Service Catalogue Management Procedure

How the Organisation creates, approves, publishes and keeps current a service catalogue, with a worked template and criteria for evaluating new and changed services.

SXL-SM07Procedure3,043 words 14 min readOwner: Service Catalogue Manager
Sign in to download the PDFFree. You return straight to this document after you sign in.
Template draft. Replace everything in [square brackets] with your own decision, delete what does not describe what you really do, and approve it through your own document control. It is not legal advice and does not make an organisation compliant or certified.

1. Introduction

The service catalogue is the Organisation's list of every live service, written so that customers, service desk staff and delivery teams all describe a service the same way. It is the source for what each service is, who owns it, when it is supported, what it depends on and which agreement applies. Other processes read from it: the service desk uses its categories to classify tickets, service level management uses its entries to attach agreements, and change management uses its dependencies to assess impact.

The catalogue has two views. The customer view lists what a customer can buy or request, in plain language. The technical view adds the support model, dependencies and configuration links that only staff need.

2. Purpose

To make sure that the Organisation keeps an accurate, approved and current catalogue of the services it provides, and that a service is added, changed or retired only through a controlled step that confirms it meets defined requirements.

3. Objectives

  • Every service in the scope of the SMS has one catalogue entry with a named owner.
  • Entries are accurate: reviewed at least every [6 months], and updated within [5 working days] of a live change.
  • A new service is not made live until its entry is approved and its support arrangements, service levels and categories exist.
  • Staff and customers can find the right version of the information quickly.
  • Services that no longer meet evaluation criteria are identified and either improved or retired.

4. Scope

  • In scope: all services delivered to customers and all internal services on which customer services depend, as listed in the SMS Scope and Service Management Plan.
  • In scope: the customer view, the technical view, the retired services archive and the request and incident categories derived from entries.
  • Out of scope: the design of a new service, which is in the Service Design and Transition Procedure, and the detail of agreements, which is in the Service Level Management Procedure.
  • Applies to: service owners, the service catalogue manager, the service desk, relationship managers and any team that supports a service.

5. Terms and definitions

TermMeaning
ServiceA means of delivering value to a customer by facilitating the outcomes the customer wants to achieve, delivered by the Organisation with defined responsibilities.
Service catalogueThe approved list of services with the information needed to deliver and support them.
Service portfolioAll services in the pipeline, live and retired, with their business case and investment.
Live serviceA service that is delivered to customers or users and has passed transition.
Supporting serviceAn internal or supplier service that a customer-facing service needs, such as hosting or an identity platform.
Catalogue entryThe record that describes one service using the fields in this procedure.
Request categoryA standard type of request that a user can raise against a service.
Incident categoryA standard type of fault used to classify an incident against a service.

6. Roles and Responsibilities

RoleResponsibilities
Process ownerOwns this procedure; approves the entry fields and the evaluation criteria; reports catalogue health to the governance group.
Service catalogue managerMaintains the catalogue; checks entries for completeness; publishes both views; runs the review cycle; maintains the retired archive.
Service ownerAccountable for the accuracy of the entry, the performance of the service and the proposal to change or retire it.
Business relationship managerSupplies customer wording and requirements; confirms the customer view is understandable.
Service deskUses the catalogue to classify and route; reports entries that are missing, wrong or unclear.
Resolver groupsConfirm support tier, hours and dependencies for the services they support.
Configuration managerEnsures each entry links to the correct configuration items and the dependency map.
Management RepresentativeApproves new services into the catalogue and retirements, and resolves disagreement between owners.
Customer representativeReviews the customer view and confirms the service description matches the agreement.
ActivityResponsibleAccountableConsultedInformed
Propose and describe a new serviceService ownerManagement RepresentativeBusiness relationship manager; resolver groupsService desk
Check and approve the entryService catalogue managerProcess ownerService owner; security leadGovernance group
Publish the catalogueService catalogue managerProcess ownerService deskAll staff; customers
Update an entry after a changeService ownerService ownerConfiguration manager; service catalogue managerService desk
Run the periodic reviewService catalogue managerProcess ownerService owners; customer representativesManagement Representative
Retire a serviceService ownerManagement RepresentativeCustomer representatives; supplier managerAll affected parties

7. Service lifecycle

A service moves through stages. The catalogue holds entries from the moment a service is approved for live operation until it has been retired and archived.

StageWhat happensCatalogue statusWhere it is controlled
ConceptIdea or customer demand is assessed against strategy and capacityNone (portfolio record only)Service Design and Transition Procedure
Design and buildRequirements are agreed; service levels, support and dependencies are designedDraft entryService Design and Transition Procedure
TransitionTested against acceptance and evaluation criteria; operations are trained; entry is approvedApproved, not publishedThis procedure and the Release and Deployment Management Procedure
LiveDelivered, monitored and reviewedPublishedThis procedure
ChangedA change alters scope, hours, support, price or dependenciesPublished with revisionChange Management Procedure and this procedure
RetirementService is withdrawn with notice to customers, data and assets dealt withRetiring, then archivedThis procedure

8. Procedure inputs and outputs

InputsOutputs
New or changed service proposal and business caseApproved catalogue entry (both views)
Customer requirements and agreementsUpdated request and incident categories
Dependencies and configuration dataPublished catalogue and revision notices
Results of service evaluationRetirement notices and archive record
Feedback from the service desk and customersCatalogue health report

9. Service catalogue content

Each entry must hold at least the information in the template below. Fields are completed by the service owner and checked by the catalogue manager. A service with an empty mandatory field cannot be published.

9.1 Catalogue template

The table gives the catalogue layout with worked example rows. Use one row per service, and attach the detailed entry form (Annexure A) for each. Example rows are illustrative and show the level of detail to expect; replace them with the Organisation's own services.

ServiceDescriptionOwnerHoursSupport tierDependenciesSLA referenceRequest and incident categories
[Customer web portal]Self-service website where customers view usage, download reports and raise requests[Head of Product][24x7]L1 service desk; L2 technical; L3 engineering[Hosting service; identity platform; database service][SLA-001]Requests: account change, report access, new user. Incidents: unavailable, slow, login failure, wrong data
[Integration interface service]Interfaces that let customers exchange data programmatically[Head of Engineering][24x7]L1; L2 technical; L3[Hosting service; network service; certificate service][SLA-002]Requests: new key, quota change, test access. Incidents: errors, latency, rejected calls
[Managed monitoring service]Continuous monitoring and alert triage for the customer's systems[Head of Operations][24x7]L1; L2 business; L3[Monitoring platform; ticketing tool; on-call service][SLA-003]Requests: add system, change threshold, report. Incidents: missed alert, false alarms, platform down
[Corporate email and collaboration]Staff email, calendars, messaging and shared storage[Head of IT][Working days 07:00 to 21:00]L1; L2 technical[Identity platform; internet connectivity][OLA-001]Requests: new mailbox, shared folder, distribution list. Incidents: no mail, sync failure, storage full
[Internal service desk]First point of contact for staff and customers[Head of Service Delivery][Working days 08:00 to 20:00]L1; L2[Ticketing tool; telephony; knowledge base][OLA-002]Requests: new starter kit, desk move. Incidents: tool unavailable, telephone line down
Note. The template is intentionally compact. If a row grows beyond what a reader can scan, move detail into the entry form and keep the row short.

9.2 Detailed entry fields

FieldWhat to recordMandatory
Service name and identifierPlain name, unique code and short description a customer would useYes
Service typeCustomer-facing or supporting; internal or external supplierYes
Service owner and deputyNamed individuals with contact detailsYes
Customers and usersCustomer groups served and user numbersYes
Business purpose and outcomesWhat the customer achieves by using the serviceYes
Features and optionsWhat is included, optional extras and what is explicitly excludedYes
Hours of service and supportHours delivered and hours supported; time zone; public holiday arrangementsYes
Support modelTiers, teams, on-call, supplier support and contact routeYes
DependenciesServices, suppliers, assets and people that the service needs, linked to configuration itemsYes
Service level agreement or level agreement referenceAgreement number and the targets that applyYes
Request catalogueStandard requests, fulfilment times, approval needs and any chargeYes
Incident categoriesCategories, default severity, default resolver groupYes
Service continuity and availabilityRecovery time and point targets; continuity plan referenceYes
Information security requirementsClassification of data handled; controls; security ownerYes
Charges and billingPricing basis, if any, and how it is invoicedIf charged
Interfaces and constraintsOther services this service connects to; technical or contractual limitsYes
Status and datesDraft, approved, live, retiring; go-live date; next review dateYes
Retirement planPlanned end date, notice period, data return, migration routeIf retiring

10. Service requirements

Service requirements are the conditions every service must satisfy before it is accepted into the catalogue. They come from customers, from law and contract, from the Organisation's policy and from the capability of the support teams. The service owner records them in the entry and the service catalogue manager checks them at approval.

Requirement areaQuestion to answerEvidence
Customer needIs there an agreed description of the outcome, users and volumes?Signed requirements or agreement
Service levelsAre availability, response, resolution and reporting targets agreed and measurable?Service level agreement or draft
SupportDoes every tier know how to support it, with runbooks and trained staff?Training record; runbooks; roster
DependenciesAre suppliers and internal services under agreement that covers the targets?Operational level agreement; supplier contract
Security and privacyHas the service been assessed for information security and personal data handling?Risk assessment; privacy assessment
ContinuityAre recovery targets, backups and fallback arrangements defined and tested?Continuity plan; test result
CapacityIs capacity sufficient for the planned demand, and is growth monitored?Capacity plan
CostIs the cost known and the pricing or internal allocation agreed?Budget record; price list
MonitoringAre alerts and measures set up to detect failure and report the targets?Monitoring configuration review
Legal and contractDo contract terms and applicable law allow the service as designed?Legal review note

11. Service catalogue management procedure

11.1 Add a new service

  1. ProposeThe service owner submits a proposal and draft entry (Annexure A) after design has defined the service. Input: business case, requirements. Output: draft entry. Owner: service owner. Target: when the design phase begins.
  2. AssessThe catalogue manager checks completeness and consistency with existing entries, and checks for overlap with other services. Output: assessment note. Owner: catalogue manager. Target: [3 working days].
  3. EvaluateThe service is tested against the evaluation criteria below, with security and continuity checks. Output: evaluation record. Owner: service owner with process owners. Target: before go-live.
  4. ApproveThe Management Representative approves the entry and service levels, after the governance group confirms support readiness. Output: approval. Target: [5 working days] from evaluation.
  5. Create linksThe configuration manager links configuration items; the service desk loads categories and routing rules in the ticketing tool. Output: working categories. Target: before go-live.
  6. PublishThe catalogue manager publishes the entry, sends a revision notice and archives the previous version. Target: on go-live day.

11.2 Change an existing service

  1. TriggerA change request, review result, customer request or incident analysis shows that an entry is wrong or must change. Any employee may report the gap to the catalogue manager.
  2. UpdateThe service owner updates the draft with the change, within [5 working days] of the live change being completed.
  3. CheckThe catalogue manager checks the update and its effect on service levels, categories and dependencies.
  4. ApproveThe service owner approves minor changes (text, contact, category). The process owner approves changes to hours, scope, support or price. Customer-visible changes are shared with the relationship manager before publication.
  5. Publish and notifyThe revised entry is published and staff and affected customers are told of what changed and the effective date.

11.3 Retire a service

  1. DecideThe service owner proposes retirement with reasons, impact, alternatives and a notice date. The Management Representative approves.
  2. NotifyCustomers are given the notice required by the agreement, and at least [90 days] where none is stated. The relationship manager manages the conversation.
  3. Wind downService is withdrawn in steps: new orders stop, migration support is given, data is returned or deleted as agreed, access is removed, and assets are disposed of under the Asset Disposal Process.
  4. CloseAgreements are ended, configuration items marked retired, categories closed and the entry moved to the retired archive with the retirement record.

11.4 Periodic review

Each entry is reviewed at least every [6 months] and after any significant incident or change. The reviewer checks the owner and deputy, hours, support model, dependencies, agreements, categories and links against the live situation, and records the date. Entries not reviewed within [3 months] of their due date are reported to the governance group.

11.5 Process flow

  1. Proposal or change trigger arrives with draft information.
  2. Catalogue manager checks completeness and consistency.
  3. Service evaluated against criteria; shortfalls fixed or accepted.
  4. Approval by the right authority.
  5. Links, categories and routing created in the tools.
  6. Publication, notification and archive of the previous version.
  7. Monitoring and periodic review; return to the start when a change is needed.

12. Service evaluation criteria and sample test case

A new or changed service is evaluated before go-live and in review. The criteria below are applied to all services; the service owner can add criteria suited to the service. A service passes when all mandatory criteria are met, or any gap is accepted in writing by the Management Representative with a date to close it.

12.1 Evaluation criteria

CriterionMeasurePass conditionMandatory
Fit to requirementsTraceability from each requirement to a feature or control[100 percent] of agreed requirements met or formally deferredYes
OperabilityRunbooks, monitoring, alerts and on-call arrangements exist and are testedA supporting engineer unfamiliar with the build completes [3 of 3] sample fixes from runbooksYes
PerformanceResponse time and throughput at forecast loadWithin the agreed targets at [150 percent] of forecast peak loadYes
Availability and recoveryFailover, backup and recovery test resultsRecovery time and recovery point objectives met in a test within the last [6 months]Yes
SecuritySecurity assessment and vulnerability findingsNo open critical or high findings without an accepted riskYes
Support readinessTraining and knowledge articles[100 percent] of tier 1 staff trained; articles publishedYes
Customer acceptanceAcceptance test or pilot outcomeSigned acceptance or documented pilot resultWhere a customer is involved
FinancialCost and priceCost within [10 percent] of the business caseYes
Ongoing healthCustomer satisfaction, incident rate, SLA attainmentAt or above target over the last [2 quarters]In review

A service already live that fails its health criteria for [2 consecutive quarters] is placed on an improvement plan by the service owner. If the plan fails, the governance group considers withdrawal or redesign.

12.2 Sample test case

The sample below shows how an evaluation test case is recorded. Each service has its own set.

FieldEntry
Test case ID[SM07-TC-01]
Service[Customer web portal]
ObjectiveShow that support staff can restore the service after the application process stops, using only the runbook
PreconditionsTest environment matches live; monitoring configured; runbook version recorded
Steps1. Stop the application process. 2. Wait for the alert. 3. Receive and triage the alert as on-call. 4. Follow the runbook to restart. 5. Confirm login and report download work.
Expected resultAlert raised within [2 minutes]; service restored within [15 minutes]; ticket logged with correct category and severity
Actual result
Pass or fail and evidence
Tester and date
Actions

13. Interfaces with other processes

  • Service level management: each entry points to its agreement; agreement changes trigger entry updates.
  • Configuration and asset management: entries link to configuration items and dependency maps.
  • Change management and release management: live changes that affect an entry trigger an update; release acceptance depends on a draft entry.
  • Service design and transition: new services arrive with draft entries; transition checks use the evaluation criteria.
  • Incident and request management: categories and routing derive from entries.
  • Supplier management: supporting services are listed with their supplier agreements.
  • Business relationship management: the customer view is the source for sales and account discussions.
  • Information security management for services: data classification and security owner come from the entry.

14. Key performance indicators

MeasureTargetSourceFrequency
Services in scope with a published entry[100 percent]Catalogue[Monthly]
Entries reviewed on time[95 percent]Review log[Quarterly]
Entries updated within [5 working days] of a live change[95 percent]Change records against revision dates[Quarterly]
Entries with all mandatory fields complete[100 percent]Catalogue check[Monthly]
Tickets using a catalogue category[98 percent]Ticketing tool[Monthly]
New services accepted with all mandatory criteria met[90 percent]Evaluation records[Quarterly]
Discrepancies found by audit between catalogue and live servicesZero materialAudit report[Annual]

15. Records and evidence

  • Current and previous versions of every catalogue entry, with approval records, kept for [3 years] after retirement.
  • Evaluation records and sample test case results for each new or changed service, kept for [3 years].
  • Review log with dates, reviewers and changes, kept for [3 years].
  • Retirement records with notices to customers, kept for [6 years] or the contract term plus [1 year], whichever is longer.
  • Catalogue health reports, kept for [3 years].

Annexure A: Service catalogue entry form

FieldEntry
Service name and code
Service owner and deputy
Type (customer-facing or supporting)
Description and outcomes
Customers, users and volumes
Features, options and exclusions
Hours of service and support
Support model and contacts
Dependencies and configuration items
Agreement reference
Request categories and fulfilment times
Incident categories and default severity
Recovery targets and continuity plan reference
Data classification and security owner
Charges
Next review date and approver

Annexure B: Service catalogue register

ServiceCodeOwnerStatusLast reviewNext reviewAgreement

Annexure C: Service evaluation record

CriterionResultEvidencePass or gapAction and owner
Fit to requirements
Operability
Security

Annexure D: Document history

VersionDateAuthorChangeApproved by
1.0[date][name]Initial release[Process owner]

16. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

17. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

18. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 20000-1:2018 references

ReferenceTitle
8.2.4Service catalogue management
4.3Determining the scope of the service management system
8.1Operational planning and control
8.3.3Service level management
Sign in to download the PDFFree. You return straight to this document after you sign in.