Monthly Archives: July 2021

What is the Service Management System in ISO 20000?

Why do we need the ISO/IEC 20000 standard?

What is a Service Management System in ISO 20000

Getting your ISO 20000 certification is all about showing (with documented evidence) that you have control over the processes, policies and procedures to deliver services as per the agreed needs and demands of your customers.

Do not confuse this with your professional development certification – ISO certification is for your business, or at least a contained portion of your business determined by the scope of the project. (This is important, more about that later).

ITSM – Implementing IT Service Management, or the management of your IT Services has been tricky for many organisations in the past few decades.

There are so many different frameworks and methodologies – there is DevOps, Cobit, Lean IT , Microsoft Operations Framework and of course ITIL.

What is IT Service Management?

IT Service Management is the management of all processes that cooperate to ensure the quality of live services, according to the levels of service agreed with the customer.

It addresses the initiation, design, organization, control, provision, support and improvement of IT services, tailored to the needs of the customer organization.

The term IT Service Management (ITSM) is used in many ways by different management frameworks and organizations seeking governance and increased maturity of their IT organization.

Standard elements for most definitions of ITSM include:

  • Description of the processes required to deliver and support IT Services for customers
  • The purpose primarily being to deliver and support the products or technology needed by the business to meet key organizational objectives or goals
  • Definition of roles and responsibilities for the people involved including IT staff, customers, and other stakeholders • The management of external suppliers (partners) involved in the delivery and support of the technology and products being delivered and supported by IT. The combination of these elements provides the capabilities required for an IT organization to deliver and support quality IT Services that meet specific business needs and requirements. IT Service Management gives the following benefits to the customer:
  • Provision of IT services becomes more customer-focused and the relationship between the service provider and the customer is improved through agreements about service quality.
  • The services are better described in customer language and in more appropriate detail.
  • The availability, reliability, cost, and other quality aspects of the service are better managed.
  • Communication with the IT organization is improved by agreeing on points of contact.

What is a Service?

Means of delivering value for the customer by facilitating outcomes the customer wants to achieve

It is important to note that a service is generally intangible.

The term service as used in the standards document means the service or services in the scope of the Service Management System (SMS for short) .

What is a Process?

A process is a set of interrelated or interacting activities that use inputs to deliver an intended result

The construction of a process is rather simplistic and involves detailed documentation of the following components:

  • Inputs – what the process must have in order to begin, such as information, tools, and triggers.
  • Triggers – an event that invokes the process or an activity within the process.
  • Outputs – what the process must deliver in order to achieve the desired outcomes. Outputs are always tangible.
  • Activities – the process steps necessary to transform the inputs into outputs. • Roles – the people, systems, or tools used to execute the process.

Words are important in the ISO/IEC 20,000 standard – especially the words SHALL vs. SHOULD

Part 1 = system requirements

The current edition was  of ISO 20000:1 was published in 2018 (which means that the 2011 version has been withdrawn)

The requirements specified in this document include the planning, design, transition, delivery and improvement of services to meet the service requirements and deliver value.

Part 2 = Guidance on application and implementation (should statements) – published in 2019. It’s all about how to interpret and implement the standard.

First things first… when talking about standards, we need to talk about SCOPE. Listen to the video on the description of the scope in the standard and why this is so important.

 

Some questions to ask when discussing ISO 20000 internally

  • How does a software provider ensure that users understand how to use systems?
  • Which interfaces exist between systems?
  • How robust are the processes in place to identify and make efficiency improvements?
  • Have policies, procedures and processes been revised or developed to support the new way of work?

** These questions appear in the ISO20000 Self Assessment Toolkit

ISO 27001 1 big thing: Meet expected timelines for customer output and reports, based upon findings per customer objectives.

503 words, 1.9 minutes read.

ISO 27001 1 big thing: Meet expected timelines for customer output and reports, based upon findings per customer objectives.

The big picture: Oversee that your strategy develops and conducts an annual risk assessment to evaluate security and compliance risks across your organization, and oversees quarterly updates.

Why it matters: Oversee the security of products (Secure Systems Development Life Cycle) including Threat Modeling and Application Security Testing (Code reviews, vulnerability testing, and penetration testing).

State of play: Operationalize the analysis and delivery of findings, solutions, or engagements to internal stakeholders with impactful, comparative, interpretative security analysis in a clear, consistent, and factual manner.

Yes, but: Make sure your personnel uses broad and deep security knowledge and technical auditing skills to help ensure risks are appropriately identified, assessed, and articulated.

The backdrop: Ensure you have involvement with ISO 27001 or SOC 2 security controls and understand how they are applied by security and engineering teams.

Go deeper: Make headway so that your team is involved in security incident response activities that includes responding in a manner that identifies, contains and remediates threats to the business.

What they’re saying: “Lead programs and processes to manage and deploy security controls to support business needs and minimize risk, and monitor the emergence of new threats and vulnerabilities, assessing impacts and driving responses as appropriate., Chase P. – Security Consultant, US NPO

How it works: Warrant that your process coordinates disaster recovery, business continuity and incident response planning to ensure effective protection and recovery of information services, organization data and business operations.

Under the hood: Guarantee your workforce analyzes trends and changes in threat and compliance environment with respect to organizational risk; advises organization management and develops and executes plans for compliance and mitigation of risk; performs risk and compliance self-assessments, and engages and coordinates third-party risk and compliance assessments.


A MESSAGE FROM THE ART OF SERVICE

 

Through using your assessment book and toolkit you know now that this is the better way to learn, assess and implement.

Top thinkers are using The Art of Service Critical Capabilities Analysis, the report that’s helping leaders stay ahead of what’s next.

Here’s how: now that you own your assessment, stay one step ahead with the ISO 27001 Critical Capabilities Analysis.

This Analysis will help you plan your roadmap. This Critical Capabilities report enables leaders to shortlist hundreds of appropriate results across the seven RDMAICS typical use cases.

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


What to watch: Ensure your organization needs in depth knowledge, skill, and involvement in designing, building, and maintaining highly secure, always on (high consequence), large scale distributed systems.

The bottom line: Conduct a thorough review of the organizations adherence to regulation guidelines, such as HIPAA, FISMA, SOX, PCI DSS, GDPR, ISO 27001 and 20000, and COBIT.

What’s next: Ensure your staff is creating an enterprise wide action plan to protect organization and client information, monitor cyber threats, and manage information security incidents.

ICYMI: Safeguard that your staff guides the completion of specific programs and projects relating to the subject matter; with no direction, provides expert support, analysis, and research into exceptionally complex problems and processes relating to the subject matter.


A MESSAGE FROM THE ART OF SERVICE

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


Trusted by: Stream, RADcube, Lloyds Register Group, SkyePoint Decisions, McKinsey and Company, Ping Identity, KITTY HAWK TECHNOLOGIES, Siemens, Blue Cross and Blue Shield of Minnesota, The Cadence Group, COMPQSOFT, General Dynamics Information Technology, Amazon Web Services, Inc., Link Solutions, Inc., Kelmar Associates, LLC, Splunk, King and Spalding, Bank of the West, Garmin, Opendoor, J. J. Keller and Associates, Inc., NTT Ltd, GRSi, Adtran, RainFocus, Vistra Corporate Services Company, f5, Sparksoft Corporation, NSSPlus, Edgewater Federal Solutions, Inc., Delta, CHOISYS TECHNOLOGY INC, Super Micro Computer, Inc., Weave HQ, KLDiscovery, Synoptek, Verizon, Google, BSI, Fisher Investments, Imagine One Technology and Management, Ltd., Coalfire, Johnson Controls, Chamberlain Group Inc, EBI, Inc, Highspot, Semtech, Cigna, M3 Global Research, Kellogg Company, University of California – Irvine, Ciena, Dell Technologies, University of Alaska, CALNET INC., University of California, Santa Barbara, Inflection, PTC, Centene Corporation, Deloitte, Inserso, Data Innovations, LLC, APV, Trapp Technology, Ensono, Simon-Kucher and Partners, TeleTracking Technologies, Abbott Laboratories, DXC Technology, Simmons Bank, Sutherland, Pinnacle Group, Power Integrations, amdocs, Microsoft, Rockwell Automation, Sony Corporation of America, TÜV SÜD, Blackwatch International Corporation, ServiceNow, Lucid, iPipeline, T-Mobile

ISO 27001 1 big thing: Partner with operations and product teams with respect to business initiative developments.

577 words, 2.1 minutes read.

ISO 27001 1 big thing: Partner with operations and product teams with respect to business initiative developments.

The big picture: Work with the IS leadership to develop, implement and monitor a strategic, comprehensive enterprise information security and IT risk management program to ensure that the integrity, confidentiality, and availability of information is owned, controlled or processed by the organization.

Why it matters: Lead customer, partner, and vendor InfoSec audits and risk assessments, communicate results to information security stakeholders or business partners, and ensure remediation of outstanding issues.

Be smart: Be able to use common regulations and standards as inputs into IT security and compliance policy creation and updates including NIST, ISO 27001, CobIT, SOX and PCI.

Meanwhile: Perform information security operational tasks and day to day follow up of actions with the overall objective of ensuring the operational effectiveness of existing security controls, improve the overall control environment and reduce risk exposure.

The backdrop: Be confident that your organization oversees and provides direction to the wargaming team to design a scenario to achieve identified goals, including scenario storyline, inject timeline, delivery structure.

How it works: Make certain that your organization is developing and maintaining information security policies, standards, guidelines and oversee the dissemination of security policies and practices.

On the flip side: Make headway so that your process analyzes and develops information security governance, including organizational policies, procedures, standards, baselines and guidelines with respect to information security and use and operation of information systems.

Go deeper: Ensure staff development is an ongoing focus of this operation including having team members work with each other to ensure the distribution of skill sets.

What to watch: Ensure there is a strong knowledge and hands on involvement implementing various cloud technologies including networking, security and compliance, compute, storage, and databases.

What they’re saying: “Present assessment findings to impacted stakeholders and recommend mitigation strategies including updating technology, compensating controls, or policy modifications to improve overall security posture., Brooklyn H. – PCI Risk Manager

State of play: Make sure your company controls operating and capital budget, and participates in the recommendation, evaluation, and selection of new corporate hardware and software systems.

Under the hood: Perform training to the sales organization enhancing the knowledge regarding your security and privacy practices, and architecture, applying existing security and compliance material.


A MESSAGE FROM THE ART OF SERVICE

 

Through using your assessment book and toolkit you know now that this is the better way to learn, assess and implement.

Top thinkers are using The Art of Service Critical Capabilities Analysis, the report that’s helping leaders stay ahead of what’s next.

Here’s how: now that you own your assessment, stay one step ahead with the ISO 27001 Critical Capabilities Analysis.

This Analysis will help you plan your roadmap. This Critical Capabilities report enables leaders to shortlist hundreds of appropriate results across the seven RDMAICS typical use cases.

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


Between the lines: Ensure your group is involved in securing industrial wireless networks and industrial internet of things (iiot) and monitoring packages as siem, soc and noc.

The bottom line: Automate and orchestrate the process of Cloud software deployment (CI/CD) to integrate enterprise security standards, policies, configurations, and architectures, for applications, platforms, and infrastructure.

What’s next: Make sure your process manages and leads the design and operation of the Information Security program and policies along with compliance monitoring and improvement activities to ensure compliance both with internal security policies etc.

ICYMI: Engage in irm program for the key accounts: define control framework; identify and evaluate risks; understand business context and prepare reports and recommendations.


A MESSAGE FROM THE ART OF SERVICE

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


Trusted by: Stream, RADcube, Lloyds Register Group, SkyePoint Decisions, McKinsey and Company, Ping Identity, KITTY HAWK TECHNOLOGIES, Siemens, Blue Cross and Blue Shield of Minnesota, The Cadence Group, COMPQSOFT, General Dynamics Information Technology, Amazon Web Services, Inc., Link Solutions, Inc., Kelmar Associates, LLC, Splunk, King and Spalding, Bank of the West, Garmin, Opendoor, J. J. Keller and Associates, Inc., NTT Ltd, GRSi, Adtran, RainFocus, Vistra Corporate Services Company, f5, Sparksoft Corporation, NSSPlus, Edgewater Federal Solutions, Inc., Delta, CHOISYS TECHNOLOGY INC, Super Micro Computer, Inc., Weave HQ, KLDiscovery, Synoptek, Verizon, Google, BSI, Fisher Investments, Imagine One Technology and Management, Ltd., Coalfire, Johnson Controls, Chamberlain Group Inc, EBI, Inc, Highspot, Semtech, Cigna, M3 Global Research, Kellogg Company, University of California – Irvine, Ciena, Dell Technologies, University of Alaska, CALNET INC., University of California, Santa Barbara, Inflection, PTC, Centene Corporation, Deloitte, Inserso, Data Innovations, LLC, APV, Trapp Technology, Ensono, Simon-Kucher and Partners, TeleTracking Technologies, Abbott Laboratories, DXC Technology, Simmons Bank, Sutherland, Pinnacle Group, Power Integrations, amdocs, Microsoft, Rockwell Automation, Sony Corporation of America, TÜV SÜD, Blackwatch International Corporation, ServiceNow, Lucid, iPipeline, T-Mobile

ISO 27001 1 big thing: Support preparing technical debriefs for (internal) customers requesting further details on vulnerability management.

613 words, 2.3 minutes read.

ISO 27001 1 big thing: Support preparing technical debriefs for (internal) customers requesting further details on vulnerability management.

The big picture: Secure that your group is involved in compliance requirements and industry standards like PCI, HIPAA, ISO 27001, NIST, CSF, ITIL, COBIT, Sarbanes Oxley and SANS 20.

Why it matters: Make sure your staff is working with business leaders and client management organizations to account for and level set fraud event issues and concepts.

What they’re saying: “Safeguard that your workforce acts as the organizations representative with respect to inquiries from partners, elected officials, the media/press, and the general public regarding the organizations security and data protection strategy., Marcus S. – Cyber + Data Risk Compliance Manager

How it works: Be sure your company performs and evaluates costs analyses and vendor comparisons from small through large scale projects to ensure cost effective and efficient operations.

What we’re hearing: “Lead and facilitate the evaluation and selection of security technologies and product standards, and the design of standard configurations/implementation patterns for security solutions., Francisco D. – Cyber Risk + Privacy Analyst

Yes, but: Assure your operation develops strong relationships with business and technology leaders and other business continuity and disaster recovery stakeholders to ensure an integrated approach to both planning and incident response activities.

The backdrop: Make sure your company is responsible for self development on latest trends/developments in the related role/work profile according to professional development plan.

Be smart: Evaluate the implementation of security mitigation techniques to protect the confidentiality, integrity, and availability of the organizations information, information systems, and IT infrastructure and applications in accordance with policies, procedures, security techniques regulations.

Under the hood: Oversee that your organization works closely with teammates maintaining the resources and planning for growth and new services consistent with the mission and strategic objectives.


A MESSAGE FROM THE ART OF SERVICE

 

Through using your assessment book and toolkit you know now that this is the better way to learn, assess and implement.

Top thinkers are using The Art of Service Critical Capabilities Analysis, the report that’s helping leaders stay ahead of what’s next.

Here’s how: now that you own your assessment, stay one step ahead with the ISO 27001 Critical Capabilities Analysis.

This Analysis will help you plan your roadmap. This Critical Capabilities report enables leaders to shortlist hundreds of appropriate results across the seven RDMAICS typical use cases.

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


Between the lines: Be sure your personnel utilizes configuration management tools to support configuration identification, control, reporting, and delivery of developed and commercial off the shelf (COTS) software products.

Meanwhile: Certify your staff is ongoing review and update of the Third Party Risk Management Framework, ensuring the effective integration of industry best practices and regulatory changes affecting third party risk management.

State of play: Ensure constant contact with internal stakeholders, (internal) clients and the other regions, to ensure the smooth management and delivery of advanced security services.

On the flip side: Safeguard that your staff is managing, maintaining, and supporting your Container Security Vulnerability tool(s) to include managing the output and working hands on with the DevOps and Infrastructure teams to drive remediation.

The bottom line: Make sure the team is also the primary touch point between the Corporate Security Group and Business teams, while supporting the business on Client security requirements and compliance.

What’s next: Safeguard that your operation monitors and enforces appropriate and consistent application of the IT General Control Framework – plans, organizes, and executes control monitoring and testing in a manner that meets reporting deadlines, performs impact assessments when weaknesses are identified, and provides training to various IT and business teams on proper application of IT controls to improve your organizations overall compliance posture.

ICYMI: Secure that your company has a strong sense of ownership and persistence to delivering a great customer experience and development of qualified leads.


A MESSAGE FROM THE ART OF SERVICE

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


Trusted by: Stream, RADcube, Lloyds Register Group, SkyePoint Decisions, McKinsey and Company, Ping Identity, KITTY HAWK TECHNOLOGIES, Siemens, Blue Cross and Blue Shield of Minnesota, The Cadence Group, COMPQSOFT, General Dynamics Information Technology, Amazon Web Services, Inc., Link Solutions, Inc., Kelmar Associates, LLC, Splunk, King and Spalding, Bank of the West, Garmin, Opendoor, J. J. Keller and Associates, Inc., NTT Ltd, GRSi, Adtran, RainFocus, Vistra Corporate Services Company, f5, Sparksoft Corporation, NSSPlus, Edgewater Federal Solutions, Inc., Delta, CHOISYS TECHNOLOGY INC, Super Micro Computer, Inc., Weave HQ, KLDiscovery, Synoptek, Verizon, Google, BSI, Fisher Investments, Imagine One Technology and Management, Ltd., Coalfire, Johnson Controls, Chamberlain Group Inc, EBI, Inc, Highspot, Semtech, Cigna, M3 Global Research, Kellogg Company, University of California – Irvine, Ciena, Dell Technologies, University of Alaska, CALNET INC., University of California, Santa Barbara, Inflection, PTC, Centene Corporation, Deloitte, Inserso, Data Innovations, LLC, APV, Trapp Technology, Ensono, Simon-Kucher and Partners, TeleTracking Technologies, Abbott Laboratories, DXC Technology, Simmons Bank, Sutherland, Pinnacle Group, Power Integrations, amdocs, Microsoft, Rockwell Automation, Sony Corporation of America, TÜV SÜD, Blackwatch International Corporation, ServiceNow, Lucid, iPipeline, T-Mobile

ISO 27001 1 big thing: Escalate information technology/security risks in a timely fashion to address risk treatment.

544 words, 2.0 minutes read.

ISO 27001 1 big thing: Escalate information technology/security risks in a timely fashion to address risk treatment.

The big picture: Promote the use of information security, enabling the workforce to utilize new technologies in a secure manner to support the strategic business plan.

Why it matters: Make headway so that your company is involved in developing risk management and information security processes as they grow in size and complexity.

Under the hood: Participate in improving the overall Security culture across Factor; operationalize employee security awareness campaigns and educational activities to address areas of potential risk and/or gaps in compliance.


A MESSAGE FROM THE ART OF SERVICE

 

Through using your assessment book and toolkit you know now that this is the better way to learn, assess and implement.

Top thinkers are using The Art of Service Critical Capabilities Analysis, the report that’s helping leaders stay ahead of what’s next.

Here’s how: now that you own your assessment, stay one step ahead with the ISO 27001 Critical Capabilities Analysis.

This Analysis will help you plan your roadmap. This Critical Capabilities report enables leaders to shortlist hundreds of appropriate results across the seven RDMAICS typical use cases.

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


How it works: Drive and deliver change to the organizations Information and Cyber Security systems, processes and procedures by continuously analyzing and reviewing new security technologies and practices as informed by industry best practice.

Yes, but: Keep updated with emerging security threats and alerts; conduct research on emerging products, services, protocols, and standards in support of security enhancement and development efforts.

State of play: Develop experience architecting and implementing enterprise security solutions that are in compliance with standard industry frameworks and protocols PCI, NIST, ISO 27001, etc.

What they’re saying: “Write policies, controls, and other compliance content regarding information security, risk assessment, business continuity, and other SOC 2 topics, to be included in your product., Claire M. – Director, QA + Compliance-CLM

The backdrop: Provide support to the Staffing and Recruiting team to ensure smooth launches, with the overall goal of creating a positive involvement for your (internal) clients and your employees.

What we’re hearing: “Manage the cost efficient information security organization, consisting of direct reports and/or indirect reports (as individuals in business continuity and IT operations)., Kelly A. – Subject Matter Expert

What to watch: Ensure your team is responsible for the identification of anomalies between the developed system and requirements and quick feedback for resolution of the anomalies Quality Assurance.

Between the lines: Be certain that your staff is responsible for providing security guidance to other team members in their design, implementation and support of new cloud architecture and automation technologies, as well as updates and maintenance of existing cloud and automation systems.

Be smart: Conduct a thorough review of the organizations adherence to regulatory guidelines, such as HIPAA, FISMA, SOX, PCI DSS, GDPR, ISO 27001 and 20000, and COBIT.

The bottom line: Secure that your team is involved in lan/wan security networking principles and devices including vlan, wlan, frame relay, firewall, dmz, vpn, ids, ips, acl, switches, routers, firewalls.

What’s next: Ensure your independent but seamlessly integrated modules include customer data unification, identity resolution, enrichment, analytics/modeling (including in data clean rooms), and activation to 100+ partners in the marketing ecosystem.

ICYMI: Guarantee your organization is responsible for taking requirements and drafting IT security and compliance policy that is understandable to the broader user community.


A MESSAGE FROM THE ART OF SERVICE

 

Get started: store.theartofservice.com/ISO-27001-critical-capabilities/

 


Trusted by: Stream, RADcube, Lloyds Register Group, SkyePoint Decisions, McKinsey and Company, Ping Identity, KITTY HAWK TECHNOLOGIES, Siemens, Blue Cross and Blue Shield of Minnesota, The Cadence Group, COMPQSOFT, General Dynamics Information Technology, Amazon Web Services, Inc., Link Solutions, Inc., Kelmar Associates, LLC, Splunk, King and Spalding, Bank of the West, Garmin, Opendoor, J. J. Keller and Associates, Inc., NTT Ltd, GRSi, Adtran, RainFocus, Vistra Corporate Services Company, f5, Sparksoft Corporation, NSSPlus, Edgewater Federal Solutions, Inc., Delta, CHOISYS TECHNOLOGY INC, Super Micro Computer, Inc., Weave HQ, KLDiscovery, Synoptek, Verizon, Google, BSI, Fisher Investments, Imagine One Technology and Management, Ltd., Coalfire, Johnson Controls, Chamberlain Group Inc, EBI, Inc, Highspot, Semtech, Cigna, M3 Global Research, Kellogg Company, University of California – Irvine, Ciena, Dell Technologies, University of Alaska, CALNET INC., University of California, Santa Barbara, Inflection, PTC, Centene Corporation, Deloitte, Inserso, Data Innovations, LLC, APV, Trapp Technology, Ensono, Simon-Kucher and Partners, TeleTracking Technologies, Abbott Laboratories, DXC Technology, Simmons Bank, Sutherland, Pinnacle Group, Power Integrations, amdocs, Microsoft, Rockwell Automation, Sony Corporation of America, TÜV SÜD, Blackwatch International Corporation, ServiceNow, Lucid, iPipeline, T-Mobile