ITIL Continual Service Improvement

ITIL Continual Service Improvement

The ITIL Continual Service Improvement process focuses on quality management. The continual improvement process intends to continually improving the efficiency of IT processes and IT services, carried out in custom software development companies, in an effective way , as per the standard adopted of continual improvement adopted in ISO 20000

The objective of the ITIL Continual Service Improvement includes :

• To review and analyze improvement opportunities in each phase of the continuous lifecycle
• To review and analyze results of the Service Level achievement
• To improve cost of delivering IT services effectively without sacrificing the satisfaction of customer
• To identify and implement individual activities to improve the quality of IT services
• To ensures that the appropriate quality management processes and methods are used to support the activities carried out for the continual improvement in a software development organization.

The activities of ITIL Continual Service Improvement includes :

• Reviewing that the ITSM processes achieve the desired and qualitative results
• Periodically demonstrate areas of improvement 
• Conducting internal audits verifying employees and process compliance
• Reviewing existing deliverables for relevance
• Conducting external and internal service to identify CSI opportunities
• Review management information and trend to ensure services are meeting the SLAs.
• Periodically proposing recommendations for improvement opportunities
• Periodically conducting customer satisfaction surveys
• Conducting service reviews i.e both internal as well as external ,to identify CSI opportunities

There are 7 steps followed in the ITIL Continual Service Improvement process.

They are as follows :

• To define what data you should measure
• To define what data you can measure
• To gather the relevant data need for the continuous improvement
• To process and filter the appropriate data
• Analyze the data by choosing the relevant methods
• To present/assess the data
• To implement corrective actions for getting the quality information and improved data

The processes of ITIL Continual Service Improvement  includes :

• Service Review
• Process Evaluation
• Definition of CSI Initiatives
• Monitoring of CSI Initiatives

Service Review

The objective of service review includes :

• To review business and IT services and infrastructure services on a regular basis.
• To improve the quality of the IT services where necessary
• To identify more efficient and economical ways of providing IT service where possible.

Process Evaluation

The objective of Process Evaluation includes :

• To evaluate processes on a regular basis. 
• To identify those areas where the targeted process metrics are not reached, 
• Holding regular benchmarking, audits, maturity assessments and reviews.

Definition of CSI Initiatives

The objective of Definition of CSI Initiatives includes :

• To define specific initiatives which focuses on improving services and processes, based on the results of service reviews and process evaluations.

Monitoring of CSI Initiatives

The objective of Monitoring of CSI Initiatives includes :

• To verify and monitor improvement initiatives whether they are proceeding according to plan or not
• To introduce and take corrective measures where necessary during the lifecycle.

TARGET AUDIENCE

ITIL Continual Service Improvement is relevant to organizations involved in the development, delivery or support of services, including:

• Various Service providers – Internal providers and External providers
• Software development Organizations that target to improve services through the effective application of service management to improve their service quality
• Software development Organizations that require a consistent managed approach across all service providers in a supply chain or value network
• Software development Organizations that are going out to tender for their services.

Conclusion :

Thus, the IT software development companies should use and implement the Continuous Service Improvement to improve and monitor IT service as a part of ITIL processes for increasing quality of the services and thereby increasing the value plus customer satisfaction.

References:

• http://wiki.en.it-processmaps.com/index.php/ITIL_CSI_-_Continual_Service_Improvement

Moving from ISO/IEC 27001:2005 to ISO/IEC 27001:2013 - Part 2

Clause 4: Context of the organization 

This is a new clause that in part addresses the depreciated concept of preventive action and in part establishes the context for the ISMS. It meets these objectives by drawing together relevant external and internal issues (i.e. those that affect the organization’s ability to achieve the intended outcome(s) of its ISMS) with the requirements of interested parties to determine the scope of the ISMS. 

It should be noted that the term ‘issue’ covers not only problems, which would have been the subject of preventive action in the previous standard, but also important topics for the ISMS to address, such as any market assurance and governance goals that the organization might set for the ISMS. Further guidance is given in Clause 5.3 of  ISO 31000:2009.

Note that the term ‘requirement’ is a ‘need or expectation that is stated, generally implied or obligatory’. Combined with Clause 4.2, this in itself can be thought of as a governance requirement, as strictly speaking an ISMS that did not conform to generally-accepted public expectations could now be ruled nonconforming with the standard.

The final requirement (Clause 4.4) is to establish, implement, maintain and continually improve the ISMS in accordance with the requirements the standard.

Clause 5: Leadership 

This clause places requirements on ‘top management’ which is the person or group of people who directs and controls the organization at the highest level. Note that if the organization that is the subject of the ISMS is part of a larger organization, then the term ‘top management’ refers to the smaller organization. The purpose of these requirements is to demonstrate leadership and commitment by leading from the top. 

A particular responsibility of top management is to establish the information security policy, and the standard defines the characteristics and properties that the policy is to include. This is important for software development companies.

Finally, the clause places requirements on top management to assign information security relevant responsibilities and authorities, highlighting two particular roles concerning ISMS conformance to ISO/IEC 27001 and reporting on ISMS performance.

Clause 6: Planning 

Clause 6.1.1, General: This clause works with Clauses 4.1 and 4.2 to complete the new way of dealing with preventive actions. The first part of this clause (i.e. down to and including 6.1.1 c)) concerns risk assessment whilst Clause 6.1.1 d) concerns risk treatment. As the assessment and treatment of information security risk is dealt with in Clauses 6.1.2 and 6.1.3, then organizations could use this clause to consider ISMS risks and opportunities.

Clause 6.1.2, Information security risk assessment: This clause specifically concerns the assessment of information security risk. In aligning with the principles and guidance given in ISO 31000, this clause removes the identification of assets, threats and vulnerabilities as a prerequisite to risk identification. This widens the choice of risk assessment methods that an organization may use and still conforms to the standard. The clause also refers to ‘risk assessment acceptance criteria’, which allows criteria other than just a single level of risk. Risk acceptance criteria can now be expressed in terms other than levels, for example, the types of control used to treat risk.

The clause refers to ‘risk owners’ rather than ‘asset owners’ and later (in Clause 6.1.3 f)) requires their approval of the risk treatment plan and residual risks.

In other ways the clause closely resembles its counterpart in ISO/IEC 27001:2005 by requiring organizations to assess consequence, likelihood and levels of risk. Assessment of consequences, likelihood and levels of risk is essential for software development companies.

Clause 6.1.3, Information security risk treatment: This clause concerns the treatment of information security risk. It is similar to its counterpart in ISO/IEC 27001:2005, however, it refers to the ‘determination’ of necessary controls rather than selecting controls from Annex A. Nevertheless, the standard retains the use of Annex A as a cross-check to make sure that no necessary control has been overlooked, and organizations are still required to produce a Statement of Applicability (SOA). The formulation and approval of the risk treatment plan is now part of this clause.

Clause 6.2, Information security objectives and planning to achieve them: This clause concerns information security objectives. It uses the phrase “relevant functions and levels”, where here, the term ‘function’ refers to the functions of the organization, and the term ‘level’, its levels of management, of which ‘top management’ is the highest. The clause defines the properties that an organization’s information security objectives must possess. This lets software application development companies to move from ISO 27001:2005 to ISO 27001:2013.

Author Signature: Shreyans Agrawal (ifour.shreyans.agrawal@gmail.com)

Moving from ISO/IEC 27001:2005 to ISO/IEC 27001:2013 - Part 1

ISO/IEC 27001:2013 is the first revision of ISO/IEC 27001. First and foremost, the revision has taken account of practical experience of using the standard: there are now over 17,000 registrations worldwide. However, there have been two other major influences on the revision. The first is an ISO requirement that all new and revised management system standards must conform to the high level structure and identical core text defined in Annex SL to Part 1 of the ISO/IEC Directives. Conformance to these requirements will have a tendency to make all management system standards look the same, with the intention that management system requirements that are not discipline-specific are identically worded in all management system standards. This is good news for software application development companies that operate integrated management systems, i.e. management systems that conform to several standards, such as ISO 9001 (quality), ISO 22301 (business continuity) as well as ISO/IEC 27001. The second influence was a decision to align ISO/IEC 27001 with the principles and guidance given in ISO 31000 (risk management). Again, this is good news for integrated management systems as now an organization may apply the same risk assessment methodology across several disciplines.

The result is that structurally ISO/IEC 27001:2013 looks very different to ISO/IEC 27001:2005.In addition, there are no duplicate requirements, and the requirements are phrased in a way, which allows greater freedom of choice on how to implement them.  A good example of this is that the identification of assets, threats and vulnerabilities is no longer a prerequisite for the identification of information security risks. The standard now makes it clearer that controls are not to be selected from Annex A, but are determined through the process of risk treatment. Nevertheless, Annex A continues to serve as a cross-check to help ensure that no necessary controls have been overlooked.

Clause 0: Introduction 

This is a much shorter clause than its predecessor. In particular the section on the PDCA model has been removed. The reason for this is that the requirement is for continual improvement (see Clause 10) and PDCA is just one approach to meeting that requirement. There are other approaches, and organizations are now free to use them if they wish. Many software application development companies are adopting such approaches.

The introduction also draws attention to the order in which requirements are presented, stating that the order does not reflect their importance or imply the order in which they are to be implemented. 

Clause 1: Scope 

This, too, is a much shorter clause. In particular there is no reference to the exclusion of controls in Annex A.

Clause 2: Normative references 

The only normative reference is to ISO/IEC 27000, Information technology — Security techniques — Information security management systems — Overview and vocabulary.

Clause 3: Terms and definitions 

There are no longer any terms or definitions in ISO/IEC 27001:2013. Instead, readers are referred to ISO/IEC 27000. However, please ensure that you use a version of ISO/IEC 27000 that was published after ISO/IEC 27001:2013 otherwise it will not contain the correct terms or definitions. This is an important document to read. Many definitions, for example ‘management system’ and ‘control’ have been changed and now conform to the definitions given in the new ISO directives and ISO 31000. If a term is not defined in ISO/IEC 27000, please use the definition given in the Oxford English Dictionary. This is important, otherwise confusion and misunderstanding may be the result.


Author Signature: Shreyans Agrawal (ifour.shreyans.agrawal@gmail.com)

Implementing ISO 27001 - Part 2

Implementation Phases

An organization needs to have the detailed understanding of PDCA implementation phases to manage the costs of the project. Software development companies adopt PDCA cycle to implement international standards. Cycle of the PDCA is consistent with all auditable international standards: ISO 18001, 9001 and 14001. ISO/IEC 27001:2005 gives the following PDCA steps for an organization to follow:

• Define an ISMS policy.
• Define the scope of the ISMS.
• Perform a security risk assessment.
• Manage the identified risk.
• Select the controls to be implemented and applied.
• Prepare an SOA.

Phase 5—Prepare an Inventory of Information Assets to Protect, and the Rank Assets According to the Risk Classification Based on Risk Assessment

The various companies, such as software development companies, needs to create a list of information assets to be protected. The following are suggested steps:

• For the assets classify the key CIA impact levels: high, medium and low.
• Identify the risks, and also classify them according to their severity and vulnerability.
• After complete identification of the risks and the levels of CIA, do assign the values to the risks.

Phase 6—Manage the Risks, and Create a Risk Treatment Plan

To control the impact associated with risk, the organization must accept and avoid and transfer or reduce the risk to an acceptable level using risk mitigating controls. Then the next stage is performing the gap analysis with the controls provided in the standard to create an RTP and an SOA and it is also important to obtain management approval of the proposed residual risks.

The RTP also provides:

• Acceptable risk treatment (accept, transfer, reduce, avoid)
• Identification of operational controls and additional proposed controls with the help of gap analysis

Phase 7—Set Up the Policies and Procedures to Control Risks

For the controls adopted, shown in the SOA the organization will require the statements of policy or a detailed procedure and responsibility document to identify user roles for consistent and effective implementation of policies and procedures. And the documentation of policies and procedures is a requirement of ISO/IEC 27001. Also the list of applicable policies and procedures depends on the organization’s structure, the locations and the assets.

Phase 8—Allocate Resources, and Train the Staff

The ISMS process highlights one of the important commitments for the management: sufficient resources to manage, develop, maintain and implement the ISMS. And also it is very essential to document the training for audit.

Phase 9—Monitoring the Implementation of the ISMS

The periodic internal audit is a must for monitoring and review. The internal audit review consists of testing of controls and identifying corrective/preventive actions. In order to complete the PDCA cycle all the gaps identified in the internal audit must be addressed by identifying the corrective and preventive controls needed and the company’s compliance based on a gap analysis.

Also to be effective, the ISMS need to be reviewed by management at periodic and planned intervals. This review follows the changes and improvements to the policies, procedures, the controls and staffing decisions. It is a very important step in the process is project management review. Thus the results of audits and periodic reviews are documented and maintained.

Phase 10—Preparation for the Certification Audit

In order for the organizations, such as software development companies, to be certified it is very essential that it conduct a full cycle of internal audits and management reviews and activities in the PDCA process and that it retains evidence of the responses taken as a result of those reviews and audits. The ISMS management should review risk assessments, the RTP, the SOA, and the policies and procedures at least annually.

An external auditor will first examine the ISMS documents to determine the scope and content of the ISMS and the objective of the review and audit is to have sufficient evidence and review/audit documents sent to an auditor for review. Thus the evidence and documents will demonstrate the efficiency and effectiveness of the implemented ISMS in the organization and its business units.

Phase 11—Conducting Periodic Reassessment Audits

The follow-up reviews or periodic audits confirm that the organization remains in compliance with the standard.

The certification maintenance requires periodic reassessment audits to confirm that the ISMS continue to operate as specified and intended. Thus with any other ISO standard the ISO 27001 follows the PDCA cycle and assists ISMS management in knowing how far and how well the enterprise has progressed along this cycle. It directly influences the time and cost estimates related to achieving compliance.

Conclusion

The true success of ISO 27001 is its alignment with the business objectives and effectiveness in realizing those objectives. For software development companies the IT and other departments play an important role in implementing ISO 27001. Implementing ISO 27001 is an exercise toward better understanding an existing inventory of IT initiatives, information availability and ISMS implementation phases. An organization also needs to have the detailed understanding of PDCA implementation phases. 

Without a well-defined and well-developed ISO 27001 project plan, implementing ISO 27001 would be a time- and cost-consuming exercise. To achieve the planned return on investment (ROI), the implementation plan has to be developed with an end goal in mind. Training and internal audit are major parts of ISO 27001 implementation. ISO 27001 certification should help assure most business partners of an organization’s status with respect to information security without the necessity of conducting their own security reviews. 

Author Signature: Shreyans Agrawal (ifour.shreyans.agrawal@gmail.com)

Implementing ISO 27001 - Part 1

Implementation Phases

An organization needs to have the detailed understanding of PDCA implementation phases to manage the costs of the project. Software development companies adopt PDCA cycle to implement international standards. Cycle of the PDCA is consistent with all auditable international standards: ISO 18001, 9001 and 14001. ISO/IEC 27001:2005 gives the following PDCA steps for an organization to follow:

• Define an ISMS policy
• Define the scope of the ISMS
• Perform a security risk assessment
• Manage the identified risk
• Select the controls to be implemented and applied
• Prepare an SOA

Phase 1—Identify Business Objectives

Stakeholders must buy in; identifying and prioritizing objectives is the step that will gain management support. The primary objectives can be derived from the company’s mission, the strategic plan and IT goals. The objectives are:

• Increased marketing potential
• Complete assurance to the business partners of the organization’s status with respect to information security
• Both Increased revenue and profitability by providing the highest level of security for customers’ sensitive data
• Identification of the information assets & effective risk assessments
• Compliance with industry regulations

Phase 2—Obtain Management Support

Management must make a commitment to the establishment, planning, the implementation, the operation, monitoring, review, improvement and maintenance of the ISMS. The commitment must also include activities such as ensuring that the proper resources are available to work on the ISMS and that all employees affected by the ISMS have the proper training, competency and also awareness. The following activities/initiatives show management support:

• An information security policy
• The information security objectives & the plans
• The roles & responsibilities for the information security or a segregation of duties (SoD) matrix that shows the list of the roles related to information security
• Sufficient resources for managing, developing, maintaining and implementing the ISMS
• The determination of acceptable level of risk
• The management reviews of the ISMS at planned intervals
• Assurance that personnel affected is also affected by the ISMS are provided with training
• Appointment of the competent people for the roles and responsibilities that they are assigned to fulfill

Phase 3—Select Proper Scope of Implementation

ISO 27001 states that any scope of implementation may cover all or part of an organization. According to it for the software company or any other company the scope of the ISMS, the processes, business units, external vendors or contractors falling within the scope of implementation must be specified for certification to occur.

The standard also thus requires companies to list any scope exclusions and the reasons why they were excluded.

Identifying the scope of implementation can save the organization time, money. The following points should be considered:

• Selected scope helps to achieve all the identified business objectives.
• The organization’s over all scale of operations is an integral parameter needed to determine the compliance process’s complexity level.
• To find out appropriate scale of operations, organizations need to consider the number of employees, business processes, work locations, and products or services offered.

Phase 4—Define the appropriate Method of Risk Assessment

To meet the requirements of ISO/IEC 27001, the companies need to define & document the method of risk assessment. The ISO/IEC 27001 standards do not specify the risk assessment method that can be used. The following all points should be considered:

• The method that can be used that can assess the risk to identified information assets
• Which risks are intolerable therefore, that need to be mitigated
• Managing the residual risks through carefully considered policies, the procedures and controls
• Choosing a risk assessment method is one of the most important parts of establishing the ISMS and use of the following will be helpful:
• NIST Special Publication (SP) 800-30 Risk Management Guide for Information Technology Systems
• Sarbanes-Oxley IT risk assessment
• Asset classification, data classification documents (determined by the organization)
• ISO 27001 needs risk evaluations based on levels of confidentiality, integrity and availability (CIA):
• Confidentiality—Clause 3.3: Ensuring that information is accessible only to those authorized to have access
• Integrity—Clause 3.8: Safeguarding the accuracy and completeness of information and processing methods
• Availability—Clause 3.9: Ensuring that authorized users have access to information and associated assets when required

Conclusion

The true success of ISO 27001 is its alignment with the business objectives and effectiveness in realizing those objectives. For any software development company, IT & the other departments play an important role in implementing the ISO 27001. Implementation of ISO 27001 is an exercise toward better understanding an existing inventory of IT initiatives & the information availability and ISMS implementation phases. The organization also needs to have the detailed understanding of PDCA implementation phases. 

Without a well-defined and well-developed ISO 27001 project plan & implementing ISO 27001 would be a time- and cost-consuming exercise & to achieve the planned return on investment (ROI), the implementation plan has to be developed with an end goal in mind. Training and internal audit are major parts of ISO 27001 implementation. ISO 27001 certification should help assure most business partners of an organization’s status with respect to information security without the necessity of conducting their own security reviews. 

Author Signature: Shreyans Agrawal (ifour.shreyans.agrawal@gmail.com)