Copyright protected. Use is for Single Users only via a VHP Approved License. For information and printed versions please see

Transcription

1

2 Global Standards

3 Colophon Title: Global Standards Publisher: The International Best Practice Institute (IBPI) Design and Layout: CO2 Premedia bv, Amersfoort NL Version: Version 1 October 2012 Although this publication has been composed with most care, neither Author nor Editor nor Publisher can accept any liability for damage caused by possible errors and/or incompleteness in this publication. No part of this publication may be reproduced in any form by print, photo print, microfilm or any other means without written permission by the Publisher. Licensed to IBPI For copyright queries and information please contact enquiries@ibpi.org

4 Contents About IBPI 6 The Benefits for Members 7 Why Aren t Standards Standard? 8 About the Aim matrix Agile Amsterdam Infor ma tion management Model (AIM) ArchiMate ASL Balanced Scorecard BiSL CATS CM CMMI COBIT EFQM escm-cl escm-sp Frameworx ICB ISO ISO ISO/IEC ISO/IEC series ISO ISO ISO/IEC ITIL Lean management M_o_R 87 3

5 Contents 25. MoP MSP OPBOK P3O PMBOK Guide PRINCE SABSA Scrum Six Sigma SqEME TMap NEXT TOGAF 128 4

6 Dear readers, In this rapidly changing IT and business environment most things should and could be easier. It is no wonder that methods like Agile and Scrum are gaining popularity. New developments offer great opportunities for those willing to make the most of them but it can be difficult not to get overwhelmed. In the current environment with constant changes and almost infinite ways of accessing and communicating information it is essential to make communication as clear as possible and ensure the quality of information. Nowhere is this more true than in regard to the Best Practices, standards and frameworks that organizations use to manage their businesses and information systems. IBPI (The International Best Practice Institute) provides quality, practically validated information on Best Practices worldwide. The use of standards and frameworks gives everyone the same language thus minimizing the chance of errors due to unclear communication. Best Practices regarding these standards and frameworks provides you with information summarizing years of experience by the best in the industry. To make communication on standards everywhere a little easier, we enclose a basic summary of 36 relevant standards in our booklet. However it is an illusion those standards will lead by themselves to better results. More important are the people factors and the business context. This is why IBPI encourages all users to look at the business drivers and select what and when the standards and frameworks are right for YOU. Kind regards, The IBPI Management Board 5

7 About IBPI IBPI (The International Best Practice Institute) meets a market need for an independent provider of Best Practice Information resources. The content covers a wide range of standards and frameworks on IT management and related domains. It is transparent and easily accessible. It provides free data on key standards and frameworks within the following domains: IT Service Management IT Security Application Management IT Governance Enterprise Architecture Project Management Program and Portfolio Management Risk Management Business Continuity Sourcing and Contract Management Business Management Business Process Management Quality Management 6

8 The Benefits for Members Independent IBPI provides independent information on key standards and frameworks, unencumbered by commercial interests. Members can judge this for themselves on the strength and breadth of IBPI content, which spans IBPI sponsors and a wide range of other providers. Independence is assured through the range of stakeholders involved in providing IBPI services, many of them known for their independent thinking, the commitment to listen to members and the independence of the Operational Board. Cross disciplinary Because IBPI provides comprehensive coverage of IT-related disciplines, it makes it easy for members to learn about or take on new disciplines and to work across disciplines. Practical IBPI opens the door on tried and tested resources, backed up in many cases by competences and qualification schemes, and refreshed by stakeholders to ensure it remains relevant to ongoing and evolving needs. Complete IBPI covers a full range of IT-related disciples, which means members wanting access to information on all of them have easy access in one place. Contact information is provided to allow members to dig deeper on all the key standards and frameworks, there are links to guidance, templates, qualification schemes and competences. For more please go to our website: 7

9 Why Aren t Standards Standard? How Many? According to their website ( ISO has developed over 19,000 International Standards on a variety of subjects and more than 1000 new ISO standards are published every year. That isn t even counting the many de facto standards in use. Apart from the inevitable resulting cacophony, most of these standards are developed in isolation from each other. Many organizations, especially upon mergers, feel overwhelmed at the inherited weight of obligations, audits and paper-work required to maintain an increasing number of standards and accreditation. Others are just bamboozled as to what it all means for them. So how do we cope? Many standards have a similar approach; many have good concepts -- often rather well-hidden. Wouldn t it be great to have one area where you can go and see which standards look relevant for you and which to discard? Surprisingly it s not easy to find.. New independent reference service This service ( takes a look at the frequently referenced standards and accreditation used in IT and business management and simply presents them with links to sources of in-depth information. What s really great about this service is that the standards are placed in the context of the business driver/context in other words find what you need. And avoid a headache. 8

10 Do I need all these standards? Most definitely not! But given the 19,000 on offer you might need to pinpoint quickly the ones that are relevant for your sector and where to find more information. Many standards aren t vital but there are some good ideas that you can follow up that can help non-critical areas up their game. In many cases there are free templates, descriptions, short-cuts that are worth considering. IBPI doesn t include all standards of course but we ve selected those that are popular, useful or have something new to offer. And we don t limit ourselves to formal standards; we also include key non-proprietary frameworks, certification schemes and the like, which are widely deployed in the marketplace. These are put in the business context using the AIM (otherwise commonly known as the Amsterdam Model) which shows how the models serve wider organizational objectives. About IBPI IBPI is independent and is supported by an independent Advisory Board and Operational Board. IBPI draws on expertise from a wide range of knowledge partners to take the pain out of standards for the Institute s members and users. Membership is free of charge and provides access to a compelling range of free content, including templates, white papers and training material, as well as to added-value chargeable items. For More Information: Contact Us Today! enquiries@ibpi.org 9

11 About the Aim matrix The Amsterdam Information management Model (AIM or Amsterdam model) is used as a tool for positioning and interrelating information management functions. We have used it here as a schematic for mapping IBPI domains. AIM was developed at the University of Amsterdam. It can be applied to the areas of business-it alignment and sourcing, and can be of use when considering IT governance. It offers a high level view of the entire scope of information management; its main application is in the analysis of organization and responsibilities. For more information please see 10

12 1. Agile 1.1 Title/definition Agile software development approach 1.2 The basics Agile software development is set of software development methodologies based on iterative and incremental development, where requirements and solutions evolve through collaboration between self-organizing, cross-functional teams. 1.3 Summary Incremental software development methods have been traced back to Lightweight software development methods evolved in the mid-1990s as a reaction against heavyweight methods, which were characterized by their critics as a heavily regulated, regimented, micromanaged, waterfall model of development. Supporters of lightweight methods (and now agile methods) contend that they are a return to earlier practices in software development. Early implementations of lightweight methods include Scrum (1993), Crystal Clear, Extreme Programming (1996), Adaptive Software Development, Feature Driven Development, and Dynamic Systems Development Method (1995). These are now typically referred to as Agile methodologies, after the Agile Manifesto. The Agile Manifesto was written in February 2001, at a summit of independent-minded practitioners of several programming methodologies. 11

13 1. Agile Manifesto for Agile Software Development We are uncovering better ways of developing software by doing it and helping others do it. Through this work we have come to value: Individuals and interactions over processes and tools Working software over comprehensive documentation Customer collaboration over contract negotiation Responding to change over following a plan Source: agilemanifesto.org/ That is, while there is value in the items on the right, we value the items on the left more. The Agile Manifesto has twelve underlying principles: 1. Customer satisfaction by rapid delivery of useful software 2. Welcome changing requirements, even late in development 3. Working software is delivered frequently (weeks rather than months) 4. Working software is the principal measure of progress 5. Sustainable development, able to maintain a constant pace 6. Close, daily co-operation between business people and developers 7. Face-to-face conversation is the best form of communication (co-location) 8. Projects are built around motivated individuals, who should be trusted 9. Continuous attention to technical excellence and good design 10. Simplicity 11. Self-organizing teams 12. Regular adaptation to changing circumstances Agile methods break tasks into small increments with minimal planning and do not directly involve long-term planning. 12

14 1. Agile Iterations are short time frames. Team composition in an agile project is usually cross-functional and self-organizing and team size is usually small (5-9 people.) The agile method encourages stakeholders to prioritize their requirements on the basis of business value. The Agile approach is supported by the Agile Alliance, a not-forprofit organization that wants to see Agile projects start and help Agile teams perform. It is funded by individual memberships, corporate memberships, and by the proceeds from the Agile 200X series of conferences. It is not a certification body and does not endorse any certification programs. 1.4 Target audience Anyone involved in an Agile software development project team; including analysts, architects, developers, testers and business customer/users; anyone supporting or managing an Agile project team who requires a detailed understanding of the practices and benefits of Agile software development. 1.5 Scope and constraints Applicable to software development environments. Improved quality; higher productivity; positive effect on business satisfaction; Constraints: Works less well in istributed development efforts where teams are not located together Acceptance: forcing an Agile process on a development team that is unfamiliar with the approach 13

15 1. Agile Exceptions: mission-critical systems where failure is not an option at any cost (e.g. software for surgical procedures). 1.6 Relevant links (web lin ks) and 14

16 2. Amsterdam Infor ma tion management Model (AIM) 2.1 Title/definition The Amsterdam model for information management: A Generic Framework for Information Management 2.2 The basics The Amsterdam Information management Model (AIM) provides a mapping of the relationships between organization and information. 2.3 Summary AIM was developed at the University of Amsterdam (paper: Abcouwer, A.W., Maes, R. Truijens, J. (1997), Contouren voor een generiek model voor informatie-management, Tijdschrift Informatie en Management.). It can be used as a tool for positioning and interrelating information management functions. It can be applied to the areas of business-it alignment and sourcing, and can be of use when considering IT governance. It offers a high level view of the entire scope of information management; its main application is in the analysis of organization and responsibilities. AIM can be used to support strategic discussions in three different ways, as shown in the diagram below (Figure 2.1): Descriptive, orientation the framework offers a map of the 15

17 2. Amsterdam Infor mation Management Model (AIM) entire information management domain, and can be used for positioning specific information management processes in the organization. Specification, design the framework can be used to reorganize the information management organization, e.g. to specify the role of the Chief Information Officer (CIO) or determine the responsibilities of the retained organization in the case of outsourcing. Prescriptive, normative the framework can be used as a diagnostic instrument to find gaps in an organization s information management, and specifically aimed at identifying missing interrelationships between the various components of the framework. On the horizontal axis, the framework distinguishes three domains of governance: 1. Business This domain comprises all standard business functions such as management, HR, resources and processes. 2. Information and Communication (information domain This domain describes how information and communication supports the business. In this domain, business requirements are translated into the IT (technology) capabilities that are needed to support the business. 3. Technology (IT domain) This domain specifically describes the development and management of IT solutions. The vertical axis describes the three levels of governance: Strategy (scope, core competencies and governance); Structure (architecture and competencies); Operations (processes and skills). 16

18 2. Amsterdam Infor mation Management Model (AIM) Business Information/ Communication Technology Strategy (direction) Structure (implementation) Operations Figure 2.1: The Nine Square framework (het negenvlak) Abcouwer, Maes and Truijens (1997) AIM (originally known as the nine square framework) connects the two dimensions of management and information as the central components for Information Management. The dotted line demarks the scope of Business-IT alignment. 2.4 Target audience The framework was developed for information managers, enterprise architects and IT architects. 17

19 2. Amsterdam Infor mation Management Model (AIM) 2.5 Scope and constraints The scope of the framework is the information management domain. This framework enables discussions on the topic of business and IT alignment, but it does not provide information on how organizations can actually achieve better communications between business and IT. The framework is not a method, and cannot be used in a descriptive way; however, it can be a useful addition to enterprise architecture frameworks such as TOGAF TM. 2.6 Relevant links (web links) The framework can be downloaded for free from the website of the University of Amsterdam (Dutch site): uva.nl. Original paper: (Dutch) Abcouwer, A.W., Maes, R. Truijens, J. (1997), Contouren voor een generiek model voor informatie-management, Tijdschrift Informatie en Management. The model was further enhanced by Maes in the period from 1999 to 2003 in a series of working papers: (English) Maes, R. (1999) A Generic Framework for Information Management, Primavera workingpaper series ; 18

20 3. ArchiMate 3.1 Title/definition ArchiMate, an Open Group Standard 3.2 The basics ArchiMate is an open and independent modelling language for Enterprise Architecture that is supported by different tool vendors and consulting firms. ArchiMate provides instruments to enable Enterprise Architects to describe, analyze, and visualize the relationships among business domains in an unambiguous way. 3.3 Summary Developed by the members of The Open Group, ArchiMate 2.0 was released in January 2012 and is now more aligned with TOGAF, the world s most popular Enterprise Architecture framework. As a result, Enterprise Architects using the language can improve the way key business and IT stakeholders collaborate and adapt to change. The standard contains the formal definition of ArchiMate as a visual design language, together with concepts for specifying inter-related architectures, and specific viewpoints for typical stakeholders. The standard also includes a chapter addressing considerations regarding language extensions. The contents of the standard include the following: The overall modelling framework that ArchiMate uses The structure of the modelling language A detailed breakdown of the constituent elements of the modelling framework covering the three layers (Business/ 19

21 3. ArchiMate Application/Technology), cross-layer dependencies and alignment, and relationships within the framework Architectural viewpoints, including a set of standard viewpoints Optional extensions to the framework Commentary around future direction of the specification Notation overviews and summaries ArchiMate 2.0 improves collaboration through clearer understanding across multiple functions, including business executives, enterprise architects, systems analysts, software engineers, business process consultants, and infrastructure engineers. The standard enables the creation of fully integrated models of an organization s Enterprise Architecture, the motivation behind it, and the programs, projects, and migration paths to implement it. ArchiMate already follows terms defi ned in the TOGAF framework, and version 2.0 of the specification enables modelling throughout the TOGAF Architecture Development Method (ADM) cycle. 3.4 Target audience Enterprise architects, business architects, IT architects, application architects, data architects, software architects, systems architects, solutions architects, infrastructure architects, process architects, domain architects, product managers, operational managers, senior managers, project leaders, and anyone committed to work within the reference framework defined by an Enterprise Architecture. 20

22 3. ArchiMate 3.5 Scope The role of the ArchiMate standard is to provide a graphical language for the representation of Enterprise Architectures over time (i.e., including transformation and migration planning), as well as their motivation and rationale. The ArchiMate modelling language provides a uniform representation for diagrams that describe Enterprise Architectures, and offers an integrated approach to describe and visualize the different architecture domains together with their underlying relations and dependencies. The design of the ArchiMate language started from a set of relatively generic concepts (objects and relations), which have been specialized for application at the different architectural layers for an Enterprise Architecture. The most important design restriction on ArchiMate is that it has been explicitly designed to be as compact as possible, yet still usable for most Enterprise Architecture modelling tasks. In the interest of simplicity of learning and use, ArchiMate has been limited to the concepts that suffice for modelling the proverbial 80% of practical cases. 3.6 Relevant links (web links) Official websites:

23 4. ASL 4.1 Title/definition ASL (Application Services Library) 4.2 The basics ASL (Application Services Library) is a framework and collection of best practices for application management. 4.3 Summary ASL (Application Services Library) was developed by a Dutch IT service provider, PinkRoccade in the 1990s and was made public in Since 2002 the framework and the accompanying best practices have been maintained by the ASL BiSL Foundation. The current version is Version 2, published in the Netherlands in ASL is concerned with managing the support, maintenance, renewal and strategy of applications in an economically sound manner. The library consists of a framework, best practices, standard templates and a self-assessment. The ASL framework provides descriptions of all the processes that are needed for application management. The framework distinguishes six process clusters, which are viewed at operational, managing and strategic levels (Figure 4.1). The application support cluster at the operational level aims to ensure that the current applications are used in the most effective way to support the business processes, using a minimum of resources and leading to a minimum of operational disruptions. The application maintenance and renewal cluster ensures that 22

24 4. ASL the applications are modified in line with changing requirements, usually as a result of changes in the business processes, keeping the applications up-to-date. The connecting processes form the bridge between the service organization cluster and the development and maintenance cluster. Strategic Application management organization strategy Application strategy Strategic processes Managing Management processes Operational processes Operational Application support Connecting processes Application maintenance & renewal Figure 4.1: The ASL framework The management processes ensure that the operational clusters are managed in an integrated way. Finally, there are two clusters at the strategic level. The aim of the application strategy cluster is to address the long-term strategy for the application(s). The processes needed for the long-term strategy for the application management organization are described in the application management organization strategy cluster. 23

25 4. ASL 4.4 Target audience The target audience for ASL consists of everyone who is involved in the development and management of applications: application support personnel, application architects and designers, programmers, testers, and managers with responsibility for application development or application management. 4.5 Scope and constraints The scope of ASL is the support, maintenance, renewal, and strategy of applications, and the management of all related activities. Strengths It offers a common language and conceptual framework for application management (maintenance and support) It provides an overview of all the activities (from operational to strategic) that are needed to keep applications up-to-date with the changing needs of the organization. It is usable in various organizations and It is part of the public domain and owned by one single corporati on It is supported by a not-for-profit, vendor-independent foundation with participation by a wide range of organizations Constraints ASL overlaps partially with other IT Service Management frameworks. 4.6 Relevant links (web links) Official website of the ASL BiSL Foundation: 24

26 5. Balanced Scorecard 5.1 Title/definition method Balanced Scorecard 5.2 The basics The Balanced Scorecard is a strategic planning and management framework that is used to to align business activities to the vision and strategy of the organization, improve internal and external communications, and monitor organization performance against strategic goals.(source: Balanced Scorecard Institute) 5.3 Summary The Balanced Scorecard was originated by Drs. Robert Kaplan (Harvard Business School) and David Norton as a performance measurement framework that added strategic non-financial performance measures to traditional financial metrics to give managers and executives a more balanced view of organizational performance. The Balanced Scorecard has evolved from its early use as a simple performance measurement dashboard to a full strategic planning and management system. It transforms an organization s strategic plan from a passive document into the marching orders for the organization on a daily basis. The Balanced Scorecard is a management system (not only a measurement system) that enables organizations to clarify their vision and strategy and translate them into action. It provides feedback around both the internal business processes and external outcomes in order to continuously improve strategic performance and results. 25

27 5. Balanced Scorecard The Balanced Scorecard has four perspectives (see Figure 5.1): The Learning and Growth Perspective: employee training and corporate cultural attitudes related to both individual and corporate self-improvement. The Business Process Perspective: internal business processes. The Customer Perspective: customer focus and customer satisfaction. The Financial Perspective: financial and financial-related data, such as risk assessment and cost-benefit data. Financial To succeed financially, how should we appear to our shareholders? Objectives Measures Targets Initiatives Customer To achieve our vision, how should we appear to our customers? Objectives Measures Targets Initiatives Vision and Strategy Internal Business Processes To satisfy our shareholders and customers, what business processes must we excel at? Objectives Measures Targets Initiatives Learning and Growth To achieve our vision, how will we sustain our ability to change and improve? Objectives Measures Targets Initiatives Figure 5.1: Four perspectives of the Balanced Scorecard (Adapted from Robert S. Kaplan and David P. Norton, Using the Balanced Scorecard as a Strategic Management System, Harvard Business Review (January-February 1996): 76.; source: 26

28 5. Balanced Scorecard A Balanced Scorecard should be enhanced with cause-andeffect relationships between measures: outcome measures (lag indicators of past performance) and performance drivers (lead indicators). A well-developed scorecard should contain a good mix of these two metrics. 5.4 Target audience Senior management; strategic planners; business managers 5.5 Scope and constraints The Balanced Scorecard was initially developed at enterprise level. It can easily be adapted to align IT projects, IT departments and IT performance to the needs of the business. The Balanced Scorecard is used extensively in business and industry, government and non-profit organizations worldwide Use of an IT Balanced Scorecard is one of the most effective means to support the board and management in achieving IT and business alignment. Constraints: Visions and strategies that are not actionable Strategies that are not linked to departmental, team and individual goals Strategies that are not linked to long- and short-term resource allocation Feedback that is tactical, not stra tegic. 5.6 Relevant links (web links) Official website of the Balanced Scorecard Institute: Original paper: Kaplan R S and Norton D P (1992) The Balanced Scorecard: measures that drive performance, Harvard Business Review Jan Feb pp

29 6. BiSL 6.1 Title/definition BiSL (Business Information Services Library) 6.2 The basics BiSL (Business Information Services Library) is a framework and collection of best practices for business information management. 6.3 Summary BiSL (Business Information Services Library) was developed by a Dutch IT service provider, PinkRoccade and was made public in BiSL was then transferred to the public domain and adopted by the ASL BiSL Foundation. The current version is Version 1.1, published in BiSL focuses on how business organizations can improve control over their information systems: demand for business support, use of information systems and contracts and other arrangements with IT suppliers. BiSL offers guidance in business information management: support for the use of information systems in the business processes, operational IT control and information management. The library consists of a framework, best practices, standard templates and a self-assessment. The BiSL framework gives a description of all the processes that enable the control of information systems from a business perspective (Figure 6.1). 28

30 6. BiSL Strategic I-organization strategy cluster Information strategy cluster Management Management processes Operational Use management cluster Functionality management cluster Connecting processes Figure 6.1: The BiSL framework The framework distinguishes seven process clusters, which are positioned at the operational, managing and strategic levels (Figure 6.1). The use management cluster provides optimum, on-going support for the relevant business processes. The functionality management cluster structures and effects changes in information provision. The connecting processes cluster focuses on decision making on which changes need to be made to the information provision, and how they are implemented within the user organization. The management processes cluster ensures that all the activities within the business information management domain are managed in an integrated way. 29

31 6. BiSL There are three clusters at the strategic level, which are concerned with the formulation of policies for information provision and the organizations involved in this activity. 6.4 Target audience BiSL is primarily aimed at business management, information management and professionals who wish to improve the support of their business processes by realizing a better automated and non-automated information provision. 6.5 Scope and constraints The scope of BiSL is the support, usage, maintenance, renovation and policy of the information provision and the management of all related activities. Strengths It offers a stable framework and a common language for business information management It is supported by a not-for-profit, vendor-independent foundation in which a wide range of organizations participate It fills the gap between the business and IT functions. BiSL recognizes and addresses management issues that are increasingly important. Constraints BiSL is relatively new, and therefore relatively unknown outside the Netherlands 6.6 Relevant links (web links) Official website of the ASL-BiSL Foundation: 30

32 7. CATS CM 7.1 Title/definition CATS CM (Contract Administration and Tracking Scenarios - Contract Management) 7.2 The basics CATS CM provides a proactive methodical approach to contract management for IT service providers. 7.3 Summary In the past five years contract management has become an important focus area for the IT industry, and has become a separate governance area. Because of this development, the need arose for a structured and verifiable method for contract management. CATS CM was developed by two Dutch experts in the field of contract management, Van Beckum and Vlasveld. The method was first published in 2008: Contract management voor ICT op basis van CATS CM. The CATS CM method is owned by CM Partners in the Netherlands. In the method, contract management is defi ned as all related procedures, measures, guidelines and protocols aimed at creating, managing and profitable running of a continuously increasing order book. The concept of Tracking Scenarios shows how to monitor all contract management aspects with the help of detailed and structured roadmaps. The detailed roadmaps provide a way to manage contracts from the moment they are signed. CATS CM consists of thirty activities that are grouped into six blocks. Each of these six blocks forms one stage in the contract management process. 31

33 7. CATS CM The activities are interrelated, and arise from the tasks, responsibilities and accountabilities of the contract manager. 1 Initiate 2 Plan 3 Do 1.1 Organize intake 1.2 Analyze contract file 1.3 Compose CM essentials 1.4 Check CM task 1.5 Conduct intake 1.6 Start Contract implementation 2.1 Review CM essentials 2.2 Adjust contract time frame 2.3 Plan Key Meetings series 2.4 Plan own activities (3 months) 2.5 Plan close out 3.1 Execute CM essentials 3.2 Compose reports 3.3 Consult through KM 3.4 Monitor 100% ABC 3.5 Manage contract file 3.6 Follow code of conduct 6 Close out 6.1 Close CM essentials 6.2 Organize discharges 6.3 Close Control admin 6.4 Evaluate contract 6.5 Dismantle temporary organization 6.6 Close CM task 5 Act 4 Check 5.1 Select actions for next contract 5.2 Consult CO 5.3 Execute actions for current contract 4.1 CM via CATS CM? 4.2 Self-assessment and improvement 4.3 Code of conduct? 4.4 Plan actions for improvement Figure 7.1: Tracking scenarios 7.4 Target audience CATS CM is aimed at four different categories of IT functions: Operational managers responsible for managing contracts at the operational level. Contract managers that have a natural ability to manage contract without using specific methods. CATS CM will provide them with a tool to further structure their work to make it verifiable and transferable. General management that is accountable for a solid, dependable and verifiable contract management. Contract managers for customer organizations. CATS CM will provide them with insights on how IT service providers organize their contract management processes. 32

34 7. CATS CM 7.5 Scope and constraints The scope of the method is contract management from the perspective of IT service providers. CATS CM complements other approaches such as PRINCE2, ITIL, ASL and BiSL. Constraints: CATS CM enables service provider organizations to make their contract management function more effective and efficient. The most important constraint is the abstract level of description of the elements of the CATS CM method. It is not suitable for inexperienced contract managers and organizations. 7.6 Relevant links (web li nks) Information about the CATS CM method (Dutch only) can be found at: 33

35 8. CMMI 8.1 Title/definition CMMI (Capability Maturity Model Integration) Version The basics CMMI is an internationally recognized process improvement approach that helps organizations to identify where to focus their improvement efforts along an evolutionary maturity path from ad hoc and chaotic to mature disciplined processes. 8.3 Summary CMMI is owned and supported by the Carnegie Mellon Software Engineering Institute (SEI). Version 1.0 of the CMM for Software (SW-CMM) was published in 1991; it was upgraded to CMM Integration (CMMI) in 2000 and the current version is Version 1.3, released in November An important change in Version 1.3 is the addition of agile. CMMI integrates traditionally separate organizational functions, sets process improvement goals and priorities, provides guidance for quality processes, and provides a point of reference for appraising current processes. The CMMI models are collections of best practices that help organizations to improve their processes: The CMMI for Acquisition (CMMI-ACQ) model provides guidance on managing the supply chain to meet the needs of the customer. The CMMI for Development (CMMI-DEV) model supports improvements in the effectiveness, efficiency, and quality of product and service development. The CMMI for Services (CMMI-SVC) model provides guidance on establishing, managing, and delivering services 34

36 8.CMMI that meet the needs of customers and end users. The People CMM provides guidance on managing and developing the workforce. An organization appraises its processes against the CMMI best practices: To determine how well its processes compare to CMMI best practices, and to identify areas where improvement can be made And/or to inform external customers and suppliers of how well its processes compare to CMMI best practices And/or to meet the contractual requirements of one or more customers 5 4 Focus on continuous process improvement Process measured and controlled Quantitatively Managed Optimizing 3 Process characterized for for the organization and is proactive Defined 2 1 Process characterized for projects and is often reactive Process unpredictable, poorly controlled, and reactive Initial Managed Figure 8.1: CMMI maturity levels Source: SCI Organizations can use a staged approach to appraisal to identify process maturity levels from 1 to 5 (Figure 8.1). They can also take a more flexible continuous approach to appraisal, measuring capability maturity in individual process areas. The appraisal 35

37 8. CMMI results can then be used to plan process improvements for the organization. 8.4 Target audience Managers responsible for process improvement programs; project managers, process improvement specialists, project team members; appraisals teams. 8.5 Scope and constraints CMMI applies to teams, work groups, projects, divisions, and entire organizations. CMMI works best in combination with Agile, Scrum, ITIL, Six Sigma, COBIT, ISO 9001, RUP, or Lean, Provides a common, integrated vision of improvement or can focus on a specific process area Generic descriptions based on industry best practice Supporting guidance such as roadmaps help to interpret generic models for specific circumstances Constraints: Aiming for higher maturity levels that will not achieve increased business benefits Rigid adherence to a staged approach trying to move every project in the organization to the next level of maturity can be costly and time-consuming. Failing to interpret the generic descriptions appropriately for the specific needs of the or ganization. 8.6 Relevant links (web links) Official website: 36

38 9. COBIT 9.1 Title/definition COBIT 9.2 The basics Originally designed for auditors to audit the IT organisation, COBIT 5 (Control Objectives for IT) is about linking business goals to IT objectives (note the linkage here from vision to mission to goals to objectives). COBIT 5 (launched April 2012) provides metrics and maturity models to measure whether or not the IT organisation has achieved its objectives. Additionally, COBIT identifies the associated responsibilities of the business process owners as well as those of the IT process owners. 9.3 Summary COBIT (originally Control Objectives in IT) is owned and supported by ISACA. It was released in 1996; the current version 5.0 (April 2012) brings together COBIT 4.1, Val IT 2.0 and Risk IT frameworks. The COBIT 5 principles and enablers are generic and useful for enterprises of all sizes, whether commercial, not-for -profit or in the public sector (Figure 9.1 and 9.2). 37

39 9. COBIT 1. Meeting Stakeholder Needs 5. Separating Governance From Management COBIT 5 Principles 2. Covering the Enterprise End-to-end 4. Enabling a Holistic Approach 3. Applying a Single Integrated Framework Figure 9.1: The COBIT 5 Principles. COBIT 5 ENTERPRISE ENABLERS Processes Organisational Structures Culture, Ethics and Behaviour Principles, Policies and Frameworks Information Services Infrastructure Applications People, Skills and Competencies RESOURCES Figure 9.2: The COBIT 5 Enablers 38

40 9. COBIT The process reference model defi nes and describes in detail a number of governance, and management processes. It represents all the processes normally found in an organisation relating to IT activities, thus providing a common reference model understandable to operational IT, and business managers, and their auditors/advisors. The process reference model divides the processes of organisation IT into two domains governance, and management: COBIT 5 provides a set of 36 governance and management processes within the framework. The governance domain contains fi ve governance processes; within each process, evaluate, direct, and monitor practices are defi ned. EDM1: set and maintain the governance framework EDM2: ensure value optimisation EDM3: ensure risk optimisation EDM4: ensure resource optimisation EDM5: ensure stakeholder transparency The four management domains, in line with the responsibility areas of plan, build, run, and monitor (PBRM) provide end-to-end coverage of IT Align, plan, and organise Build, acquire, and implement Deliver, service, and support Monitor, evaluate, and assess A casual look at the four management domains of COBIT 5 rapidly illustrates its direct relationship with ITIL. The align, plan, and organise domain relates to the service strategy and design phases The build, acquire, and implement domain relates to the service transition phase The deliver, service, and support domain relates to the service operation phase And fi nally, the monitor, evaluate, and assess domain relates to the continual service improvement phase All aspects of COBIT 5 are in line with the responsibility areas of plan, build, run and monitor. In other words, COBIT 5 follows the PDCA cycle of Plan, Do, Check, and Act. COBIT has been positioned at a high level, and has 39

41 9. COBIT been aligned and harmonised with other, more detailed, IT standards and proven practices such as COSO2, ITIL3, ISO 27000, CMMI, TOGAF and PMBOK. COBIT 5 acts as an integrator of these different guidance materials, summarising key objectives under one umbrella framework that link the proven practice models with governance and business requirements. 9.4 Target audience Senior business management, senior IT management and auditors. 9.5 Scope and constraints COBIT provides an umbrella framework for IT governance across the whole of an organization. It is mapped to other frameworks and standards to ensure its completeness of coverage of the IT management life cycle and support its use in enterprises using multiple IT-related frameworks and standards. Some strong points are: value creation through effective governance, management enterprise information and technology (IT) assets Business user satisfaction with IT engagement and services by enabling business objectives Compliance with relevant laws, regulations and policies Constraints: Treating COBIT as a prescriptive standard when it should be interpreted as a generic framework to manage IT processes and internal controls. Key themes from COBIT must be tailored to the specific governance needs of the organization. 40

42 9. COBIT Lack of commitment from top management without their leadership and support, the IT control framework will suffer and business alignment of IT risks will not happen. Underestimating the cultural change COBIT is not just about the technical aspects of IT. The organization needs to have a good understanding of the governance controls for the IT risks. 9.6 Relevant links (web links) Official ISACA website: Further information from the IT Governance Institute: and 41

43 10. EFQM 10.1 Title/definition EFQM (European Foundation for Quality Management) Excellence Model 10.2 The basics The EFQM Excellence Model is a management framework for helping organizations in their drive towards excellence and increased competitiveness. The EFQM organization does not issue certificates of compliance but runs comprehensive awards and recognition programs for organizations of all sizes and sectors Summary The EFQM Excellence Model was introduced in 1992 as the framework for assessing organizations for the EFQM Excellence Award and is now the most widely used organizational framework in Europe. It is reviewed every three years; the current version was released in EFQM, based in Brussels, is its custodian. The Model is a non-prescriptive framework based on nine key criteria (Figure 10.1).. Five criteria are Enablers (Leadership, Policy and Strategy, People, Partnership and Resources and Processes) and four are Results (Customer Results, People Results, Society Results and Key Performance Results). The Enabler criteria cover what an organization does; the Results criteria cover what an organization achieves. 42

44 10. EFQM Enablers Results Leadership People Processes, Product & Services People Results Key Results Strategy Customer Results Partnerships & Resources Society Results Learning, Creativity and Innovation Figure 10.1: The EFQM Excellence Model (Source: EFQM.org) The EFQM Model s nine boxes represent the criteria against which to assess an organization s progress towards excellence. At the heart of the Model lies the logic known as RADAR, which consists of four elements: Results, Approach, Deployment, Assessment and Review. These elements emulate and complete the basic elements of Deming s Plan, Do, Check, Act cycle by adding specific details that are more comprehensive. The Model is based on the premise that excellent results in Performance, Customers, People and Society are achieved through Leadership driving Policy and Strategy, which is delivered through People, Partnerships and Resources. It is used as a basis for self-assessment, an exercise in which an organization grades itself against the nine criteria. This exercise helps organizations to identify current strengths and areas for improvement against strategic goals. This gap analysis then facilitates definition and prioritization of improvement plans to achieve sustainable growth and enhanced performance. 43

45 10. EFQM 10.4 Target audience People who are coordinating or leading improvement or change programs; people who are providing training, coaching or consultancy in EFQM 10.5 Scope and constraints The EFQM Excellence Model has an enterprise-wide scope. It takes a holistic view to enable organizations, regardless of size or sector to: Assess where they are, helping them to understand their key strengths and potential gaps in performance Provide a common vocabulary and way of thinking about the organization that facilitates the effective communication of ideas, both within and outside the organization. Integrate existing and planned initiatives, removing duplication and identifying gaps. Strengths: It provides a holistic framework that systematically addresses a thorough range of organizational quality issues and also pays attention to impacts through the Results criteria. It provides a clear diagnosis of an organization s activities and is useful for planning as it links what an organization does and what results it achieves, highlighting how they are achieved. The Model is relatively difficult to implement. It generates benefits over a longer period of time; an overall organizational strategy on excellence needs to be adopted in order to achieve the benefits. 44

46 10. EFQM 10.6 Relevant links (web links) Official EFQM website: Other useful websites: (dutch institute for quality management; runs similar schemes like EFQM). (US National Institute of Standards and Technology). 45

47 11. escm-cl 11.1 Title/definition escm-cl (The esourcing Capability Model for Client Organizations) 11.2 The basics escm-cl is a best practices capability model for client organizations seeking to improve their capabilities and relationships when sourcing IT-enabled services; it complements the escm-sp for service providers Summary escm-cl is owned and supported by ITSqc, a spin-off from Carnegie Mellon University. Version 1.0 was released in 2006; the current version is version 1.11 (2010). The model has two purposes: to give client organizations guidance that will help them improve their capability across the sourcing life-cycle, and to provide client organizations with an objective means of evaluating their sourcing capability. It is organized into Capability Areas covering major areas of sourcing expertise, with 95 Practices that address the critical capabilities needed by clients of IT-enabled services. Each Practice is arranged along three dimensions: Sourcing Life-cycle, Capability Area, and Capability Level. The Sourcing Life-cycle is divided into Analysis, Initiation, Delivery, and Completion, plus Ongoing, which spans the entire Sourcing Lifecycle. The seventeen Capability Areas are logical groupings of Practices that help users to remember and intellectually manage the content of the Model. The five Capability Levels, numbered 1 through 5, describe an improvement path that progresses from a limited capability to 46

48 11. escm-cl perform sourcing up to the highest level of sustaining excellence over time in the client organization s sourcing activities Target audience Client organizations who procure or source IT-enabled services, 11.5 Scope and constraints escm-cl relates to IT-enabled services. It addresses a full range of client-organization tasks, ranging from developing the organization s sourcing strategy, planning for sourcing and service provider selection, initiating an agreement with service providers, managing service delivery, and completing the agreement. Organizations can be certified to the escm-cl. Strengths escm is twofold: escm-cl for Clients and escm-sp for Service Providers. These two models are consistent, symmetrical and complementary for each side of the client-provider relationship and this is the strength and the uniqueness of this model. Both models have been used to ensure alignment of processes to build stronger partnership relationships, focus on the primary objectives of the sourcing initiative and sourcing strategy, whether outsourcing, insourcing or shared services. Constraints Fails to define the client organization structure; rather provides guidance to develop the sourcing functions and its workforce Emphasis on innovation is present; but assumes that stabilized relationships and governance of service provision come first (i.e., tactical first, strategic later). 47