Asset & Configuration Management (CMDB) Workshop. Don Page Marval Group

Transcription

1 Asset & Configuration Management (CMDB) Workshop Don Page Marval Group

2 Who is Don - Credentials Co-author of ITIL (worldwide best practice in ITSM) Co-author of BS15000 (British Standard for IT Service Management) Co-author ISO (worldwide ISO Standard for IT Service Management) Co-author BSI Code of Practice for ITSM (BS ) Don Page (ITSMF Life-Time Achievement award) Fellow of the Institute of Service Management Helpdesk Institute advisor Award winning ITSM projects

3 Don s ITSM projects have won 8 of last 10 annual European IT Service Management Improvement Project of the Year Awards News: At the recent UK ITSMF Service Management Awards, Marval & British Telecom Ireland picked up Service Improvement Project of the Year Finalists: BT Ireland, Racal Vodaphone, BT England, Pilkington's

4 Recent Projects Include European Central Bank (ISO 20000/SOX) Dimension data worldwide (ISO 20000/SOX) Heineken Worldwide (ITIL) AIB bank Europe (ISO 20000/SOX) UK National Health Service British Telecom Ireland (ISO 20000/SOX) Worldwide Scout Jamboree CMDB played a critical role in delivering success

5 Don s thought for the day 1. I believe many traditional IT departments are not currently capable of delivering a quality & cost effective business service without having a critical re-think

6

7 ICT Strategic Objectives 1. Internal cost reduction & resource optimisation 2. Increased IT infrastructure & Service reliability 3. Investment protection & risk reduction 4. Encourage positive workplace behaviour & investment 5. Improved customer experience & communication reduced IT cost increased business value of IT Accountability/Governance/Evidence

8 Clarification 1. Asset Management Focused on the financial accounting of assets within an organization 2. Inventory Management Focused on the physical & quantitative tracking of assets within an organization 3. Configuration Management Focused on the relationships & dependencies between physical assets components, software & Services within an organization

9 What is the IT Infrastructure? People Who, Where, What Skills, Attributes, Experience Documentation Reports, Agreements, Contracts, License details, Policies, Processes, Procedures, Service Improvement Plans, Service requests (Incidents Problems Changes), Evidence Environment Accommodation, Light, Heat, Power Utility Services (Electricity Gas Water Oil) Office Equipment Furniture Plant & Machinery Services Payroll Internet ATM Data Files What, Where, How important Hardware Computer & network components, cables (LAN, WAN) Telephones, Switches ATMs Software Business & In-house applications, Operating systems, Network management systems, Utilities (scheduling, backup & recovery) Packages, Desktop support

10 Sample CI record Location Maintainer /supplier Licenses/contracts Maintenance costs Owner/user Components & key attributes Maintainer Value Service Parent/Child relationships & dependencies Turns an asset register into a CMDB Essential for good change mgt & risk assessment

11 Question: What can we use a CMDB for? 1. Managing the IT Infrastructure 2. Standard asset & inventory tracking 3. Customer support (service desk) 4. Risk assessment for change evaluation 5. Managing licence, maintenance & warranty contracts 6. Business continuity & Maintaining a disaster recovery manifest 7. Documenting who, what & where critical business systems & services are. 8. Dependencies & relationships between items 9. Departmental costing & chargeback 10. Reducing operational costs & purchases through improved control 11. Supporting regulatory & corporate governance (e.g. ISO 20000/ ISO 9000)

12 The Goal of a Configuration Management Database (CMDB) 1. Account for all the IT assets & configurations & Services within the organization 2. To support change & risk assessment within the business 3. Provide accurate information on configurations & their documentation to support all the other Service Management processes 4. To assist in delivering a better service & more reliable IT infrastructure 5. Reduce dependency on individuals having all the knowledge

13 In summary 1. What have we got 2. Where are they 3. Who owns them 4. How many have got 5. How much are they worth 6. What are the key dependencies & relationships 7. What problems with them had we got/had/fixed

14 Benefits of Configuration Management 1. Control Verifying & correcting configuration records gives you a greater degree of control over your infrastructure 2. Integration Integrating all configuration-related IT processes can reduce errors & the number of staff needed to administer your environment 3. Decision Support Making decisions & meeting commitments is easier when you have complete & accurate data, resulting in better resource & performance estimates

15 Tips & pitfalls

16 The Business & customer already think we are in control of the IT Infrastructure Sorry Don is off today - where exactly is your PC located Mr. Smith

17 The Challenge 1. No central CMDB available 2. Different source of asset information, maintained in various forms (databases, spreadsheets, text documents) 3. Auditing often difficult & time consuming 4. Dependencies & relationships unclear or even unknown 5. Dependency on key personnel 6. Information time consuming to maintain 7. Contract renewals sometimes missed 8. Governance controls not in place 9. Documentation not always updated 10. Don t know where to start The job is just to big

18 CMDB Project Scope DEFINE DISCOVER DESIGN DEPLOY DRIVE What is the Vision Where are we now Where do we want to be How do we get there? How do we know we have arrived? High level business Objectives Assessment Policies, Process, Procedures, Guidelines. Implementation Measurement Continuous Process Improvement Time

19 Common problems 1. Operational processes & procedures not in-place or followed 2. Poor data requirements & quality 3. Underestimating the size of the task 4. Trying to please everyone trying to get every CI & attribute to meet everyone s wish list

20 Common problems cont. 1. Not keeping the data up-to-date 2. Not selling the benefits 3. Assuming that discovery tools will solve all your problems 4. Not having the right people available to identify relationships & dependencies between items

21 Some Practical Tips 1. Don t expect 100% accuracy but aim towards it 2. Audit the process as well as the data, control access 3. When capturing initial data, don t spend time trying to get 100% attributes. Decide what you consider mandatory - value added data can be captured later

22 Getting started

23 FOCUS Managing an IT & Service infrastructure Is the same as managing a number of coke machines

24 High Level CMDB Process Framework Start CMDB End

25 Focus on these 4 simple questions Alignment to industry best practice & standards Are we Classifying CI/Assets correctly? Are they easy to identify & report on? The 4 R s Risk Are we seeing the benefits/value? Is the information accurate Operational & Financial Worth/value Level of Professionalism

26 ISO 17799

27 What do you want from your CMDB? Examples: 1. Should we buy X more of these computers? 2. What equipment & applications is causing us problems? 3. Should we renew this maintenance contract? 4. Is the supplier meeting their agreements? 5. What has been the performance of supplier X? 6. How many of these items have we got? 7. What services are running on server X? 8. What other business services are effected/at risk if we turn this server off?

28 Configuration & Service Relationships Payroll Service Accounts Department HR Payroll Marketing What are the maintenance functions & routine activities Performed & by who? Server X If Server X fails Backup server 1. Who do we keep informed/when 2. What other services are effected 3. Who needs to fix it/be involved 4. How long will it take 5. How long have we got 6. What service needs to be restored first 7. What is its business priority & impact? If the Payroll Service fails 1. Who do we inform & when 2. What computer is it on 3. Who needs to fix it/be involved 4. How long will it take 5. How long have we got 6. How do we do it 7. What is its business priority & impact?

29 CMDB Automation Uses Infrastructure event detected for SERVER X Affected CI passed to ITSM Tool Expectation mgt. Service Desk Payroll Service e.g Your own scripts, Network/hardware Monitoring, Security, Operational Events CI detail & Related Services Obtained from CMDB (+SLAs, priority, impact etc) Major Incident recorded against Server X in ITSM tool Related Major Incidents recorded against affected Service's running on Server X CMDB Server X Assigned to support team for repair Affected Business users automatically notified Billing Service Each customer who reported an incident against any of the services receives an automatic receipt & closure notification (Asset & Configuration Mgt. Database) Server X Restored (1 st ) Business Service's restored Requests auto-closed Business users notified NOTE: 3 service incidents generated for this outage

30 Identify & agree high level scope of CMDB

31 Scope & level of detail required (phase 1) 1. Phased approach recommended - Identify a) Critical services b) Underpinning services, critical servers & devices c) Critical applications d) Licensed applications e) VIP People & places f) Devices & Services required for Business continuity g) Support for related Key ITSM processes (e.g. Change & incident)

32 Phase 1 - Key Steps Required 1. Produce required ITSM policies, processes & procedures for maintaining CMDB 2. Collect information relating to IT products & services within key locations 3. Identify & collect critical servers & services for all locations 4. Provide phased collection for each site (e.g. Period1=Kettering, Period 2=London)

33 Team Questions* 1. In order to obtain team buy-in & contribution, we need to ensure there is a direct benefit for each team What s in it for me What decisions does the business want to make? What does change & problem management need? What do applications support need? What does finance need? What does the Service Desk need? What does business continuity need? What do the other teams need (e.g. networks, operations)? Facilities & telecoms?

34 CMDB Data Population & Maintenance

35 Data availability/sources 1. What have we got; where is it; who owns it? Master source of Supplier & Contact data Asset databases Spread sheets LDAP databases may contain additional information HR, Pat testing, facilities databases Other tools

36 Data collection methods 1. Manually - can be time consuming 2. Semi-automatic - with Bar code scanners Resource intensive, but accurate 3. Auto-discovery - Discovery tools can be expensive & resource intensive. You still have to manage the exceptions 4. Required Activities - Obtain details from discovery supplier which components will be identified & what will not be identified We need to Identify what elements of the discovery data is required (defining the filters) Check mapping to ITSM tool is possible & at what level of integration will be available Discovery tools may not address bespoke applications identification

37 TOOLS (A fool with a tool is still a fool) 1. Standalone Asset/CMDB tool will limited its value 2. You will need an integrated IT Service management software tool to best exploit your CMDB investment 3. The tool will fail without underpinning policies, processes & procedures, which are available followed

38 Marval Process Improvement process Process Reinforcement Statements 1. A process exists to produce quality products & services 2. A process which inhibits quality is a bad process 3. Process, whether defined or understood, always exists 4. Process must evolve to be successful

39 Education 1. Hold awareness, benefits & training sessions before you start (not after) 2. Run usage scenarios for policies, processes, procedures & workflows 3. Understanding the processes, procedures & workflows required to support the CMDB 4. How to use the new processes, procedures & workflows from within your ITSM tool

40 Reporting & Governance Actions 1. Is there any Governance/regulatory requirements & evidence required 2. Identify who needs what information from the CMDB e.g. Applications team Service Desk Finance department Change management Quality assurance Contracts/license management Others

41 Business Continuity Actions 1. Identify critical Hardware components (e.g. Servers Routers 2. Identify critical Services & Applications running on critical hardware 3. Identify critical applications/source which should be part of the Definitive Software Library 4. Assign Business impact & risk ratings to critical items 5. Identify required reporting & audit checks

42 Asset & configuration item life-cycle CMDB Process workflows

43 CMDB Process Requirements* 1. Identify high level processes required 2. Define support process & procedures required to maintain the CMDB (e.g. Take-on Moves Disposals Ownership changes Configuration & relationship changes Audit Loan Contract /licence controls

44 Related CMDB Process Requirements 1. For all ITSM processes ensure they have an Update CMDB step before closure (e.g. Incident, Change) NEW WIP SOLVED UPDATE CMDB CLOSED

45 1. Keep them simple CI Classification rules Good classification allows you to group, search & report on your CMDB 2. Only maintain to the level of detail you need & have the resource to keep it up-to-date 3. Identify what you want to report on before you define the classifications 4. Decide who needs to know what & why 5. You must be able to make a decision on the collected data

46 Data & its classification is the Key 1. No matter which service management processes you implement, the data used will make them effective a) Configurations are constantly changing, last week s correct data could be obsolete this week b) Your configuration data must be available to all of your ITSM processes, even the most accurate data is useless if you can t get to it

47 ISO 17799

48 1. High level grouping CMDB CI Categorisation* Category (e.g. hardware, software, documentation) Major type (computer, database) - * Minor type (e.g. Backup-server), use for detailed classification Logical or physical CI Hardware, computer, laptop

49 Logical configurations items 1. Is generally used a Grouping item 2. Makes CMDB maintenance/searcing easier 3. Used to identify a Service or grouping CI s FINANCIAL (LOGICAL) Application 1 Application 2 Training-room1 Location PC 1 PC 2 Projector

50 Minor type consideration 1. Use a minor type to maintain the right level of detail needed 1. Backup-Server 20 pieces of data 2. PC 10 pieces of data 3. Printer 3 pieces of data

51 Category Hardware Software Application Documentation Service Hardware Computer Backup server server Database server Network Software Application Payroll System

52 Define CI Organisational Grouping activity* 1. Define organisational structure to support reporting & grouping e.g. Department Division Site Location Region

53 For example: Define Misc. CI Attributes 1. System ID 2. Cost centre 3. DSL Item 4. DHS item 5. Business continuity item 6. Last audit date 7. Next audit date 8. Last preventative maintenance 9. Service state Under warranty Under maintenance None

54 CI Status Codes* 1. Describing the current operational state of a CI. E.g. Active Disposed of Damaged Free Under Change Reserved In Repair In Test Stock

55 SLA & OLA CI assignment* 1. Maintenance contracts CI Exceptions 2. Asset/CI 3. Services 4. CI major types (e.g. web server, servers) 5. Locations 6. People + suppliers 7. Departments

56 ITIL CI Relationships 1. Child of 2. Concerns 3. Connected with 4. Depends upon* 5. Is a copy of 6. Is part of 7. Runs on 8. Uses

57

58 Conclusion Building an effective CMDB is NOT difficult, it just requires: 1. Attention to detail 2. Having the right policies, processes & procedures in place 3. People to follow process 4. Demonstrable business & operational benefits 5. Hard work 6. Alternatively hire a Storeman

59 ICT s role is to help the business do things Faster, More Reliably More Efficiently More Cost effectively With the evidence to prove it Achieving Operational Excellence; balancing Risk, Service Quality & Cost

60 The End Thanks for listening

61 CMDB Work Packets Breaking in down into smaller chucks really works

62 Objective 1. To Identify the required work packets that will contribute to the delivery of a phase 1 Project 2. Assign activities, roles & responsibilities Project Process Technical Data

63 Task Description Owner(s) Estimate in man-days CW1 Project: Define business case, & obtain management sponsorship 5 days CW2 Process: Define CMDB process activity owners, roles & responsibilities 2 days CW3 Technical: If required,confirm from discovery tool supplier which components will be identified & what will NOT be identified for all required platforms. 1 day CW4 Process: Identify related ITSM CMDB process, sub processes & activities. E.g. Change control, availability 5 days

64 Task Description Owner(s) Estimate in man-days CW5 Project: Agree CI scope & detail (Stage 1) Business Critical & underpinning services 5 days Critical servers/devices Critical services Critical applications VIP People & places Devices & Services required for Business continuity Support for related Key ITSM processes (e.g. Change & incident) CW6 Process: Produce required ITSM policies, processes & procedures & workflows for maintaining the CMDB 30 days CW7 Data: Collect information relating to Critical IT products & services 30 days

65 Task Description Owner(s) Estimate in man-days CW9 Data: Identify & collect critical servers & services for remaining (locations/sites) days CW10 Project: Define plan & timelines for non-critical CI collection for remaining sites 3 days CW11 Technical: Identify critical relationships of which applications & services run on which server for each site/location 60 days CW12 Technical: Review requirements for data integration & maintenance with ITSM tool 5 days

66 Task Description Owner(s) Estimate in man-days CW13 Technical: Create a test system/environment for new CMDB database & test 5 days CW14 Project: Create CMDB training program for:- 30 days CMDB Awareness & benefits sessions New Process & procedure training Using new processes, procedures & workflows from within ITSM tool Sample usage scenarios for new processes, procedures & workflows CW15 Project: Identify reporting & governance/evidence requirements for support teams & business 15 days CW16 Data: Business continuity - Identify critical Hardware components (cross ref. with critical servers activity) 30 days

67 Task Description Owner(s) Estimate in man-days CW17 Data: Business continuity - Identify critical Services & Applications 15 days CW18 Data: Business continuity - Identify critical Services & Applications running on critical hardware 30 days CW19 Data: Business continuity - Identify critical applications which should be part of the Definitive Software Library (Master software source code) 10 days CW20 Data: Business continuity - Assign Business impact & risk ratings to critical items 15 days

68 Task Description Owner(s) Estimate in man-days CW21 Process: Business continuity - Identify required CI reporting, audit checks & processes including DSL verification 10 days CW22 Technical: Finalise & agree CI Relationships 1 day CW23 Technical: Define & agree technical major type CI attributes. E.g. category, major & minor types 2 days CW24 Technical: Finalise & agree organisational structure to support reporting (e.g.. site, department, region etc) 2 days

69 Task Description Owner(s) Estimate in man-days CW25 Technical: Finalise & agree CI Status codes 1 day CW26 Project: Identify & agree what SLA/OLAs should be attached to which CI s (service, people, places etc) 30 days CW27 Project: Identify external, internal business services, Operational & Core Services 60 days

70 Task Description Owner(s) Estimate in man-days CW28 Project/technical: Map external, internal business services, Operational & Core services & relationships to Underpinning CIs (output=revised service catalogue & SLA Targets) 90 days CW29 Project: SLAs: Identify business & supplier; related licences, contract & SLA details. 30 days Identify any contract conflicts & overlaps CW30 Technical: Transfer reconfigured CMDB to live environment & test 3 days

71 Task Description Owner(s) Estimate in man-days CW31 Process: Important: Review & modify related ITSM workflows, processes & procedures to include a Update CMDB step 10 days CW32 Project: Review, document & confirm requirements for application management Identify for each application:- e.g. 90 days Underlying database version Application interfaces Developed with CW33 Technical: Review application support for CW32 3 days CW34 Tool: Review CMDB exploitation e.g. ing, Service desk, system mgt. & event mgt. tools 10 days

72 Business Value Key Performance Indicators

73 What s in a Configuration Item?! "&$ $, "#!- 23 "! &$!' ' (' "! ' & +!&' & &$, "! $ '$ '&&$!' &$ -&- -.!!" #$ %& ' () ( #' & & &!" *! *! /& &, 01& + & "' &' &'! (&

74 Data is the Key 1. No matter which service management processes you implement, the data they use will make them effective Your configuration data must be accurate, which means it must be updated frequently Configurations are constantly changing, so last week s correct data could be horribly obsolete this week Your configuration data must also be available to all of your IT processes, because even the most accurate data is useless if you can t get to it

75 Understanding a CMDB Model 1. Relationships between CIs Relationships make the CMDB a powerful decision support tool Relationships allow you to understand the dependencies among CIs 2. Related Data Includes information related to CIs, such as incidents, change requests, contracts, Service Level Agreements (SLAs) Contains information about your CIs & forms an important part of your IT infrastructure

76 Value Proposition 1. Relationships between CIs bring it all together 2. CMDB provides a single source of record that can be leveraged by all ITSM processes 3. Configuration Management provides better control, integration & decision support across your organization 4. It is critical to ensure the CMDB always provides accurate information about your infrastructure

77 The CMDB Challenges 1. To have the plan & processes in place to keep it up-to-date Start with a phased approach, critical servers & services first If you find it difficult hire a STOREMAN not an IT guy 2. To identify how to better exploit the CMDB to make informed decisions & risk assessments 3. Note: Discovery tools will help but are not a substitute for good change control

78 Start Agree on purpose Agree on Scope of mgt. End 1. Build Overview Agree on Standards/Process for mgt. Build CMDB Decide what Needs to managed Discover components

79 Discover Assets Do you need To manage it Yes Are CI s for this asset defined NO End End 2. Define CI Do you need to manage CI Use it Add CI (s) to CMDB Identify CI Relationships & dependencies

80 The End Thanks for listening