Added

Travel and Off-Site Meeting Security Added

Forms Check boxes automated for double clicks

130