ITILworx Publications

Home
ITIL Downloads

Marketplace

Taxonomy

Is your

IT Organization

on the

same page?

=> ITIL Awareness

Coming Soon!

ITSM Toolkit Volume 2

Enter your email address

to receive notification upon availability and you will also be entered into our drawing for a FREE copy of the

ITSM Toolkit Vol. 2 CD:

The Big Picture: ITIL as an Integrated Framework

by Kevin LeBlanc (August, 2004)

As ITIL proliferates in North America, it is becoming increasingly important to consider integration with parallel frameworks such as CoBiT, ISO 17799 and Six Sigma, to name a few. Many IT professionals are already familiar with these or other quality models, but can they integrate? The short answer is yes, granted some effort must be made to establish clear integration points and determine which areas of each framework are applicable to a particular organization.

Before we take a look at integration, let’s quickly review four of the more significant quality frameworks outside of the ITIL sphere:

ISO17799 (security standard) - comprised of ten sections, coverage consists of systems development, access controls, business continuity, compliance, personal / physical security, asset controls and related policies. Each sub-section is comprised of associated standards to be applied to the target environment.

Six Sigma (statistical process-improvement method) - developed by Motorola Inc. with a focus on quality from a customer’s perspective. The method primarily revolves around DMAIC (Define, Measure, Analyze, Improve & Control) to improve the capabilities of existing processes.

CoBiT (audit & control) - sponsored by ISACA and the IT Governance Institute, CoBiT provides a set of guidelines for IT processes, practices and controls. It primarily focuses on reducing risk in four primary IT domains.  IT environment audits are performed through checklists resulting in a six-scale rating. Continuous improvements as a result of those ratings are left to the IT organization.

ISO 9000 (auditing standards) - sponsored by the International Standards Organization (ISO), the framework provides audit standards for quality management systems. ISO 9000 focuses on repeatability and process consistency, but is not particularly analytical. ISO 9000 can be used throughout the enterprise, but its relevance is more in line with certification rather than continuous improvement.

All these frameworks can add value to just about any IT shop depending on the specific business needs of the parent organization. However, the best fit-for-purpose combination benefiting ITIL practitioners may point to CoBiT (audit), ITIL (improve) and ISO17799 (secure).

ISO9000 is a relatively encompassing framework and tailors itself more to an internal/external auditor's perspective, but lacks self governance. On the other hand, ISO17799 and CoBiT have shown their ability to integrate effectively with ITIL by focusing on process-specific activities, and CoBiT and ITIL are particularly good at separation of duties (audit vs. improve).

Since none of the aforementioned frameworks are primarily data-driven, Six Sigma is the square peg in the round hole. Six-Sigma certainly thrives off data, and also focuses primarily on manufacturing processes. Therefore, it may prove difficult to apply Six Sigma concepts surrounding defect reduction to IT services and processes. This is not to say that Six-Sigma cannot provide value to ITIL—the DMAIC method can be tailored to drive an ITIL Continuous Service Improvement Program. However, a 99.9997 defect-free service environment may be a little premature.

Bottom Line: With the increased activity surrounding regulatory compliance, systems centralization and security concerns, one of the strongest foundations may be achieved through an improvement (ITIL), audit (CoBiT) and security (ISO 17799) framework integration. ◊

Interested in publishing your views or tools on ITILworx.com? See our Publication Guidelines.

Feedback or suggestions? Please submit your comments via ITILworx Feedback.

ITILworx © 2004 | All Rights Reserved

Privacy Statement  |  Terms of Use