It's been nearly a year since Version 3 of the IT Infrastructure Library (ITIL) came out. The update to ITIL, a framework for best practices in IT service delivery, was intended to sharpen its focus and, not incidentally, to attract a new group of followers.
So did it? Well, yes and no. Early adopters have mostly high praise for ITIL Version 3. It is broader, deeper and better organized, and users say its "life-cycle" approach to IT service delivery is a major improvement over Version 2's more narrow focus on day-to-day operations and its disjointed collection of point prescriptions.
Still, not all users of Version 2 have rushed to adopt Version 3, which its authors call a "refresh."
Many say they are happy with the older version of ITIL because they have patched its shortcomings with other methodologies and homegrown remedies. And, they say, a comprehensive adoption of any version of ITIL is a huge task, often requiring a major cultural change inside IT.
ITIL was created in the late 1980s by an agency of the British government, now called the Office of Government Commerce (OGC), as a way to describe a systematic approach to the provisioning and management of IT services. ITIL became popular in Europe during the 1990s but didn't catch on in the U.S. until well after 2000.
ITIL was, and remains, literally a library of books, though the OGC also offers a raft of ITIL-related materials on its Web site.
Published in 2001, Version 2 focused on two pillars of IT infrastructure and operations: service support and service delivery. It prescribed best practices for incident, change, capacity and configuration management. Using those best practices, companies found that they were able to improve and standardize their data center operations.
However, important topics like security, financial management, the relationship between IT services and business value, and links between ITIL and other process disciplines got only lip service, if that, in the v2 ITIL.
And Version 2 tended to say what to do without specifying exactly how to reach that goal. Many companies liked that approach, saying it gave them freedom to adapt ITIL to their unique situations, while others complained that it left too much to the imagination.
In 2000, Microsoft Corp. put some of the "how to" into the Microsoft Operations Framework, its extension and enhancement of ITIL tailored to Microsoft IT environments.
Version 3 to the rescue
Now, v3 sweeps aside many of those earlier criticisms. It is much more specific as to how its advice might be carried out, turning theories in v2 into specifics via the inclusion of business case examples and templates for capturing information. It also goes to a much deeper level of detail by providing performance metrics and workflow examples.
"What v3 has done is integrate ITIL's different components much better," explains Robert Humphrey, global process governance director at Computer Sciences Corp. "With the introduction of the life-cycle model, which covers strategy through design through to continuous improvement, ITIL provides a much more natural flow," he says. "Now it gives equal importance to all the elements."
ITIL v3 has expanded the concept of IT service delivery from day-to-day operations of those services to five life-cycle phases (each with its own guidebook): strategy, design, transition (which covers implementation and change), operations and continual improvement.
And at the strategy end of things, v3 specifically invites the business manager into the process by asking IT to base the design, maintenance and evolution of IT services on the business objectives of the organization. ROI, business metrics and business benefits are covered in much greater detail.
Evelyn Hubbert, an analyst at Forrester Research Inc., says v3 will accelerate the already rapid adoption of ITIL. She says that ITIL is here to stay in part because "there is nothing else." Non-IT organizations, from human resources to manufacturing to purchasing, have had structured processes and disciplines for a very long time, she says, and it's high time IT put some structure into its processes. Those who don't get it "are to be blamed for why IT is still in baby shoes," she says.
So is it time to get on the ITIL v3 bandwagon? Experienced users offer this advice:
Don't abandon your Version 2 efforts
Companies that have patched and supplemented ITIL v2 over the years may feel little urgency to go with v3. Phyllis Drucker, director of consolidated services at AutoNation Inc., says the car retailer filled some gaps in v2 with the Microsoft Operations Framework (MOF) and with some homegrown processes. The result is a "very robust" and integrated set of processes for change, capacity and service design management, she says.
Will she scrap v2 and MOF? "No," she says. Instead, "we'll lay v3 over our processes and see if there are any gaps."
Progress Energy Inc. has been working with ITIL v2 for six years. "But there's still a lot we haven't implemented," says Sheri Cassidy, manager of process engineering services.
According to Cassidy, whose unofficial title is ITIL program manager, "To someone just getting into v3, I'd say don't view it as a replacement for v2, view it as a wrapper or a supplement."
She says she'll continue with v2 and with some extracurricular efforts that were under way before v3's arrival but which are now included in the refresh, such as a more prescriptive approach to knowledge management, service catalog management, transition management, continuous improvement and templates for things such as service-level agreements.
Alan Claypool, manager of business applications at the City of Tampa, Fla., has been getting into ITIL v2 for the past 18 months. He says he's starting with mostly old, legacy applications running on old, legacy operational procedures.
"We already have a framework for operations," he says, "and in many ways it's successful. But it's not really a structured framework that can guarantee the quality of outcome each time, and then [allow us to] do continuous improvements."
Claypool plans to get further into v2 before going headlong into v3, but he and his staff have already begun working their way through the v3 Service Strategy book. He explains: "We started into design and realized we didn't have our strategy on solid ground, so we stepped back into strategy. What's so nice about v3 is that it really takes you back to the basics of business, and then you design your service to meet those."
But do get started on Version 3. It's worth it.
Users say that the most important advance in v3 is its firm linkage of IT services to the business side of the organization.
Hewlett-Packard Co. uses ITIL for its internal operations and for the services it provides clients. David Cannon, IT service management practice principal at HP and co-author of the Service Operation book in ITIL v3, says that to the extent v2 talked at all about return on investment, it was always in terms of cost savings, and that a focus on the cost of an IT service says nothing about the value of that service to the business. "But v3 focuses instead on what the service specifically is trying to achieve," he says.
Cannon says v3 helps match IT service costs not with "outputs" -- such as the number of invoices produced, but with "outcomes" -- the value of improved cash flow, for instance. "V3 gives you a lot of guidelines as to how to break down your services, how to map them to outcomes and how to cost the services," he says.
Dale Ott, director of service management at Sarasota County [Fla.] Government and Schools, says the best thing about the new ITIL is its expansion from service operations to include the additional phases of service design and rollout, and the linkages of those to the business. He said it has already provided a new framework for helping his department review some applications recently put in place, like an intranet for the county.
"We can look at these and say, 'I don't think I really asked all the right questions before I launched this thing.' We have several things, like Vista and [Microsoft] Office '07, on the horizon, and how to do those well is what v3 offers us."
Look at the tools
As ITIL has evolved, a variety of IT vendors have developed tools that support its premises. Tampa's Claypool says his early work with ITIL v2 was slowed by a lack of automated software to support such vital ITIL elements as a configuration management database. "Now," he says, "you can actually go out and buy a product that matches up with the ITIL structure. That helps tremendously."
Cassidy at Progress Energy hails the better integration of topics in v3, and she says that's aided by a similar advance in support tools. She says the company in August will begin using Service-now.com, a Web-based utility that supports ITIL v3 practices. "It has much more integration between different [ITIL] processes," she says. "You could be in problem management but want to update a change ticket, and it's very seamless."
In fact, Cassidy challenges the mantra that companies going into ITIL should get their processes down pat before looking for tools that fit those processes. "We got into ITIL, and by our third year we realized that our tools were not allowing us to do some of the things we wanted to do," she says. "In hindsight, we could have made much faster progress had we had better tools."
Be prepared for culture shock
"Our No. 1 challenge is the changing of our culture," says Claypool. The difficulty, he says, lies in changing a mind-set within IT that believes current practices are "good enough" when in fact they could be much better.
Nearby in Sarasota, ITIL has been in place eight years -- long before it gained popularity elsewhere in the U.S. "Gartner didn't even have it on the hype-cycle chart in 2000," says Bob Hanson, CIO at Sarasota County Government and Schools. Now the county has mastered the basics of ITIL v2, but, Hanson says, "It hasn't been easy. It's not the process itself, it's the human side. The traditional model is that the IT person doesn't mind playing the hero role" --- that is, swooping in to save the day when processes run amok. "And ITIL usurps the hero role by putting structure in place."
Hanson's advice: "You have to tell your people what's in it for them. Getting them out of hero mode does simplify their life a great deal in the long run."
Tampa is just getting started on ITIL but is not reaching out to pricey consultants. Says Claypool, "We are working with Sarasota County. We are looking at their processes and saying, county and city are pretty similar; let's just photocopy their processes and see if they are different from our own and should be tailored."
Don't expect to find -- or like -- everything in v3
Progress Energy's Cassidy acknowledges that v3 doesn't do everything. For example, she says, she looked but failed to find information about how to set up an IT architecture review board. She also found v3 weak in its treatment of project management. "It's mentioned in several of the v3 books, but the integration between project management and the ITIL processes is still kind of squishy," she says.
While many people praise v3's broader scope, at least one user is not impressed with the Service Strategy book, a topic new to v3. "It's my pet hate," says Humphrey at Computer Sciences. "There isn't a lot of process in there. It lacks the practicality you get in the more mature areas."
Humphrey says v3 is weak in its treatment of business continuity as well. "Unless you have sorted out business continuity, IT service continuity has no anchor," he says. He adds that it also falls short on governance, but that a coming supplement will better address linkages between ITIL and things like the audit-oriented CobiT (Control Objectives for Information and related Technology).
HP's Cannon says current work to enhance ITIL v3 -- perhaps for a Version 4 -- is focused on expanding its scope beyond data center operations to other areas of technology, such as telecommunications and the mobile devices of end users. That will become increasingly important as computing continues its long trend toward decentralization, he says.
For example, a future version of ITIL could help an insurance company whose IT services include capturing and processing claims data and photographs from field agents via handhelds, he says.
Cannon says the authors of v3 decided not to address specific technologies such as iPods, "but that will start changing." He says new processing approaches that are undergoing rapid evolution and can't be precisely defined at the moment, such as service-oriented architectures, were also deliberately omitted, but that too will change. V3 is intended to have a shelf life of eight to 10 years, but it will be accompanied over time by topic-specific "complementary guides," he says.
Sarasota County's Ott speculates that now that ITIL has been broadened to embrace business concepts more rigorously, it may be applicable even outside of IT, to any situation where a team of people is providing a service to customers. It could be applied in a call center, for example, and not just to those parts of the center that are strictly IT based. "We've all talked about the loss of service in the U.S.," he says. "I think this is a way to structurally put it back in place."
This story, "ITIL v3: Five ways to make it work for you" was originally published by Computerworld.