Profile of GC Information Technology (IT) Services

Definitions

TBS Guidelines

A TBS guideline provides guidance, advice or explanation to managers or functional area specialists.  Guidance is based on sound management practices that officials should take into account when carrying out their duties.  A document providing guidance, advice or explanation to managers or functional area specialists.

Profile

As a TBS guideline for enterprise architecture, a profile provides best practice advice, guidance and explanations for a particular GC domain; offers best practice models for the GC domain that may evolve into a TBS Standard (i.e. reference model); represents in-depth knowledge of the domain's GC community of practice typically informed by sound industry best practices.

Acknowledgements

1.1 Purpose of Document

Typically referred to as "Corporate Services", the Government of Canada's (GC) Internal Services enable public programs, as well as other internal services, to operate more efficiently and effectively.

The Profile of GC Internal Services outlines a whole-of-government perspective and reference of the GC's internal services for supporting a common government-wide approach to planning, design, budgeting, reporting and communications of GC internal services ^{See footnote 4}.

The Profile of GC IT Services presented outlines:

• A GC context for IT Services in line with the Profile of GC Internal Services;
• The most common sets of GC IT services for five main IT service groups;
• A common GC IT Services Framework comprised of a common process model for planning, acquiring, delivering, supporting and evaluating common GC IT Services; and
• A common cost model proposed for GC IT Services.

The most common sets of GC IT services are presented for five main IT service groups:  Distributed Computing, Application/Database Development and Maintenance, Production and Operations Computing, Telecommunications Network – Data & Voice, and IT Security.

GC IT Services are planned, acquired, built, delivered, supported and evaluated upon a common process model for IT Services.  The structure of this process model for IT, as presented, is similar to all GSRM provider programs and consists of three process groups:  Program management processes; Service delivery processes; and Service support processes.

In addition, a common cost model for GC IT Services is presented which offers a template planning and budgeting the direct and indirect costs of GC IT Programs.

As a GC TBS guideline, the Profile of GC IT Services provides an enterprise view and reference point for GC's IT Programs that supports the development of consistent IT service descriptions, more detailed IT service catalogues of IT Service Providers (as required), as well as the basis for common planning, design and communications of GC IT Services across government.  Over time, the Profile presented may evolve into a program area standard reference model for IT, GC Internal Services and the GSRM.

In addition, the Profile of GC IT Services can help support the achievement of several other key ERC recommendations for GC IT Programs by providing a framework for developing more detailed standardizing IT Service catalogues, the design of strategic key performance indicators (KPIs) for IT Programs, and advancing a common GC IT reference model.

1.2   Approach

The Profile of GC IT Services is the result of a collaborative effort of the CIOB's Information Technology Division (ITD) and Alignment and Interoperability Division (AID).

The Profile of GC IT Services presented is based upon an in-depth knowledge and analysis of IT across the GC IT Community of Practice, sound industry best practices for IT Programs/Services, and is aligned with the concepts and models offered by the Governments of Canada Strategic Reference Models ^{See footnote 5} (GSRM).

The initial draft Profile was derived from an analysis and synthesis of several key GC studies and a literature review of the relevant best practices, listed below.

• The process for developing a framework describing IT Services first began with the Horizontal Review on Common Infrastructure and Service Delivery (CISD) reported in December 2003.
• Complementing the CISD study, the results of a multi-department IT Overview Assessment (ITOA) study, provided a provisional set of standardized definitions of IT services, based on world-wide best practices researched by industry experts Gartner Inc.
• The government-wide ERC study refined descriptions from the CISD and ITOA studies for the government-wide survey and report on IT Services, with a broad base of government-wide consultations including departments, agencies, and CIO Council.
• The Profile of IT Services as presented was derived from an analysis of the CISD, ITOA, ERC studies; the Business Case for Enterprise IT Services (PWGSC, 2004); and a selected literature review of relevant best practices on IT Services.
• The draft Profile of IT Services was vetted with IT industry analysts from META Group Consulting Inc. (now part of Gartner Inc.).
• The updated release (V 1.2, June, 2008) incorporates the results of three selected "pathfinder" departments that were engaged to validate the IT services description in an actual operational environment.  The objective of this engagement was to determine the adequacy, relevancy, and completeness of the services, and to arrive at a comprehensive and holistic categorization of IT services, one that can be used across all of government for the purpose of common expenditure reporting.

A Working Group (WG) mandated by the GC IT/IM Management Board (IMB) have provided valuable insights and advise on various aspects of IT Services during the course of developing the Profile of GC IT Services – Version 1.0 as presented (see Acknowledgements for IMB WG).  In addition, a high-level summary of the GC IT Services Profile has been presented for communication and general feedback to the GC CIOC.

Following the endorsement and direction of the IMB WG, the next steps for advancing the Profile of GC IT Services will engage the GC IT Community at large, with implementation tasks including:  broad communications to build "bench-strength" support for the changes; workshops; testing; as well as implementation consulting and alignment with other GC planning and budgeting vehicles such as the GC Program Activity Architecture (PAA).

1.3   Context – Profile of GC Internal Services

Typically referred to as "Corporate Services", the Government of Canada's (GC) Internal Services enable public programs, as well as other internal services, to operate more efficiently and effectively.

The Profile of GC Internal Services outlines a whole-of-government perspective and reference of the GC's internal services for supporting a common government-wide approach to planning, design, budgeting, reporting and communications of GC internal services ^{See footnote 6}.

Figure 1 - Profile of GC Information Technology Services

The Profile of GC Internal Services outlines the internal services in the following 11 main internal service groupings: Management and Oversight Services, Communications Services, Legal Services, Human Resources Management Services, Financial Management Services, Information Management Services, Information Technology Services, Travel and Other Administrative Services, Real Property Services, Materiel Services and Acquisition Services.

The Profile of GC Internal Services provides a framework that can support the development of more detailed design models for GC internal services/initiatives, the design of strategic key performance indicators (KPIs), and advancing a common GC Internal Services reference model.

The final Profile of GC Internal Services⁶ outlines the internal services in the following 11 main internal service groupings:

• Management and Oversight Services
• Communications Services
• Legal Services
• Human Resources Management Services
• Financial Management Services
• Information Management Services
• Information Technology Services
• Travel and Other Administrative Services
• Real Property Services
• Materiel Services
• Acquisition Services

The Profile of GC Internal Services will continue to evolve over time, with increases in knowledge from communities of interest, best practices and advancements in the areas of internal services modernization and government shared service initiatives.

1.4   GC IT Services - in brief

The Profile of GC IT Services, as highlighted in Table 1, outlines the most common sets of GC IT services for five main IT service groups:  Distributed Computing, Application/Database Development and Maintenance, Production and Operations Computing, Telecommunications (Data and Voice), and IT Security.

The common sets of GC IT Services comprising each of the five main GC IT Services groups are described in Section 2.0

1.5   GC IT Services Program Framework - in brief

GC IT Services are planned, acquired, built, delivered, supported and evaluated upon a common process model for IT Services.  The structure of this process model for IT, as presented, is similar to all GSRM provider programs and consists of three process groups, as shown below:

• IT Program management processes ^{See footnote 7};
• Service delivery processes ^{See footnote 8}; and
• Service support processes.

Figure 2 - Process Model for GC IT Services Program Framework

Image showing the three process groups that make up the Process Model for the GC IT Services Program Framework: IT Program Management Processes which are Plan and Organize, Acquire and Implement and Monitor and Evaluate. The IT Service Support Processes are Service/Helpdesk, Incident Management, Problem Management, Change Management, Release Management and Configuration Management. The IT Service Delivery Processes are Service Level Management, IT Financial Management, Availability Management, Capacity Management, IT Service Continuity Management and IT Security Management. IT Service Group Offerings are Distributed Computing Environment, Application/Database Development and Maintenance, Production and Operations Computing, Telecommunications (Data and Voice) and IT Security.

The common GC IT processes comprising the GC IT Services Program Framework shown above, along with additional information and a proposed IT cost model, are described in the Section 3.4.

2.1 Distributed Computing Services

Distributed Computing Services (DCS) includes the provision and support that provides users with local and remote access to individual, workgroup, DCS program-specific and DCS corporate applications, workstation provisioning/support and Local Area Network (LAN, physical or virtual) functionality including file/print and directory services.

• Workstation Service: Provides provision and support for the underlying capabilities, including the local physical workstation hardware (any standard interface device) to access and use DCS applications and to be an interface to all other authorized applications and services. Components include the physical workstation hardware (desktop computer, notebook computer, thin-client device, PDA (data side)); provision/support activities (including procurement, installation/configuration, operating, protecting and decommissioning); and operating system, Internet browser, and corporate portals.
• Desktop and Office Productivity Suite:  Provides provision and technical support for desktop/office productivity suite applications and local/LAN-based (physically or virtually) standard utilities. Components include desktop/standardized office suites software (word processing, presentation, spreadsheet, etc. functionality), records and document management applications (e.g. RDIMS); provision and support activities (including procurement, installation/configuration, operating, protecting and de-installation activities); and local/LAN-based standard utilities such as anti-virus, security, data handling tools, and client-side printing utilities.
• Workgroup Collaborative Services:  Provides provision and technical support for workgroup collaborative applications. Components include workgroup collaborative tools (e.g. group scheduling, group database applications, electronic forums and/or community of interest workspaces); and authorized wikis, blogs and other electronic collaborative utilities.
• Email and Directory Service:  Provides support for e-mail functionality including transmission, instant messaging and scheduling, along with enabling directory services. Components include mail servers, including all activities such as procurement, configuration and protection; and Logical Access Directory Service that provides the set of capabilities that support identity/group-based privileges to users who require access to email and DCS applications, data and/or printers.
• GC Corporate/Program-Specific Application Services:  Provides the set of capabilities that operate and support program-specific and corporate applications enabling service delivery, administration, management, information management and decision-making activities within a distributed computing environment. Functionality includes "common components" which are shared automated business processes (such as credit card verification, address change, etc.). Components include DCS program-specific applications; DCS corporate applications; and DCS common components.
• File/Print Service:  Provides the set of capabilities that support user/group access for the storage, retrieval and protection of office-type documents (such as word processing, spreadsheets, presentations etc.), DCS data files and shared workgroup folders and the provision of 'server-side' print services. Components include file sharing/management servers; and server-side printing servers.
• Remote Access Service:  Provides the set of capabilities that support remote end-users with complete access to the standard distributed computing desktop components, applications and data via access over a Secure Remote Access (SRA), dial-in or wireless service. Components include remote access software and hardware; and communications software.

2.2 Application/Database Development and Maintenance Services

The Application/Database Development and Maintenance Service involves the development, implementation, integration and maintenance of the departmental IT application development and database management services. These services include all of the services that develop, test, integrate, implement, deploy, maintain and release manage IT applications and database management systems. In this context, an application is an automated form of business processes that can be a custom application, adapted application (from a package) or enhanced application (maintenance). A database is an automated form of data/information supporting applications and business processes. Applications and database components support program-specific, cross-program and enterprise-wide processing needs.

• Applications Development/Maintenance Services: These services provide new functionality (custom coding), adapted functionality (adaptation of a software package) or enhanced capability (maintenance to an existing application) in response to business requirements following a structured systems development (maintenance) methodology and in accordance with policy, legislative or service delivery requirements. Services also include the development of functionality to integrate or link internal or external applications/components. Maintenance activities pertain to breaks & fixes, patches and application impact analysis/operating systems upgrades. Components include planning, definition, design/specification/verification, acquisition (if applicable), programming (if applicable), integration (if applicable), documentation, and reporting and management activities.
• Database Development/Maintenance Services:  These services include development, installation, management, monitoring and support of database management systems including database architectures for information systems, data models, delivery platforms, systems, and procedures governing data collection, data administration, backup and recovery, and data access and security. In addition, these services include the definition of enterprise data models and architectures, the selection, application and implementation of database management tools, new uses of database technology, the interrelations between hardware/software/data and users and rules regarding data quality, privacy, security and access.
• Deployment Services:  Provides support for the implementation and rollout of new, adapted or enhanced applications/databases and any supporting deployment technology. Deployments are based on Information Technology Infrastructure Library (ITIL) standard processes. Deployment activities pertain to promotion of "Released" applications/databases into the production environment and all processes related to implementation. Components include hardware or software procurement; configuration/tuning; staging; installation; and user/client group training.
• Integration Services:  Provides support the for the implementation and management of services that link applications/databases (custom or pre-packaged) to each other or with the established or planned information technology and using standard application programming interfaces (APIs). Integration services pertain to technical level integration (i.e. at workflow, business model process level based on business or technical requirements). Components include standard interface protocols; middleware; and standard adapters/interface protocols.
• Engineering and Testing Service:  Provides support for a consolidated and managed facility and technical services for a base-lined engineering lab used to conduct development and configuration testing of new software/hardware products, or troubleshooting and patching of exist software, or hardware destined for the Production and Operations Computing environment. Components include all types of testing: functionality, stress, system integration, interoperability testing, and user testing and acceptance testing; quality assurance (impact analysis in the test environment); and readiness for production and operations.
• Certification/Release Service:  Provides support of the post-development/pre-production test environment which ensures that any new or enhanced applications/databases being deployed into the Production environment are certified to meet all standards and will not impact the installed base of production applications and technology in its released state. Certification and Release services are based on Information Technology Infrastructure Library (ITIL) standard processes. Components include certification; quality assurance (from impact analysis into production); and release to Production and Operations.

2.3 Production and Operations Computing Services

The Production and Operations Computing Service Group includes the provision, technical support and certification for the hosting of the enterprise's day-to-day operations and production applications and database computing environments, including Web application environments, regardless of where they reside in the virtualized data centre or within the business unit (in a server room). Included in this service group is the execution of business resumption plans and disaster recovery plans developed under Security Services.

Utility Computing Services:  Provide the support and capabilities for deploying repeatable technical provisioning services, procedures, and customized support options in a highly available, scalable, reliable, secure and manageable technology infrastructure. It also provides the set of capabilities that support program-specific activities that do not require specific technology infrastructure/technical services and corporate administrative application systems. Components include data centre or server room hardware and operating software systems; infrastructure operations, including certification of new hardware; database and application system specific storage and servers management; directories for applications, Data Naming Service (DNS) and other uses; data and applications (production) configuration; centralized storage, backup and recovery, including business resumption and disaster recovery (as an activity); software distribution/updates (standard versus required maintenance activities); data centre or server room hardware upgrades/extensions; centralized print and distribution services; sizing and scalability analysis for technology within scope of the utility computing services; system installs, moves, adds and changes (IMACs) in the data centre or server room; performance monitoring, adjusting, control and system; user account administration, asset inventory, license management; and technical environments to support research and testing.

• Dedicated Application Hosting & Management Services:  Provide the support and capabilities for the operation and management of a specific/dedicated technical environment that may employ specialized computing equipment and is outside of 'utility' computing services. Components include specialized or dedicated computing equipment.
• Facilities Management Services:  Provides the support and capabilities for the 'end-to-end' management of physical complexes/computing facilities and facilities management services in a data centre or server room. Components include heating, ventilation and cooling systems; environmental controls; uninterrupted power supplies, diesels, conditioned power and power distribution; physical security access; and cabling, equipment racking, etc.

2.4 Telecommunications (Data and Voice) Services

Telecommunications service group includes the transmission of data and voice within and across the enterprise. Data network services include the provision and ongoing support of multi-platform, multi-protocol electronic data and communications networks, which includes all software as well as wiring, switches, hubs, routers and all other hardware required to support data communications between computing devices. The voice communication services include the provision of local and long-distance services globally, as well as fax services, voice mail, video-conferencing, secure voice and other related services, which include all carrier software and hardware environments.

Note: This service group has a strong direction towards the convergence of voice and data networks.

• Data Network Infrastructure Services:  Provides the support and capabilities for all data network traffic between nodes on the network (internal and external origin of transmission). It provides support for client access connectivity where the user communities are connected to the data network infrastructure. The services include network and management operational activities for the data network infrastructure. Components include CSU/DSUs; private circuits; frame relay; dedicated Internet connections; public broadband Internet connections; private and public Internet-based VPNs; and satellite, microwave and dial-up.
• Inter and Intra-Data Centre Network Services:  Provides the support and capabilities for the interconnectivity translation of network elements between transmission facilities and computing facilities. It includes network and management operational activities for inter and intra-data centre network infrastructure. Components include multiplexers, switches, bridges, routers, protocol converters and VPN gateways.
• Voice Network Services:  Provides support and capabilities for long distance, inter-campus, private network (i.e. internally managed across a corporate facility) and virtual network (i.e. external service provider managed) components along with providing the set of capabilities that support the software and hardware for a virtual voice, secure voice and a private voice network. It includes network and management operational activities for voice network infrastructure. Components include Public Switched Telephone Network (PSTN); point-to-point video teleconference; dedicated access lines; Software Defined Networks (SDN, V-Net and VPN); PBX and tandem switch; and voice services on all client-end and handheld access devices (such as, cell phones, PDA's, kiosks, Blackberries, etc.).
• Call Centre Services:  Provides the capabilities and technology that allow external (citizens, other jurisdictions, businesses, etc.) and internal stakeholders the ability to communicate with a government service agent or automated self-service system across a variety of media and channels. It includes network and management operational activities for the call centre infrastructure. Components include IVR, PBX, ACD; Centrex; toll-free numbers; telephone and related set/equipment; and call centre management and monitoring systems.

2.5 IT Security Services

IT Security Services is concerned with applying "safeguards to preserve the confidentiality, integrity, availability, intended use and value of electronically stored, processed or transmitted information" (GSP, MITTS).

• IT Environment Protection Services:  Provides the set of capabilities that support physical security measures to reduce the risk of unauthorized access to information, IT assets, and facilities. This would include the protection and disposal of sensitive IT media in appropriate containers designed to resist fire, environmental damage, and unforeseen hazards (for both on-site and off-site storage). Also included would be the use of TEMPEST protection to ensure emanations by radiated signals do not contain compromising information. IT environment protection services also involves personnel identification provided by the set of capabilities that support establishing trust in personnel and others, who require access to government facilities, systems, and networks; including security requirements for personnel screening. Components include physical site card readers; and protection and disposal of sensitive IT media in appropriate containers designed to resist fire, environmental damage, and unforeseen hazards (for both on-site and off-site storage).
• Identification, Authentication and Authorization Services:  Provides the set of capabilities that support obtaining information about those parties attempting to log on to a system or application for security purposes and the validation of those users. Privileges and access control mechanisms and their management are provided to support the granting of abilities to users or groups of users of a computer, application or network and support the confirmation of authority to enter a computer system, application or network.

  Components of the service typically include: access management, authentication, delegated administration, directory services, trusted identities, password management, provisioning, privilege management, self-service, and single sign-on. In practice, it may leverage a Public Key Infrastructure (PKI) that is a system of digital certificates, certification authorities, and other registration authorities that verify and authenticate the validity of each party involved in an electronic transaction.

  Also included are the non-repudiation services that provide the set of capabilities to prevent an individual or entity from denying having performed a particular action related to data by making available historical records of actions related to any transaction.

  Components include access management technology and supporting management software (includes smart cards, biometric readers, user ids/passwords, etc.); authentication (trusted identities and pseudo identities) and password management software (may leverage a PKI which would include PKI support management activities); provisioning; privilege management and delegated administration; and security directory services.

• Secure Communications Services:  Provides the set of capabilities to secure communications based on the sensitivity (i.e. confidentiality, integrity, and availability) requirements of the information. Cryptographic mechanisms such as encryption are used to protect the confidentiality of voice and data communications. Cryptographic protection also involves the use of digital signatures to provide a set of capabilities that verify the authenticity of the data against unauthorized modification, deletion, creation and replication. Cryptographic security advice, guidance and technical services are provided to assure that sensitive and classified information is afforded an appropriate level of protection.

  Secure communications requires the use of a trusted and robust key management infrastructure. Key management services such as operation of the Classified Canadian Electronic Key Management System (CCEKMS) and GC PKI are provided to ensure a source of trusted cryptographic keying material. Provides the support for secure communications based on the sensitivity (i.e. confidentiality, integrity, and availability) requirements of the information.

  Components include cryptographic mechanisms such as encryption used to protect the confidentiality of voice and data communications; cryptographic protection, which may also involve the use of digital signatures to provide a set of capabilities that verify the authenticity of the data against unauthorized modification, deletion, creation and replication; and cryptographic security advice, guidance and technical services provided to assure that sensitive and classified information is afforded an appropriate level of protection.

• Perimeter Defence, Detection, Response, Recovery and Audit Services:  Provides the set of capabilities that support network security services at network boundaries including firewall, intrusion detection systems, anti-viral and anti-vandal gateways, content filtering, anti-spam gateways, malicious code defence software, and a secure area for application security services (i.e. DMZ).

  The set of capabilities that support the detection of unauthorized access or entrance into computer systems is also provided as part of this service. It provides the capabilities that support monitoring, analysis, network mapping and collection of alarms, events, and/or incidents. Incident response services provides the set of capabilities that support responding effectively to an incident and/or attack by mitigating the effects of such incidents on systems and networks and reporting incidents to all levels of authority within the enterprise. Incident reporting provides the set of capabilities that support communicating the incident specifics, including impact and the response. Audit trail capture and analysis provides the set of capabilities that support the identification and monitoring and post-analysis of activities within an application or system.

  Services also include the provision of information infrastructure protection services that include the activities typically associated with network vulnerability assessments, analysis of threat agents, tools, techniques or technical trends, incident analysis support and training and awareness; as well as IT security policy, security audit, disaster recovery/business resumption planning, network vulnerability assessments and isolation activities.

  Components include firewalls; intrusion detection systems; anti-viral and anti-vandal gateways; content filtering and anti-spam gateways; malicious code defence software; secure area for application security services (i.e. DMZ); monitoring, analysis, network mapping and collection of alarms, events, and/or incidents; and audit trail capture and analysis, providing the set of capabilities that support the identification and monitoring and post-analysis of activities within an application or system.

Expanded and includes services outlined in TBS Policy - Operational Security Standard:  Management of Information Technology Security (MITS), April 2004; Part III – Technical and Operation Safeguards, Sections 16, 17, 18.

Overview

The GC IT services identified above are the services seen by IT consumers.  These services are planned, acquired, built, delivered, supported and evaluated upon a common process model for IT services.  As shown in Figure 3, the structure of this process model for IT is similar to all GSRM provider programs and consists of three process groups:

• IT program management processes –manage the direction, acquisition and investment, as well as the overall performance of the program;
• IT service delivery processes –provide the service specific planning, provisioning, delivery, and decommissioning processes for the services provided by the program; and
• IT service support processes –provide the support processes common to all services delivered by the program.

3.0 Profile - GC IT Services Program Framework - Figure 3 text version

Image showing the three process groups that make up the Process Model for the GC IT Services Program Framework: IT Program Management Processes which are Plan and Organize, Acquire and Implement and Monitor and Evaluate. The IT Service Support Processes are Service/Helpdesk, Incident Management, Problem Management, Change Management, Release Management and Configuration Management. The IT Service Delivery Processes are Service Level Management, IT Financial Management, Availability Management, Capacity Management, IT Service Continuity Management and IT Security Management. IT Service Group Offerings are Distributed Computing Environment, Application/Database Development and Maintenance, Production and Operations Computing, Telecommunications (Data and Voice) and IT Security.

In the case of IT services, this program structure lends itself to the use of widely recognized international best practices offered by Control Objectives for Information and related Technology (COBIT) and Information Technology Infrastructure Library for Service Management (ITIL).

COBIT provides an industry best practice reference model of common IT management and governance processes within four groups:  Plan and Organise, Acquire and Implement, Deliver and Support, and Monitor and Evaluate.  ITIL provides a framework of common IT processes for the service delivery and service support processes (IT Service Management Framework).

While service delivery and service support processes are defined in both COBIT and ITIL reference models, ITIL is most recognized as a de facto standard for IT service delivery and IT service support processes.

In view of the above, the program structure for GC IT Services described below adopts:

• the ITIL framework for IT Service Support and IT Service Delivery processes, and
• the COBIT framework for IT Program Management processes (i.e. plan, acquire, monitor/evaluate).

The processes for IT Service Delivery, IT Service Support and IT Program Management for GC IT Services, as shown in Figure 3, are described next.

3.1 IT Service Delivery Processes

This group of service delivery processes focuses on service-specific planning, provisioning, delivery, continuity, security and decommissioning processes for the services provided by the program ^{See footnote 9}.

• Service Level Management.  Service Level Management involves the processes of planning, coordinating and reporting on Service Level Agreements (SLAs) between the IT service provider and customer/client group; and the ongoing reviewing of service achievements to ensure that service levels and quality are consistently delivered and maintained.
• IT Financial Management.  IT Financial Management involves three main processes - budgeting, IT accounting, and charging – to ensure the cost-effective stewardship of IT assets and resources used in providing IT services.  Charging is an optional activity and is dependent on the charging policy of the organisation as a whole.
• Availability Management.  Availability Management is concerned with the design, implementation, measurement and management of IT infrastructure availability to ensure the stated business requirements for availability are consistently met, according to agreed levels.
• Capacity Management.  Capacity Management is the focal point for all IT performance and capacity issues.  Capacity Management aims to optimize the amount of capacity needed to deliver a consistent level of current and future services.
• IT Service Continuity Management.  IT Service Continuity Management involves undertaking a systematic approach to the creation of a plan and or set of procedures (which are updated and tested regularly) used to prevent, cope with, and recover from the loss of critical services for extended periods, in line with business continuity plans.
• IT Security Management.  IT Security Management processes involve organizing the collection, storage, handling, processing and management of data and services in such a way that the integrity, availability, and confidentiality business conditions are satisfied.

3.2 IT Service Support Processes

This group of service support processes focuses on the day-to-day operational services common to all IT services.  They include service/help desk processes which interact directly with IT program customers; however, the value contribution of these processes to the IT services is more indirect than that of the service delivery processes and this is indicated in Figure 3 by placing these "behind" the service delivery processes ^{See footnote 10}.

• Service/Help Desk.  The Service/Help Desk is the single contact point within the IT provider organization for all end-users to seeking assistance and support for IT services and/or related problems, incidents, questions, and complaints.
• Incident Management.  The primary goal of the Incident Management process is to restore normal service as quickly as possible following loss of service, and to minimize the adverse impact on business operations, thus ensuring that the best possible levels of service quality and availability are maintained.
• Problem Management.  The goal of Problem Management is to minimize the adverse impact of incidents and problems on the business as may be caused by errors within the IT infrastructure, and to prevent recurrence of incidents related to these errors.
• Change Management.  The goal of Change Management is to ensure that standardized methods and procedures are used for the efficient and prompt handling of all changes, to minimize the impact of change-related incidents and improve day-to-day operations.
• Release Management.  Release Management is very closely linked with Configuration Management and Change Management, and undertakes the planning, design, build, and testing of hardware and software to ensure that all aspects of a release, both technical and non-technical, are considered together.
• Configuration Management.  Configuration Management covers the identification of all significant components within the IT infrastructure and recording details of these components in the Configuration Management Database (CMDB).

3.3 IT Services Program Management Processes

This group of program management functions is dedicated to managing the direction, investment, and overall performance of the program.  The IT Services Program Management Processes fall into three groups ^{See footnote 11}:

• Plan and Organize.  This grouping sets the direction and objectives for the IT services program.  This function also includes the processes required to manage the resources common to the program.  Processes within this group include define a strategic IT plan; define the enterprise architecture ^{See footnote 12}; determine technological direction; define the IT processes, organisation and relationships; manage the IT investment; communicate management aims and direction ^{See footnote 13}; manage IT human resources; manage quality; assess and manage IT risks; and manage projects.
• Acquire and Implement.  This grouping develops and/or acquires and implements IT solutions and their enhancements or maintenance.  Processes in this group include identify automated solutions; acquire and maintain application software; acquire and maintain technology infrastructure; enable operation and use (including user training); procure IT resources; manage program changes; and install and accredit solutions and changes.
• Monitor and Evaluate.  This grouping monitors and evaluates the overall effectiveness of an IT services program.  Processes in this group include monitor and evaluate IT performance; monitor and evaluate internal control; ensure regulatory compliance; and provide IT governance.

3.4 GC IT Services Cost Reporting Model

Table 2 outlines a common cost model for GC IT services and offers a template for planning and budgeting the direct and indirect costs of GC IT programs and associated GC IT services .

1. This template can be applied to create a Direct Cost View table, Indirect Cost View table, as well as Expected/Actual Savings Realized table
2. See descriptions for processes comprising Plan and Organize, Acquire & Implement, and Monitor and Evaluate
3. If the table is not accessible to you, please contact publicenquiries-demandesderenseignement@tbs-sct.gc.ca.

In brief, the following discusses how the GC IT Program Service Cost Model may be applied:

• The model shown could be applied for three main views of budget – Direct Costs, Indirect Costs and as a view of Expected/Actual Savings Realized.  Minimally, there will be a view of Direct Costs.
• Costs may be allocated by common IT Processes (the rows) or by IT Services (the columns).
• For those IT Program budgeting by IT Services (columns), costs could be allocated to selected IT processes (rows) using an allocation formula.
• On the other hand, for those IT Programs budgeting by IT Process (rows), costs could be allocated to selected IT Services (columns) using an allocation formula.
• For an IT Process (rows) that generally contributes to more than one IT Service, costs could be allocated to the applicable IT Services (columns) using an allocation formula.
• Types of IT Program costs budgeted and reported will include capital, operating and maintenance, and salaries.
• Depending on the desired level of budgeting details for an IT Program, budgets and reports may provide a next level breakdown of costs, such as hardware, software, people, external services/contracts, facility, and accommodation.
• Indirect Costs are those incurred in the course of providing products/services, but which cannot be traced directly to a program or service because it has been incurred for a number of programs or services.
  • For those IT Programs budgeting Indirect IT costs, a table view of indirect costs could include, for example, prorated portions of a department's overall costs for operating facilities, fixed assets, and corporate services (e.g. finance, human resources, materiel, etc.).
  • In some organizations, the total of overhead costs are distributed across their respective programs, including the IT program, using a pre-determined formula.