ITIL Assessment and Gap Analysis

1. ITIL Assessment and Gap Analysis For UnumProvident July 10, 2006

2. Agenda • Introductions • Project Scope • Executive Summary • ITIL Review • ITIL Maturity Levels • Assesment • Assessment Methodology • ITIL Gaps: Service Support • ITIL Gaps: Service Delivery • Easy Wins • ROI • Road Maps

3. Introductions • UnumProvident • Core Team • Evergreen Systems • Jason Bowra • Joe Koester

4. Project Scope • Assess and benchmark the current ITIL maturity of the service management processes used by UnumProvident’s (UPC) IT Department. • Conduct a gap analysis exercise and document our findings. • Evaluate UPC’s IT organization for other critical factors, including technology enablement, organizational readiness and key performance indicators. • Develop an ITIL Improvement Roadmap and a detailed action plan for UPC to use in initiating an effective IT transformation plan.

5. Executive Summary • Key Findings: • One ITIL process area does not meet Pre-requisites • Service Level Management • Overall ITIL maturity varies by department and process area: • From Level 1 – Pre-requisites to Level 3.5 – Quality Control • No consistent ‘Enterprise’ approach to ITIL process areas • Many processes are used but not documented

6. Executive Summary • Positive Findings • Problem management (RCA) process and activities are defined and being used. • Management intent has been established and teams appear receptive to ITIL • Service catalog development has been initiated

7. Executive Summary • Key Recommendations • Go after the ‘low hanging fruit’ in 3 process areas: • Incident, Change, Service Level Management • Develop and execute an ITIL Awareness program across all IT areas • Establish an ITIL governance body/group??? • Establish an IT quality improvement program

8. ITIL Review • ITIL (IT Infrastructure Library) provides a framework of “best practice” guidance for IT Service Management and is the most widely used and accepted approach to IT Service Management in the world. • The key ITIL message is that IT services are there solely to support the business and its efficient and effective operation. All of ITIL’s recommendations flow from the business relationship.

9. ITIL Review Why use ITIL? • Improved communication and better working relationships within and between IT and the business • Demonstrable, reduced long term costs through improved ROI or reduced TCO through process improvement and greater efficiency • Reduced risk of not meeting business objectives, through the delivery of rapidly recoverable, consistent services • The ability to absorb a higher rate of Change with an improved, measurable rate of success • Processes and procedures that can be audited for compliance to “best practice” guidelines • Continuous improvement in the delivery of quality IT services • Improved ability to counter take-over, mergers and outsourcing.

10. Questions Addressed by ITIL Business - IT Alignment Operations Bridge Business Assessment From a market perspective, what opportunities are there for IT to add value? Incident Management Operations Management Customer Management How does IT become a trusted advisor? How can customer calls and infrastructure failures be quickly addressed? How will services be run and maintained day-to-day? IT Strategy Development What is IT’s value proposition? Problem Management Configuration Mgmt. How will assets, their attributes and relationships be tracked? How will root causes be eliminated and future incidents prevented? Service Level Management Service Planning What current and future services fulfill IT’s value proposition? How do we define and measure service success? Change Mgmt. How will changes to production be controlled? Availability Management Capacity Management Cost Management Build & Test How are services developed and assembled? Release to Production How are services deployed and activated? How are services provisioned for maximum uptime? How does the service manage changes in demand? What is the financial budget for the service? Service Design & Management Service Development & Deployment

11. ITIL Maturity Levels Level 1: Prerequisites – Minimum level of items available to support the process Level 1.5: Management Intent – Documented policies and/or objectives providing purpose and guidance in the use of the prerequisite items. Level 2: Process Capability – The minimum set of activities are being performed. Level 2.5: Internal Integration – The activities are integrated sufficiently in order to fulfill the process intent. Level 3: Products – The actual output of the process to determine whether all the relevant products are being produced. Level 3.5: Quality Control – Review and verification of the process output to ensure quality. Level 4: Management Information – Governance of the process and validating that there is adequate and timely information to support necessary management decisions. Level 4.5: External Integration – External interfaces and relationships between the process and other processes have been established. Level 5: Customer Interface – Continuous external review and validation of the process to ensure that it remains optimized towards meeting the needs of the customer. Reduces firefighting, rework, redundant work and reoccurring problems

12. Assessment Methodology • Data Collection • Prepared questionnaire • Interviewed key IT staff • Reviewed documentation, reports, metrics • Validate and re-visit open questions • Some of the people we talked to: Mike McCleery Michael Smith Mack McDowell Donna Cote Brenda Keniston Ray Goodpasture Alicia O’Connor Vonda Brazier Chris Fason Richard Smith Wendy Kulingoski xx xx xx xx xx xx xx xx xx xx

13. ITIL Gaps: Service Support

14. ITIL Gaps: Service Support • Service Desk • Meets Level 3: Products • Key finding: The Service Desk is not the only point of contact into IT. • Recommendation: Utilize the Service Desk as the single conduit for all customer communication • Value: The ability to track/measure/manage IT’s work. Utilize people resources by clearly identifying roles/responsibilities. • Incident Management • Meets Level 3: Products • Key finding: Not all incidents are recorded and not all groups participate. • Recommendation: Utilize ServiceCenter for recording all incidents. Categorize Incidents and Service requests, Utilize tools for event correlation and auto ticket generation. Create standard repository and known errors DB for triage and communication procedures • Value: Reportable and reliable metrics are available for continuous improvement. Automate unnecessary manual procedures, reduce MTTR.

15. ITIL Gaps: Service Support • Problem Management • Meets Level 3: Products • Key finding: Problem Management process in place with RCA meeting weekly. Reactive process working well. • Recommendation: Implement proactive trending process and assign PM responsibility per group. • Value: Reduce MTTR and Increase MTBF. Create Known Errors and prevent Incident reoccurrence. • Configuration Management • Meets Level 1: Pre-requisites • Key finding: Lack of processes for configuration management • Recommendation: Finish IT asset management process using Asset Center). High Level Config Plan, Identify CI locations, CI attribute levels, Register CI’s • Value: Foundation to IM, PM and Change. Data for Service Delivery and CMDB

16. ITIL Gaps: Service Support • Change Management • Meets Level 3.5: Quality Control • Key finding: No consistent process used for requesting changes, Opportunities for completing changes without following the change process. No Impact assessment for technology or the business. • Recommendation: Develop standardized workflows for managing, assessing, approving and closing changes. • Value: Reduce the number of emergency changes, validate change during the window. • Release Management • Meets Level 2: Process Capability • Key finding: No formal process used across the organization. Mainframe team has been completing the process for years. • Recommendation: Create a standard, documented auditable process across the organization. Communicate Policy across the Organization. • Value: Create a holistic view of change to ensure both the business and technical requirements are considered. Higher quality of releases and increased customer confidence.

17. ITIL Gaps: Service Delivery

18. ITIL Gaps: Service Delivery • Service Level Management • Does not meet Level 1: Pre-requisites • Key findings: Pre-requisites not established • Recommendation: Utilize Service Catalog initiative to determine Service Level Requirements. Formalize Service Management responsibilities and liaison with the customer. Establish performance metrics and process improvement. • Value: SLM defines priority for work, both from customers and within IT. • Financial Management • Meets Level 2: Process Capability • Key finding: Process in place that empowers the group manager responsibility and employee/outsourced costs on the scorecard. • Recommendation: Start to establish the cost of assets (install/maintenance) and all of the supporting costs including people, facilities, insurance etc. • Value: Allow the customer to understand what the cost of IT services are on the business. • Capacity Management • Meets Level 1.5: Management Intent • Key findings: No formal capacity plan across all organizations. No understanding of future business demands and organizational operations. • Recommendation: Create standard enterprise plan that includes change, release and configuration management. Define standard terminology and strategy. • Value: Decrease Incidents based on future planning. Reduce wasted spend of IT assets. Increased Customer satisfaction of service delivery expectations.

19. ITIL Gaps: Service Delivery • IT Service Continuity Management • Meets Level 2.5: Internal Integration • Key finding: High level continuity plans in place. • Recommendation: Need Annual impact analysis to determine the cost of down time. Understand current and future organizational and regulatory requirements. Complete organizational risk assessment. • Value: Reduce business risk and vulnerabilities. Reduce MTTR. Fulfill regulatory requirments. Ensure business survival. Reduce MTTR. • Availability Management • Meets Level 1.5: Management Intent • Key finding: Current component monitoring in place vs. service. No agreements between the business and IT for availability. • Recommendation: Create regular outage reports with actionable items. Communicate standard availability of services with business needs. • Value: Proactive Technical solutions to minimize downtime. Reduce MTTR.

20. ITIL model

21. Chaotic Incidents/Calls from Users DeskTop Business Support Managers Service Desk Ticket Network Tracking IT Engineers/ System Managers Administration Information Technology Department Business Security Problem Continuity Administration Management Change Process

22. Easy Wins • These three process areas at UPC are relatively immature and closely related. Relatively simple changes will result in significant improvements: • Service Desk, Incident and Problem Management • Change Management and Release Management • Service Level Management and Capacity Management • General • Create ITIL Awareness Presentation • Manager Tool Kit by Interested Party

23. Easy Wins • Service Desk • Review Change Calendar proactively (Shift Turnover, Triage) • Formal Job Sharing • End User Awareness training (One Pager) • Incident Management • Create Formal Event Management process • Prioritize Incidents and Service Requests • Standardized Document tree structure and Procedure Templates • Daily Operations Meeting and Reporting • Problem Management • Crete formal process with change • Proactive trending on “Top Talkers” • Awareness Training • Success Metrics

24. Easy Wins • Change Management • Validate all changes after completion • Create a Production Control Process • Close the loop with Problem Management • Audit the CAB checklist • Release Management • Licensing Governance Process • Back out plans and check points • Approval process for Releases • Audit Process • Start Formal Planning Meetings • Configuration Management • Finish Asset Management • Identify Configuration Items (Locations)

25. Easy Wins • Service Level Management • Complete Service Catalog • Assign Service Management Responsibilities • Formal Monthly Meetings to Review Service • Create Roles and Responsibility Metrics • Financial Management • Pricing Policy • Capacity Management • Use Proactive PM for trending • Create Standard Capacity Terminology • Use stress testing for future planning • Work with customers to understand future requirements • Focus on critical resources for proactive needs

26. Easy Wins • IT Service Continuity • Application Catalog with business requirements • Include ITSCM in SDLC • Testing results impact performance reviews • Formal Awareness program – Continue Awards • Availability Management • Daily Operations Meeting • Understand Single Points of Failure • Technical Solutions? • Define Availability • Weekly Outage report

27. Significant Findings • Many of the ITIL benchmarks are met “by the skin of your teeth” and these processes would benefit by more robust design • Example: “at least some” activities exist. • Establish Operational and Performance Metrics for All Best Practices

28. Technology Platform Capability • Currently available applications can support core ITIL processes • ServiceCenter, AssetCenter, Mercury, UniCenter etc. • Opportunities: • Define, support and enforce IT-wide use of Incident and Problem tracking • Establish a more comprehensive IT asset management (ITAM) process using AssetCenter • Build upon ITAM towards a Configuration Management strategy

29. Organizational Climate • Current Evidence of Management Commitment • Identified ITIL SME’s • ITIL assessment • Service catalog implementation included in scorecard • Continued Support of ITIL • ITIL Governing body • Service Delivery Owner • Service Support Owner • Best Practice SME • Production Control Team – Long Term • Align with Six Sigma Projects

30. Service Level Mgmt (SME) Service Continuity Mgmt (SME) Financial Mgmt (SME) Capacity Mgmt (SME) Availability Mgmt (SME) Release Mgmt (SME) Configuration Mgmt (SME) Change Mgmt (SME) Problem Mgmt (SME) Incident Mgmt (SME) Functional Org Model ITIL ITIL GOVERNANCE Shared Services Network Storage Server Storage LEAN Six Sigma Service Delivery Owner Service Support Owner

31. Challenges • “ITIL” is a big and long-term goal • Manage as a continuous improvement project • It’s not Free • Staff time for: • Training • Process design • Buy-in, debate, compromise • Management attention, focus, sponsorship • Tools • Training • Consulting • It involves everyone • It’s bigger than just ITIL • HR factors such as compensation/bonus plans, Org structure, job descriptions, daily tasks and duties will change. • New and different relationships within/between IT departments • New and different relationships with the business

32. Challenges • Continuous communication is critical • What happens next, who’s involved, when, why, how, where. • Senior management must demonstrate commitment • ITIL will require cultural change • Leadership style, how managers manage the teams. • Written and unwritten policies, procedures • Culture of continuous improvement – not “it ain’t broken” • There will be resistance • It’s human nature, it’s predictable, and it’s manageable • Communication is critical

33. Returns on Investment (Generic) • Accurate, reliable, useful data and metrics about the volume, type, quality and cost of the work that IT does • Foundation for continuous improvement in service quality, costs, responsiveness to the customer • Ability to prove and justify costs to the business with hard data. • Ability to reduce costs by: • Smarter allocation of labor • Reduced re-work and duplication of effort

34. ROI - Impact on IT • Change the culture of IT to be more teamwork-oriented • Create an environment that promotes a free flow of information, ideas, and communication (upward, downward and across IT) • Improve accountability by establishing clear expectations and measurements where individuals and teams are held responsible for their actions and results • Elevate business partnerships to increase the value and perception of IT to the business • Achieve Operational Excellence

35. ROI - SPECIFIC • Efficiencies gained in an April 2006 survey of IT managers by IDC:* • 30% average overall efficiency gain in productivity in IT: • Incident management and help desk support: 40.5% • Managing and supporting servers: 30.9% • Change management: 28.4% • Managing and maintaining network infrastructure: 23.1% • Maintaining configuration database: 22.8% • Managing applications: 10% • Problem management: 9.4% • Service level management: 8.5% • Other documented efficiencies include: • 12.2% average reduction in IT headcount growth • 25% savings in overall IT budgets • Diminished likelihood to underfund their IT infrastructure** *Determining the Return on Investment from Deploying Integrated IT Service Management (IDC April 2006) **The ITIL Library Improves Infrastructure Investment (Gartner June 9, 2006)

36. Areas for Development of Metrics and Savings • Increased service quality for end users • Lowered wait times on hold for help desk • Less down time due to better problem, incident and change management • Increased productivity for IT staff (including lowering growth of FTE) measured by time and resource savings associated with: • Incident management and help desk support • Managing and supporting servers • Change management • Managing and maintaining network infrastructure • Maintaining configuration database • Managing applications • Problem management • Service level management • Risks associated with inefficiencies in data center management including: • Unnecessary duplication of server and application resources • Unnecessary distribution of data center resources over multiple locations • Loss risks associated with insufficient business continuity procedures • Inefficiencies associated with storage • Loss risks associated with poor disaster recovery procedures and planning • Expensive poorly used data center infrastructure as a result of inefficient planning and implementation

37. Key Recommendations • Start small: • “Define and streamline three IT processes (incident, change, and problem management) to produce a quantifiable improvement in Business Partnerships and Customer Service by December ‘06” • Draft and publish long-term vision and plan. • Plan for continuous, incremental, value-based improvements. • Goal: benchmark and measure value for each sub-phase.

38. Proposed Implementation Plan Project Dependencies • Organizational Dependencies • ITIL Training: Service Desk staff, IT staff • Clearly Defined Responsibilities for each ITIL process • Process Dependencies • Service Desk • Incident Management • Problem Management • Change Management • Technology Dependencies • ServiceCenter 6.x + sufficient modules – ongoing detail assessment required in parallel w/ process design.

39. Evergreen Approach Organization Planning / Governance Requirements Definition Process Definition Design Implementation Adoption

40. Implementation Plan Organizational Planning/Governance • Identify Project Sponsor • Establish Project Advisory Committee (PAC) • Define Responsibilities of the PAC • Finalize and Publish Project Charter and Identify Project Manager • Identify Client Stakeholders • Identify Process Owners • Identify Business Owners • Identify Technology Owners

41. Implementation Plan Requirements Definition • Process • Detail Assess Current Processes • Detail necessary Goals, Commitments, Activities, Measurements, Analysis, and Verifications • Detail current state benchmarks for improvement • Technology • Detail Assess IT Service Management Technologies, Need for Technology Enhancements / integrations • Revisit/update previous recommendations/findings re: ServiceCenter

42. Implementation Plan Adoption • Marketing Plan • Align to Business Objectives • Identify Organizational Benefits • Identify Departmental Benefits • Communication and Information Distribution • Adoption Strategies • Incentives for Process Adoptions • Deterrents to Non-compliance • Audit Process • Management of Change • User Training

43. Implementation Roadmap • Phase 1 - September ‘06 • Add the 3 process areas here… • Phase 2 – January ’07 • Next process areas… • Phase 3 – July ’07 • Next process areas… • Phase 4 – January ’08 • Next process areas…

44. Implementation Plan Resource Requirements • Executive Sponsor – 1 hour/week • PM – Fulltime throughout project • Process Owners – 1-2 hours/week • Technology Owners – 4 hours/week • Technical resources - variable

45. Implementation Critical Success Factors • Active, Frequent, Continuous Executive Sponsorship • Marketing of the long-term vision from top down and bottom up • Process definition and adoption • Don’t allow technology to impede progress • Short wins, small bites

46. Implementation Next Steps • A • B • C

47. Implementation Questions?