summit strategies

w w w. s u m m i t s t r a t . c o m

Getting Started with Change and Configuration Management Process Improvement

July 2005

White Paper

summit strategies
Table of Contents

Getting Started with Change and Conguration Management Process Improvement

Sections
Section 1 Change and Conguration Management is Often the First Step To Enabling Dynamic Business and Technology Strategies ........................ 2 CCM Transformation Requires Executive Leadership and Focus ............................. 4 Pilot Limited Number of CCM Processes ................................ 6 Strategies for Filling the CCM Gaps ........................................ 7 Next StepsCommit to CCM Reinvention and Take the Plunge ................................... 9

Section 2 Section 3 Section 4 Section 5

Figures

Figure 1

ITIL Process Framework Emphasizes the Central Role of Conguration and Change Management ................................. 2 Conguration and Change Management Challenges Escalate with the Introduction of Dynamic Infrastructure Architectures ............... 3 Checklist for CCM Gap Assessment ........................................ 7

Figure 2

Figure 3

NOTE: This report is based upon information believed to be accurate and reliable. Neither Summit Strategies, Inc. nor its agents make any warranty, express or implied, as to the accuracy of the information or the opinions expressed. We shall have no liability for any errors of fact or judgment or for any damages resulting from reliance upon this information. Trademarked names appear throughout this report. Rather than list the names and entities that own the trademarks or insert a trademark symbol with each mention of the trademarked name, Summit Strategies uses the names only for editorial purposes and to the benet of the trademark owner with no intention of infringing upon that trademark. 2005. Reproduction in whole or in part is prohibited except with the written permission of the publisher. Unauthorized use or sharing of this document is strictly forbidden.

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

July 2005

summit strategies

Executive Summary

Getting Started with Change and Conguration Management Process Improvement

When it comes to improving IT service levels and operational efciencies, many CIOs rank change and conguration management process improvement high on their list of critical path enablers. But knowing that an organizations change and conguration processes and tools need to become more integrated, effective and exible is just the rst step. To actually implement change and conguration management (CCM) process best practices, as described by IT Infrastructure Library (ITIL) and other IT best practices standards, CIOs need to create a multi-step roadmap that gradually aligns and connects processes, data and tools across multiple IT silos and operational workows. The success of change and conguration transformation programs is anchored by senior-level commitment and measured by tangible, incremental milestones. Successful programs depend on three equally important IT management pillars: Shared, accurate asset and conguration data; Well dened and integrated approval processes and task workows; and Policy-driven workows and automation. IT staff cannot be expected to make the right decisions if they dont have access to the right informationmaking the broad availability of robust and accurate conguration data imperative. State-of-the-art tools are needed to collect and correlate conguration information provided by multiple, independent components and tools. CCM tools must be able to identify dependencies and relationships across servers, storage, software, security, provisioning, and other systems and provide accurate, actionable information to all IT staff quickly and accurately. Like shared data, common and consistent processes are needed to coordinate the actions and decisions taken by each domain-specic technology specialist. Documenting formal task workows, identifying specic process owners and designating approvers at each major milestone are critical steps. So is enforcing these common and consistent processes across the board. Over time, IT organizations can learn from the data and develop automation policies to reduce the time and human errors that frequently cause SLA problems and business downtime. Once a CIO is committed to integrating, streamlining and transforming the organizations CCM approach, it is vital to prove the value of CCM with a focused pilot targeting one or two key processes. Activities that are subject to frequent operator errors, or are agged by compliance audits are often good starting points where CIOs can quickly demonstrate the value of integrated change and conguration management approaches to both business and IT stakeholders. Change and conguration management transformation needs to be modular and well thought out. The most successful organizations dene their desired state of affairs, identify where process and tools gaps exist in the current environment and chart a structured, methodical path to transform their organization, one step at a time. For enterprises that need agile and cost-competitive IT environments, change and conguration management transformation is inevitable. The sooner your organization begins the journey, the sooner it will reap the benets. Mary Johnston Turner, mturner@summitstrat.com
Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

July 2005

summit strategies
White Paper

Getting Started with Change and Conguration Management Process Improvement

ITs ability to enable critical business services reliably and cost effectively, day in and day out, depends on detailed choreography and communication among specialists supporting diverse systems, software and management platforms. When communications break down, operators often have incomplete information and context on which to base their individual decisions and actions. The result is service-affecting human errors. Most CIOs intuitively understand that IT operations can be much more stable and efcient if operators and technology specialists across IT are able to work together using shared up-to-date information, consistent operational processes and coordinated approval processes. They also quickly appreciate the potential benets that can result from automating routine manual tasks by using standard policies and workow tools. In fact, the challenge for most CIOs is not trying to understand the opportunity and potential benets that might result from implementing IT Infrastructure Library (ITIL) or similar IT best practices process models. Rather, their real challenge is determining how to get started in a way that delivers measurable, incremental near-term results, drives the organization to higher service levels, improves operational efciencies over time and continues to support current business requirements without disruption. This paper provides advice to CIOs who want to get started with change and configuration management (CCM) transformation. Section 1 describes why CCM is such a critical element of enterprise IT management strategies. Section 2 explains why CCM transformation has to be led from the top. Section 3 shows why targeting a few high profile processes early on helps build support from both business and IT stakeholders. Section 4 describes the types of gaps most CIOs are likely to find when they compare their current CCM environment with the processes and tools they will need to get the job done in the future. Section 5 concludes with a brief discussion of the benefits that result from implementing a well thought-out CCM strategy.
|

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 1

Section 1

Change and Conguration Management is Often the First Step To Enabling Dynamic Business and Technology Strategies
Change and conguration management process improvement is an important rst step supporting many broad IT transformation strategies. Whether CIOs want to reduce costs, make IT more responsive to the business or implement a services view of IT management and operations, CCM processes must be tightly integrated and standardized. Without well-dened CCM processes, supported by accurate, in-depth real-time information, different IT operational domains and platform-specic specialists have a very difcult time communicating, resolving problems and planning for the future. As ITIL explains, conguration management data and CCM processes are core IT control points that must be aligned and standardized if an IT organization is going to successfully manage increasingly complex infrastructure and operational requirements (see Figure 1). As most CIOs already know, uncoordinated change and conguration management processes often create as many problems as they solve since most changes, upgrades and patches impact more than one technology component and often require action by more than one operator or administrator. Lack of communication or incomplete conguration information can result in wellintended operators and administrators making disastrous mistakes. As a result, something as simple as applying a security patch to a server can require multiple, time-consuming change control meetings and ad hoc communications involving systems administrators, database experts, security specialists and application software developersas well as their supervisors and directors.

Figure 1

ITIL Process Framework Emphasizes the Central Role of Conguration and Change Management
The ITIL Process Framework provides a high level set of process models for standardizing the end-to-end operation of IT. Configuration and change management are identified as central processes which directly impact every other process area on a day-to-day basis. Service Delivery
Capacity Planning Availability/ Continuity Reporting Service Level Management
& Change Configuration and Processes Change Processes

Security Budgets and Finance

Release Management

Incident and Problem Management

Vendor/Asset and Contracts Management

Source: Summit Strategies, Inc., www.summitstrat.com

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 2

More complex system upgrades or new application rollouts often require months of planning and coordination and, many times, still need to be rolled back due to unforeseen problems resulting when changes to one systems parameters and congurations negatively impact another platform or application. Worse, changes are often analyzed, documented and approved in different independent systems using tools and databases that can only be correlated manually. Time and time again this situation makes it difcultif not impossiblefor different functional areas to stay in synch and often results in delays or duplication of effort. The use of multiple overlapping assessments, approvals and acceptances only escalates when CIOs begin to implement blades, virtualization, Web services or other emerging technologies designed to make IT more exible and cost effective. A recent Summit Strategies survey of 100 decision makers experienced with operating or pilot testing these technologies indicates that conguration, communication and automation are top priorities going forward (see Figure 2).
Figure 2 Conguration and Change Management Challenges Escalate with the Introduction of Dynamic Infrastructure Architectures
Configuration, communication and automation are top priorities for companies that have had experience with virtualized infrastructure technologies.

Improve cross-domain configuration and change management Improve workload balancing/capacity planning Implement more automation to deal with complexity Improve communications across different IT groups More equitably allocate costs and charge backs Increased staff training and education Better identity management Develop business oriented SLAs Faster IT decision making NA/Other
N=100; multiple selections permitted

34% 33% 33% 27% 21% 19% 16% 8% 5% 28% 0% 5% 10% 15% 20% 25% 30% 35% 40%

Source: Summit Strategies, Inc., www.summitstrat.com

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 3

For many CIOs hoping to improve the stability of their IT operationswhile holding down costs and enabling increased business exibilitychange and conguration management is an area where focused attention can have major payback across the IT organization. It is also an area where change must be driven from the top of the IT organization, if those investments are to have any lasting impact.

Section 2

CCM Transformation Requires Executive Leadership and Focus

More than any other set of core IT processes, effective CCM strategies require traditional IT silos to work together in untraditional and, for some, unnatural ways. Effective CCM processes are supported by three equally important sets of tools: Well dened and integrated approval processes and task workows; Shared, accurate asset and conguration data; and Policy-driven workow and automation. Common and consistent processes are critical for aligning the actions and decisions taken by each individual technology specialist around a consistent set of business priorities, operational task ows and approval authorizations. Documenting formal task workows, identifying specic process owners and designating approvers at each major milestone is critical. So is enforcing these common and consistent processes across the board. Most organizations attempting to standardize and integrate CCM processes nd that documenting the desired process can be arduous and time consuming but well worth the effort in the end. Many organizations assign dedicated SWAT teams to drive implementation and keep process standardization on course. Well-implemented process standardization programs can deliver immediate benets by streamlining and simplifying decision making and eliminating overlapping or unclear areas of responsibility. However, to be successful, process improvement efforts must have strong executive backing and support. Without unwavering senior-level commitment to streamlined processes, mid-level, and even senior-level approvers and process owners might abdicate their responsibilities and allow their organizations to revert back to the old way of doing things. CIOs consistently report they are surprised and often alarmed about the difculties they encounter in driving cultural and process changes. Most advise their peers to start with a few critical task areas and to insist on consistent, universal enforcement at all levels of the organization. CIOs must be willing to revise and simplify heavy processes if needed with an eye toward implementing a level of accountability that is reasonable given the resources available and the priorities of the business.

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 4

Once processes have been reviewed and streamlined, IT needs to make sure it has the data necessary to drive its critical decisionsand that the data is accurate and easily shared across all IT groups who need access. Critical conguration data encompasses several types of information about the IT environment. Most often, these different types of data are collected in different systems, then are correlated and shared across IT using federated database architectures. Critical conguration data includes both static asset inventory and licensing information, the mapping of assets to owners and users, and run-time information about device and software settings, parameters, patch levels, and so forth. Tools are needed to federate and correlate this information and identify dependencies and relationships across servers, storage, software, security and provisioning platforms. Making robust, accurate, conguration data management systems available is an imperative, as IT staff cannot be expected to make the right decisions if they dont have access to the right information. Having created an environment that is driven by accurate, up-to-date data and standardized CCM processes, CIOs can begin developing a CCM automation strategy to help drive down the costs of CCM while improving reliability and overall service levels. The automation strategy needs to followrather than leadthe process and data management activities since CIOs need the analysis conducted during the process and data reviews to support automation planning activities. Automation improves performance and reduces costs by limiting opportunities for human error. It also speeds implementation by enabling specic actions to be implemented immediately based on pre-dened conditions and policies. Effective automation needs to align with the organizations end-to-end workow and CCM process guidelines and be triggered by metrics and thresholds developed using operational data. Many organizations begin by automating very specic, manual, repetitive processes such as patch application or desktop image compliance enforcement. The more they can reduce and automate manual tasks, the fewer opportunities will exist for human error to create service-level problems, and the more IT staff can focus on higher value activities. Most CIOs advise organizations to start slow with automation, targeting very well-dened tasks for which there are few and infrequent exceptions. Overall, the importance of senior executive leadership in CCM transformations cannot be underestimated. Service desk or mid-level managers simply have insufficient power to influence senior executives who must actively participate as approvers in new or re-defined projects. And, it often takes direct pressure from the CIO to force high-level IT executives to enforce process compliance among their own staff and to insist that each IT group be evaluated based on how well it helps the organization execute the CCM strategy.

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 5

Section 3

Pilot Limited Number of CCM Processes

Once a CIO is committed to integrating, streamlining and transforming his rms CCM approach, it is vital to select a few key processes which can quickly demonstrate the value of CCM best practices and provide the business case for purchasing required platforms and tools. CCM requires changes at many levels, including process design, service level metrics, process ownership assignments and individual operator roles and responsibilities. Biting off a too aggressive agenda makes it difcult to document clear benets in the short run. Criteria for selecting these initial processes include areas that: Frequently experience problems due to operator error; Have or can dene clear process checkpoints and sign-offs; Involve several different technology domains and specialists who are willing to support the process changes; and Systems and processes agged by compliance audits and requirements imposed by Sarbanes-Oxley, HIPAA and related regulatory edicts. Many organizations begin with processes such as: Desktop image standardization and refresh; Desktop or server patch management and distribution; System update scheduling and lock-down procedures; and User provisioning/terminations. These types of processes typically require multiple technology specialists to work together, but the end-to-end workows are reasonably well understood and can be documented without excessive internal debate. They are also applications for which there is a clear business caseeither based on estimated labor savings and/or support for regulatory requirements. Regardless of the pilot processes selected, the CIOs goal is to demonstrate how sharing conguration information, integrating conguration and change processes and communicating better across silos can improve ITs value to the business and reduce operational inefciencies and errors. After selecting target pilot process areas, the CIO must next implement a structured process (see Figure 3) that: Documents the desired service level and workow targets; Assesses the ability of the current environment to deliver on those targets; and Creates a documented set of tasks and responsibilities to ll the gaps and implement the plan.

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 6

Figure 3

Checklist for CCM Gap Assessment

The most effective CCM gap assessments focus on specific processes and workflows. Initially stakeholders representing multiple technology silos will find it very challenging to work together to develop an integrated process model. But, over time, the organization will be more comfortable and efficient with the process. Target Process As Is Model Identify current process SLAs Identify existing task owners/approval checkpoints Identify existing documentation requirements and management tools Identify existing configuration management/assets and data management tools Map decision making and task execution flows/relationships Desired Workflow To Be Model Define desired SLAs Model desired task flows Identify optimal approvers and task owners Identify required approval points and task assignments Identify required configuration management data and tools Identify required documentation requirements Gap Assessment Key Points of Analysis Points of decision making overlap; missing control points Ability of existing data management tools to support target Ability of existing documentation process and tools to support target Missing metrics and management dashboard KPIs Opportunities for mid-to-longterm task automation Transformation Plan Specify changes to task owners and approvers Select and implement required documentation and data management tools Pilot target process and tools Assess and refine as needed

Source: Summit Strategies, Inc., www.summitstrat.com

As part of this assessment, the CIO needs to develop a business case for the projectone that highlights the potential near-term cost savings as well as the expected improvements to business processes, such as faster new employee activations or improved compliance with regulatory requirements.

Section 4

Strategies for Filling the CCM Gaps

Most organizations struggle much more with the human and cultural factors of CCM transformation than they do with the implementation of tools and feder-

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 7

ated conguration management database architectures. Therefore, before committing to massive investments in new tools and technology, many CIOs nd it important to educate their staff about the need for an end-to-end process view of IT. Whether it be ITIL training or other similar best practices education, raising both staff and executive awareness about what it really means to take a services view of IT operations can help pave the way for the changes that will be required. Simultaneous with staff education, CIOs must examine their current process models with an eye towards simplifying and standardizing workows and approval processes. Taking something as straightforward as desktop or server patch management, consultants or an internal team should map out the current ow, identify where approvals occur today, identify which individuals and roles have which responsibilities and, perhaps most important, identify where portions of the end-to-end process become disconnected or where required information is difcult to capture. In the case of patch management, for example, this means noting when and by whom the request is initiated, understanding what types of conguration data is required for planning and assessment purposes, and noting what key decisions need to be made in terms of when patches can be scheduled, which systems have priority, how much notication must be given to end users and what type of backups must be made before the patch is implemented. During this process analysis phase, CIOs may discover that the handoffs and coordination between systems, security and applications software specialists are not documented or sufciently formalized. This can result in situations where end users encounter problems because system-level patches are applied before applications have been updated to support them. Such analysis can also uncover situations where missing or inconsistent processes directly increase costs and/or reduce service levels by needlessly adding to service desk workloads and/or delaying the closeout of trouble tickets. It may also uncover areas where required conguration data is lacking or out of date. The process analysis phase may also point out areas where the lack of clear process owners or measurable workow SLAs will result in delays and unnecessary ad hoc interventions. For example, CIOs may nd situations where too many people participate in approvals. Reducing the number of checkpoints might smooth out the process. CIOs may also nd situations where too few people are involved. Depending on what the assessment shows, CIOs may need to update asset or conguration database tools, implement tools to better correlate data, and improve systems that map assets and runtime conguration data across multiple server, middleware and applications tiers. They may also need to dene target SLAs for each required process step, and dene the appropriate approvers, approval response times, and related workow milestones.

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 8

Once organizations dene the target end state, process ows and SLAs, they must improve information sharing between different IT silos and key business sponsors to streamline decision making and assure that all decision makers are reacting to the same set of real-time data. To do this, most organizations deploy multi-tier dashboards allowing different stakeholders to view the status and impact of changes in their own context. These tools permit everyone to see the same top line status data and then drill into the data as needed to get their jobs done. Once the target workows and approvals are interconnected and well understood, and the support, asset and conguration data is available in the shared system, IT can begin to develop standardized policies to gradually shift the organization away from manual approval processes, by automating selected repeatable processes according to IT and business policies. Over time, such activities as patch management, usage reporting and chargeback, software distribution, desktop image management and many security conguration policies can be implemented and enforced on an automated basisas long as all stakeholders have agreed to the policies, SLAs and priorities driving these automated activities. By starting on a few, high impact process areas or regulatory requirements, CIOs can drive the vision of ITIL into day-to-day operations, at a pace that existing organization structures, staff and end users can more readily accept. As the shift to a services model for IT delivery is accepted, it becomes easier to streamline and automate more and more processes and domains.

Section 5

Next StepsCommit to CCM Reinvention and Take the Plunge

Regardless of the specic task priorities or the status of a particular rms existing conguration and change management tools and processes, all CIOs must approach CCM transformation as an evolutionary rather than revolutionary opportunity. This evolution starts with staff education and building support and an understanding for what it means to deliver IT capabilities to the business as an end-to-end service. It builds with targeted, in-depth analysis and standardization of a few high prole CCM processes. When it comes time to purchase or upgrade tools, the major investments most CIOs need to make involve beeng up their conguration management database platform, enhancing dependency and root cause analysis capabilities and adding policy management and workow automation tools. The most effective tools will allow CIOs to begin to transform their CCM processes using environments that can be extended modularly over time. They will support a mix of agentless and agent-based discovery mechanisms and support industry standard protocols such as CIM and SOAP. Most importantly, CIOs will be able to justify their CCM investments with clear business cases that include:

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 9

More stable and reliable delivery of IT services; Fewer, less frequent operator errors; Lower overall cost of operating IT; Increased ability to respond to changing business conditions as needed; and Fulllment of regulatory requirements. CCM transformation is still more of a vision than reality for the majority of CIOs. However, leading-edge CIOs have passed the point of considering when or why they should transform their CCM environments. To stay agile and cost competitive, these CIOs know its simply a question of when. The sooner your organization begins the journey, the sooner it will reap the benets.

Mary Johnston Turner mturner@summitstrat.com

This white paper was sponsored by BMC Software. Summit Strategies is a market strategy and consulting rm focused on helping IT vendors quickly identify and capitalize on disruptive industry inection points. Since 1984, our breakthrough thinking and one-to-one consulting engagements have provided vendors with objective, hard-hitting insight critical for creating successful market, channel and product strategies in changing markets. Our current focus is on the adoption of dynamic (a.k.a. utility or on demand) computing among enterprise, mid-market and small business customers. For more information, please visit our Website at www.summitstrat.com or contact Ms. Billie Farmer at bfarmer@summitstrat.com or 703-897-5188

Doc. #56584

Getting Started with Change and Conguration Management Process Improvement 2005 Summit Strategies, Inc. Unauthorized use or sharing of this document is strictly forbidden.

Page 10