Security intelligence

ISO/IEC / 20000-1
Anan Sony
CISSP, CISA Section Manager, ACIS Professional Center Co., Ltd.

Security intelligence

 Security intelligence

What is ISO/IEC 20000?

Worldwide standard for IT Service Management 200+ requirements to be able to demonstrate compliance Certification for Quality Management => Like ISO 9001 in IT Service Management

Security intelligence

What is ISO/IEC 20000? (Cont (Cont.) )

ISO 20000 => IT Service Management System

 Security intelligence

ISO/IEC / 20000 vs. ITIL and why y not ISO 9001?

WHAT?

HOW?
5

Agenda Why Should we care ?

Security intelligence

1. 1 Worldwide W ld id Standard St d d for f IT Service S i Management M t 2. International Certification against standard 3 Proof 3. P f th that t ITIL b best t practices ti h had db been implemented 4 ITIL (IT Infrastructure 4. I f t t Library) Lib ) is i a library lib of f best b t practices, not a standard 5 ITIL is a set of g 5. guidance idance , ISO 20000 is requirement 6 Certification for Quality Management 6.

 Security intelligence

ISO/IEC 20000 vs. vs ITIL

Security intelligence

ISO/IEC 20000 vs. ITIL

Ref: http://www.isaca.org

 Security intelligence

What IT Strategies are Being Implemented?

n = 616

ITIL is, by far, the most

common strategy being implemented

Users are significantly more likely to be implementing ITIL (85%) and BSM (26%) Americas respondents are significantly more likely to be i l implementing i Six Si Sigma (28%) Larger companies are g y more significantly likely to be implementing Six Sigma (33%) and CMI (20%)

Ref: BMC

Security intelligence

ITIL Processes Adopted

n = 209

Incident Management,

Service Desk and Change Management are most likely to have been adopted p already y Larger companies are significantly more likely to have already adopted release management, change management, capacity management, and problem management best practices

Ref: BMC

10

 Security intelligence

ITIL Processes in ISO 20000

11

Security intelligence

ISO/IEC 20000 and AEC 2015

There are more competitor in IT Service Management Industries How organization prove that they are better than the others ISO/IEC 20000-1 certified is the answers!

12

 Security intelligence

How to Becomes ISO/IEC 20000-1:2011 Certified

Ref: http://www.bureauveritas.com/
13

Security intelligence

ISO/IEC 20000 Benefits

Guarantee your IT Service Management p Advantage g for IT Service Provider Competitive Improve brand image from customer perspective Business-IT Business IT Alignment Customer Satisfaction Eff ti Effectiveness and d Effi Efficiency i f for IT S Service i

14

 Security intelligence

How to find certified organization g and scope?

Ref: http://www.isoiec20000certification.com/home/ISOCertifiedOrganizations/ISOCountryListings-TH.aspx
15

Security intelligence

 Security intelligence

ISO 20000 & ITIL Timeline

ITIL Concept 1989 1980s

ITSMF ITIL 2011 2001 1991 2007 2011

GITIMM / ITIL V1 ITIL V3 ITIL V2 BS 15000-1 15000 1 2002 ISO/IEC 20000-1 ISO/IEC 20000 20000-2 2 ISO/IEC 20000-4 ISO/IEC 20000-5 2009 2011

2000 2005 2010 BS 15000-1:2002 ISO/IEC TR 20000-3 ISO/IEC 20000-1:2011 BS 15000-2:2002 ISO/IEC 20000-2:2011
17

Security intelligence

ITIL Historical Highlights

1986 CCTA starts the GITIMM project To gain control of IT costs; particularly in procurement and operations To promote use of best practice CCTA later renamed OGC GITIMM later renamed ITIL 1989 ITIL V1 44 books published 1991 itSMF founded originally named itIMF

18

 Security intelligence

ITIL Historical Highlights (Cont.)

2001 ITIL V2 7 books published 2007 ITIL V3 5 books published 2011 ITIL 2011 5 books revised

19

Security intelligence

ISO 20000 Historical Highlights

Was originally a BS standard. BS 15000 was the worlds first standard for IT service management, t and d was i initially iti ll published bli h d in i 2000 In 2002 a second part was added to the standard set, BS15000 2 A formal certification scheme was also BS15000-2. introduced. In December 2005, 2005 ISO 20000 itself was published published, based almost entirely on the above predecessors.

20

 Security intelligence

Security intelligence

ISO/IEC 20000 & IT Audit

One of CISA domain!

22

 Security intelligence

1st 2nd, 1st, 2nd 3rd party audit

1st party audit: Internal audit
Organization/ Company

2nd party audit: Customer audit (External audit)

Organization/ Company Audit Customers

3rd party audit: Certification audit (External audit)

Organization/ Company Audit Certification
23

Certification bodies

Security intelligence

Philosophy of Audit
Audit Criteria

Effectiveness
Seek

Conform

Execute Exist

Audit Evidences

24

 Security intelligence

How to develop checklist?

Standard clauses
Transform

Dont make two or more topics in a question

Yes/No / Q Questions

Copyright, ACIS Professional Center Company Limited, All rights reserved

25

Security intelligence

Checklists Example

Copyright, ACIS Professional Center Company Limited, All rights reserved

26

 Security intelligence

How to get ready to audit?

Knowledge & Skills!!!
IT Background ITIL Certification, CISA ISO/IEC 20000-1:2011 understanding IRCA Course Business Sector Knowledge Company products/services IT service process Financing and Budgeting Stakeholders Suppliers and customers relationship

Copyright, ACIS Professional Center Company Limited, All rights reserved

27

Security intelligence

www irca org www.irca.org

Copyright, ACIS Professional Center Company Limited, All rights reserved

28

 Security intelligence

The 10 CSFs for SMS Implementation

1. Management Support 2. Balancing between ITIL and organization culture 3. Staff Awareness and Organization Change 4. ITSM Tools 5. Good Consultant 6. Staff Competency 7. Implementation Scope 8. Continuous Monitoring 9. Continual Service Improvement 10. Beliefs Attitudes Behaviors
Ref: itSMF Thailand Conference 2011
29

Security intelligence

Q&A
30

 Security intelligence

You can follow us!

www.facebook.com/itsmfthailand www.twitter.com/itsmfthailand

Copyright, ACIS Professional Center Company Limited, All rights reserved

31