1. ITIL ® AITR Workshop 0 ITIL ® AITR Workshop: Change, Configuration & Release Management April 4, 2007

2. ITIL ® AITR Workshop 1 Agenda ITIL ® : What is it and How Can it Help You? ITIL ® : Process Roll-Out – Change, Configuration, Release Why are We Implementing ITIL ® Processes? Agency Onboarding Schedule What are the Impacts to an Agency? Agency Interface to Change When to Submit a Change Request? How Fast Will Change Requests be Approved? How to Get Changes (Code) Out in a Timely Manner? Testing Expectations from Agencies Who Will Perform the Change? Forward Schedule Of Change (FSC) Security Concerns ITIL ® information Sources

3. ITIL ® AITR Workshop 2 ITIL ® : What is it and How Can it Help You? ITIL ® stands for Information Technology Infrastructure Library - - - set of books ITIL ® will address IT business problems that are caused by unmanaged change (e.g. unplanned changes that affect other operations, which may cause an outage) ITIL ® is a “Framework” to establish and manage quality IT processes - - - based on industry “best practice”

4. ITIL ® AITR Workshop 3 ITIL ® : Process Onboarding Note: Only Phase I Has Direct Customer Impact

5. ITIL ® AITR Workshop 4 Phase I - Change Management Goal/Objective: Use standardized methods and procedures Efficient and prompt handling of all Changes Minimize the impact of any related Incidents upon service

6. ITIL ® AITR Workshop 5 Phase I - Configuration Management Goal/Objective: Make accurate information accessible (physically but also logically) to everybody who needs it in a timely manner Enable control of the infrastructure by monitoring and maintaining information on all resources needed to deliver services, their status, history and relationships

7. ITIL ® AITR Workshop 6 Phase I - Release Management Goal/Objective: Ensure quality of production environment by using formal procedures and checks when implementing new versions.

8. ITIL ® AITR Workshop 7 Why Are We Implementing ITIL ® Processes? To provide better customer service, there needs to be controls and metrics To provide standard and repeatable processes Reduce downtime and increase productivity – System and Personnel

9. ITIL ® AITR Workshop 8 Service DeskDesktopMessaging Services Enterprise Exchange/Outlook Email Enterprise Collaboration tools Active Directory, DNS Mass Desktop Refresh Projects Network Printer Consolidation and Refresh Enterprise Desktop Management Systems New IBM and Unisys Mainframes in new Data Center Consolidation and refresh of servers Migration of servers to the data center Enterprise Service Desk in Lebanon and Meadowville Field Based agents and technicians for Level 3 Enterprise Help Desk System (ServiceCenter) New Data Center/Office Building in Meadowville New Disaster Recovery Center and Help Desk in Lebanon/Russell County New Commonwealth-wide MPLS Core WAN LAN upgrades to local switches/routers as needed Network Re-addressing of IP, DHCP Voice over IP Network optimized for voice and video traffic Enterprise Security Operations Center Computer Security Incident Respon Center Secure Internet Gateway Security Network Voice / Video Mainframe and Servers Facilities Tier 3 and Tier 2 ITIL ® Moving from agency-centric operation to an enterprise-managed service “People – Process – Tools”

10. ITIL ® AITR Workshop 9 Service DeskDesktopMessaging Services Enterprise Exchange/Outlook Email Enterprise Collaboration tools Active Directory, DNS Mass Desktop Refresh Projects Network Printer Consolidation and Refresh Enterprise Desktop Management Systems New IBM and Unisys Mainframes in new Data Center Consolidation and refresh of servers Migration of servers to the data center Enterprise Service Desk in Lebanon and Meadowville Field Based agents and technicians for Level 3 Enterprise Help Desk System (ServiceCenter) New Data Center/Office Building in Meadowville New Disaster Recovery Center and Help Desk in Lebanon/Russell County New Commonwealth-wide MPLS Core WAN LAN upgrades to local switches/routers as needed Network Re-addressing of IP, DHCP Voice over IP Network optimized for voice and video traffic Enterprise Security Operations Center Computer Security Incident Respon Center Secure Internet Gateway Security Network Voice / Video Mainframe and Servers Facilities Tier 3 and Tier 2 ITIL ® Moving from agency-centric operation to an enterprise-managed service “People – Process – Tools”

11. ITIL ® AITR Workshop 10 Transformation: A Three-Year Program FROM  68,000 desktops (varying standards)  40+ help desks  3,000+ servers  85+ Internet connections  No common SLA management  Ad hoc, Inconsistent Processes / Procedures TO  Standard platform and images  1 Enterprise Help Desk  1,000 Physical Servers (Target)  2 Redundant Internet Connections  Enterprise SLA Standards  ITIL ® Compliant Processes / Procedures “If you got best practices in place for a well-managed environment, you can reduce your total cost of ownership by as much as 25% to 30%.” - Gartner

12. ITIL ® AITR Workshop 11 Agency Onboarding Schedule Phase 1 Key Dates: ITIL ® Change, Configuration and Release Management –User Test Training: 19 Feb 07 – 2 Mar 07 –User Test: 5 Mar 07 to 30 Mar 07 –Process Implementation: –Agency Pilot (VITA) - April –IT Partnership Onboarding – May / June –Other Agencies – As Scheduled (beginning July)

13. ITIL ® AITR Workshop 12 Agency Impacts: Pre-Agency Onboarding Agencies will continue to use their current Software Engineering Processes for Change, Configuration, and Release Management IT Partnership staff will be following the Enterprise Change Management Process for the IT Partnership Infrastructure (no Agency impact)

14. ITIL ® AITR Workshop 13 Agency Impacts: Post-Agency Onboarding Agency Software Releases need to be coordinated with ITP Release Management for Planning, Build and Roll-Out of the Release (Triggered by a Change Request) Change Requests are required for any addition, modification or removal of IT components in the IT Partnership Production Infrastructure (Includes Software and Hardware) Agencies will identify interface points within their current process to interact with the IT Partnership Change Management process

15. ITIL ® AITR Workshop 14 Agency Interface to Change Development and Test Environments IT Partnership Production Infrastructure (Controlled) When there is impact to the Production Infrastructure, a Change Request is submitted by the Requestor.

16. ITIL ® AITR Workshop 15 When to submit a Change Request? The timing of a change request submission depends on the classification of the request: All questions and concerns about when, and how to submit your CR should be communicated with your Regional Change Manager or the IT Partnership Service Level Director Major Change Request: Type 1– For a large proposed change that does not require a new design for a solution, we ask that you submit the change request after you have unit and system tested the change. Minor Change Request– For smaller changes, such as requesting a new version of MS Visio, we ask that you submit the change request after testing for compatibility within your environment. Major Change Request: Type 2– For a large proposed change that does require a new design for a solution, we ask that you submit the change request during the Design Phase. Ideally, the submission should occur when enough data has been gathered to properly communicate and coordinate with Change Management.

17. ITIL ® AITR Workshop 16 When Do I Create a Change Request?

18. ITIL ® AITR Workshop 17 How Fast Will Change Requests be Approved? Change ClassCriteriaExpected Approval EmergencyUnplanned changes Service is down, requires immediate attention to restore Always High Priority Emergency CAB (ECAB) approves As soon as the ECAB can be contacted Immediately to same day MajorPlanned changes of higher complexity Service has potential to be impacted, but planning and scheduling mitigate outage Scheduled CAB approves 1-5 days MinorPlanned changes of lower to medium complexity Service generally not impacted. Change Manager approves, or Scheduled CAB approves 1-5 days StandardPlanned, routine changes No impact to services Low impact, Low priority changes typically repeated and well known Pre-approved First occurrence needs to go through full process to be identified as a “Standard” change

19. ITIL ® AITR Workshop 18 What are the basic mechanics of the Change Advisory Board (CAB)?  The Regional ITIL ® Change Manager will set a regular meeting schedule  Regional IT Partnership and Agency employees will participate in the CAB meetings  Agency CAB members will be identified as part the ITIL ® Onboarding process  Agency CAB members will only need to meet about their Agency’s change requests  The Peregrine tool will send a ‘notification’ regarding when change requests require CAB participation  CAB members are expected to review and comment on CRs independently  The CAB will only discuss CRs when there is disagreement or when clarification is needed

20. ITIL ® AITR Workshop 19 Forward Schedule of Change (FSC) Approved Changes Allows for Proper Planning and Coordination Planned Events Maintenance Schedules Change Data Contains:  Change Title  Estimated Time For Change (Start / End)  What / Who is Affected  Primary Contact (Team/Agency)

21. ITIL ® AITR Workshop 20 How to Get Changes (Code) Out in a Timely Manner? PLAN Communicate: Stakeholders Change Manager Properly Document the Change Details: Who, What, When, Where Be thorough when completing the Change Request (CR) Identify all areas that may be impacted by the change and ensure that the Stakeholders understand the risks. Must have buy-in and acknowledgement to proceed. Prior Planning Prevents Poor Performance Tips:  Submit Change Requests as soon as details are known  DO NOT submit requests at last minute. It is best to communicate with Change Management as soon as all of the details are known about the change that has been identified. Coordinate with all stakeholders to properly plan for the event.

22. ITIL ® AITR Workshop 21 Testing Expectations From Agencies Test Plan Test Procedure “EVIDENCE” Documented Test Results attached to the CR:  Unit Test – Results  (Include Screen Shots if available)  Functional Test - Results Testing is required for all changes that will be introduced into the IT Partnership Production Environment. (Rigor of test is dependent upon complexity of the change)

23. ITIL ® AITR Workshop 22 Who Will Perform the Change? Changes to the ITP Production Infrastructure will be made by ITP Operations Staff Agency staff may be present, and are encouraged to participate in the overall change process. POC’s need to be identified and available for questions and/or assistance during change activities. Release, or deployment scripts/instructions, need to accompany all Change Requests.

24. ITIL ® AITR Workshop 23 ITIL ® Information Sources Agency Customers: Go to http://www.vita.virginia.gov/itpartnership/updates/coins.cfm#itil http://www.vita.virginia.gov/itpartnership/updates/coins.cfm#itil ITP and VITA employees: ITIL ® page on VITAWeb contains ITIL ® information: Go to https://vitaweb.virginia.gov/C2/ITIL/default.aspxhttps://vitaweb.virginia.gov/C2/ITIL/default.aspx –Use your DITLAN account to access the site Future COIN meetings – next April 25 Monthly AITR meetings Transformation Kick-Off meetings Monthly newsletters (e.g. IT Partnership News) VITA Transformation POC ITIL ® Change Champions Process Documentation – Send a request to questions@vita.virginia.gov There are multiple sources for you to obtain more information about ITIL ® :

25. ITIL ® AITR Workshop 24 Additional Security Concerns Outside Change, Configuration & Release Management

26. ITIL ® AITR Workshop 25 - Security Concerns - Question: How will the partnership ensure that infrastructure staff have the appropriate security clearances to access sensitive data? Answer:  Agency requirements have been gathered for protection of Sensitive data.  All IT Partnership personnel will go through a criminal background check.  Additionally, staff with proximity to an agency with additional background check requirements (VSP, Tax, HIPPA for example) will also go through those additional checks at the customer agency expense.

27. ITIL ® AITR Workshop 26 Access Policy Question: Will Agency personnel have “Admin Access?” Answer: Agency personnel will not have these access rights except on an documented, and agreed upon, exception basis.