51CTO下载-ITIL培训讲稿全
51CTO下载-ITIL培训讲稿全
TTNIC
ITIL和IT桌面管理产品的架构融合
基于ITIL的流程化管理服务帮助 台
故 障 问 题 申 告 管 理 维 护 策 略
管理控制台 知识库 桌面配置管理 Internet访问控制 桌面应用管理 客户端 （桌面系统） 桌面安全管 理服务器组 IT桌面管理知识更新 Internet
公司内部网
企业防火墙
对于关键系统和基础设施使之达到更高的可靠性在所有员工中建立一种共识who为什么使用itil谁在使用itil世界范围内超过10000家的公司微软惠普ibm等国际厂商支持服务供应商ttnicitil桌面管理产品的架构融合桌面安全管理服务器组管理控制台客户端桌面系统企业防火墙internet公司内部网桌面配置管理桌面应用管理internet访问控制桌面管理知识更新知识库基于itil的流程化管理服务帮助ttnic基于itil桌面管理服务体系分派工单web方式提交工单系统告警面信息收集输出问题统计报表查看问题处理统计信息反馈处理过程和结果分派工单电话或web式提交问题web方式提交工单itil管理服务帮助台全程跟踪问题企业桌面系统使用者企业员工外包服务供应商技术支持中心企业部门管理员企业桌面管理功能实体事故管理问题管理配置管理变更管理ttnic基于itil部门能集中资源进行企业的业务支撑系统的信息化建设新型的桌面管理体系能给企业带来
企 业 IT 部 门 管 理员
反馈处理过 程和结果
事故管理 问题管理 配置管理 变更管理
企业IT桌面管理功能实体
TTNIC
基于ITIL的IT桌面管理体系的优势
新型的IT桌面管理体系能给企业带来：
彻底摈弃了手工的、逐台电脑维护的传统IT桌面管理服务方式 企业IT桌面管理效率的极大提升
IT部门能更高质量的完成IT桌面管理服务
ITIL知识培训讲义
目录
• ITIL概述与核心思想 • ITIL服务战略 • ITIL服务设计 • ITIL服务转换 • ITIL服务运营 • ITIL持续改进 • ITIL实施方法与案例分析
01
ITIL概述与核心思想
Chapter
ITIL起源与发展
ITIL起源
ITIL（Information Technology Infrastructure Library，信息技术基础架构库）起源于20世纪80 年代，由英国政府计算机与通信局（CCTA）开发 ，旨在提供一套全面、实用的IT服务管理最佳实践 。
请求管理
处理用户提出的IT服务请求，包括服务开通、变更、关闭等，确保服 务满足用户需求。
服务运营流程与工具
流程
包括事件管理、问题管理、请求管理、配置管理、变更管理等关键流程，确保服务运营 的高效和规范。
工具
采用专业的IT服务管理工具，如事件管理系统、问题管理系统、配置管理系统等，支持 服务运营流程的自动化和智能化。
服务转换目标与原则
01
服务转换原则
02
03
04
采用标准化的方法和流程进行 服务转换
强调变更、发布和配置管理的 规范性和一致性
注重团队协作和沟通，确保服 务转换过程的顺利进行
变更、发布与配置管理
变更管理 变更请求的受理、评估和批准流程
变更实施过程中的监控和控制
变更、发布与配置管理
变更后的验证和回顾 发布管理
服务目录与服务级别协违约赔偿等条款。
作用
确保服务提供商按照约定提供高质量服务，保护客户利益。
服务设计流程与工具
1. 确定服务需求
收集业务需求、技术需求和用户需求，明确服务目标。
ITIL培训介绍
ITIL培训介绍
ITIL的发展历程
v 20世纪80年代后期ITIL由英国计算机和电信中心CCTA（2001年4月 并入英国政府商务办公室OGC）提出，在英国开始应用。
v 20世纪90年代初期ITIL被引入欧洲其他国家，成为了事实上的欧洲 IT服务管理标准
v 20世纪90年代后期ITIL被引入美国、南非和澳大利亚等国。 v 2001年OGC开始更新ITIL，英国标准化协会BSI正式发布以ITIL为基
务商签订外包合同和运营级别协议(OLA)来确保按 服务级别协议规定的质量提供
➢ 签署服务级别协议(SLA)
➢ 监控提供的服务水平
➢ 提高服务质量
➢ 建立和维护服务目录
PPT文档演模板
ITIL培训介绍
v IT服务财务管理(Financial Management for IT Services)
n 目标——帮助IT部门在提供服务的同时加强成本效 益核算，以合理利用IT资源、提高效益。
n 主要任务
n 定义、规划及管理业务需求 n 提供用于服务的资源 n 监控资源的性能，如果必要，须进行调整 n 规划和实施提升能力计划 n 编制和维护能力计划
PPT文档演模板
ITIL培训介绍
v IT服务持续性管理(IT Service Continuity Management)
n 目标——在灾难发生的情况下，确保服务运营所需的 IT技术和服务实施能够在要求和约定的时间内恢复
n 主要任务
n 根据整个业务持续管理确定IT持续性计划的需求 与战略
n 确定IT服务的持续性计划 n 管理持续性过程(培训、测试、评审、变更管理和
持续提高过程) n 紧急情况下业务持续管理与恢复
PPT文档演模板理(Availability Management)
ITIL基础培训PPT课件
Aperture VISTA
/solutions/data_center_solutions.html
Aexis IT Service Management http://www.aexis.nl/
Artemis
/
/
eService, eAsset, eConfigurator /
Enterprise Service Desk (ESD) /
ExpertDesk*
http://www.mansystems.nl/
.
7
举例（2）
2001 年6 月，NASDAQ 宕机长达半天，原因 是操作人员做了一个未经测试的变更动作，结 果导致整个系统停机。同样也是在2001 年6 月，NYSE 在半夜做了一个软件变更的变更动 作，导致部份系统当机，无法完成股票买卖交 易。
.
8
举例（3）
B 公司的产品管理员C 君致电A 君，说系统出 了问题，请他去协助解决。A 君到现场花了半 天，终于找出原因了 ─ 是该服务器的另一位 管理员F君更改了一些设定，导致C 君所负责 的系统出了问题。C 君抱怨道：“每次改东西 都不先商量一下。真会被他害死！”
http://www.cyberlan.nl/produkten/Powerdesk.html
HelpDESK
/
.
4
几组数据
行业分析表明：
50％以上的IT预算放在了如何（更好）的运行上； 80％的IT意外故障时间由人员和流程造成的； 60％多的时间用于解决重复的“琐事”上。
微软调查发现*：
5倍重启次数 20倍的蓝屏错误
（*: 微软对5个不同站点的1,300个WinNT 4.0 SP3服务器和10个不同站点的 3,300个WinNT 4.0 SP4服务器进行宕机等错误调查，发现最差结果对最 好结果的比数。）
ITIL内部培训资料
ITIL服务战略实施与控制
服务流程
建立并优化IT服务流程， 确保服务的高效运作和客 户满意度的提高。
监控与评估
通过监控和评估IT服务的 性能和满意度，及时发现 问题并采取改进措施。
持续改进
根据监控和评估结果，持 续改进IT服务流程和技术 ，以适应业务变化和客户 需求。
事件管理：对突发事件、问题和变更请求进行识别、记录 、分类、优先级排序和响应处理。
事故管理：对重大事件进行快速响应和处理，恢复IT服务并防止再 次发生。
问题管理：识别和分析问题根本原因，采取措施消除或减少 潜在问题。
变更管理：对变更请求进行评估、批准和执行，确保变更对 组织内部用户的影响最小化。
配置管理：记录和跟踪IT基础架构中的所有物理和逻辑组 件，确保准确和一致的配置信息。
服务持续改进包括以 下关键步骤
实施改进：根据计划 实施改进措施，确保 改进活动的有效性和 高效性。
目标设定：明确改进 目标和期望结果，制 定可行的计划和时间 表。
ITIL服务持续改进
检查和评估
对改进活动进行跟踪、监控和评估，确保达到预期目标并收集反馈意见。
反馈和调整
根据检查结果和反馈意见进行总结分析，识别改进机会并制定新的改进计划， 持续改进IT服务。
03
04
增强IT业务价值；
降低IT风险；
05
06
提升企业竞争力。
02
ITIL服务战略
ITIL服务战略概述
ITIL服务战略是一种管理框架，旨在帮助组织有效地提供IT服务，以满足业务需求并 提高运营效率。
ITIL服务战略的核心是客户至上，强调与客户的沟通、协作和反馈，以实现服务质量 和客户满意度的提升。
51CTO下载-ITIL中级课程-风险管理71页资料之欧阳家百创编
Contents欧阳家百（2021.03.07）CHAPTER 1: INTRODUCTION1.1 Purpose of this guideThis guide is intended to help organisations to put in place effective frameworks for taking informed decisions about risk. The guidance provides a route map for , bringing together recommended approaches, checklists and pointers to more detailed sources of advice on tools and techniques. It expands on the Guidelines for Managing Risk.The process of investment appraisal, in which assessments are made of costs, and risks, is outside the scope of this guide. However, many of the principles and techniques described here can be used when developing the . The approach described in this guide complements ’s guidance on programme and management and is continually updated to reflect current thinking. This approach, branded by as (), is supported by training and qualifications.1.2 What is management of risk?In this guide risk is defined as uncertainty of outcome, whether positive or negative . The term ‘’ incorporates all the a ctivities required to identify and control the exposure to risk which may have an impact on the achievement of an organisation’s business objectives. Every organisation manages its risk, but not always in a way that is visible, repeatable and consistently applied to support decision making. The task of is to ensure that the organisation makes cost effective use of a that has a series of well defined steps. The aim is to support better decision making through a good understanding of risks and their likely impact.There are two distinct phases: and . Risk analysis is concerned with gathering information about exposure to risk so that the organisation can make appropriate decisions and manage risk appropriately.involves having processes in place to monitor risks, access to reliable and up to date information about risks, the right balance of control in place to deal with those risks, and decision making processes supported by a framework of and evaluation.covers a wide range of topics, including business continuity management, security, / management and operational servicemanagement. These topics need to be placed in the context of an organisational framework for the . Some risk-related topics, such as security, are highly specialised and this guidance provides only an overview of such aspects.1.3 Why management of risk is importantA certain amount of risk taking is inevitable if your organisation is to achieve its objectives. Effective helps you to improve performance by contributing to:•increased certainty and fewer surprises•better service delivery•more effective management of change•more efficient use of resources•better management at all levels through improved decision making•reduced waste and fraud, and better value for money•innovation•management of contingent and maintenance activities.See for examples of the of more effective .1.4 Who is involved in risk managementIn practice, everyone in an organisation is involved in risk management to some extent and should be aware of their responsibilities in identifying and managing risk. However, there are some aspects for which responsibility must be assigned to individuals. Without clear responsibility (and the authority to support that responsibility) some risks will be missed or overlooked.In the public sector, there are two major roles with a clear responsibility to ensure risks are managed (there will be equivalents to these roles in private sector organisations). These roles are:•an Accounting Officer (or equivalent senior manager), who is responsible for the organisation’s overall exposure to risk.Typically this person will be the Chief Executive Officer(CEO); the senior manager in the organisation. They maydelegate some of the actions but cannot forgo the responsibility • a senior m anager acting as a ‘owner’, who is responsible for risk relating to a specific or and for the realisation ofassociated business .Audience for this guidanceBusiness managers, process owners, strategic planners, and teams, business continuity planners and security teams are the primary audience for this guidance, together with their service providers.It will also be of interest to auditors, with their responsibility for ensuring effective .1.5 How to use this guideChapter 1 introduces the structure, process and culture of , explaining why organisations need to devise and implement effective strategies in order to maximise and minimise to the achievement of their business objectives. It identifies key personnel in the and the target audience for the guidance.outlines the key principles underpinning : establishing a framework, risk ownership, where risks occur, the decision making process, the importance of embedding the risk management culture, and allocating realistic budgets.describes the main activities of . It contains practical examples, pointers and checklists for identifying and responding to risk, and monitoring .–7 explain when and how should be applied throughout an organisation, at the strategic, , and operational levels.discusses the range of techniques available to support the process. The Annexes provide supporting detail:•: Examples of of•: Healthcheck: how well is your organisation managing risk?•: Categorising risk•: Setting a standard for evaluation of risk•: , contractual and legal considerations•:•: Managing organisational safety and security•: Information on further techniques to support•: Lessons learned from others•: Assessing the suitability of tools•: Documentation outlines.1.6 The research for this guidancePrepared by OGC's Directorate, this guidance has been developed from extensive research into current thinking and practice in both the public and private sectors, drawing on published papers and interviews/studies with a number of leading organisations involved in major change and with specialist experts in the . It builds on the recent work of the National Audit Office (), HM Treasury and Cabinet Office, together with OGC's published guidance on best practice in ; it also aims to address issues relating to .This guidance responds to lessons learned and the experiences of real-world practical issues, as reported by consultants in 's Strategic Assignments Consultancy Service and their clients. In addition, it incorporates feedback from contributors to workshops and other review channels. These contributions are acknowledged with thanks.CHAPTER 2: PRINCIPLESThis chapter outlines the key principles underpinning the effective .2.1 Critical success factors for management of riskThe key elements that need to be in place if is to be effective, and innovation encouraged, include:•clearly identified senior management to support, own and lead on• policies and the of effective management clearlycommunicated to all staff•existence and adoption of a framework for that is transparent and repeatable•existence of an organisational culture which supports well thought-through risk taking and innovation• fully embedded in management processes and consistently applied• closely linked to achievement of objectives•risks associated with working with other organisations explicitly assessed and managed•risks actively monitored and regularly reviewed on a constructive ‘no-blame’ basis.Joint working and partnerships often involve more complex types of risk that can adversely affect the delivery of business services. For example, if part of the service provided by one organisation is delayed or of poor quality, the success of the whole collaboration can be put at risk. You must make sure that your organisation knows about the approaches of your partners. Sharing information about risk management means that risks in collaborative can be identified and managed in a proactive way.Public sector concernsThe Modernising Government initiative seeks to encourage the public sector to adopt well managed risk taking where it is likely to lead to sustainable improvements in service delivery. More effective will improve the public sector’s ability to undertake the increasingly complex and cross-cutting that are demanded by the Modernisation agenda. Public sector organisations need to have in place the skills, management structures and organisational structures to takeadvantage of potential to perform better and to reduce the possibility of failure.The key areas that have to be addressed are:•the requirements of – including more focused and open ways of managing risk (see the section on below)•the need for a ‘’ at senior level, for an activity (strategy, or ).He or she is supported by at everyday working levels asappropriate for the activity and risk exposure•the need for improved reporting and upward referral of major problems• and the potential resolution approaches•the need for shared understanding of at all levels in the organisation and with partners, combined with consistenttreatment of risk•managing in the wider context of of change and the business.The study of (Supporting Innovation: Managing Risk in Government Departments), the Cabinet Office’s report Successful : Modernising Government in Action, and HM Treasury’s Orange Book provide valuable messages that are incorporated in this guidance.Meeting the needs of corporate governanceCorporate governance is the ongoing activity of maintaining a sound system of internal control to safeguard shareh olders’ investment and the company’s .The states that:‘a company’s objectives, its internal organisation and the environment which it operates in are continually evolving and as a result the risks it faces are continually changing. A sound system of control therefore depends on a thorough and regular evaluation of the nature and extent of the risks to which the company is exposed. Since profits [or business results] are in part the reward for successful risk taking in business, the purpose of internal control is to help manage and control risk rather than eliminate it.’frameworks must ensure that management is held accountable for a corporation’s performance and that owners are able to monitor and intervene in the operations of management.These principles apply equally to the public and private sectors. Whereas corporations focus mainly on shareholder returns and the preservation of shareholders’ value, the public sector’s role is to implement cost effectively in accordance with Government legislation and policies.The British Standards Institute () has produced a guidance note on Corporate Governance – PD 6668:2000– relating to the management of . It outlines a management framework for identifying the , determining the risks, implementation and maintaining control measures and finally reporting annually on the organisation’s commitment to this process.Policy on management of risk to support corporate governance To support , there needs to be a policy in place. This policy should:•be appropriate for the size and nature of your organisation, its business and operating environment•be clear about the roles (and, if possible, individuals) that are responsible for risk•be clear about escalation criteria in relation to (i.e., when to refer decision making upwards)•ensure that processes, and the culture/infrastructure, to identify and manage risk are put in place; these processes must berepeatable•set up the mechanism for monitoring the success of the application of the policy (including reports to management, atleast annually)•ensure that internal control mechanisms are in place for independent assessment that the policy is implemented (andchecked).2.2 What is at risk and why?There are many diverse factors that could place an organisation at risk. outlines the main reasons why there should be a robust process in place.Your organisation will have a set of key objectives. Risks should be identified against these objectives, ideally not more than 10-15 at high level. These high-level risks will then be considered and managed by senior management, increasing the organisation’s ability to meet its objectives. provides a ‘healthcheck’ to see if an organisation is adopting an effective framework for and risk management process.expands on possible categories of risk.Relating management of risk to safety, security and business continuityshould be carried out in the wider context of safety concerns, security and business continuity.•Health and safety policy and practice is concerned with ensuring that the workplace is a safe environment.•Security is concerned with protecting the organisation’s , including information, buildings and so on.•Business continuity is concerned with ensuring that the organisation could continue to operate in the event of a disaster,such as loss of a service, flood or fire damage.Figure 1: Reasons for a processReducing risk in large scale projectsExperience has shown that and attempting a large scale, comprehensive business change are less likely to be successful than those taking a less ambitious, step-by-step approach. Although the latter increases management activity, with each of the elements needing to be controlled and coordinated, the advantages are that activities are:•easier to manage•simpler to implement within the business environment•easier to accept formally as, typically, the specification is easier to document and thus simpler to verify that it has been met•able to offer more options for contingency•more likely to accommodate fast moving changes in technology, or in the political or financial environment•able to offer more decision points, allowing greater control of the .2.3 Decisions about riskDecisions about risk need to be balanced so that the potential are worth more to the organisation than it costs to address the risk.For example, innovation is inherently risky but could achieve major in improving services. The ability of the organisation to limit its exposure to risk will also be of relevance.You should aim to make an accurate assessment of the risks in a given situation and analyse the potential . The risks and presented by each course of action should be defined in order to identify appropriate response.Scope of decisionsDecisions about risk will vary depending on whether the risk relatesto long, medium or short-term goals.Strategic decisions are primarily concerned with long-term goals; these set the context for decisions at other levels of the organisation. The risks associated with strategic decisions may not become apparent until well into the future. Thus it is essential to review these decisions, and associated risks, on a regular basis.Medium-term goals are usually addressed through and to bring about business change. Decisions relating to medium-term goals are narrower in scope than strategic ones, particularly in terms of timeframe and financial responsibilities.At the operational level the emphasis is on short-term goals to ensure ongoing continuity of business services; however, decisions aboutrisk at this level must also support the achievement of long- and medium-term goals. These organisational levels are discussed in more detail in Chapters , , and .There are also considerations about what can realistically be achieved in one change initiative. Delivery of each of the of a change initiative (whether a , or stage) must provide some direct benefit to the organisation as a result of its delivery. This could be by delivering:• a major to support/build towards the intended outcome – forexample, providing a telephone helpline first as part of a newinformation service and then adding website services to expand the facilities available to the public•the to part of the end user community and then ‘rolling out’ to the rest of that community – for example, introducing a newinformation service in the North-East and gradually making itavailable nationwide.This is a modular and/or incremental approach that is further discussed in Chapters and and in .When managing any it is essential to ensure major decisions are made appropriately. A will support some business change and so require something to be produced and then put into use.shows the main stages of the process and the decisions to be taken about breaking projects down into manageable ‘packages’. For major projects, there will be formal in addition to the normal decision points; these reviews establish whether the is ready to proceed to the next stage.Figure 2: Main stages of the process2.4 Where risks occurThe process should be most rigorously applied where critical decisions are being made.shows where risk can occur in an organisation. For convenience, these levels are described as:•strategic or corporate•operational.In practice, the levels overlap; however, it is helpful to clarify the occurrence of risks at these levels to inform the kind of decisions you are likely to make.Figure 3: Organisational management hierarchyIt is important to note that a risk may materialise initially at one level but subsequently have a major impact at a different level. A recent example is a High Street bank facing technical faults at the operational level; ultimately customers’ confidence in the bank’s online service became a . This highlights the need for relevant information about risks to be shared throughout the organisation.shows examples of typical risks occurring at each organisational level.Table 1: related to organisational levelsLevel Examples of typical risks considered at this levelStrategic/corporate Commercial, financial, political, environmental, directional, cultural, acquisition and quality risks. There is a focus on business survival, continuityand growth for the future.When , and exceed set criteria –e.g. notacceptable, outside agreed limits, could affect strategic objectives,information needs to be escalated to this level so that appropriate decisionscan be taken./acquisition, funding, organisational, , security, safety, quality and businesscontinuity risks.When and exceed set criteria – e.g. not acceptable, outsideagreed limits, could affect objectives, information needs to be escalated tothis level so that appropriate decisions can be taken.Personal, technical, cost, schedule, resource, operational support, qualityand provider failure.Operational issues/risks should be considered at thislevel as they affect the and how it needs to be run. Information on strategicand related risks should be communicated to this level where they couldaffect objectives. Project managers should communicate information onrisks to other projects and operations as appropriate.Operations Personal, technical, cost, schedule, resource, operational support, quality, provider failure, environmental and infrastructure failure.All the higher levelshave input to this level; specific concerns include /, support for businessprocesses and customer relations.Additional factorsAdditional factors may increase the complexity of assessing overall exposure to risk. These include:•interdependencies, or links between and/or related issues, where the impact of one or more risks could affect others,possibly creating a ‘domino’ effect. You should ensure that any known interdependencies are identified and assessed so thatappropriate action can be planned•the relationship between business and risks to delivery, where achievement of is dependent on successful delivery of a . Youshould continually check whether changing plans affect theachievement of .2.5 A framework for managing riskA framework for sets the context in which risks will be identified, analysed, controlled, monitored and reviewed. It must be consistent with processes that are embedded in everyday management and operational practices. It addresses:•how risks are identified•how information about their probability and potential impact is obtained•how risks are quantified•how options to deal with them are identified•how decisions on are made, such as further risk reduction•how these decisions are implemented•how actions are evaluated for their effectiveness•how appropriate communication mechanisms are set up and supported•how are engaged throughout the process.(See for more information about the and supporting processes.)2.6 Risk ownershipFor the organisation, ownership of the framework lies with the Accounting Officer (or equivalent senior manager at Board level). Individual senior managers own the or and are responsible for the management of the overall risk of that activity. However, these roles do not own all the individual risks. Risk ownership must be clearly defined, documented and agreed with the individual owners at all levels, so that they understand their various roles, responsibilities andultimate accountability with regard to the . The owner of a risk may not be the person tasked with the assessment or management of the risk, but he or she is responsible for ensuring the process is applied –there may be separate owners to actually deal with the risks.It is important to identify who owns:•the setting policy and the organisation’s willingness to take risk •the process at the different levels – that is, strategic, , , operational levels•different elements of the process, such as identifying , through to producing and reporting on decisions•implementation of the actual measures taken in response to the risks•interdependent risks that cross organisational boundaries, whether they are business processes, operational services or .For example, for a senior manager with responsibility for a , ownership of risk could be defined as follows:Senior managers responsible for projects must assure themselves that a number of types of risk are being tracked and dealt with as effectively as possible. The mechanisms in place for monitoring and reporting risk will vary according to the size and complexity of the or , ranging from the use of a simple to the appointment of a risk manager reporting directly to the senior manager. Clearly, the degree of delegation adopted by the senior manager will vary, but he or she must be sure that the critical issues are being addressed; for example, through chairing the board or by developing strong mechanisms for reporting problems.Checklist: ownership of risk and the process•Have owners been allocated for all the various parts of the complete process?•Are the various roles and responsibilities associated with ownership well defined?•Do the individuals who have been allocated ownership actually have the authority and capability to fulfil their responsibilities?For example, suppliers may be tasked with risk ownership.•Have the various roles and responsibilities been communicated and understood?•Are the nominated owners appropriate and aware of their nomination?•Is ownership reassessed on a periodic basis, or in the event of a change in the situation; and if necessary, can it be quickly andeffectively reallocated?•Do all risks, and where appropriate their mitigation actions, have clearly identified owners? Are these owners appropriate?2.7 Embedding the risk management cultureIdentifying appropriate policies, standards and practices is the first stage of creating a risk management culture. Once these are in place they need to be totally embedded in individuals through the enactment of their roles and associated responsibilities.Awareness of and responsibility for risk issues must be linked explicitly to key objectives, in order to build a sustainable culture. There should be delegated responsibility for risks at every level of objectives in the organisation. This is the major support to embedding risk management into the organisation and its culture, with seen as an intrinsic part of the way an organisation works. As the people in an organisation change, it is essential to ensure a continuing understanding of roles and responsibilities related to managing risk. The risk environm ent is constantly changing too. Your organisation’s priorities and the relative importance of risks will shift and change. Assumptions about risk have to be regularly revisited and reconsidered, perhaps by annual review of the risks associated with each of the key organisational objectives.Establishing appropriate competencies and behavioursAn important aspect of setting up a risk culture is to ensure it is relevant to the organisation. is a major facet of effective .Those responsible for need to have knowledge and understanding of:•strategic planning•legal requirements•agreements and contracts•communication techniques and information management•staff matters, including how staff can be motivated and involved•education and continual professional development•continuous improvement and/or analytical techniques•how the organisation is monitored and evaluated•resource management, including equal opportunities and delegation.Although managers tend to work in specific areas of the organisation, either based on technical specialism or business function, they all need to identify and manage risk. To do this they need to be able to:•ensure that the situation is properly scoped•identify and assess the risk•create valid options for reducing risk to an acceptable level•collect appropriate and meaningful information to assess risk and the options, and then to monitor the risk•use sound reasoning when making a trade-off between the costs and of managing a risk•make a clear commitment to a particular course of action.For planning, the major areas to consider are:•deciding on the likelihood of a specific event occurring•prioritising areas to address/actions to instigate. This requires understanding the implications of the options available•assigning ownership of risks and actions, containment or contingent, to be deployed in a timely manner•ensuring that continuity plans can cope with the current and potential future situation, not with how things were in therecent past.Visible information on riskInformation on risk and its management needs to reach the people who have to take action or make decisions. This information will flow downwards and upwards between the organisational levels. There will also be sideways flows across each level, between or . The vertical flows are the most important as they reflect levels of responsibility for decision making.For example, a decision may be made at the strategic level that affects the progress of current . Conversely, the collective risks relating to the progress of current may have a strategic impact.These examples illustrate why risks should be identified and handled at each level before they are passed up or down to the next level. Good communication mechanisms are essential to avoid the following problems:•inadequate communication from lower levels, where people have ‘hands on’ knowledge, to the level where decisions aremade, leads to unrealistic expectations from senior management•inadequate communication from the top down can mean that are no longer supporting the business direction.CommunicationsTo address these problems you will need to ensure that appropriate communication mechanisms exist and are adopted. Your organisation should:•ensure there is sufficient communication to key , whether internal or external, to support their needs•ensure that people are aware, informed and understand their part in managing risk•consider whether there is a need to improve internalcommunications•consider training needs and how these can be met adequately •ensure people have the right information at the right time to fulfil their responsibilities (and how to recognise if this does not happen).。
ITIL基础培训课件(ppt 63页)
Ø 可用性的真实级别vs 达成协议的级别
Ø 说明存在的不足 Ø 提交计划宕机事件的日程安排
可用性规划
29
可用性管理中所涉及的故障类型
预定的 预先传达并公开 (通常每年一次) 用来执行定期任务 (常规事务, 操作系统升级, 服务器重启 等) 预先与业务部门协商 在指定的时间发生，一个月一次。 在故障发生前48小时提醒最终用户，发生前1小时再提醒一次。 计划内的 对于解决难题/ 实施变更这些额外故障要在下一个预期故障前解决。 要在故障发生前48小时与业务部门及时协商 (在可能发生的地方) 在故障发生前48小时通知最终用户，发生前1小时再通知一次。 计划外的 计划外的停机是指那些由于难题而导致的停机(例如，系统宕机 )。 他们是计划外的，因此通常不能预先警告最终用户。 有时候能预测系统什么时候会崩溃，例如，空调发生故障时，一旦温度高于极限值就需要
13
成本管理－IT服务财务管理
业务
管理层 客户 用户
15
数据中心管理
策略
业务策略 人力资源 IT 策略
体系结构
财务
客户管理 客户关系管理
开发 编码/测试 设计
服务规划 可用性管理
安全管理
服务水平管理
财务管理 容量管理
突In发cid事en件t 管理 Management
RFC Pr问ob题le管m理 Management
开发 编码/测试 设计
服务规划 可用性管理
安全管理
服务水平管理
财务管理 容量管理
突In发cid事en件t 管理 Management
RFC Pr问ob题le管m理 Management
C变ha更ng管e 理 RFC Management
ITIL培训教程(全套课件232P)
营方面的实践和经验。
案例分析
深入分析该案例的成功因素和实施 过程，提炼出可供借鉴的方法和策 略。
案例启示
结合案例分析结果，探讨高效IT组 织的服务转换和运营实践对其他组 织的启示和借鉴意义。
04
持续服务改进与评估
Chapter
CSI模型介绍及实施步骤
ITIL框架结构及组件关系
ITIL的框架结构
包括服务战略、服务设计、服务转换、服务运营和持续改进五个核心组件。
ITIL组件关系
五个核心组件相互关联，共同构成了一个完整的IT服务管理体系。其中，服务 战略是顶层设计，服务设计、服务转换和服务运营是实施层面，持续改进则贯 穿整个体系。
为什么需要学习和实施ITIL
服务目录管理与需求分析
01
02
03
服务目录管理
建立和维护服务目录，确 保所有服务都得到有效管 理和控制，提高服务质量 和效率。
需求分析
通过市场调研、客户反馈 等方式收集和分析客户需 求信息，为服务设计提供 输入。
服务级别协议
与客户签订服务级别协议， 明确双方的权利和义务， 确保服务质量和客户满意 度。
案例选择与背景介绍
选择具有代表性的优秀企业作为案例，简要介绍其背景和业务情况。
CSI实施过程与成果展示
详细描述该企业如何运用CSI模型进行持续改进，包括目标设定、计划制定、措施实施、效果 评估等环节，并展示其取得的显著成果。
经验总结与启示
总结该企业在CSI实践中的成功经验，提炼出对其他企业具有借鉴意义的启示和建议。
强化沟通与协作
定期召开跨部门沟通会议，分享经验、 解决问题，促进各部门之间的紧密合 作。
2024版年度ITIL培训介绍PPT大纲
2024/2/2
25
学员互动交流渠道
线上学习社区
我们为学员提供了一个线上学习社区，学员可以在这里与其他学员进行互动交流， 分享学习心得和经验。
定期举办线下交流活动
我们还会定期举办线下交流活动，为学员提供一个面对面交流的机会，加深学员之 间的友谊和合作。
2024/2/2
26
课后辅导及答疑安排
2024/2/2
2024/2/2
ITIL作为ITSM领域的最佳实践指南，为企业或组织提供了一种标准化的IT服务管理 方法。
5
ITIL框架体系结构
ITIL框架包括五个核心组件： 服务战略、服务设计、服务转 换、服务运营和持续服务改进。
2024/2/2
每个组件都包含一系列流程、 职能和最佳实践，共同构成了 ITIL的完整体系。
3
ITIL定义及发展历程
ITIL（Information Technology Infrastructure Library）即信息技术基 础架构库，是一套被广泛认可的用于IT服务管理的最佳实践指南。
ITIL起源于20世纪80年代末，由英国政府商务部（OGC）开发，旨在提 高IT服务质量、降低成本和风险。
ITIL框架还强调了IT与业务之间 的紧密关系，以及IT在支持业 务发展方面的重要作用。
6
培训目标与课程安排
培训目标
使学员全面了解ITIL的基本概念、原 理和实践方法，掌握ITIL框架下的各 个流程和职能，提高学员在IT服务管 理领域的专业素养和实践能力。
课程安排
包括ITIL基础概念、ITIL框架介绍、各个 组件详解、案例分析与实践等模块，采 用理论讲解、案例分析、小组讨论等多 种教学方式。
学员B
ITIL培训内容
1.什么是ITILITIL: Information Technology Infrastructure Library 信息技术基础设施库的简称。
ITIL为企业的IT服务管理（ITSM）实践提供了一个客观、严谨、可量化的标准和规范。
实施ITIL的最大意义在于把IT与业务紧密地结合起来了，从而让企业的IT投资回报最大化。
ITIL为企业的IT服务管理实践提供了一个客观、严谨、可量化的标准和规范，企业的IT部门和最终用户可以根据自己的能力和需求定义自己所要求的不同服务水平，参考ITIL来规划和制定其IT基础架构及服务管理，从而确保IT服务管理能为企业的业务运作提供更好的支持。
对企业来说，实施ITIL的最大意义在于把IT与业务紧密地结合起来了，从而让企业的IT投资回报最大化。
目前，ITIL已经在全球IT服务管理领域得到了广泛的认同和支持，四家最领先的IT管理解决方案提供商都宣布了相应的策略：IBM Tivoli推出了“业务影响管理”解决方案、HP公司倡导“IT服务管理”、CA公司强调“管理按需计算环境”、BMC公司则推出了“业务服务管理”理念。
实际上，无论各公司的理念和解决方案有多大差异，但目标都是一致的：把IT 与业务相结合，以业务为核心搭建和管理IT系统。
2.实施ITIL的益处a)对于企业实施ITIL，可以有助于最终进行完善的服务管理。
在ITIL的各个流程管理中，可以直接与各个业务部门相互作用，实现对业务功能及流程进行重新设计，降低成本、缩短周转时间、提高质量和增进客户满意度。
b)ITIL的实施，使信息系统部门能够对发生在财务、销售、市场、制造等业务上的流程改变，做出及时反应。
某些情况下，这还导致了一些相关组织机构的诞生，如变更委员会、紧急变更委员，内部的业务经理等，以增进业务与IT的整合。
c)实施ITIL，可以实现IT对业务支持的精确性和前瞻性。
市场竞争的加剧要求企业能够快速做出决策，并缩短反应时间。
51CTO下载-ITIL中级课程-风险管理71页资料
Contents•CHAPTER 1: INTRODUCTION•CHAPTER 2: PRINCIPLES•CHAPTER 3: HOW RISKS ARE MANAGED•CHAPTER 4: MANAGING RISK AT THE STRATEGIC LEVEL•CHAPTER 5: MANAGING RISK AT THE PROGRAMME LEVEL•CHAPTER 6: MANAGING RISKS AT THE PROJECT LEVEL•CHAPTER 7: MANAGING RISK AT THE OPERATIONAL LEVEL•CHAPTER 8: TECHNIQUES•ANNEX A: EXAMPLES OF BENEFITS OF RISK MANAGEMENT•ANNEX B: HEALTHCHECK: HOW WELL IS YOUR ORGANISATION MANAGING RISK?•ANNEX C: CATEGORISING RISK•ANNEX D: SETTING A STANDARD FOR EVALUATION OF RISK•ANNEX E: PROCUREMENT, CONTRACTUAL AND LEGAL CONSIDERATIONS •ANNEX F: BUSINESS CONTINUITY MANAGEMENT•ANNEX G: MANAGING ORGANISATIONAL SAFETY AND SECURITY •ANNEX H: INFORMATION ON FURTHER TECHNIQUES TO SUPPORT MANAGEMENT OF RISK•ANNEX J: LESSONS LEARNED FROM OTHERS•ANNEX K: ASSESSING THE SUITABILITY OF TOOLS•ANNEX L: DOCUMENTATION OUTLINESCHAPTER 1: INTRODUCTION 1.1 Purpose of this guide1.2 What is management of risk?1.3 Why management of risk is important1.4 Who is involved in risk management1.5 How to use this guide1.6 The research for this guidance1.1 Purpose of this guideThis guide is intended to help organisations to put in place effective frameworks for taking informed decisions about risk. The guidance provides a route map for risk management, bringing together recommended approaches, checklists and pointers to more detailed sources of advice on tools and techniques. It expands on the OGC Guidelines for Managing Risk.The process of investment appraisal, in which assessments are made of costs, benefits and risks, is outside the scope of this guide. However, many of the principles and techniques described here can be used when developing the business case. The approach described in this guide complements OGC’s guidance on programme and project management and is continually updated to reflect current thinking. This approach, branded by OGC as M_o_R (Management of Risk), is supported by training and qualifications.1.2 What is management of risk?In this guide risk is defined as uncertainty of outcome, whether positive opportunity or negative threat. The term ‘management of risk’ incorporates all the activities required to identify and control the exposure to risk which may have an impact on the achievement of an organisation’s business objectives.Every organisation manages its risk, but not always in a way that is visible, repeatable and consistently applied to support decision making. The task of management of risk is to ensure that the organisation makes cost effective use of a risk process that has a series of well defined steps. The aim is to support better decision making through a good understanding of risks and their likely impact.There are two distinct phases: risk analysis and risk management. Risk analysis is concerned with gathering information about exposure to risk so that the organisation can make appropriate decisions and manage risk appropriately.Management of risk involves having processes in place to monitor risks, access to reliable and up to date information about risks, the right balance of control in place to deal with those risks, and decision making processes supported by a framework of risk analysis and evaluation.Management of risk covers a wide range of topics, including business continuity management, security, programme/project risk management and operational service management. These topics need to be placed in the context of an organisational framework for the management of risk. Some risk-related topics, such as security, are highly specialised and this guidance provides only an overview of such aspects.1.3 Why management of risk is importantA certain amount of risk taking is inevitable if your organisation is to achieve its objectives. Effective management of risk helps you to improve performance by contributing to:•increased certainty and fewer surprises•better service delivery•more effective management of change•more efficient use of resources•better management at all levels through improved decision making•reduced waste and fraud, and better value for money•innovation•management of contingent and maintenance activities.See Annex A for examples of the benefits of more effective management of risk.1.4 Who is involved in risk managementIn practice, everyone in an organisation is involved in risk management to some extent and should be aware of their responsibilities in identifying and managing risk. However, there are some aspects for which responsibility must be assigned to individuals. Without clear responsibility (and the authority to support that responsibility) some risks will be missed or overlooked.In the public sector, there are two major roles with a clear responsibility to ensure risks are managed (there will be equivalents to these roles in private sector organisations). These roles are:•an Accounting Officer (or equivalent senior manager), who is responsible for the organisation’s overall exposure to risk. Typically this person will be the Chief ExecutiveOfficer (CEO); the senior manager in the organisation. They may delegate some of theactions but cannot forgo the responsibility• a senior manager acting as a project ‘owner’, who is responsible for risk relating to a specific programme or project and for the realisation of associated business benefits.Audience for this guidanceBusiness managers, process owners, strategic planners, project and procurement teams, business continuity planners and security teams are the primary audience for this guidance, together with their service providers.It will also be of interest to auditors, with their responsibility for ensuring effective corporate governance.1.5 How to use this guideChapter 1 introduces the structure, process and culture of management of risk, explaining why organisations need to devise and implement effective strategies in order to maximise opportunities and minimise threats to the achievement of their business objectives. It identifies key personnel in the management of risk and the target audience for the guidance.Chapter 2 outlines the key principles underpinning management of risk: establishing a risk management framework, risk ownership, where risks occur, the decision making process, the importance of embedding the risk management culture, and allocating realistic budgets.Chapter 3 describes the main activities of management of risk. It contains practical examples, pointers and checklists for identifying and responding to risk, and monitoring risk responses.Chapters 4–7 explain when and how management of risk should be applied throughout an organisation, at the strategic, programme, project and operational levels.Chapter 8 discusses the range of techniques available to support the risk management process. The Annexes provide supporting detail:•A: Examples of benefits of risk management•B: Healthcheck: how well is your organisation managing risk?•C: Categorising risk•D: Setting a standard for evaluation of risk•E: Procurement, contractual and legal considerations•F: Business continuity management•G: Managing organisational safety and security•H: Information on further techniques to support management of risk•J: Lessons learned from others•K: Assessing the suitability of tools•L: Documentation outlines.1.6 The research for this guidancePrepared by OGC's IT Directorate, this guidance has been developed from extensive research into current thinking and practice in both the public and private sectors, drawing on published papersand interviews/studies with a number of leading organisations involved in major change and with specialist experts in the management of risk. It builds on the recent work of the National Audit Office (NAO), HM Treasury and Cabinet Office, together with OGC's published guidance on best practice in risk management; it also aims to address issues relating to corporate governance.This guidance responds to lessons learned and the experiences of real-world practical issues, as reported by consultants in OGC's Strategic Assignments Consultancy Service and their clients. In addition, it incorporates feedback from contributors to OGC workshops and other review channels. These contributions are acknowledged with thanks.CHAPTER 2: PRINCIPLES2.1 Critical success factors for management of risk2.2 What is at risk and why?2.3 Decisions about risk2.4 Where risks occur2.5 A framework for managing risk2.6 Risk ownership2.7 Embedding the risk management culture2.8 BudgetsThis chapter outlines the key principles underpinning the effective management of risk.2.1 Critical success factors for management of riskThe key elements that need to be in place if risk management is to be effective, and innovation encouraged, include:•clearly identified senior management to support, own and lead on risk management•risk management policies and the benefits of effective management clearly communicated to all staff•existence and adoption of a framework for management of risk that is transparent and repeatable•existence of an organisational culture which supports well thought-through risk taking and innovation•management of risk fully embedded in management processes and consistently applied •management of risk closely linked to achievement of objectives•risks associated with working with other organisations explicitly assessed and managed •risks actively monitor ed and regularly reviewed on a constructive ‘no-blame’ basis.Joint working and partnerships often involve more complex types of risk that can adversely affect the delivery of business services. For example, if part of the service provided by one organisation is delayed or of poor quality, the success of the whole collaboration can be put at risk. You must make sure that your organisation knows about the risk management approaches of your partners. Sharing information about risk management means that risks in collaborative programmes can be identified and managed in a proactive way.Public sector concernsThe Modernising Government initiative seeks to encourage the public sector to adopt well managed risk taking where it is likely to lead to sustainable improvements in service delivery. More effective risk management will improve the public sector’s ability to undertake the increasingly complex and cross-cutting projects that are demanded by the Modernisation agenda. Public sector organisations need to have in place the skills, management structures and organisational structures to take advantage of potential opportunities to perform better and to reduce the possibility of failure.The key areas that have to be addressed are:•the requirements of corporate governance – including more focused and open ways of managing risk (see the section on corporate governance below)•the need for a ‘risk owner’ at senior level, for an activity (strategy, programme or project).He or she is supported by risk owners at everyday working levels as appropriate for theactivity and risk exposure•the need for improved reporting and upward referral of major problems•opportunities and the potential resolution approaches•the need for shared understanding of risk management at all levels in the organisation and with partners, combined with consistent treatment of risk•managing project risk in the wider context of programmes of change and the business.The NAO study of risk management (Supporting Innovation: Managing Risk in Government Departments), the Cabinet Office’s report Successful IT : Modernising Government in Action, and HM Treasury’s Orange Book provide valuable messages that are incorporated in this guidance.Meeting the needs of corporate governanceCorporate governance is the ongoing activity of maintaining a sound system of internal control to safeguard shareholders’ investment and the company’s assets.The Turnbull Report states that:‘a company’s objectives, its internal organisation and the environment which it operate s in are continually evolving and as a result the risks it faces are continually changing. A sound system of control therefore depends on a thorough and regular evaluation of the nature and extent of the risks to which the company is exposed. Since profits [or business results] are in part the reward for successful risk taking in business, the purpose of internal control is to help manage and control risk rather than eliminate it.’Corporate governance frameworks must ensure that management is held accountable for a corporation’s performance and that owners are able to monitor and intervene in the operations of management.These principles apply equally to the public and private sectors. Whereas corporations focus mainly on shareholder returns and the prese rvation of shareholders’ value, the public sector’s role is to implement programmes cost effectively in accordance with Government legislation and policies.The British Standards Institute (BSI) has produced a guidance note on Corporate Governance – PD 6668:2000– relating to the management of strategic risks. It outlines a management framework for identifying the threats, determining the risks, implementation and maintaining control measures and finally reporting annually on the organisation’s commitment t o this process.Policy on management of risk to support corporate governanceTo support corporate governance, there needs to be a risk management policy in place. This policy should:•be appropriate for the size and nature of your organisation, its business and operating environment•be clear about the roles (and, if possible, individuals) that are responsible for risk•be clear about escalation criteria in relation to risk management (i.e., when to refer decision making upwards)•ensure that processes, and the culture/infrastructure, to identify and manage risk are put in place; these processes must be repeatable•set up the mechanism for monitoring the success of the application of the policy (including reports to management, at least annually)•ensure that internal control mechanisms are in place for independent assessment that the policy is implemented (and checked).2.2 What is at risk and why?There are many diverse factors that could place an organisation at risk. Figure 1 outlines the main reasons why there should be a robust risk management process in place.Your organisation will have a set of key objectives. Risks should be identified against these objectives, ideally not more than 10-15 at high level. These high-level risks will then be considered and managed by senior management, increasing the organisation’s ability to meet its objectives. Annex B provides a ‘healthcheck’ to see if an organisation is adopting an effective framework for management of risk and risk management process.Annex C expands on possible categories of risk.Relating management of risk to safety, security and businesscontinuityManagement of risk should be carried out in the wider context of safety concerns, security and business continuity.•Health and safety policy and practice is concerned with ensuring that the workplace is a safe environment.•Security is concerned with protecting the organisation’s assets, including information, buildings and so on.•Business continuity is concerned with ensuring that the organisation could continue to operate in the event of a disaster, such as loss of a service, flood or fire damage.Figure 1: Reasons for a risk management processReducing risk in large scale projectsExperience has shown that programmes and projects attempting a large scale, comprehensive business change are less likely to be successful than those taking a less ambitious, step-by-step approach. Although the latter increases management activity, with each of the elements needing to be controlled and coordinated, the advantages are that activities are:•easier to manage•simpler to implement within the business environment•easier to accept formally as, typically, the specification is easier to document and thus simpler to verify that it has been met•able to offer more options for contingency•more likely to accommodate fast moving changes in technology, or in the political or financial environment•able to offer more decision points, allowing greater control of the project.2.3 Decisions about riskDecisions about risk need to be balanced so that the potential benefits are worth more to the organisation than it costs to address the risk.For example, innovation is inherently risky but could achieve major benefits in improving services. The ability of the organisation to limit its exposure to risk will also be of relevance.You should aim to make an accurate assessment of the risks in a given situation and analyse the potential benefits. The risks and opportunities presented by each course of action should be defined in order to identify appropriate response.Scope of decisionsDecisions about risk will vary depending on whether the risk relates to long, medium or short-term goals.Strategic decisions are primarily concerned with long-term goals; these set the context for decisions at other levels of the organisation. The risks associated with strategic decisions may not become apparent until well into the future. Thus it is essential to review these decisions, and associated risks, on a regular basis.Medium-term goals are usually addressed through programmes and projects to bring about business change. Decisions relating to medium-term goals are narrower in scope than strategic ones, particularly in terms of timeframe and financial responsibilities.At the operational level the emphasis is on short-term goals to ensure ongoing continuity of business services; however, decisions about risk at this level must also support the achievement of long- and medium-term goals. These organisational levels are discussed in more detail in Chapters 4, 5, 6 and 7.There are also considerations about what can realistically be achieved in one change initiative. Delivery of each of the components of a change initiative (whether a programme, project or stage) must provide some direct benefit to the organisation as a result of its delivery. This could be by delivering:• a major component to support/build towards the intended outcome – for example, providing a telephone helpline first as part of a new information service and then addingwebsite services to expand the facilities available to the public•the product to part of the end user community and then ‘rolling out’ to the rest of that community – for example, introducing a new information service in the North-East andgradually making it available nationwide.This is a modular and/or incremental approach that is further discussed in Chapters 5 and 6 and in Annex E.When managing any project it is essential to ensure major decisions are made appropriately. A project will support some business change and so require something to be produced and then put into use.Figure 2 shows the main stages of the procurement process and the decisions to be taken about breaking projects down into manageable ‘packages’. For major projects, there will be formal Gateway Reviews in addition to the normal project decision points; these reviews establish whether the project is ready to proceed to the next stage.Figure 2: Main stages of the procurement process2.4 Where risks occurThe risk management process should be most rigorously applied where critical decisions are being made.Figure 3 shows where risk can occur in an organisation. For convenience, these levels are described as:•strategic or corporate•programme•project•operational.In practice, the levels overlap; however, it is helpful to clarify the occurrence of risks at these levels to inform the kind of decisions you are likely to make.Figure 3: Organisational management hierarchyIt is important to note that a risk may materialise initially at one level but subsequently have a major impact at a different level. A recent example is a High Street bank facing technical faults at the operational level; ultimately customers’ confidence in the bank’s online service became a strategic risk. This highlights the need for relevant information about risks to be shared throughout the organisation.Table 1 shows examples of typical risks occurring at each organisational level.Table 1: Risk related to organisational levelsLevel Examples of typical risks considered at this levelStrategic/corporate Commercial, financial, political, environmental, directional, cultural, acquisition and quality risks. There is a focus on business survival, continuity and growthfor the future.When programme, project and operational risks exceed setcriteria –e.g. not acceptable, outside agreed limits, could affect strategicobjectives, information needs to be escalated to this level so that appropriatedecisions can be taken.Programme Procurement/acquisition, funding, organisational, projects, security, safety, quality and business continuity risks.When project and operational risks exceedset criteria – e.g. not acceptable, outside agreed limits, could affect programmeobjectives, information needs to be escalated to this level so that appropriatedecisions can be taken.Project Personal, technical, cost, schedule, resource, operational support, quality and provider failure.Operational issues/risks should be considered at this level asthey affect the project and how it needs to be run. Information on strategic andprogramme related risks should be communicated to this level where they couldaffect project objectives. Project managers should communicate information onrisks to other projects and operations as appropriate.Operations Personal, technical, cost, schedule, resource, operational support, quality, provider failure, environmental and infrastructure failure.All the higher levelshave input to this level; specific concerns include business continuitymanagement/contingency planning, support for business processes andcustomer relations.Additional factorsAdditional factors may increase the complexity of assessing overall exposure to risk. These include:•interdependencies, or links between projects and/or related issues, where the impact of one or more risks could affect others, possibly creating a ‘domino’ effect. You should ensure that any known interdependencies are identified and assessed so that appropriate actioncan be planned•the relationship between business benefits and risks to delivery, where achievement of benefits is dependent on successful delivery of a project. You should continually checkwhether changing plans affect the achievement of benefits.2.5 A framework for managing riskA framework for management of risk sets the context in which risks will be identified, analysed, controlled, monitored and reviewed. It must be consistent with processes that are embedded in everyday management and operational practices. It addresses:•how risks are identified•how information about their probability and potential impact is obtained•how risks are quantified•how options to deal with them are identified•how decisions on risk management are made, such as further risk reduction•how these decisions are implemented•how actions are evaluated for their effectiveness•how appropriate communication mechanisms are set up and supported•how stakeholders are engaged throughout the process.(See Chapter 3 for more information about the management of risk framework and supporting processes.)2.6 Risk ownershipFor the organisation, ownership of the risk management framework lies with the Accounting Officer (or equivalent senior manager at Board level). Individual senior managers own the programme or project and are responsible for the management of the overall risk of that activity. However, these roles do not own all the individual risks. Risk ownership must be clearly defined, documented and agreed with the individual owners at all levels, so that they understand their various roles, responsibilities and ultimate accountability with regard to the management of risk. The owner of a risk may not be the person tasked with the assessment or management of the risk, but he or she is responsible for ensuring the management of risk process is applied – there may be separate owners to actually deal with the risks.It is important to identify who owns:•the setting policy and the organisation’s willingness to take risk•the management of risk process at the different levels – that is, strategic, programme, project, operational levels•different elements of the management of risk process, such as identifying threats, through to producing risk responses and reporting on decisions•implementation of the actual measures taken in response to the risks•interdependent risks that cross organisational boundaries, whether they are business processes, operational services or projects.For example, for a senior manager with responsibility for a project, ownership of risk could be defined as follows:Senior managers responsible for projects must assure themselves that a number of types of risk are being tracked and dealt with as effectively as possible. The mechanisms in place for monitoring and reporting risk will vary according to the size and complexity of the project or programme, ranging from the use of a simple risk register to the appointment of a risk manager reporting directly to the senior manager. Clearly, the degree of delegation adopted by the senior manager will vary, but he or she must be sure that the critical issues are being addressed; for example, through chairing the project board or by developing strong mechanisms for reporting problems.Checklist: ownership of risk and the process•Have owners been allocated for all the various parts of the complete management of risk process?•Are the various roles and responsibilities associated with ownership well defined?•Do the individuals who have been allocated ownership actually have the authority and capability to fulfil their responsibilities? For example, suppliers may be tasked with riskownership.•Have the various roles and responsibilities been communicated and understood?•Are the nominated owners appropriate and aware of their nomination?•Is ownership reassessed on a periodic basis, or in the event of a change in the situation;and if necessary, can it be quickly and effectively reallocated?•Do all risks, and where appropriate their mitigation actions, have clearly identified owners?Are these owners appropriate?2.7 Embedding the risk management cultureIdentifying appropriate policies, standards and practices is the first stage of creating a risk management culture. Once these are in place they need to be totally embedded in individuals through the enactment of their roles and associated responsibilities.Awareness of and responsibility for risk issues must be linked explicitly to key objectives, in order to build a sustainable risk management culture. There should be delegated responsibility for risks at every level of objectives in the organisation. This is the major support to embedding risk management into the organisation and its culture, with risk management seen as an intrinsic part of the way an organisation works. As the people in an organisation change, it is essential to ensure a continuing understanding of roles and responsibilities related to managing risk.The risk environment is constantly changing too. Your organisation’s priorities and the relative importance of risks will shift and change. Assumptions about risk have to be regularly revisited and reconsidered, perhaps by annual review of the risks associated with each of the key organisational objectives.Establishing appropriate competencies and behavioursAn important aspect of setting up a risk culture is to ensure it is relevant to the organisation. Risk management is a major facet of effective corporate governance.Those responsible for corporate governance need to have knowledge and understanding of:。
ITIL_基础培训ppt
规划及控制
质量控制
服务需求规划 服务级别管理 培训策略
成本管理 可用性管理 应急计划 容量管理
资产管理 预算管理
第三方 管理 合同管理
开发
IT 技术架构 应用开发及获取
版本发布 生产环境 测试
外包商管理
运维管理
事件管理 服务台 (reactive) 监控(proactive)
问题管理
变更管理
生产环境的管理
恢复标准
投入资源与 解决目标
流程考核指标
影响程度分级
影响或潜在影 响系统服务
1.顶级
2.高级
3.中级
4.低级
举例说明
考核项目 总体满意度 呼叫次数 提交呼叫数 解决呼叫数 呼叫解决率 呼叫解决时间
说明
指标分级 备注
23
事件管理的好处
- 减小突发事件对业务的影响 - 最优化资源进行事件支持，合理分工 - 服务分轻重缓急，保障系统有效运行 - 加强管理层的有形监控和及时反馈 - 及时有效的沟通，提升用户满意度 - 建立知识库，进行知识积累 - 提供管理信息和决策支持依据
350
300
250
200
150
118
100
50
0 Apr
连续性
295
335 分析后
结果
59
May
Jun
July
32
问题管理的好处
找出事件发生的根本原因
主动分析事件发生趋势 找出根治的解决方案 减少事件的重复发生
预先防止事件和问题的发生 提高资源使用效率
提高事件管理的一线解决率
33
问题管理的 关键成功因素
• 专注于处理出现在IT基础架构中或由用户 报告的事件来尽快恢复服务的可用性.
ITIL培训ppt课件
第 三 部分 ITIL的核心流程：服务支持
➢事件管理
➢问题管理
➢配置管理
➢变更管理
➢发布管理
第 四 部分 ITIL的核心流程：服务提供
➢服务级别管理
➢IT服务财务管理
➢能力管理
➢IT服务持续性管理
➢可用性管理
最新版整理ppt
<该卷资料名>
体验管理感悟
共享成功智慧 7
IT服务需求的发展趋势
<该卷资料名>
基础上的：SLA 领导、SLA 协调、SLA 激励机制以及与SLA 相关的培训、汇报和衡
量机制。
体验管理感悟
共享成功智慧 8
信息化管理要素框架
<该卷资料名>
目标制定
信息化组织
目标与考核
目标考核
信息化流程
信息部门 定位
组 织 架 构
岗位职责
项 目
项目实施及管理 上线管理 投资策略 外包管理
管 立项管理
<该卷资料名>
业务部门
信息部门
IT是业务的依托，业务部门要从整体角度来高 度重视IT技术的应用工作，充分利用和依靠IT 技术支撑业务发展；
根据IT技术发展方向，探明业务运作发展趋势 ，不断利用新技术和新观念，改善业务运作， 快速适应业务变化，提高核心竞争力。
规划立项 业务以IT为依托
发挥信息技术的优势，引导和启发业务部门的 信息化需求，全力支持业务运作；
➢发布管理
第 四 部分 ITIL的核心流程：服务提供
➢服务级别管理
➢IT服务财务管理
➢能力管理
➢IT服务持续性管理
➢可用性管理
最新版整理ppt
<该卷资料名>
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
任务&行动 实施
事件管理 服务台 产品
需求
供给
客户关系管理 愿景、目标和政策
TTNIC
服务与质量
旋转方向 质量改进 人员 人员方面 的成效
D
2 1 3 4
P
A
C
ITIL ISO-9000
质量保证 戴明质量环
质量计划： 1.Plan(计划) 2.Do(实施) 3.Check(检查) 4.Act(改进)
业务管理（Business Perspective）
服务管理模块是ITIL的核心模块； 侧重于从技术角度对基础设施进行管理； 1999年新增到ITIL中； 为了确保应用系统满足客户需求并方便对其进行支持和维护，IT服务管 －在提供IT服务的时候，首先应该考虑业务需求，根据业务需求来确定IT需求； ITIL把IT管理活动归纳为十个核心流程和一些辅助流程，然后利用这些 覆盖了IT技术设置管理的所有方面，包括识别业务需求、实施和部署、 目标是保护IT基础设施，使其避免未经授权的使用； 理的职能应该合理地延伸，介入应用系统的开发、测试和部署； －业务管理模块知道业务管理者以自己习惯的思维模式： 流程进行有关IT管理工作； 对基础设施进行支持和维护等活动； 为确定安全需求、制定安全政策和策略以及处理安全事件提供全面指导； 应用管理模块指导IT服务提供方协调应用系统的开发和维护，以使它们 分析IT问题， 一共包括十大流程和一项服务太职能； 目标是确保IT基础设施稳定可靠，能够满足业务需求和支撑业务运作； 侧重从政策、策略和方法的角度指导如何进行安全管理。 一致地为客户的业务提供支持和服务。 了解IT基础架构支持业务流程的能力
我们怎样才能 到达目的地？
流程改进
输入规范
流程 活动和 子流程 输出规范
我们如何知道 我们已经到达了？
指 标
流程改进模型
流程辅能者 （Process Enablers）
资源
角色
流程的概念模型
TTNIC
IT管理&服务的层次和定位
业务管理
需求管理
项目组合管理
技术 IT服务战略管理 服务 业务 业务 技术 服务 外包管理 服务
TTNIC
企业IT部门面临的挑战
许多企业的IT部门面临如下问题:
IT 为业务部门做了什么? 抱怨低质量服务和高成本 如何更好地进行IT决策,包括人员,系统等 来自用户的不合理期望和需求 ………..
影响?
IT部门的工作 没有得到正确评价, 客户不满意…..(是否是IT的错?)
TTNIC
建立一系列完全的、一致的、连贯的最佳实践规范， 以提高IT服务管理质量，并推动采用IT技术提高业务 有效性 鼓励私营机构开发相关的产品和服务（培训、咨询
OGC开发ITIL的目标
及工具）以支持ITIL
TTNIC
关于的ITIL的WHY和WHO
Why 为什么使用ITIL？ Who 谁在使用ITIL？
— Gartner
2 组织结构
3 流程
IT服务管理是一种以流程为导向、以客户 为中心的方法。它通过整合IT服务与企业 业务，提高了企业的IT服务提供和服务支 持的能力和水平。 — itSMF
4 工具
进行有效而合理的整合，以提供高质量的IT服务。
TTNIC
像制造产品一样生产服务
ITSM/ITIL
ITIL提高服务质量 流程（Process Flow）
1 以客户为中心 1 服务可计量 3 高质量、低成本的服务
TTNIC
ITSM的“范围”
ITSM VS. ERP/CRM/SCM
— ITSM主要适用于IT管理、而不是企业的业务管理； — 前者面向IT管理，后者面向业务管理
ITSM VS. ERP/CRM/SCM
— ITSM不是通用的IT规划方法； — ITSM的重点是IT的运营和管理，而不是IT的战略规划。
TTNIC
培训目录
ITSM/ITIL简介
ITIL: Service Support
ITIL: Service Delivery
TTNIC
Service Support流程-服务台
事件请求、需求 管理工具 沟通、更新
服务台 概念 主要作用 事故 和权益措施 服务台目标 事故 服务台（Service Desk）在服务支持中扮演着一个极其重要的角色。完整意义 （1）响应用户呼叫。即对于用户发出的错误报告、服务请求、变更请求等事件进行记录和 服务台的主要目标是协调客户（用户）和IT部门之间的关系，为IT服务运作提供 处理。这是服务台的最主要工作。 支持，从而提高客户的满意度。 上的服务台可以理解为其他IT部门和服务流程的“前台”，它可以在不需要联系 客户调查报告 事件管理 作为与用户联系的“前台”，服务台首先对来自用户的服务请求进行初步处理。 （2）提供信息。服务台是为用户提供IT服务信息的主要来源，一般可以采用布告栏、Email、 特定技术人员的情况下处理大量的客户请求。对用户而言，服务台是他们与IT部
其它
服务管理
安全管理
运营管理
技术管理
网络
服务器
技术 技术 数据库
主机
桌面
系统
其它
TTNIC
ITSM的核心思想
传统的IT管理
技术导向 救火、应急 被动 用户 集中式，企业自己完成 孤立的，分散的 一次性的，混乱的 非正式的流程 从IT部门内部考虑 具体的运营
转变
ITSM
流程导向 保健、预防 主动 客户 分布式，外包 集成的，企业范围内的 可重复的，职责明确的 正式的最佳实践 从业务的角度考虑 面向服务的
IT组织，不管是企业内部的还是
外部的，都是IT服务提供者，其主要 工作就是提供低成本、高质量的IT服 务。
IT服务的质量和成本则需从IT
服务的客户（购买IT服务的）和用 户（使用IT服务的）方加以判断。
ITSM也是一种IT管理，但与传
统的IT管理不同，它是一种以服 务为中心的IT管理。
ITSM的“三大目标”：
IT服务提供商利用ITIL概念和实践：
─提高客户对IT服务的满意度 ─加强与客户的交流 ─对于关键系统和基础设施，使之达 到更高的可靠性 ─提升服务的性价比 ─在所有员工中建立一种共识
世界范围内超过10,000家的公司 欧洲、加拿大和澳大利亚的IT从业者 微软、惠普、IBM等国际厂商 IT支持服务供应商
IT部门能集中资源进行企业的业务支撑系统的信息化建设
先进、专业的IT桌面管理体系必然带来优质、高效的IT服务，基于ITIL的IT 桌面管理体系的全面应用，将帮助企业卸下IT管理服务的沉重包袱，轻装上 阵，集中精力提高企业的核心竞争力！
TTNIC
ITIL服务支持与服务交付的流程或职能
服务支持 服务交付 服务级别管理 IT服务财务管理 可用性管理
TTNIC
ITIL和IT桌面管理产品的架构融合
基于ITIL的流程化管理服务帮助 台
故 障 问 题 申 告 管 理 维 护 策 略
管理控制台 知识库 桌面配置管理 Internet访问控制 桌面应用管理 客户端 （桌面系统） 桌面安全管 理服务器组 IT桌面管理知识更新 Internet
公司内部网
企业防火墙
领导力
政策 & 战略
流程
客户方面 的成效
关键绩 效结果
合作 & 资源
社会方面 的成效
EFQM模型
CMM
SPICE OGC提出的ITSM的成熟度模型
TTNIC
流程管理
流程控制 （Process Control）
我们希望到哪儿？
愿景和业务目标
流程 负责人
流程 目标
我们现在在哪儿？
评 估
质量参数和 关键绩效 指标
ITSM VS. 技术管理
— ITSM的主要目标不是管理技术； — ITSM的主要任务是管理客户和用户的IT需求； — 有关IT的技术管理是系统管理和网络管理的任务
TTNIC
如何实现IT服务管理（ITSM）
IT服务管理
人 (People)
流程 (Process)
技术&工具 (Tech & Tool)
ITIL培训及应用研讨
TTNIC
培训目录
ITSM/ITIL简介
ITIL: Service Support
ITIL: Service Delivery
TTNIC
企业IT平台的管理困境
调查发现（一）：企业IT平台的大量故障 是和管理上的问题密切相关的：
技术的飞速发展并 不能掩盖管理的缺 失和滞后!
缺乏有效的监控制度和手段 维护不及时或缺乏有计划的维护 缺少总体规划/重复建设
不同部门的IT人员之间缺乏协调
缺少运营管理方法论的指导 员工不按规定/流程操作
TTNIC
如何应对？
调查发现（二）：减少基础设施故障最有 效的管理措施：
管理的问题还需要 管理来解决!
推行流程管理 实行统一的安全管理与控制 进行集中式管理 加强对用户的培训和教育 设立统一的IT支持前台
TTNIC
ITSM的发展趋势
服务管理的普及程度
100% 75% 50% 25% 00 01 02 03 04 05
90’s 80’s
SCE SCP
ITSM
分布式应用管理
SMS
70’s
网络管理 系统管理
TTNIC
ITSM流程模型
用户 客户 CRM 网络管理 应用管理 服务台 配置管理 IT服务财务管理 事件管理 问题管理 变更管理 能力管理 发布管理 可用性管理 IT服务连续性 管理 服务级别管理
IT服务管理规划与实施
了解IT服务管理在提供端到端IT服务过程中的作用