Enhancement of etom Assurance Domain by Integration with COBIT5 Framework

Transcription

1 Enhancement of etom Assurance Domain by Integration with COBIT5 Framework 1 Faride Latifi, 2 Ramin Nasiri 1 Department of Computer Engineering, Central Tehran Branch, Islamic Azad University, IRAN 2 Department of Computer Engineering, Central Tehran Branch, Islamic Azad University, IRAN 1 frhlatifi@yahoo.com 2 Ramin_Nasiri@iauctb.ac.ir ABSTRACT Today s Telecom operators are enforced by the market to provide various services; also they need a strong management framework to manage those in a right way. Considering the importance of QoS inherent there, we first aim to introduce couple of useful processes of COBIT5 (Control Objectives for Information and Related Technology) in this paper as named 1 (Manage Operations) and 2 (Manage Service Requests and Incidents) to be mapped with etom (Enhanced Telecom Operations Map) framework with, in order to promote QoS as our second target of this research. KEYWORDS Telecom Operator, Service, COBIT5, etom, Framework, QoS. 1 INTRODUCTION In recent years, types of telecom services are expanding rapidly. On the other hand, present management Frameworks cannot cover and /or support them well. There are the place where few best known standards may be used for IT Service Management to enrich it, such as etom and COBIT5. The Enhanced Telecom Operations Map (or etom for short) is an on-going TM Forum initiative to deliver a business process model or framework for use by service providers and others within the telecommunication industry and consists of three distinct phases: strategic, operational and management [2]. COBIT5 is one of the best if not the only, business framework for the governance and management of enterprise IT. This evolutionary version incorporates the latest thinking in enterprise governance and management techniques, and provides globally accepted principles, practices, analytical tools and models to help increase the trust in, and value from, information systems. COBIT5 builds and expands on COBIT 4.1, the previous version, by integrating other major frameworks, standards and resources, including ISACA s Val IT and Risk IT, Information Technology Infrastructure Library (ITIL ) and related standards from the International Organization for Standardization (ISO) [5]. Each of etom and COBIT5 has some benefits and can cover each other to build up a more complete framework, for example COBIT5 can optimize the Quality of IT services and technology that is very useful for telecom service operation domain. In this paper we use this advantage of COBIT5 and thus promote assurance domain of etom framework [3], [7]. 2 COBIT5 FRAMEWORK COBIT5 is the only worldwide business framework for the governance and management of enterprise IT. This evolutionary version incorporates the latest thinking in enterprise governance and management techniques, and provides globally accepted principles, practices, analytical tools and models to help increase the trust in, and value from, information systems, as well as, COBIT5 provides the next generation of ISACA s guidance on the enterprise governance and management of IT. It builds on more than 15 years of practical usage and application of COBIT by many enterprises and users from business, IT, risk, security and assurance communities [7]. ISBN: SDIWC 44

2 COBIT 5 helps enterprises of all sizes in a number of aspects such as: To Maintain high-quality information to support business decisions To Achieve strategic goals and realize business benefits through the effective and innovative use of IT To Achieve operational excellence through reliable, efficient application of technology To Maintain IT-related risk at an acceptable level To Optimize the cost of IT services and technology To Support compliance with relevant laws, regulations, contractual agreements and policies Manage Operations 1 "Manage Operations" is in charge for Delivering IT operational service outcomes as planned. Very positive side of it is that it Optimizes IT assets, resources and capabilities and also decreases costs for organizations like Telecom Operators that is providing the service and to the customers using those services [3], [6]. 1 KMPs is as following: 1.01 Perform operational procedures, 1.02 Manage outsourced IT services, 1.03 Monitor IT infrastructure, 1.04 Manage the environment, 1.05 Manage facilities [3], [6] Manage Service Requests and Incidents 2 "Manage Service Requests and Incidents" is focused on Providing timely and effective response to user requests and resolution of all types of incidents, Restore normal service; record and fulfill user requests; and record, investigate, diagnose, escalate and resolve incidents so performance of Service Requests Fulfillment and Incident Management within organizations like Telecom Operators could be increased and maybe better solution for the incident could be found. One should consider that a powerful incident management is used instead of crisis management as serious disruption can occur to the business through events which would not normally be classified as a crisis. 2 KMPs is as following: 2.01 Defines incident and service request classification schemes, 2.02 Records, classifies and priorities requests and incidents, 2.03 Verifies, approve and fulfills requests, 2.04 Investigates, diagnoses and allocates incidents, 2.05 Resolves and recovers from incidents, 2.06 Closes service requests and incidents, 2.07 Tracks status and produces reports [6], [8] Manage Problems Managing Problems is in charge for classification, Identification and providing timely resolution to prevent recurring incidents. Also it caused to respond quickly to customer s service problems and minimizing their effects on customers 3 KMPs is as following: 3.01 Identifies and classifies problems, 3.02 Investigates and diagnoses problems, 3.03 Raises known errors, 3.04 Resolves and closes problems, 3.05 Performs proactive problem management [5], [6] Manage Security Services 5 "Manage Security Services" is focused on Protection and Development of information security roles and access privileges and perform security monitoring to protect information systems and technology from malware so it could help to prevention of service failure 5 KMPs are as following: 5.01 Protects against malware, 5.02 Manages network and connectivity security, 5.03 Manages endpoint security, 5.04 Manages user identity and logical access, 5.05 Manages physical access to IT assets, 5.06 Manage sensitive documents and output devices, 5.07 Monitor the infrastructure for security-related events [5], [6], [8]. ISBN: SDIWC 45

3 2.5 6 Manage Business Process Controls 6 Manages Business Process Controls is in charge for maintaining data integrity, security of information assets managed to business processes in or out of enterprise and may optimize the resource and service performance as a result. It is aligned with 5 "Manage Security Services" and contained of 6 KMPs as following: 6.01 Aligns control activities embedded in business processes with enterprise objectives, 6.02 Controls the processing of information, 6.03 Manages roles, responsibilities, access privileges and levels of authority, 6.04 Manages errors and exceptions, 6.05 Ensures traceability of information events and accountabilities, 6.06 Secures information assets[5], [6]. 3 PROCESS GROUPS of etom OPERATIONS PHASE 3.1 CRM CRM process group is the first process group of Operations Domain and focused on ensuring service availability, before sending the process to 'SC&A' (Service Configuration & Activation) and monitoring, assessment and management of QoS to deliver services to customers according to enterprise's Service Descriptions, customer contracts or catalogue of product offerings[6], [9]. 3.2 SM&O SM&O process group is the second process group of Operations Domain and is in charge for knowledge of services and providing a set of service Quality parameters like process performance and customer satisfaction at a service level, as well as Service Cost [6], [10]. 3.3 RM&O RM&O Process group is the third process group of Operations domain and focused on maintaining knowledge of resources managing all these resources. The purpose of these processes is to ensure that infrastructure runs smoothly, is accessible to services and employees, is maintained and is responsive to the needs, whether directly or indirectly, of services, customers and employees[6], [10]. 3.4 S/PRM S/PRM Process group is the last process group of Operations Domain and is in charge for supporting of the core operational processes and Mediates & Supplier/Partner Interactions to promote the quality of service delivery [6], [10]. 4 An OVERALL COMPARISION BETWEEN etom and COBIT5 FRAMEWORKS With a Comparative analysis between this two frameworks included that merging them can generate new benefits for the service domain and also this combination can be useful in converged services because of the rapid development of them. For easier comparison, there are overlaps of etom Assurance processes with COBIT5 DSS process domain in table1 [10]. Table 1. etom Operations 1 Phase Overlaps with COBIT5 DSS Domain 2 DSS COBIT5- DSS Domain P KMP CRM SM& O etom Operations Phase RM& O S/PR M 1 CRM is CUSTOMER RELATIONSHIP MANAGEMENT SM&O is SERVICE MANAGEMENT & OPERATIONS RM&O is RESOURCE MANAGEMENT & OPERATIONS S/PRM is SUPPLIER/PARTNER RELATIONSHIP MANAGEMENT 2 DSS is Deliver, Service and Support P is Process KMP is Key Management ISBN: SDIWC 46

4 their customers and leads another important goal which is improving communication with users through of Providing of timely and effective response to user requests and resolution of all types of incidents [1], [3], [6]. In table2 and table3 introduced some specifications of these two processes, including the following: Goal Metrics: Goal Metrics can be used to measure the achievement of each goal. : For each COBIT5 processes, the governance/management practices provide a complete set of high-level requirements for effective and practical governance and management of enterprise IT. and : The COBIT 5 inputs and outputs are the process work products/artifacts considered necessary to support operation of the process. : In COBIT5 the main actions to operate the process [6]. Table 2. 1 Manage Operations 1 Manage Operations Example 5 IMPLEMENTATION of NEW etom STANDARD New etom standard starts with two process of COBIT5 framework with the purpose of improving QoS in a telecom operator enterprise. Based on comparative analysis of service domain in COBIT5 and etom it can be concluded that some operations related to QoS in etom framework can be improved by use of COBIT5 framework. 1 Manage Operations and 2 Manage Service Requests and Incidents are very important in Defining an incident model for known errors to enable efficient and effective resolution and also Log all service requests and incidents, recording all relevant information so that they can be handled effectively and a full historical record can be maintained and because the final aim of a service operator is satisfying Goal Metrics Percent of critical business processes, IT services and IT-enabled business programs covered by risk assessment Number of significant IT-related incidents that were not identified in risk assessment Percent of enterprise risk assessments including IT-related risk Frequency of update of risk profile Perform operational procedures Operation and use plan Operational schedule Develops and maintains operational procedures and related activities to support all delivered services. Manage outsourced IT services ISBN: SDIWC 47

5 3 OLAs 4 SLAs -Operation and use plan Independent assurance plans Ensures that the enterprise s operational business and IT processing requirements and priorities for service delivery are adhered to in accordance with contracts and SLAs with third parties hosting or providing services. Monitor IT infrastructure Service definitions Asset monitoring rules and event conditions, Event logs, Incident tickets Identifies and maintains a list of infrastructure assets that need to be monitored based on service criticality and the relationship between configuration items and services that depend on them Benefits for QoS Management Domain: requests. Record, classify and priorities requests and incidents. SLAs Incident and service request log Logs all service requests and incidents, recording all relevant information so that they can be handled effectively and a full historical record can be maintained. Resolve and recover from incidents Risk-related incident response plans Incident resolutions Selects and applies the most appropriate incident resolutions (temporary workaround and/or permanent solution). Improvement of Reliability and continuity Table 3. 2 Manage Service Requests and Incidents 2 Manage Service Requests and Incidents Goal Metrics 3 Operational Level Agreements 4 Service Level Agreements Example Percent of critical business processes, IT services and IT-enabled business programs covered by risk assessment Number of significant IT-related incidents that were not identified in risk assessment Percent of enterprise risk assessments including IT-related risk Frequency of update of risk profile Define incident and service request classification schemes SLAs Incident and service request classification schemes and models Defines service request models according to service request type to enable self-help and efficient service for standard Benefits for QoS Management Domain: Providing of timely and effective response to user requests and resolution of all types of incidents 6 RESULTS of COMPARISON Enhanced etom standard is more powerful than the current sample in service offering domain. In telecom operator customers and satisfaction of them are two main cases that can be upgraded through providing of QoS. Two proposed processes in this paper focus on customer satisfaction and suggested in assurance process group domain of operations phase of etom framework. COBIT5 contains of 37 governance and management processes (32 management and also 5 governance processes). DSS domain of management area contains of 4 processes and each of its processes contains of some processes. According to figure1 processes of DSS domain shows completely, as well as version 12.4 of etom map shows at figure1. COBIT5 provides some values such as providing a framework for providing IT assurance; also it seems useful to ISBN: SDIWC 48

6 improve of assurance domain in etom framework. In this paper after a complete review of all processes of DSS, according to our purpose two processes of it (1, 2) is suggested. This seems suitable to match this two processes in CRM domain of etom framework because final element in chain of service providing are customers [3], [7]. Figure1 shows this matter. achieved such as, improvement of reliability and continuity, providing of timely and effective response to user request and resolution of all types of incidents, better interactions to customers and improvement of customer satisfaction with improving of QoS. Future research in this area will be focused on improvement of etom in other domain to integrate with suitable processes of COBIT5 framework which would be published later on. 8 REFERENCES [1] Tele Management Forum, etom The Business Process Framework, "Use Cases for Commercial Spectrum Management ", [2] Tele Management Forum, etom The Business Process Framework, "An etom Primer", [3] M. Asic, Student, E. Bajrami, Student, A. Tanovic, Improvement of the etom Operations phase through the comparison with ITIL best practices, 20th Telecommunications forum, pp , Nov [4] Tele Management Forum, etom The Business Process Framework, "Extended Process Decompositions and Descriptions", [5] Tele Management Forum, etom The Business Process Framework, "Concepts and Principles", [6] The Book of COBIT5 Enabling Processes available at [7] The Book of COBIT5: A Business Framework for the Governance and Management of Enterprise IT, available at: http: // Figure 1. Value added assurance domain of etom framework [5]. 7 CONCLUSION and FUTURE WORK In this paper we propose an enhanced etom framework that is more powerful than the current one. As well as, our work is based on a deep study on COBIT5 framework in service domain to improve etom through integration with it. Based on this outcome some values for a telecom industry in service offering domain can be [8] Tele Management Forum, etom The Business Process Framework, Extended Process Decompositions and Descriptions, [9] B. Raouyane, M Bellajkih, M Errais, IMS Management based etom framework for Multimedia service, 14th International Telecommunications Network Strategy and Planning Symposium (NETWORKS), pp.1 6, Sept [10] A. Zhuang, X. Qiu, H. Cheng, X. Chen, Z. Gaol," A Management process defining approach for converged services based on etom and ITIL", 3rd IEEE International Conference on Broadband Network and Multimedia Technology (IC-BNMT), pp , Oct ISBN: SDIWC 49