ITIL a step at a time

The Information Technology Infrastructure Library encompasses thousands of pages of guidance designed to boost an organization's efficiency. The National Institute of Standards and Technology, one of the first agencies to use ITIL, has opted to turn the pages just a few at a time.'The first thing I would suggest is really take it slow,' said Timothy Halton, chief of the Customer Access and Support Division at NIST's IT department. Halton helped kick off ITIL adoption five years ago.NIST has been taking an incremental approach to ITIL, implementing a chunk that addresses a pressing IT issue, moving on to the next phase and sometimes circling back to build on previous work.The steady, phased approach makes sense, ITIL experts say, given the scope of the library's best practices. The most recent iteration of ITIL, Version 3, consists of five core volumes encompassing 1,343 pages. Those volumes are titled Service Strategy, Service Design, Service Transition, Service Operation and Continual Service Improvement.NIST has been working from the predecessor framework, ITILv2 ' which is also voluminous, with eight core titles.Implementing the whole thing at once could prove complicated, costly and disruptive to an organization.'If you take ITIL as one huge project and try to force everybody to follow that framework, you lose control quickly, and the project'usually won't survive,' said Majed Saadi, consulting services manager of the IT Services Group at QinetiQ North America. 'Make sure you are phasing it in, starting with some small wins.'NIST's approach to Version 2 has helped the agency boost efficiency, improve incident handling and remedy defects in the infrastructure.Overall, ITIL is changing the conversation between IT and its in-house consumers, Halton said.'My ultimate goal with business customers is to move the discussion from the cost of IT services to the value of IT services,' he said.NIST laid the foundation for ITIL in 2003.Halton came on board the newly created Office of the Chief Information Officer in part because of his process work in the private sector. IT service management and the ITIL framework came up during Halton's job interview at NIST, catching the interest of then CIO Cita Furlani.'That kind of kick-started it for us,' Halton said.To get the senior IT leadership team fully on board, NIST brought in a vendor to provide a half-day executive briefing on IT service management. The CIO, deputy CIO and IT organization's division chiefs attended.The next step was a three-day ITIL foundation class for the leadership team and first-line supervisors. Technical staff members, who were also invited to attend the three-day class, got their own one-day overview of the ITIL framework and terminology.'I wanted to make sure we all spoke the same language when we got into ITIL,' Halton said. Concepts such as incident management and problem management sound similar, he said, but have different meanings in the ITIL vocabulary.With the ITIL foundation in place, NIST launched its step-by-step deployment. Because the agency's initial concern was to stabilize its IT infrastructure, it first focused on incident management.Under ITIL, incident management aims to restore IT services quickly when an event causes disruption or affects quality.Halton said he views the creation of incident categories as particularly beneficial. The NIST service desk prioritizes incidents on a severity scale of one to four, with one the most severe. That classification system is defined by business rules NIST established.An outage in an enterprise application, for example, rates a two on the scale, and a user with a broken PC represents a three.The service desk assigns higher priority to enterprise-supporting applications, but users with nonfunctioning PCs can set the urgency for their service requests.The incident classification system, in turn, drives NIST's service-level objectives for resolving outages, Halton said.'Based on that severity level, certain support processes kick in to resolve [the problem] in an agreeable time frame,' he added.After pursuing incident management in 2003, the agency shifted the next year to implementation of ITIL's problem management component, which Halton said also fell under the stabilization banner. Problem management as defined under ITIL involves finding the root cause of problems and fixing infrastructure defects, he said. With its IT systems stabilized, NIST moved to optimization. This phase of ITIL focuses on the change management process, which sets forth standardized procedures that IT employees must follow when introducing change to the IT infrastructure.Before the ITIL initiative, each division in NIST's IT organization had its own change management process, Halton said. NIST's CIO office worked with the divisions to establish a common process, which NIST rolled out in 2005. As a result, the IT department can better handle directives from the business side of the house.'The change management process brings to any organization the ability to absorb a high level of business-driven change,' Halton said.Change management can also provide savings by controlling unauthorized changes that might create conflict in the infrastructure and lead to service disruption.'A good adoption of change management practices could translate into a reduction in the number of incidents,' Saadi said. 'This is the main, most direct and most measurable [return-on-investment] factor of change management.'For the future, the agency has set its sights on release management, which guides the implementation of new software. In the meantime, NIST is revisiting change management.'Right now, what we are looking at is refining our change management process,' Halton said, adding that the objective is to further streamline that process.In addition, NIST plans to integrate knowledge management into its incident management process. This effort seeks to encourage users to solve IT issues on their own through NIST's searchable IT knowledge database.Going back to bolster an ITIL process is part of the adoption path, which Halton described as 'stabilize, optimize and improve.'In addition to pursuing the journey at a deliberate pace, Halton had the following advice for ITIL adopters: 'You really need to remain focused on the key reasons you want to adopt the framework, identify quick wins, and keep a strong and open line of communication.'