ITIL Service Operations and Processes

Service Operation Lifecycle


  • Explain the purpose, objectives, and scope of the service operation lifecycle stage
  • Explain the business value of service operation
  • Describe the basic concepts related to service operation
  • Explain the purpose, objectives scope, basic concepts, activities and interfaces for incident management and problem management
  • Describe the purpose, objectives, and scope for event management, request fulfillment, and access management

Service Operation


  • Coordinate and carry out the activities and processes required to deliver and manage services at the agreed upon levels
  • Provide ongoing management of the technology that is used to deliver and support services


  • Maintain business satisfaction and confidence
  • Provide effective delivery and support of agreed IT services
  • Minimize the impact of service outages on business activities
  • Ensure that access to services is provided only to those who are authorized


  • The service provided
  • Service management processes
  • Technology
  • People


  • Provide operational data for use by other processes
  • Reduce unplanned labor and costs through optimized handling of service outages and identification of root causes
  • Meet the goals and objectives of the organizations security policy
  • Provide quick and effective access to standard services
  • Provide a basis for automated operations
  • Reduce duration and frequency of service disruptions

Basic Concepts

  • Importance of communication
    • Team and process communications should be supported by formal policy
    • Method and frequency of communication must be understood by all stakeholders
      • Clear purpose, audience, and required actions
      • Periodic review of communications practices

Processes and Functions

  • Processes:
    • Event Management
    • Incident Management
    • Problem Management
    • Request Fulfillment
    • Access management
  • Functions
    • Service Desk
    • Application Management
    • IT Operations Management
    • Technical management



Service Operation Process 1: Event Management


  • Manage events throught heir lifecycle
  • Includes activities to detect events, make sense of them, and determine the appropriate response
  • Provide the basis for operational monitoring and controlCAn be used for automating normal operations as well as detecting early warnings and failures of CI


  • Detect all significant changes of state to Cis
  • Determine the appropriate control action (response)
  • Provide a trigger to initiate other operational processes
  • Provide means to compare actual performance against designs


  • Event management supports any service management aspect that needs to be controlled and can be automated
    • Cis – monitoring operational states
    • Cis – Automated updating of status
  • Environmental conditions
  • Software license monitoring
  • Security monitoring
  • Normal activities

Basic Concepts

  • Three types of events
    • Informational Events
      • Information that can be used for trending and analysis to inform service provider decision making
    • Warning Events
      • Early warning information that can often be leveraged to minimize or prevent any user or business impat
    • Exception Events
      • Abnormal situations or failures that require additional follow-up-actions


Service Operation Process 2: Incident Management


  • Restore normal service operation as quickly as possible
  • Minimize the adverse impact on business operations
  • What is an incident?
    • Unplanned interruption to an IT service, or reduction in the quality of an IT service, or Failure of a CI that has not yet impacted a service.


  • Ensure standardized methods and procedures are used
  • Increase visibility and communication of incidents
  • Enhance business perception of IT
  • Align activities to the priorities of the business
  • Maintain user satisfaction with IT service quality


  • In Scope
    • Any event that indicates a disruption to an IT service
    • Andy event that could disrupt an IT Service
  • Out of Scope
    • Informational events that indicatenormal service operation
    • Service requests

Basic Concepts

  • Incident Models and Timescales
    • Timescales:
      • Must be agreed for all incident handling stages
      • Will differ based on incident priority
      • Must be based on agreed response and resolution targets with SLAs
      • Captured as targets on OLAs and UCs as appropriate
      • Communicated to all support groups
      • Service management tools should be used to automate timescales based on predefined rules.
  • Incident Status Tracking
    • Incidents should be tracked throughout their lifecycle
    • Properly handled and escalated
    • Accurately reported incident status
    • Captured within the incident management system
  • Major Incidents
    • Incidents with the highest impact – significant business disruption
    • Must be clearly defined and mapped into incident prioritization scheme
  • Major incident procedure
    • Establish a separate team to manage major incidents
    • Led and managed by the incident manager
    • Focused on faster resolution and minimizing impact


  • Incident Identification
  • Incident logging
  • Incident categorization
  • Incident prioritization
    • Based on Impact and Urgency
  • Investigation and diagnosis
  • Resolution and Recovery
  • Incident Closure


  • Service Strategy
  • Service Design
    • Service level management
    • Information security management
    • Capacity management
    • Availability management
  • Service Transition
    • Service asset and configuration management
    • Change management
  • Service Operation
    • Problem Management
    • Access management
  • Continual Service Improvement


Service Operation Process 3: Problem Management


  • Manage the lifecycle of all problems from identification ro removal
  • Understand, document, and communicate known errors and initiate actions to improve or correct the situation
  • Reactively minimize the adverse impacts of incidents and problems
  • Proactively prevent recurrence of incidents related to erros
  • What is a problem?
    • Underlying cause of one or more incidents


  • Prevent problems and resulting incidents from happening
  • Eliminate recurring incidents
  • Minimize the impact of incidents that cannot be prevented


  • Problem Management is primarily within the scope of service operation
    • Proactive problem management supports CSI
    • Problems may be identified in transition activities
  • Reactive problem management
    • Resolves problems in response to specific incidents or events
  • Proactive problem management – triggered by Improvement Activities
    • Identifies and solves problems and known errors before the incident recurs
    • Is performed on an ongoing basis – reviewing and analyzing incident records and trends looking for signs of common causes that can be corrected
    • Conducts major incident reviews
    • Conducts reviews of operational and event logs to identify problems
    • Conducts brainstorms to identify problems
    • Uses check sheets to collect data related to problems

Basic concepts

Key definitions

  • Work Arounds
  • Known Errors
  • KEDB (Known Error Database)
  • Problem Models

Incident vs Problems

  • Incidents and Problems are not the same thing
    • Incidents don’t become problems
    • Incidents are the symptom, problems are the cause
  • Problem Management may be invoked when
    • Incidents can’t be matched to a problem or known error
    • Trend analysis reveals and underlying error
    • A major incident occurred
    • Other IT functions identify a problem
    • Anaysis by a support group reveals an underlying error
    • Notification from a supplier indicates a problem exists.


  • Reactive
    • Monitoring, reporting, triaging of problems
  • Proactive
    • Investigating historical data to discover root causes

Service Operation Process 4: Request Fulfillment


  • Manage the lifecycle of requests from users


  • Maintain customer and user satisfaction
  • Efficiently handle requests
  • Provide a channel for requests users and customers to make requests
  • Provide information about services to customers and users
  • Source and deliver the components of required services
  • Assist with informational requests, complaints, comments and compliments


  • Requests are normal everyday needs of users, customers, and service provider staff.
  • Sometimes handled through the incident management process and tools
    • Requests becomes a special category of incident
  • Sometimes handled through an independent request fulfillment process:
    • Appropriate for large numbers of requests
    • Separate record types to facilitate differentiated workflow and reporting


Service Operation Process 5: Access Management Process


  • Provide rhe right for users to be able to use a service
  • Execute policies and actions defined in Information Security Management


  • Manage access to services based on policies and actions defined in information security management
  • Efficiently respond to access requests
  • Monitor access to services to ensure rights are not improperly used


In Scope

  • Protects confidentiality, integrity and availability of data and intellectual property by executing information security management policies
  • Ensures authorized users are given the rights to use services
  • Is performed across functions – likely with a single point of coordination

Out of Scope

  • Deciding who should have the right to use a service
  • Ensuring the availability of a service or data

Functions of Service Operation

Service Desk:

The single point of contact for users when there is a service disruption, for service requests, or even for some categories of request for change


  • Provide a SPOC between users and the service provider
  • Return normal-state service operation to users as quickly as possible (incidents, service requests, and general inquireies)


  • Logging incidents and service requests
  • Provideing first line response and diagnosis
  • Resolving incidents/requests at first contact when possible
  • Escalating incidents/requests they cannot resolve within agreed timeframes
  • Keeping users informed of incident/request progress
  • Closing all resolved incidents/requests
  • Conducting customer/user satisfaction surveys
  • Communication with users
  • Updating the CMS under direction and approval of SACM as agreed


  • Local
  • Centralized
  • Virtual
  • Follow the Sun: Location of service desk is moved to local the local working hours. E.g. 8 hrs in north America and 8 hrs in the Phillipines.
  • Specialized Groups

Technical Management:

Provides detailed technical skills and resources needed to support the ongoing operation of IT services and the management of IT infrastructure.


  • Plan, implement, and maintain stable technical infrastructure
    • Well designed, resilient, cost effective technology
    • Adequate technical skills to maintain infrastructure
    • Swift use of technical skills to diagnose and resolve technical failures
  • Known as the Subject Matter Experts

Dual role of technical management

  • Knowledge and expertise to manage IT infrastructure
  • Provides the resources to support the service lifecycle
  • Provide balance between skill levels, utilizeation of resources and costs
    • Skills levels, Utilization and Costs of technical management staff
  • Provide guidance to IT operations on operational management of infrastructure
    • Design and documentation
    • Ongoing communication

IT Operations Management:

Executes the daily operational activities needed to manage IT services and the supporting IT infrastructure.


  • Provides stability for daily processes and activities
  • Review and improve procedures and activities
  • Apply operational skills to diagnose operational failures that occure
  • Executes the ongoing activities and procedures required to maintain IT infrastructure

Plays a Dual Role

  • Maintain the status quo
  • Add value by contributing the reliability of services

Balances business and technical roles

  • Understanding how technology is used to provide services
  • Understanding the relative importance and impact of services offered

Contains two functions

  • IT Operations control
  • Facilities management


Application Management:

Is responsible for managing applications throughout their lifecycle.


  • Support the organizations business processes
  • Identify functional and manageability requirements for applications
  • Assist in the design, deployment, and ongoing management of those applications


  • Well designed, resilient, cost effective applications
  • Ensure functionality supports business outcomes
  • Organization of adequate technical skills to maintain operational applicationsSwift use of technical skills to diagnose and resolve technical failures.