In this session, John provided advice on how to put together sections of various best practice frameworks and ways of working to best suit your organisational needs.

1. John F McDermott
HPE Education Consulting
@JFMcDermott_HPE
#hpehybridit
20th November 2017
HYBRID-IT
Best Practice Input
To Your
Management System

2. Agenda
1. What is Hybrid-IT?
2. What is a management system?
3. Developing your management system with best practice
a. Governance and COBIT
b. IT4IT™
c. ITIL®
d. DevOps
e. SIAM
f. AGILE and Project Management
g. Security
h. CSF’s and KPI’s
4. Key Takeaways
5. What next?
6. Want to learn more?

3. What is Hybrid-IT?

4. Desired Business / Organisational Outcomes
Manage
costs
Operational
efficiency
and scale
Joint go-to-
market
Time to market
for new
services
Revenue
growth

5. Traditional
IT
On-Premises
Build / Consume
Off-Premises
Consume
Virtual &
Automated
Private
Clouds
Managed
Clouds
Public
Clouds
DPC VPC On-DemandSelf-Run
3rd Party
Managed
Dedicated / Single Tenant
Delivery Platform
Shared / Multi-Tenant
Delivery Platform
HPE Hybrid-IT what we have to manage

6. What is a Management System?

7. What is a management system?
Every organization has a management system
It may include any of
• Processes
• Organization design
• Organization culture
• Metrics, measurement and reporting
• Rewards and penalties
Many aspects of your management system may be informal, but they still exist
It’s how you manage and organize everything that you do
7

8. What is a management system?
- 5 Basic Principles
1. Your management system is part of your IT Operating Model
2. If you manage IT, you already have a management system
o Even if you don’t even think of your activities in this way
3. A management system will help you to provide
o Consistent, repeatable results that you can monitor, manage and improve
4. If YOU design your management system, it is much more likely to meet YOUR needs
5. Only ONE management system should control an activity
You can use lots of different standards and best practices as inputs
Your management system is what you actually do,
Not what some standard or best practice says you should do.

9. Enterprise IT
CIO Office
Management
& Operation
Design &
Development
Enterprise
Architecture
LoB 1
LoB 2
LoB 3
LoB....
..
Business
Demand Enterprise IT Supply
CustomerRelationship
• SaaS
• IaaS
• ..........
VendorManagement
External
Service
Provider
HPE – IT Operating Model / Organisation Blueprint
Development Management
Design Operate
Integration Integration
Testing&QA
ProjectMgmt
User/Customer
Support
Brokerdecision
Application
Systems
Cloud
IT Strategy
Demand Management
Quality & Performance
Portfolio
Management
IT Security
Finance
HR

10. Developing your Management System –
With Best Practice Input

11. Developing your management system
Consider
a. Your Customers
b. The End to End service
c. Suppliers
d. Transparency
Focus On
1. Value
2. Outcomes
3. Cost
4. Risk
Key Point
Any element or aspect of your management system that does not
support or is not related to any of the above, should be questioned
in terms of its validity.

12. Management system principles
Focus on value
Design for experience
Start where you are
Work holistically
Progress iteratively
Observe directly
Be transparent
Collaborate
Keep it simple
12

13. Best practice inputs to your management system

14. IT4IT™ An open standard reference architecture to manage
the business of IT today and tomorrow
http://www.opengroup.org/IT4IT

15. AGILE and Project Management
Every project has a clear beginning and end, if it goes on indefinitely then it’s not a project
Project management should achieve defined goals within constraints whilst managing risks
There are many competing best practices for project management
• PRINCE2® and PRINCE2 Agile
• PMI PMBOK ® Guide (Project Management Institute - Project Management Body of Knowledge)
• Lean project management
• Critical chain project management (part of the Theory of Constraints methodology)
You should adopt one approach for managing projects and use it consistently
AGILE is an iterative approach with short development cycles – each deliver customer value
• Develop the minimal viable product, not the final and complete solution
• Agile is an important enabler for DevOps
• Focus on value, start where you are, progress iteratively and work holistically
PRINCE2® is a registered trade mark of AXELOS Limited.. PMBOK® Guide is a registered mark of Project Management Institute, Inc.
Project management is a methodology to plan and manage temporary activities

16. DevOps
The key to DevOps is collaboration within and between teams and organizations
Collaboration should extend to the business, to suppliers, to security teams etc.
DevOps has many different forms, but it typically includes
• Cross-functional teams
• Ownership of all aspects of Dev and Ops for an IT service – For the whole service lifecycle
• Agile and Scrum for rapid software development
• Automation for continual integration, continual testing, continual deployment, infrastructure as code
• Kanban to limit work in progress (WIP)
• Recognition of technical debt, to reduce creation of unmanageable legacy code
The idea that IT development and IT operations should collaborate better

17. DevOps can be considered from a number of different viewpoints, all of these are valid
The Three Ways of DevOps
• Flow, Feedback, Experiment and learn
CALMS
• Culture, Automation, Lean, Measurement, Sharing
CI/CD
• Continuous integration, continuous delivery
ITSM
AgileLean
DevOps

18. ITIL®
Copyright © AXELOS Limited 2011. Reproduced under license from AXELOS.
The world’s most widely recognized framework for IT service management
Focused on organisational and business
OUTCOMES, VALUE, COSTS and RISKS
Creating customer value
Uses People, Process, Partners and Technology to
deliver services
Based on a lifecycle model that includes:
• Strategy, Design, Transition, Operation and
Continual Improvement

19. ITIL defines 26 processes which describe
• How to understand customers, markets and finances, and create a portfolio of services to satisfy these
• How to manage service levels, suppliers, availability, capacity, security and service continuity
• How to manage changes, testing, releases, and configurations
• How to manage service requests, incidents and problems
• How to manage continual improvement
Key concept: “ADOPT AND ADAPT”
• You saw these principles earlier – the same as those for building a management system
• ITIL is not a standard, or a set of strict rules
• ITIL is a collection and examples of things that have worked for other organizations
• Only adopt the parts of ITIL that you need. But, you should understand all of them so you can decide
• Then, adapt the parts you have chosen to adopt. Making sure they fit your culture and way of working
ISO20000 is being widely adopted and was based on ideas from ITIL and is it’s main input
ITIL®

20. Governance and COBIT
COBIT 5 – A business framework for governance and management of enterprise IT
COBIT 5 is based on the following principles
• Meeting stakeholder needs
• Covering the enterprise end-to-end
• Applying a single integrated framework
• Enabling a holistic approach
• Separating governance from management
Historically, COBIT was focussed on compliance and audit
It is now moving towards a more holistic approach
Governance is essential for any management system
- The board or owners must direct management, to ensure the mission of the organisation is realised

21. SIAM
SIAM stands for Supplier Integration and Management
• Recognises that supply chains have become complex, most services
depend on many suppliers
• Existing models don’t work well when responsibilities are shared across
organizational boundaries
Typically defines three layers of a management system, retained IT
organization, SIAM layer, suppliers
Customers
Retained IT organization
SIAM layer
Supplier 1 Supplier 2 Supplier n…

22. SIAM
– SIAM is much more than supplier management
Considers how each process could be split between suppliers, retained organization and SIAM layer
Requires a collaborative approach with CSFs, KGIs and KPIs.
Identify supplier obligations but encourage collaboration
– Retained IT typically includes
Governance, financial management and sourcing strategy
Business relationship management
Accountability for the end-to-end service
– SIAM layer typically includes
Integration and co-ordination of tools and processes across suppliers
Management of supplier performance and assurance
Testing and release management
Consolidation of supplier reporting and creation of customer-facing reports
– The SIAM layer can be carried out by the retained IT organization, or by one of the suppliers
Caution: SIAM activities must be clearly assigned to this layer, do not confuse with things that belong in other layers

23. HPE SIAM provides capabilities to address
the challenges of multi-sourcing
SIAM (Service Integration and Management)

24. Security
Managing risks that could affect the confidentiality, integrity or availability of information
needed to do business
• The heart of any information security management system is the approach to risk management
Good security is about balance:
• Between people, process and technology controls
• Between controls designed to protect, detect and correct incidents
• Between cost of controls and level of risk
• Between negative impact of controls and level of risk
• Between business need to exploit new opportunities, and business need to be safe and protected
• Between what we say and do – the need to create human firewalls with user awareness training
Security is not just an IT issue. It is about managing risks to the business
Ultimately this must be owned by the board (governance)

25. Security - standards and best practices
ISO/IEC 27000
• International standard for information security management
• Organizations can be audited and certified compliant
• Uses the lifecycle: context / leadership / planning / support / operation / performance evaluation / improvement
• Controls are defined in Appendix A and in ISO/IEC 27002
PCI-DSS
• Required standard for any organization that handles payment card data
• Defines 12 high level requirements with many specific controls
NIST Framework for Improving Critical Infrastructure Cybersecurity
• Intended for critical infrastructure but widely adopted in the USA for general information security
• Controls are defined in a “Framework Core”, using the lifecycle: identify / protect / detect / respond / recover
RESILIA™
• Best practice for cyber resilience from Axelos, the publishers of ITIL
• Uses the lifecycle: strategy / design / transition / operation / continual improvement
• Controls are defined within the lifecycle stages, and categorized as protect, detect, correct

26. CSF’s and KPI’s
CSF (Critical Success Factor)
• Something that must happen if an IT service, process, plan, project or activity is to succeed.
• Business outcome and value related
KPI (Key Performance Indicator)
• Used to measure the achievement of each critical success factor
• Every KPI must support one or more documented CSF’s
• Remember the three words:
Key, Performance, Indicator
• They are not key performance proof

27. Example CSFs and KPIs
CONTEXT: Manufacturing support application
1. CSF Downtime of the service does not have a significant impact on the customer’s
business process
KPI Maximum of 4 service outages in a year
KPI Maximum downtime of 30 minutes for any service outage
2. CSF Service performance always allows the manufacturing line to run at full speed
KPI The service supports a throughput of 100 transactions per second for [specific
critical transaction], with each transaction completing within 100mS
KPI Infrastructure upgrades needed to meet evolving business capacity needs will be
implemented within one week of being requested
27

28. Other inputs to your management system
Other Inputs may include:
i. Legal and regulatory requirements
For your country, your industry or any other jurisdiction that affects you
ii. Contractual requirements
From your customers, your suppliers or your partners
iii. Business requirements from your own organization
Governance, strategic, tactical and operational requirements
iv. Organizational culture
Some organizations work best with formal processes, others need more flexibility in how they work
Some organizations have defined metrics and reporting that drive behaviour, others are less so
Standards and Best Practices help to design your management system.

29. Summary

30. IT4IT
IT4IT Summary
• Open standard value chain-based
reference architecture for end-to-
end IT services
• Strategy to Portfolio
• Requirement to Deploy
• Request to Fulfill
• Detect to Correct

31. IT4IT
IT4IT Summary
Open standard value chain-based
reference architecture for end-to-end
IT services
• Strategy to Portfolio
• Requirement to Deploy
• Request to Fulfil
• Detect to Correct
A value chain approach is suitable for
any IT organization, that embraces
and understands the importance of
and wants to focus on the creation of
customer value
Ideas from IT4IT can be used by any
IT organization to help and improve
its customer focus, and it’s ability to
deliver business insight

32. AGILE
Project
Management
AGILE Summary
Plan and manage temporary activities
Achieve project goals within project
constraints
Managing project risks

33. AGILE
Project
Management
AGILE Summary
Plan and manage temporary activities
Achieve project goals within project
constraints
Managing project risks
Every IT organization needs a way to
manage projects
You should have a preferred methodology
and use it consistently for all projects
You might use a variant of your normal
methodology for agile projects

34. DevOps
DevOps Summary
Collaboration
• Within teams
• Between teams
• Organizations & Departments
• High Rates of Software Delivery
CALMS
• Culture, Automation, Lean,
Measurement and Sharing

35. DevOps
DevOps Summary
Collaboration
• Within teams
• Between teams
• Organizations & Departments
• High Rates of Software Delivery
CALMS
• Culture, Automation, Lean,
Measurement and Sharing
DevOps is most suited for IT
organizations that want to deploy
many changes in support of rapidly
changing business needs
Many of the DevOps ideas can be
adopted by any IT organization

36. ITIL
ITIL Summary
Focussed on Creating
• Organisation / Business Outcomes
• Organisation / Business Value
Manages Costs and Risks
Five lifecycle stages
• 26 processes within the lifecycle

37. ITIL
ITIL Summary
Focussed on Creating
• Organisation / Business Outcomes
• Organisation / Business Value
Manages Costs and Risks
Five lifecycle stages
• 26 processes within the lifecycle
Every organization needs IT Service
Management and ITIL is by far the most
common source of best practice for this
Without ITIL it will be very difficult to
create consistent, reliable, effective and
efficient ITSM processes

38. COBIT
&
Governance
COBIT Summary
Business framework for governance and
management of enterprise IT
Meet stakeholder needs
Cover enterprise end-to-end
Apply a single integrated framework
Enables an holistic approach
Separate governance from management

39. COBIT
&
Governance
COBIT Summary
Business framework for governance and
management of enterprise IT
Meet stakeholder needs
Cover enterprise end-to-end
Apply a single integrated framework
Enables an holistic approach
Separate governance from management
Your organization must provide
governance of IT
Informal approaches are common, but
don’t work very well
Alternative to COBIT
• ISO/IEC 38500 – the standard for
corporate governance of information
technology

40. SIAM
SIAM Summary
Management of multiple suppliers to
maximize value
High levels of collaboration to deliver
business outcomes
The Retained organization
The SIAM layer
CSFs, KGIs and KPIs.

41. SIAM
SIAM Summary
Management of multiple suppliers to
maximize value
High levels of collaboration to deliver
business outcomes
The Retained organization
The SIAM layer
CSFs, KGIs and KPIs.
SIAM is ideally suited for IT organizations
that have multiple strategic suppliers
However, many of the ideas can be
adopted by any IT organization

42. SECURITY
SECURITY Summary
Managing the risks to the information that
is needed to do business
Create a balance. Perfect security is an
unrealistic target
Many different standards and best
practices

43. SECURITY
SECURITY Summary
Managing the risks to the information that
is needed to do business
Create a balance. Perfect security is an
unrealistic target
Many different standards and best
practices
Information Security Management is an
essential part of your management
system
Choose which best practice to follow
You MUST use one of them
It is too hard to design everything you
need with no help

44. CSF’s
&
KPI’s
CSF’s and KPI’s Summary
CSF (Critical Success Factor)
Something that must happen if an IT
service, process, plan, project or other
activity is to succeed
KPI (Key Performance Indicator)
Used to measure the achievement of each
critical success factor.

45. CSF’s
&
KPI’s
CSF’s and KPI’s Summary
CSF (Critical Success Factor)
Something that must happen if an IT
service, process, plan, project or other
activity is to succeed
KPI (Key Performance Indicator)
Used to measure the achievement of each
critical success factor.
Every KPI must support one or more CSFs
Remember the three words:
Key, Performance, Indicator
Never use KPIs to browbeat your customer,
use them to show trends and as triggers for
action

46. Key Takeaways

47. Key Takeaways
Your management system is what you actually do,
not what some standard or best practice says you should do.
Create your management system for your organisation
These are examples, NOT a must have or must do
Review what you already have, does it help to
1. Enable business / organisation outcomes or value
2. Facilitate business / organisation outcomes or value

48. What Next?

49. What next? – Think About!
What approach to improvement will work best for you?
Theory of Constraints
What to change What to change to How to change
Lean
Identify customer value Map the value chain Establish flow
Implement pull based on demand Seek perfection
Your current approach
Do you need help to plan and change your existing system?
Your existing management system
What do you currently do well?
What areas need to be improved?
Standards and best practices
What might add value?
What do you already know about?
Which do you need to know more about?

50. HPE Pointnext: Helping to define your management system
Your management system is what you actually do,
not what some standard or best practice says you should do.
Advice, Support, Guidance & Transformational Services:
Industry Standard Reference Architectures
Best Practice Frameworks
Management Methodologies
Whatever is right for your organisation
Professional Services:
Making processes work for you
Focus on business led outcomes and value
Operational Services:
Supporting reliable & agile hybrid infrastructure
Optimizing your resources and capacity

51. Want to Learn More?

52. - Courses act as an introduction, overview and awareness of the main components
Managing the Business of IT
- Explains why organisations need a Management System
- Identifying the main components or elements needed to be successful
IT4IT™
- A new standard reference architecture for IT from The Open Group
- Supports all other frameworks and best practice
- Based on Industry Value Chains
ITIL®
- Best Practice guidance – Adopt and Adapt
- The world’s most widely recognized framework for IT service management
Governance using COBIT
- Explains how and why corporate governance influences IT Services
- A business framework for governance, audit and management of IT from ISACA
SIAM (service integration and management)
- Why these will be the skills of the future
- Integrating several discreet services
- Creating a single business outcome and value focused End to End Service
- Manage supplier relationships
CSFs & KPIs
- Verify the value being delivered to the organisation and business
- Assisting to develop and drive improvements and behaviour
- Monitoring vendor and suppliers performance in a proactive way
DevOps
- How IT, Development, Operations and the Business can collaborate
- Understand the implications and impact on people and the business
- Why automatio0n is just not enough
AGILE and Project Management
- Why both may need to co-exist
- How to differentiate and decide which technique to use
Security
- As an individual component of your management system
- Applying security in each component of your management systems
- Ensuring responsibility for security is managed in each component
HPE Education for your IT management system
Remember, your management system is what you actually do,
not what some standard or best practice says you should do.

53. Standard or customised – want to learn more?
HPE Best Practice Input to your Hybrid-IT Management System
HPE Education ITSM Portfolio
HPE Education Consulting
H9P69S 1/2 Day Managing the Business of IT - Introduction and Overview
H9P64S 1 Day IT4IT™
Introduction & Overview
H9P61S 1 Day DevOps Introduction & Overview
H9P67S 1 Day AGILE & Project Management Introduction & Overview
H9P66S 1 Day SIAM®
Introduction & Overview
H9P70S 1 Day Security Introduction & Overview
Subscription Security Creating a Human Firewall with SUAT from HPE
UC411S 1 Day Governance & COBIT®
Introduction & Overview
HF412S 1 Day ITIL®
Introduction & Overview
Contact: jmcdermott@hpe.com
@JFMcDermott_HPE

54. HPE Race to Results
DevOps Simulation
HPE Race to Results
ITSM and ITIL Simulation
HPE Race to Results
AGILE & PM Simulation
A Business Led DevOps
Simulation
(Based on the iconic book)
The Phoenix
Project
HPE Race to Results
IT4IT Value Chain Simulation

55. Thank you

56. Contact Information
John F McDermott
(HPE Pointnext Consulting)
Email: jmcdermott@hpe.com
Twitter: @JFMcDermott_HPE
Linked-In: John F McDermott
Telephone: +44 330 587 3330
#hpehybridit