Purpose / goals
The goal of this process is to ensure the secure, reliable, and efficient operation of the organization's IT infrastructure, systems, and services.
Purpose:
- Ensure availability, integrity, and confidentiality of IT systems and data
- Provide employees with the IT resources and support they need to work effectively
- Manage IT assets, access rights, and changes in a controlled manner
- Detect, handle, and learn from incidents and disruptions
Process steps
| Step | Description |
|---|---|
| 1. Requirements and request intake | Receipt of IT requests and requirements (e.g., new hardware, software, access) via the ticket system or service desk. |
| 2. Asset and license management | Recording, tracking, and maintaining hardware, software, and licenses throughout their lifecycle. |
| 3. User and access management | Creation, change, and removal of user accounts and access rights based on role and approval (joiner/mover/leaver). |
| 4. Provisioning and configuration | Procurement, setup, and configuration of devices, systems, and applications according to defined standards. |
| 5. Change management | Planning, assessing, approving, and documenting changes to IT systems to minimize risk and disruption. |
| 6. Operations and monitoring | Ongoing monitoring of systems, patching, updates, and capacity planning. |
| 7. Backup and recovery | Regular backups, restore tests, and maintenance of disaster recovery procedures. |
| 8. Incident and problem management | Logging, prioritizing, resolving, and analyzing incidents; root cause analysis for recurring problems. |
| 9. Review and improvement | Regular review of IT services, audits, and derivation of improvement measures. |
Performance indicators
- System availability (e.g., uptime in %)
- Average time to resolve incidents
- Ticket backlog and first-contact resolution rate
- Patch compliance (share of systems up to date)
- Backup success rate and restore test results
- User satisfaction with IT support (e.g., survey scores)
Risks
- Unpatched systems → vulnerability to security incidents
- Outdated or missing access rights management → unauthorized access
- Insufficient backups or untested restores → data loss
- Uncontrolled changes → outages and instability
- Incomplete asset inventory → shadow IT and license non-compliance
- Dependence on key individuals → knowledge loss and delays
