ISO/IEC 20000, checklist of documents required by the standard.

Remember that documents do not need to be very long in fact they are more likely to be used if they are kept short and succinct. Some documents can be embedded within a tool e.g. procedures. Documents should be written to be used and useful, not just because the standard requires it. Policies There are a number of required policies. Some organisations produce policies for every process which is fine but not a requirement of the standard. The required policies, with clause numbers shown in brackets are: a) service management policy (4.1.1, 4.1.2). Usually documented in the service management plan along with the

service management objectives b) policy on continual improvement of the SMS and the services (4.5.5.1) stating evaluation criteria for the opportunities for improvement. Can be documented in the service management plan or the procedure for managing improvements c) budgeting and accounting policies (6.4). These policies are often driven from the financial policies of the service providers organisation and will usually be documented in the budgeting and accounting process d) information security policy (6.6). Can be documented in the information security management process and/or the

service management plan along with the information security objectives e) change management policy (9.2) which states the CIs under the control of change management and the criteria to determine changes with potential to have a major impact on services or the customer. The criteria are used to determine which changes will be managed through clause 5, design and transition of new or changed services process. Can be documented in the change management process and/or the service management plan f) release management policy (9.3) which states the frequency and type of releases. Can be documented in the

release management process and/or the service management plan. Plans The required plans are: a) b) c) d) e) service management plan (4.1.1, 4.5.2). This will include the scope of the SMS (4.5.1) service continuity plan (6.3.2) availability plan (6.3.2). Note that the service continuity and availability plans can be combined or separate capacity plan (6.5) audit programme (4.5.5.2) including criteria, scope, frequency and methods. Also to be documented are the

objectives of internal audits and management reviews (4.5.4.1) f) plan to implement an improvement (4.5.5.2). This is for each individual improvement

g)

New or changed service plan (5.2). This is for each new or changed service. For removal of service, a removal

plan is produced h) Release plan (9.3). This is for each release.

Process descriptions and documented procedures Clause 4.3.1 requires documented service management processes. The required processes are those in Clauses 5 to 9. There are also processes in clause 4 which require a documented description e.g. resource management, documentation management. Clause 4.3.1 also requires documented procedures required by this part of ISO/IEC 20000. The required procedures are: a) b) c) d) e) f) g) h) i) j) k) l) communication procedures; control of documents; control of records; planning and conducting internal audits; management of improvements; procedures to be used for the delivery of new or changed services; procedures to support the budgeting and accounting for services process; procedures to be implemented in the event of a major loss of service as part of the service continuity plan; procedures to enable predictive analysis of capacity; managing service complaints; managing contractual disputes; managing incidents from recording to closure;

m) managing major incidents; n) o) p) q) r) managing the fulfilment of service requests from recording to closure; identifying problems and minimizing or avoiding the impact of incidents and problems; recording, controlling and tracking configuration items; recording, classifying, assessing and approving requests for change; managing emergency changes;

s)

managing emergency releases.

Definitions There are a few documented definitions required. These are as follows: a) b) c) d) e) service complaint (7.1). This is often defined in the SLA major incident (8.1). This is often defined in the SLA types of CI (9.1). This is usually defined in the configuration management process emergency change (9.2). This is often defined in the SLA emergency release (9.3). This is often defined in conjunction with the definition of emergency change.

Other key documents The other key documents required by the standard are: a) b) c) d) service requirements (4.1.4) catalogue of services (4.3.1, 6.1) service level agreements (4.3.2, 6.1) documented agreements (6.1). This applies specifically to agreements between internal groups or customers

acting as suppliers that are providing some service components or operating a process or part of a process. These can be known as operational level agreements (OLAs) e) description of each service report, including its identity, purpose, audience, frequency and details of the data

source(s) (6.2) f) g) h) risks to service continuity and availability of services (6.3.1) opportunities for improvement, including corrective and preventive actions (4.5.5.1) design of new or changed services (5.3) for each new or changed service

i) information security controls including the risks to which they relate (6.6.2) and those controls for external organisations (6.6.3) j) k) l) customers, users and interested parties of the services (7.1) supplier contracts (7.2) roles of, and relationships between, lead and sub-contracted suppliers (7.2).

Records Records are required to enable control and provide evidence of conformity to the requirements of the standard (4.3.1). Records can be paper based or kept on tools. Examples of records are minutes of management review meetings, incident records on a service desk tool and service reports. Other possible documents Clause 4.3.1 also refers to additional documents, including those of external origin, determined by the service provider as necessary to ensure effective operation of the SMS and delivery of th e services. Examples of such documents are user manuals from a software tool vendor or the ISO/IEC 20000 standard itself. Summary In summary, there are many documents required by the standard but this should not be seen as a chore. It is important to remember the hierarchy of policy, plan, process and procedure. Everything must align with the relevant policies. Process specific plans must align with the service management plan. Processes document what is to be done. Procedures support processes with more detail of how activities are to be done. All documents are there to enable the service provider to operate and deliver an excellent high quality service.