INFORMATION TECHNOLOGY DEFINITIONS AND KEY MEASURES Version 2.0.0 THE FRAMEWORK FOR PROCESS IMPROVEMENT Experience shows that benchmarking s potential to drive dramatic improvement lies squarely in making out-of-the-box comparisons and searching for insights not typically found within intra-industry paradigms. To enable this type of benefi cial benchmarking, the APQC Process Classifi cation Framework SM (PCF) serves as a highlevel, industry-neutral enterprise model that allows organizations to see their activities from a cross-industry process viewpoint. The PCF enables organizations to understand their inner workings from a horizontal process perspective, rather than a vertical functional viewpoint. The PCF does not list all processes within a specifi c organization, and every process listed in the framework is not present in every organization. 1.0 Develop Vision and Strategy 7.0 Manage Information Technology OPERATING PROCESSES >>> > > 2.0 Develop and Manage Products and Services >>> 3.0 Market and Sell Products and Services >>> 4.0 Deliver Products and Services >>> MANAGEMENT AND SUPPORT SERVICES 5.0 Manage Customer Service Originally created in 1992 by APQC and a group of members, the framework has experienced more than twenty years of creative use by thousands of organizations worldwide. The PCF is supported by APQC s Open Standards Benchmarking research. It is continuously enhanced as APQC s Open Standards Benchmarking team further develops defi nitions, processes, and measures. Please visit APQC s web site periodically for updates. The PCF is available for organizations of all industries and sizes at no charge by visiting www.apqc.org/pcf. 6.0 Develop and Manage Human Capital 7.0 Manage Information Technology 8.0 Manage Financial Resources 9.0 Acquire, Construct, and Manage Assets 10.0 Manage Enterprise Risk, Compliance, and Resiliency 11.0 Manage External Relationships HISTORY The Process Classifi cation Framework was originally envisioned as a taxonomy of business processes. The initial design involved more than 80 organizations from the United States and worldwide. Since its inception, the PCF has been updated several times to refl ect changes in the way organizations do business. 12.0 Develop and Manage Business Capabilities In response to feedback from users of the PCF, APQC regularly engages practitioners, consultants, and academics to develop defi nitions based on real-world experience with the processes. That collaborative effort resulted in this document: a listing of processes with defi nitions and selected key performance indicators from APQC s Open Standards Benchmarking repository. The defi nitions contained in this document are to be considered in conjunction with the PCF. The content in this document will be updated according to research performed by APQC and subsequent updates to the PCF. This document was created using PCF version 6.0.0. Version 2.0.0 October 2012
7.0 Manage Information Technology Definitions and Key Measures TABLE OF CONTENTS 7.1 Manage the business of information technology 3 Key Performance Indicators 3 7.1.1 Develop the enterprise IT strategy 3 7.1.2 Defi ne the enterprise architecture 3 7.1.3 Manage the IT portfolio 3 7.1.4 Perform IT research and innovation 3 7.1.5 Evaluate and communicate IT business value and performance 3 7.2 Develop and manage IT customer relationships 4 Key Performance Indicators 4 7.2.1 Develop IT services and solutions strategy 4 7.2.2 Develop and manage IT service levels 4 7.2.3 Perform demand-side management (DSM) for IT services 4 7.2.4 Manage IT customer satisfaction 4 7.2.5 Market IT services and solutions 5 7.3 Develop and implement security, privacy, and data protection controls 5 Key Performance Indicators 5 7.3.1 Establish information security, privacy, and data protection strategies and levels 5 7.3.2 Test, evaluate, and implement information security and privacy and data controls 5 7.4 Manage enterprise information 6 Key Performance Indicators 6 7.4.1 Develop the information and content management strategies 6 7.4.2 Defi ne the enterprise information architecture 6 7.4.3 Manage information resources 6 7.4.4 Perform enterprise data and content management 6 7.5 Develop and maintain information technology solutions 7 Key Performance Indicators 7 7.5.1 Develop the IT development strategy 7 7.5.2 Perform IT services and solutions life cycle planning 7 7.5.3 Develop and maintain IT services and solutions architecture 7 7.5.4 Create IT services and solutions 7 7.5.5 Maintain IT services and solutions 7 7.6 Deploy information technology solutions 8 Key Performance Indicators 8 7.6.1 Develop the IT deployment strategy 8 7.6.2 Plan and implement changes 8 7.6.3 Plan and manage releases 8 7.7 Deliver and support information technology services 9 Key Performance Indicators 9 7.7.1 Develop the IT services and solutions delivery strategy 9 7.7.2 Develop the IT support strategy 9 7.7.3 Manage IT infrastructure resources 9 7.7.4 Manage IT infrastructure operations 9 7.7.5 Support IT services and solutions 10 RIGHTS AND PERMISSIONS 2012 APQC. ALL RIGHTS RESERVED. APQC encourages the wide distribution, discussion, and use of the PCF and PCF defi nition documents for classifying and defi ning processes. APQC grants permission for use and adaptation of the PCF for internal use. For external use, APQC grants permission for publication, distribution, and use, provided that proper copyright acknowledgment is made to APQC. No modifi cations to the look or content should be made in external venues. Please use the following text when reusing the PCF in external print or electronic content. The PCF was developed by APQC and member companies as an open standard to facilitate improvement through process management and benchmarking regardless of industry, size, or geography. The PCF organizes operating and management processes into a number of enterpriselevel categories, including categories, process groups, and over 1,000 processes and associated activities. The PCF and its associated measures and benchmarking surveys are available for download and completion at no charge at www.apqc.org. ABOUT APQC APQC is a member-based nonprofi t and one of the world s leading proponents of knowledge management, benchmarking, and best practices business research. Working with more than 750 organizations worldwide in all industries, APQC provides organizations with the information they need to work smarter, faster, and with confi dence. Visit www.apqc.org or call +1-713-681-4020 and learn how to Make Best Practices Your Practices SM. 2 Permission granted to photocopy for personal use. 2012 APQC. ALL RIGHTS RESERVED.
7.1 Manage the business of information technology (10563) Manage the business of information technology involves defining and maintaining the relevance of IT to the enterprise and its mission, communicating the strategy and role of IT within the enterprise, establishing the enterprise architecture and guiding principles, defining the IT management system and governance model, and managing the strategic activities that help ensure attainment of IT value. Number of IT full-time equivalents (FTEs) for Manage the business of IT per $1 billion revenue $1,000 revenue For application development projects and enhancements completed, percentage of projects delivered on time on or below budget For application development projects and enhancements completed, percentage of initial functionality delivered Time (in months) to respond to major business shifts 7.1.1 Develop the enterprise IT strategy (10570) Develop the enterprise IT strategy consists of activities required to define and maintain a business-focused enterprise IT strategy. This includes building strategic intelligence for the enterprise, collaborating with stakeholders to identify the long-term IT needs of the enterprise, and developing and maintaining of the business-focused strategy. 7.1.2 Defi ne the enterprise architecture (10571) The purpose of Defi ne the enterprise architecture is to assess the interrelationships among the business process architecture, the information architecture, the components and services architectures, and the infrastructure architectures to ensure their continued relevance. Execution of this process requires establishing the enterprise architecture definition, confirming the enterprise architecture maintenance, acting as a clearinghouse for IT research and innovation, and governing the enterprise architecture. 7.1.3 Manage the IT portfolio (10572) Manage the IT portfolio results in the establishment of criteria for economic and strategic value and the provision of resources in accordance with strategic priorities and efforts to achieve a balanced portfolio. Activities include maximizing the value of the IT portfolio for the enterprise, provisioning resources in accordance with strategic priorities, and achieving a balanced portfolio. 7.1.4 Perform IT research and innovation (10573) Perform IT research and innovation consists of exploring new technologies in pursuit of IT services and solutions innovations, formulating a development project to build and deploy selected technologies, and transitioning technologies to the development pipeline. 7.1.5 Evaluate and communicate IT business value and performance (10575) Evaluate and communicate IT business value and performance consists of establishing key performance measures, monitoring trends and key performance indicators, linking business technology investments to business outcomes, and communicating business technology value contributions. Version 2.0.0 October 2012 3
7.2 Develop and manage IT customer relationships (10564) Develop and manage IT customer relationships involves managing communication and interactions between IT customers and the providers of IT services and solutions; gathering business requirements; helping customers develop justifications for IT services and solutions; providing the initial interface to IT architects responsible for designing services and solutions; and monitoring satisfaction with the development, deployment, and ongoing support of services and solutions. Number of IT FTEs for Develop and manage IT customer relationships per $1 billion revenue Total cost of Develop and manage IT customer relationships per $1,000 revenue 7.2.1 Develop IT services and solutions strategy (10578) Develop IT services and solutions strategy involves assessing the needs of the business and user, translating those needs into services and solutions requirements, formulating and evaluating IT services and solutions strategic initiatives, and selecting which services and solutions strategic initiatives to apply. The formulation of IT services and solutions strategic initiatives includes the tasks required to generate new ideas, identify enhancements or extensions to existing IT services and solutions, and identify outdated services and solutions for sunset or retirement. Developing and maintaining a long-term, business-focused IT strategy encompasses tasks to develop, communicate, govern, and track strategy deployment. This includes defining and communicating the strategic intent regarding the organizational use of IT; establishing and maintaining an IT governance structure; articulating strategic assumptions for IT strategy development; and developing and tracking the resulting IT plan, which optimizes the use of technologies, resources, and alliances to improve business agility. 7.2.2 Develop and manage IT service levels (10579) Develop and manage IT service levels requires creating and maintaining the IT services and solutions catalog, establishing and maintaining business and IT service level agreements, evaluating and reporting service level attainment results, and communicating business and IT service level improvement opportunities. 7.2.3 Perform demand-side management (DSM) for IT services (10580) Perform DSM for IT services consists of understanding IT services and solutions consumption and usage, developing and implementing incentive programs that improve consumption efficiency, and developing the volume/unit forecast for IT services and solutions. Development of IT services and solutions requires modeling the effect of incentive programs on the baseline forecast and generating a DSM-influenced volume/unit forecast. 7.2.4 Manage IT customer satisfaction (10581) Manage IT customer satisfaction includes capturing and analyzing customer satisfaction and assessing and communicating customer satisfaction patterns. Capturing and analyzing customer satisfaction consists of tasks required to manage and monitor IT customer complaints and feedback, conduct qualitative and quantitative assessments, and identify customer satisfaction issues and opportunities for improvement. Assessing and communicating customer satisfaction patterns consists of tasks required to evaluate satisfaction with IT services and solutions, evaluate satisfaction with complaint resolution, and determine IT customer loyalty/lifetime value. 4 Permission granted to photocopy for personal use. 2012 APQC. ALL RIGHTS RESERVED.
( 7.2 Develop and manage IT customer relationships continued ) 7.2.5 Market IT services and solutions (10582) Market IT services and solutions includes developing the IT services and solutions marketing strategy, developing and managing the IT customer strategy, managing IT services and solutions advertising and promotional campaigns, and processing and tracking IT services and solutions orders. Developing the services and solutions marketing strategy requires the IT organization to understand IT services and solutions requirements, predict user consumption behavior, and identify common usage/consumption profiles and target IT customers. Developing and managing the IT customer strategy includes tasks to establish and maintain IT customer management goals and strategies, develop a sales forecast and budget, and evaluate IT customer management results. Managing IT services and solutions advertising and promotional campaigns develops and manages solutions advertising, promotions, marketing communications, and sales opportunities. Processing and tracking IT services and solutions orders consists of collecting and maintaining IT customer account information, processing orders, and establishing delivery of the IT services and solutions. 7.3 Develop and implement security, privacy, and data protection controls (11220) Develop and implement security, privacy, and data protection controls involves protecting an organization s core electronic assets through the implementation of information security controls and governance. The goal is to implement policies and controls that proactively prevent security intrusions externally, defi ne and control data permissions internally, and plan for data security breaches should they arise. Presence of an information security plan/policy Frequency of information security audits Frequency of privacy policy reviews Number of security incidents within the last 12 months Presence of intrusion detection system(s) 7.3.1 Establish information security, privacy, and data protection strategies and levels (11230) Establish information security, privacy, and data protection strategies and levels includes the process to design and develop a comprehensive enterprise approach to data protection. This strategy includes establishing a governing body whose purpose is to gather security requirements and perform periodic reviews, design the organizational rules surrounding data access, and develop the requirements to implement logical and physical barriers for data protection. 7.3.2 Test, evaluate, and implement information security and privacy and data protection controls (11231) Test, evaluate, and implement information security and privacy and data protection controls encompasses the technical and process changes as well as the communication/change strategy for implementing information security protection. This involves developing test plans and conducting tests of data protection controls, evaluating the overall outcome of data protection control tests, and implementing data protection controls. Version 2.0.0 October 2012 5
7.4 Manage enterprise information (10565) Manage enterprise information is defined as understanding what information is important to the enterprise; determining how, when and from where that information is collected; defining how that information is structured and organized; and establishing the policies and controls needed to guide the collection and use of that information. Number of IT FTEs for Manage enterprise information per $1 billion revenue Total cost of Manage enterprise information per $1,000 revenue Average time in weeks to fulfill a simple/medium/complex information need 7.4.1 Develop the information and content management strategies (10583) Develop the information and content management strategies includes understanding information needs and the role of IT services in executing the business strategy, assessing the information and IT knowledge management implications of new technologies, and planning information and IT knowledge management actions and priorities. 7.4.2 Defi ne the enterprise information architecture (10584) Defi ne the enterprise information architecture includes defining information elements, composite structure, logical relationships, constraints, and derivation rules; defining information access requirements; and establishing data custodianship. 7.4.3 Manage information resources (10585) Manage information resources includes defining the enterprise information/data policies and standards as well as developing and implementing data and content administration. 7.4.4 Perform enterprise data and content management (10586) Perform enterprise data and content management requires the IT organization to ensure that the collection, storage, and use of information and data are in accordance with the established information/data policies. Tasks include monitoring, controlling, and managing exceptions per policies and standards. 6 Permission granted to photocopy for personal use. 2012 APQC. ALL RIGHTS RESERVED.
7.5 Develop and maintain information technology solutions (10566) Develop and manage information technology solutions involves producing, developing, and testing new, enhanced solutions; enabling services that meet all confi rmed requirements; maintaining and managing solutions; supporting services to continue meeting all confi rmed requirements; and sunsetting solutions/discontinuing services no longer needed. Total cost of IT development and maintenance per $1,000 revenue Number of IT FTEs for Develop and maintain IT solutions per: $1 billion revenue $1,000 revenue Time to market (in months) for new or enhanced IT services Percentage of planned return on investment (ROI) for projects Percentage of projects in the most recent year delivered on or below budget and on time/early 7.5.1 Develop the IT development strategy (10587) Develop the IT development strategy includes defining a consistent approach to IT development; ensuring the repeatability of development and maintenance activities; and allowing these activities and their outcomes to be measured, thereby enabling continuous improvement. 7.5.2 Perform IT services and solutions life cycle planning (10588) Perform IT services and solutions life cycle planning includes tasks to maintain the long-term viability of a family of services and solutions from cradle to grave. This includes ensuring that new solutions are created and new services enabled when needed and that existing services and solutions are properly repaired/enhanced or sunset/discontinued in an orderly fashion when no longer needed. 7.5.3 Develop and maintain IT services and solutions architecture (10589) Develop and maintain IT services and solutions architecture includes creating the technical definition of the reference architecture for a family of IT services and solutions while ensuring compliance with the overall enterprise architecture. Tasks include assessing the need for new solutions and services, enabling new solutions and services, and maintaining existing solutions and services in a prescribed fashion that is consistent across the enterprise. 7.5.4 Create IT services and solutions (10590) Create IT services and solutions is defined as the installation of service and/or solution design while ensuring that all functional and non-functional requirements are met and that solutions comply with organizational standards. Tasks include understanding service or solution requirements, designing the service or solution, building or integrating components, testing the solution or service, and gaining customer acceptance and certification. 7.5.5 Maintain IT services and solutions (10591) Maintain IT services and solutions includes the tasks required to upkeep, repair, and develop minor (as defined by enterprise policy) enhancements to existing solutions or services and ensure that existing services or solutions continue to meet requirements. Tasks include understanding requirements or defect analysis, modifying the design of services or solutions, integrating newly required components, testing changes to solutions or services, and gaining customer acceptance and certification. Version 2.0.0 October 2012 7
7.6 Deploy information technology solutions (10567) Deploy information technology solutions involves introducing new, enhanced, or improved functionality into the environment with minimal or no disruption to the services schedules; ensuring consideration of appropriate security and contractual constraints; and properly balancing business benefit with technical and business risk. Number of IT FTEs for Deploy IT solutions per $1 billion revenue Total cost of Deploy IT solutions per $1,000 revenue Percentage of unscheduled outages from: change requests release introductions Average time in weeks to: make a change to the production environment deploy a new release into the production environment 7.6.1 Develop the IT deployment strategy (10592) Develop the IT deployment strategy includes creating a consistent approach to the introduction of changes and releases into the IT environment, examining feedback from completed changes to ensure a successful deployment, and developing policies specific to change and release. Tasks include defining what constitutes a change and release, determining who can request changes and releases, establishing procedures to assign priority and approval levels, developing an exception process, defining deployment procedures, establishing and documenting a workflow for change approvals, analyzing completed changes and releases, and evaluating change trends and success rates. 7.6.2 Plan and implement changes (10593) Plan and implement changes includes all tasks necessary to administer and plan individual change requests (including accepting or rejecting the request), assessing the business and technical risks of changes, determining which individual changes can be performed simultaneously without increasing overall risk factors, and creating a master change schedule. Other tasks include requesting services, such as procurement and security, from other components to ensure component availability and obtainment of necessary security authorities. 7.6.3 Plan and manage releases (10594) Plan and manage releases involves establishing priority for changes and executing all necessary planning activities to prepare for the actual release implementation. Tasks include understanding release design, coordinating release acceptance, planning rollout, and coordinating training. 8 Permission granted to photocopy for personal use. 2012 APQC. ALL RIGHTS RESERVED.
7.7 Deliver and support information technology services (10568) Deliver and support information technology services involves delivering IT services and solutions within the budget provided, meeting service commitments as measured by customer-defined service criteria, and achieving customer satisfaction targets. Number of IT FTEs for Deliver and support IT services per $1 billion revenue Total cost of Deliver and support IT services per $1,000 revenue Average time (in hours) to resolve a service commitment disruption Tickets and transactions meeting agreed quality as a percentage of total tickets and transactions for: business process services IT Infrastructure Services (ITIS) production support Tickets and transactions meeting agreed turnaround time as a percentage of total tickets and transactions for: business process services ITIS production support 7.7.1 Develop the IT services and solutions delivery strategy (10595) Develop the IT services and solutions delivery strategy consists of defining the organizational approach for IT service and delivery. Tasks include developing a strategy for delivering IT infrastructure services and determining sourcing strategies. 7.7.2 Develop the IT support strategy (10596) Develop the IT support strategy requires defining the organizational approach to delivering key enabling services and assisting in the use of information technology. This strategy would address help desk activities, desk-side support, and third-level technical support. Tasks include coordination of vendor support and evaluation of sourcing alternatives. 7.7.3 Manage IT infrastructure resources (10597) Manage IT infrastructure resources involves managing and maintaining the physical computing assets, including hardware and software, of the organization. Tasks include identifying configuration items to be maintained, establishing the information management system, collecting configuration item information, populating the database, and ensuring that information is available to other components. Other tasks include preventive maintenance, facilities management, configuration management, and inventory (asset) management. 7.7.4 Manage IT infrastructure operations (10598) Manage IT infrastructure operations consists of activities required to manage the organizational workload and operation of physical assets, irrespective of their physical location. This includes providing and executing the requested services, preparing and handling customer input and data, managing security requests, and releasing resources employed in the delivery of the requested service and subsequently returning them to the resource pool. Version 2.0.0 October 2012 9
( 7.7 Deliver and support information technology services continued ) 7.7.5 Support IT services and solutions (10599) Support IT services and solutions includes contributing to the attainment of service level targets, managing end-users perceptions of IT services, providing assistance to customers in their use of IT, and ensuring that IT resources are available and performing within the agreed-upon service levels. Without support, there can be no accountability for a viable operational environment. This activity serves as input to the process by which the enterprise plans and manages overall business continuity and includes executing the plan to restore IT service in the event of a service interruption or outage due to catastrophe. It may also include informing key executives as to the exposures, costs, and tradeoffs. Tasks include request management, problem management, IT service continuity management, end-user support, desk-side support, and incident management. 123 North Post Oak Lane, Third Floor Houston, Texas 77024-7797 800-776-9676 phone +1-713-681-4020 +1-713-681-8578 fax pcf_feedback@apqc.org www.apqc.org 10 Permission granted to photocopy for personal use. 2012 APQC. ALL RIGHTS RESERVED.