Purpose / goals

The goal of this process is to ensure the secure, reliable, and efficient operation of the organization's IT infrastructure, systems, and services.

Purpose:

  • Ensure availability, integrity, and confidentiality of IT systems and data
  • Provide employees with the IT resources and support they need to work effectively
  • Manage IT assets, access rights, and changes in a controlled manner
  • Detect, handle, and learn from incidents and disruptions

Process steps

Step Description
1. Requirements and request intake Receipt of IT requests and requirements (e.g., new hardware, software, access) via the ticket system or service desk.
2. Asset and license management Recording, tracking, and maintaining hardware, software, and licenses throughout their lifecycle.
3. User and access management Creation, change, and removal of user accounts and access rights based on role and approval (joiner/mover/leaver).
4. Provisioning and configuration Procurement, setup, and configuration of devices, systems, and applications according to defined standards.
5. Change management Planning, assessing, approving, and documenting changes to IT systems to minimize risk and disruption.
6. Operations and monitoring Ongoing monitoring of systems, patching, updates, and capacity planning.
7. Backup and recovery Regular backups, restore tests, and maintenance of disaster recovery procedures.
8. Incident and problem management Logging, prioritizing, resolving, and analyzing incidents; root cause analysis for recurring problems.
9. Review and improvement Regular review of IT services, audits, and derivation of improvement measures.

Performance indicators

  • System availability (e.g., uptime in %)
  • Average time to resolve incidents
  • Ticket backlog and first-contact resolution rate
  • Patch compliance (share of systems up to date)
  • Backup success rate and restore test results
  • User satisfaction with IT support (e.g., survey scores)

Risks

  • Unpatched systems → vulnerability to security incidents
  • Outdated or missing access rights management → unauthorized access
  • Insufficient backups or untested restores → data loss
  • Uncontrolled changes → outages and instability
  • Incomplete asset inventory → shadow IT and license non-compliance
  • Dependence on key individuals → knowledge loss and delays