Title Slide Higher Education Office of Information Technology Management Methodology By James M. Dutcher

Page 2 Organization Development Motivation Feedback Training Capabilities Processes IT Organization Structure Establish Planning Tactical (1-12 Months) Strategic (12-24 Months) Executive Mgt. Operational Mgt Knowledge Mgt. Access Needs Issues Stability Capability Culture ROI Services Financial Processes The Process of Managing IT Processes & Projects What When Who Where Which Why How If Direction/Focus Plan Do Check Act/Adjust Align Teams Individuals Projects Processes Financials (Capital & Budgets) and Assets (IT Staff & Resources) Measure (Results, Effectiveness, Improvement, Quality, Performance) (COMMUNICATIONS)

Page 3 IT Planning Institutional Strategic Plan Institutional IT Strategic Plan Academic Technology Strategic Plan Academic Technology Tactical Plans Org. IT Tactical Plans OIT Mgt Tactical Plans E-Learning Plans IT Business Plans Staff & Faculty Development Student Services Etc. Strategic Tactical Org. Strategic IT Plan

Page 4 IT Organization Structure OIT Management Info. Tech. Strategy Mission Goals Campus Strategic IT Plan Academic Tech. Strategic Plan Info Tech Planning Strategic Project Office Project Id & Selection Project Management Tactical & Budget IT Org. Management IT Governance & Steering Committees Internet Instructional Technology Administrative Systems Library Policy Security IT Processes & Procedures Policies & Procedures Standards IT Best Practices Methods & Management Admin. Systems Legacy Misc. Servers &Systems, HW/SW ERP Network Administration Data, Voice, Video Wired Wireless HW/SW Web Management Internet Intranet Portal HW/SW Academic IT Mgt Instructional Technologies Classroom IT Computer labs CMS HW/SW Knowledge Management On-line Documentation Library Library Data Warehousing Assessments IT Training Management Technology Training Business Process Training For Students, Faculty, Staff IT Helpdesk/Support Management Academic Technology Distance Learning Campus IT CRM Tactical Strategic Integration & Security Protocols EAI Disaster Recovery HW/SW Executive IT Management Operational (Day-to-Day) IT Management IT Knowledge Management

Page 5 At The Core of Proper IT Management is - Knowledge Management Knowledge Management The lines represent proper process which are the enablers of effective, efficient, and adaptable IT Management. This allows for proper planning, organizing, directing and controlling of all IT processes and resources

Page 6 Management–The Process–Links to CIO Methodology Planning Defining Organizational Goals Establishing Strategy Developing Plans Organizing Defining Roles &Tasks Designing Structures Assigning Authorities & Decision Making Controlling Monitor Performance Take Action To Ensure Desired Results Resolve Conflicts Directing Direct Activities Inspire Commitment Create/Select Effective Communications Channels Planning, Organizing, Directing and Controlling Results for: Financial Internal Business Processes Customer Learning and Growth For the Entire Organization

Page 7 Linking the IT Department to the Entire Organization The Balanced Score Card For Continual Process Improvement

Page 8 IT Mgt Philosophy: Continual Process Improvement Define Control & StabilizeImprove Measure What is not defined cannot be controlled What is not controlled cannot be measured What is not measured cannot be improved Processes, Frameworks and Systems Utilized: COBIT Framework ITIL/ITSM PMI – Project Management ISO 9001 Quality Management CMMI-SE/SW & Application Services Library (ASL) Investors In People (IIP) ISO Information Security Gartner’s 21 Best Practices EFQM Six-Sigma

Page 9 The Processes - Putting IT all Together COBIT Framework  ITIL/ITSM PMI – Project Management – ISO 9001 Quality Management »CMMI-SE/SW & Application Services Library (ASL) »  Investors In People (IIP) »--  ISO Information Security »----  Gartner’s 21 Best Practices »  EFQM »  Six-Sigma

Page 10 COBIT Framework COBIT Framework - Control Objectives for Information Technology  Aligned with de facto standards & regulations  Based on 41 international standards  Professional standards for internal control & auditing (COSO, IFAC, AICPA, IIA, etc.)  Technical standards (ISO, EDIFACT, etc.)  Codes of Conduct  Qualification criteria for IT systems & processes (ISO9000, ITSEC, TCSEC, etc.)  Industry practices & requirements from industry forums (ESF, I4)  Emerging industry-specific requirements from banking, e-com, IT manufacturing.  Work closely with 150 Chapters in 100 Countries to develop standard Reference: 

Page 11 ITIL/ITSM ITIL – Information Technology Information Library ITSM – Information Technology Services Management Reference – Included Sub-Components: Configuration Management - physical and logical perspective of the IT infrastructure and the IT services being provided Change Management - standard methods and procedures for effective managing of all changes Release Management - testing, verification, and release of changes to the IT environment Incident Management - the day-to-day process that restores normal acceptable service with a minimal impact on business Problem Management - the diagnosis of the root causes of incidents in an effort to proactively eliminate and manage them Service Desk (Function) - a function not a process, this provides a central point of contact between users and IT Availability Management - optimize IT infrastructure capabilities, services, and support to minimize service outages and provide sustained levels of service to meet business requirements IT Service Continuity - managing an organization's capability to provide the necessary level of service following an interruption of service Capacity Management - enables an organization to tactically manage resources and strategically plan for future resource requirements Service Level Management - maintain and improve the level of service to the organization Financial Management for IT Services - managing the costs associated with providing the organization with the resources needed to meet requirements

Page 12 PMI – Project Management PMI – Project Management Institute  Project Management Methodology including S/PMO (Strategic/Project Management Office) provisioning.  Reference –

Page 13 ISO 9001 Quality Management ISO – International Standards Organization  ISO 9001 Quality Management - ISO 9001 is the internationally recognized standard for the quality management of businesses. It applies to the processes that create and control the products and services an organization supplies. It prescribes systematic control of activities to ensure that the needs and expectations of customers are met. It is designed and intended to apply to virtually any product or service, made by any process anywhere in the world.  Why seek certification to ISO 9001? Registration to ISO 9001 by an accredited certification body shows committed to quality, customers, and a willingness to work towards improving efficiency. It demonstrates the existence of an effective quality management system that satisfies the rigors of an independent, external audit. An ISO 9001 certificate enhances company image in the eyes of customers, employees and shareholders alike. It also gives a competitive edge to an organization's marketing.  How do you start to implement ISO 9001? What is involved? Identify the requirements of ISO 9001 and how they apply to the business involved. Establish quality objectives and how they fit in to the operation of the business. Produce a documented quality policy indicating how these requirements are satisfied. Communicate them throughout the organization. Evaluate the quality policy, its stated objectives and then priorities requirements to ensure they are met. Identify the boundaries of the management system and produce documented procedures as required. Ensure these procedures are suitable and adhered to. Once developed, internal audits are needed to ensure the system carries on working. Assessment to ISO 9001  Once all the requirements of ISO 9001 have been met, it is time for an external audit for verification.  Reference:

Page 14 CMMI-SE/SW & Application Services Library (ASL) CMMI-SE/SW – Capability Maturity Model® Integration for Systems Engineering and Software Engineering  Includes SDLC (Software Development Life-Cycle) Methodology Waterfall Development Methodology RAD – Rapid Application Development (via DSDM – Dynamic Systems Development Methodology)  Includes Managements components for: Release Management Configuration Management Requirements Management Risk Management  Reference - ASL – Application Services Library  Supplier independent, process framework for: Maintenance, Enhancement, Renovation of applications  ASL offers a framework for application management that is based on the best practices of professionals with years of experience. The model is developed in such a way that it guarantees the optimal ICT support for business processes. In this way you can concentrate on the business core. ASL limits itself to the giving of guidelines for the organizing of processes, leaving the organizing of the business. By doing this, the framework is generally applicable within ICT services, independent to the size of your organization.  Reference –

Page 15 Investors In People (IIP) IIP – Investors In People  The Investors in People guide to attracting and keeping the right personnel to help your business grow.  The Investors in People guide to supporting the development of your leaders and managers.  The Investors in People guide to helping organizations manage work-life balance.  Reference:

Page 16 ISO Information Security  A comprehensive set of controls comprising best practices in information security  Comprises TWO parts - a code of practice (ISO17799) and a specification for an information security management system (BS7799-2)  Basically… an internationally recognized generic information security standard  Controls: Reference: COMMUNICATIONS AND OPERATIONS MANAGEMENT ACCESS CONTROL SYSTEM DEVELOPMENT AND MAINTENANCE BUSINESS CONTINUITY MANAGEMENT COMPLIANCE SECURITY POLICY ORGANIZATIONAL SECURITY ASSET CLASSIFICATION AND CONTROL PERSONNEL SECURITY PHYSICAL AND ENVIRONMENTAL SECURITY

Page 17 Gartner’s 21 Best Practices  TCO (Total Cost of Ownership)- 21 Best Practices organized into 6 IT Management Processes: Change Management –Change Management Process –Change Management Technology –Deployment (installs, adds, changes) –Retirements and Moves Asset Administration –Procurement Process –Software Inventory Management –Hardware Inventory Management –Lifecycle Management –Vendor Management Operational Management –Standards Compliance –Data Management –Repair and Maintenance –Security –Virus Protection –Performance Monitoring and Event Management Customer Service –Service Desk Process –Services Desk Technology/Management –Marketing and Relationship Management Technology –Technology Planning & Process Management Training –IS/IT Training –End User Training

Page 18 EQFM -European Foundation For Quality Management The EFQM Excellence Model was introduced at the beginning of 1992 as the framework for assessing applications for The European Quality Award. It is the most widely used organizational framework in Europe The EFQM Excellence Model is a non-prescriptive framework based on nine criteria. Five of these are 'Enablers' and four are 'Results'. The 'Enabler' criteria cover what an organization does. The 'Results' criteria cover what an organization achieves. 'Results' are caused by 'Enablers' and feedback from 'Results' help to improve 'Enablers'. The Model, which recognizes there are many approaches to achieving sustainable excellence in all aspects of performance, is based on the premise that: “Excellent results with respect to Performance, Customers, People and Society are achieved through Leadership driving Policy and Strategy, that is delivered through People Partnerships and Resources, and Processes”.

Page 19 Six-Sigma Six-Sigma: What is it?  Six Sigma at many organizations simply means a measure of quality that strives for near perfection. Six Sigma is a disciplined, data-driven approach and methodology for eliminating defects (driving towards six standard deviations between the mean and the nearest specification limit) in any process -- from manufacturing to transactional and from product to service.  The statistical representation of Six Sigma describes quantitatively how a process is performing. To achieve Six Sigma, a process must not produce more than 3.4 defects per million opportunities. A Six Sigma defect is defined as anything outside of customer specifications. A Six Sigma opportunity is then the total quantity of chances for a defect. Process sigma can easily be calculated using a Six Sigma calculator.  The fundamental objective of the Six Sigma methodology is the implementation of a measurement-based strategy that focuses on process improvement and variation reduction through the application of Six Sigma improvement projects. Methods and Tools: Process Thinking Process Variation Facts, Figures, Data Critical Few Drivers - Customer Satisfaction, DPM, COPQ, Cycle Time Define-Measure-Analyze-Improve-Control 8 Key Tools - Process Map, C&E Matrix, Gage R&R, Capability Analysis, Multi-Vari Studies/Hypothesis Testing, FMEA, DOE, SPC/Control Plans

Page 20 Mapping The Processes ITIL PMI ISO 9001 CMMI-SE/SW ASL CMMI-SE/SW ASL IIP ISO ISO EFQM Six Sigma Six Sigma Gartner’s 21 Best Practices Gartner’s 21 Best Practices Future Strategy Future Strategy COBIT Framework COBIT Framework

Page 21 Plan and Organize (PO Process Domain) Plan and Organize (PO Process Domain)

Page 22 Acquire and Implement (AI Process Domain) Acquire and Implement (AI Process Domain) Plan and Organize (PO Process Domain) Plan and Organize (PO Process Domain)

Page 23 Deliver and Support (DS Process Domain) Deliver and Support (DS Process Domain) Acquire and Implement (AI Process Domain) Acquire and Implement (AI Process Domain) Plan and Organize (PO Process Domain) Plan and Organize (PO Process Domain)

Page 24 Deliver and Support (DS Process Domain) Deliver and Support (DS Process Domain) Monitor and Evaluate (M Process Domain) Monitor and Evaluate (M Process Domain) Acquire and Implement (AI Process Domain) Acquire and Implement (AI Process Domain) Plan and Organize (PO Process Domain) Plan and Organize (PO Process Domain)

Page 25 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture

Page 26 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management

Page 27 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management

Page 28 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management

Page 29 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management

Page 30 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management

Page 31 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management plus ISO 9001 Quality Management

Page 32 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management plus ISO 9001 Quality Management plus CMMI-SE/SW & Application Services Library (ASL)

Page 33 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management plus ISO 9001 Quality Management plus CMMI-SE/SW & Application Services Library (ASL) plus Investors In People (IIP)

Page 34 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management plus ISO 9001 Quality Management plus CMMI-SE/SW & Application Services Library (ASL) plus Investors In People (IIP) plus ISO Information Security plus ISO Information Security

Page 35 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management plus ISO 9001 Quality Management plus CMMI-SE/SW & Application Services Library (ASL) plus Investors In People (IIP) plus ISO Information Security plus ISO Information Security plus Gartner’s 21 Best Practices

Page 36 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management plus ISO 9001 Quality Management plus CMMI-SE/SW & Application Services Library (ASL) plus Investors In People (IIP) plus ISO Information Security plus ISO Information Security plus Gartner’s 21 Best Practices plus EFQM

Page 37 Deliver and Support Monitor and Evaluate Planning & Organization Acquire and Implement Planning & Organization Acquire and Implement Plan and Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organisation and Relationships Define IT Organisation and Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims and Direction Communicate Aims and Direction Manage Human Resource Manage Human Resource Ensure Compliance with External Standards Ensure Compliance with External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Acquire and Maintain Technology Infrastructure Develop and Maintain IT Procedures Develop and Maintain IT Procedures Install and Accredit Systems Install and Accredit Systems Manage Change Manage Change Manage Performance and Capacity Manage Performance and Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify and Allocate Costs Identify and Allocate Costs Manage Third-party Services Manage Third-party Services Define and Manage Service Levels Define and Manage Service Levels Educate and Train Users Educate and Train Users Assist and Advise IT Customers Assist and Advise IT Customers Manage Configuration Manage Configuration Manage Problems and Incidents Manage Problems and Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor the Process Monitor the Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture ITIL/ITSM Service Delivery Service Support Service Desk Service Desk Incident Management Incident Management Change Management Change Management Release Management Release Management Problem Management Problem Management Configuration Management Configuration Management Service Level Management Service Level Management Availability Management Availability Management Financial Management Financial Management Continuity Management Continuity Management Capacity Management Capacity Management plus PMI Project Management plus ISO 9001 Quality Management plus CMMI-SE/SW & Application Services Library (ASL) plus Investors In People (IIP) plus ISO Information Security plus ISO Information Security plus Gartner’s 21 Best Practices plus EFQM plus SixSigma

Page 38 Programs & Projects ITIL ITSM ITIL ITSM Deliver & Support Monitor Planning & Organization Acquire & Implement Planning & Organization Acquire & Implement Plan & Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organization & Relationships Define IT Organization & Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims & Direction Communicate Aims & Direction Manage Human Resource Manage Human Resource Ensure Compliance With External Standards Ensure Compliance With External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire & Maintain Application Software Acquire & Maintain Application Software Acquire & Maintain Technology Infrastructure Acquire & Maintain Technology Infrastructure Develop & Maintain IT Procedures Develop & Maintain IT Procedures Install & Accredit Systems Install & Accredit Systems Manage Change Manage Change Manage Performance & Capacity Manage Performance & Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify & Allocate Costs Identify & Allocate Costs Manage Third-Party Services Manage Third-Party Services Define & Manage Service Levels Define & Manage Service Levels Educate & Train Users Educate & Train Users Assist & Advise IT Customers Assist & Advise IT Customers Manage Configuration Manage Configuration Manage Problems & Incidents Manage Problems & Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor The Process Monitor The Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture PMI ISO 9001 ISO 9001 CMMI SE/SW ASL CMMI SE/SW ASL IIP ISO ISO EFQM Six Sigma Six Sigma Future Strategy Future Strategy Gartner 21 Gartner 21

Page 39 Programs & Projects ITIL ITSM ITIL ITSM Deliver & Support Monitor Planning & Organization Acquire & Implement Planning & Organization Acquire & Implement Plan & Organize Define Strategic IT Plan Define Strategic IT Plan Define IT Organization & Relationships Define IT Organization & Relationships Manage IT Investment Manage IT Investment Determine Technological Direction Determine Technological Direction Communicate Aims & Direction Communicate Aims & Direction Manage Human Resource Manage Human Resource Ensure Compliance With External Standards Ensure Compliance With External Standards Assess Risks Assess Risks Manage Projects Manage Projects Manage Quality Manage Quality Identify Automated Solutions Identify Automated Solutions Acquire & Maintain Application Software Acquire & Maintain Application Software Acquire & Maintain Technology Infrastructure Acquire & Maintain Technology Infrastructure Develop & Maintain IT Procedures Develop & Maintain IT Procedures Install & Accredit Systems Install & Accredit Systems Manage Change Manage Change Manage Performance & Capacity Manage Performance & Capacity Ensure Continuous Service Ensure Continuous Service Ensure System Security Ensure System Security Identify & Allocate Costs Identify & Allocate Costs Manage Third-Party Services Manage Third-Party Services Define & Manage Service Levels Define & Manage Service Levels Educate & Train Users Educate & Train Users Assist & Advise IT Customers Assist & Advise IT Customers Manage Configuration Manage Configuration Manage Problems & Incidents Manage Problems & Incidents Manage Data Manage Data Manage Facilities Manage Facilities Manage Operations Manage Operations Monitor The Process Monitor The Process Assess Internal Control Adequacy Assess Internal Control Adequacy Obtain Independent Assurance Obtain Independent Assurance Provide Independent Audit Provide Independent Audit Define Information Architecture Define Information Architecture PMI ISO 9001 ISO 9001 CMMI SE/SW ASL CMMI SE/SW ASL IIP ISO ISO EFQM Six Sigma Six Sigma Future Strategy Future Strategy Gartner 21 Gartner 21