Template draft. Replace everything in [square brackets] with your own decision,
delete what does not describe what you really do, and approve it through your own document control. It is not legal
advice and does not make an organisation compliant or certified.
1. Introduction
The service catalogue is the Organisation's list of every live service, written so that customers, service desk staff and delivery teams all describe a service the same way. It is the source for what each service is, who owns it, when it is supported, what it depends on and which agreement applies. Other processes read from it: the service desk uses its categories to classify tickets, service level management uses its entries to attach agreements, and change management uses its dependencies to assess impact.
The catalogue has two views. The customer view lists what a customer can buy or request, in plain language. The technical view adds the support model, dependencies and configuration links that only staff need.
2. Purpose
To make sure that the Organisation keeps an accurate, approved and current catalogue of the services it provides, and that a service is added, changed or retired only through a controlled step that confirms it meets defined requirements.
3. Objectives
- Every service in the scope of the SMS has one catalogue entry with a named owner.
- Entries are accurate: reviewed at least every [6 months], and updated within [5 working days] of a live change.
- A new service is not made live until its entry is approved and its support arrangements, service levels and categories exist.
- Staff and customers can find the right version of the information quickly.
- Services that no longer meet evaluation criteria are identified and either improved or retired.
4. Scope
- In scope: all services delivered to customers and all internal services on which customer services depend, as listed in the SMS Scope and Service Management Plan.
- In scope: the customer view, the technical view, the retired services archive and the request and incident categories derived from entries.
- Out of scope: the design of a new service, which is in the Service Design and Transition Procedure, and the detail of agreements, which is in the Service Level Management Procedure.
- Applies to: service owners, the service catalogue manager, the service desk, relationship managers and any team that supports a service.
5. Terms and definitions
| Term | Meaning |
|---|
| Service | A means of delivering value to a customer by facilitating the outcomes the customer wants to achieve, delivered by the Organisation with defined responsibilities. |
| Service catalogue | The approved list of services with the information needed to deliver and support them. |
| Service portfolio | All services in the pipeline, live and retired, with their business case and investment. |
| Live service | A service that is delivered to customers or users and has passed transition. |
| Supporting service | An internal or supplier service that a customer-facing service needs, such as hosting or an identity platform. |
| Catalogue entry | The record that describes one service using the fields in this procedure. |
| Request category | A standard type of request that a user can raise against a service. |
| Incident category | A standard type of fault used to classify an incident against a service. |
6. Roles and Responsibilities
| Role | Responsibilities |
|---|
| Process owner | Owns this procedure; approves the entry fields and the evaluation criteria; reports catalogue health to the governance group. |
| Service catalogue manager | Maintains the catalogue; checks entries for completeness; publishes both views; runs the review cycle; maintains the retired archive. |
| Service owner | Accountable for the accuracy of the entry, the performance of the service and the proposal to change or retire it. |
| Business relationship manager | Supplies customer wording and requirements; confirms the customer view is understandable. |
| Service desk | Uses the catalogue to classify and route; reports entries that are missing, wrong or unclear. |
| Resolver groups | Confirm support tier, hours and dependencies for the services they support. |
| Configuration manager | Ensures each entry links to the correct configuration items and the dependency map. |
| Management Representative | Approves new services into the catalogue and retirements, and resolves disagreement between owners. |
| Customer representative | Reviews the customer view and confirms the service description matches the agreement. |
| Activity | Responsible | Accountable | Consulted | Informed |
|---|
| Propose and describe a new service | Service owner | Management Representative | Business relationship manager; resolver groups | Service desk |
| Check and approve the entry | Service catalogue manager | Process owner | Service owner; security lead | Governance group |
| Publish the catalogue | Service catalogue manager | Process owner | Service desk | All staff; customers |
| Update an entry after a change | Service owner | Service owner | Configuration manager; service catalogue manager | Service desk |
| Run the periodic review | Service catalogue manager | Process owner | Service owners; customer representatives | Management Representative |
| Retire a service | Service owner | Management Representative | Customer representatives; supplier manager | All affected parties |
7. Service lifecycle
A service moves through stages. The catalogue holds entries from the moment a service is approved for live operation until it has been retired and archived.
| Stage | What happens | Catalogue status | Where it is controlled |
|---|
| Concept | Idea or customer demand is assessed against strategy and capacity | None (portfolio record only) | Service Design and Transition Procedure |
| Design and build | Requirements are agreed; service levels, support and dependencies are designed | Draft entry | Service Design and Transition Procedure |
| Transition | Tested against acceptance and evaluation criteria; operations are trained; entry is approved | Approved, not published | This procedure and the Release and Deployment Management Procedure |
| Live | Delivered, monitored and reviewed | Published | This procedure |
| Changed | A change alters scope, hours, support, price or dependencies | Published with revision | Change Management Procedure and this procedure |
| Retirement | Service is withdrawn with notice to customers, data and assets dealt with | Retiring, then archived | This procedure |
8. Procedure inputs and outputs
| Inputs | Outputs |
|---|
| New or changed service proposal and business case | Approved catalogue entry (both views) |
| Customer requirements and agreements | Updated request and incident categories |
| Dependencies and configuration data | Published catalogue and revision notices |
| Results of service evaluation | Retirement notices and archive record |
| Feedback from the service desk and customers | Catalogue health report |
9. Service catalogue content
Each entry must hold at least the information in the template below. Fields are completed by the service owner and checked by the catalogue manager. A service with an empty mandatory field cannot be published.
9.1 Catalogue template
The table gives the catalogue layout with worked example rows. Use one row per service, and attach the detailed entry form (Annexure A) for each. Example rows are illustrative and show the level of detail to expect; replace them with the Organisation's own services.
| Service | Description | Owner | Hours | Support tier | Dependencies | SLA reference | Request and incident categories |
|---|
| [Customer web portal] | Self-service website where customers view usage, download reports and raise requests | [Head of Product] | [24x7] | L1 service desk; L2 technical; L3 engineering | [Hosting service; identity platform; database service] | [SLA-001] | Requests: account change, report access, new user. Incidents: unavailable, slow, login failure, wrong data |
| [Integration interface service] | Interfaces that let customers exchange data programmatically | [Head of Engineering] | [24x7] | L1; L2 technical; L3 | [Hosting service; network service; certificate service] | [SLA-002] | Requests: new key, quota change, test access. Incidents: errors, latency, rejected calls |
| [Managed monitoring service] | Continuous monitoring and alert triage for the customer's systems | [Head of Operations] | [24x7] | L1; L2 business; L3 | [Monitoring platform; ticketing tool; on-call service] | [SLA-003] | Requests: add system, change threshold, report. Incidents: missed alert, false alarms, platform down |
| [Corporate email and collaboration] | Staff email, calendars, messaging and shared storage | [Head of IT] | [Working days 07:00 to 21:00] | L1; L2 technical | [Identity platform; internet connectivity] | [OLA-001] | Requests: new mailbox, shared folder, distribution list. Incidents: no mail, sync failure, storage full |
| [Internal service desk] | First point of contact for staff and customers | [Head of Service Delivery] | [Working days 08:00 to 20:00] | L1; L2 | [Ticketing tool; telephony; knowledge base] | [OLA-002] | Requests: new starter kit, desk move. Incidents: tool unavailable, telephone line down |
Note. The template is intentionally compact. If a row grows beyond what a reader can scan, move detail into the entry form and keep the row short.
9.2 Detailed entry fields
| Field | What to record | Mandatory |
|---|
| Service name and identifier | Plain name, unique code and short description a customer would use | Yes |
| Service type | Customer-facing or supporting; internal or external supplier | Yes |
| Service owner and deputy | Named individuals with contact details | Yes |
| Customers and users | Customer groups served and user numbers | Yes |
| Business purpose and outcomes | What the customer achieves by using the service | Yes |
| Features and options | What is included, optional extras and what is explicitly excluded | Yes |
| Hours of service and support | Hours delivered and hours supported; time zone; public holiday arrangements | Yes |
| Support model | Tiers, teams, on-call, supplier support and contact route | Yes |
| Dependencies | Services, suppliers, assets and people that the service needs, linked to configuration items | Yes |
| Service level agreement or level agreement reference | Agreement number and the targets that apply | Yes |
| Request catalogue | Standard requests, fulfilment times, approval needs and any charge | Yes |
| Incident categories | Categories, default severity, default resolver group | Yes |
| Service continuity and availability | Recovery time and point targets; continuity plan reference | Yes |
| Information security requirements | Classification of data handled; controls; security owner | Yes |
| Charges and billing | Pricing basis, if any, and how it is invoiced | If charged |
| Interfaces and constraints | Other services this service connects to; technical or contractual limits | Yes |
| Status and dates | Draft, approved, live, retiring; go-live date; next review date | Yes |
| Retirement plan | Planned end date, notice period, data return, migration route | If retiring |
10. Service requirements
Service requirements are the conditions every service must satisfy before it is accepted into the catalogue. They come from customers, from law and contract, from the Organisation's policy and from the capability of the support teams. The service owner records them in the entry and the service catalogue manager checks them at approval.
| Requirement area | Question to answer | Evidence |
|---|
| Customer need | Is there an agreed description of the outcome, users and volumes? | Signed requirements or agreement |
| Service levels | Are availability, response, resolution and reporting targets agreed and measurable? | Service level agreement or draft |
| Support | Does every tier know how to support it, with runbooks and trained staff? | Training record; runbooks; roster |
| Dependencies | Are suppliers and internal services under agreement that covers the targets? | Operational level agreement; supplier contract |
| Security and privacy | Has the service been assessed for information security and personal data handling? | Risk assessment; privacy assessment |
| Continuity | Are recovery targets, backups and fallback arrangements defined and tested? | Continuity plan; test result |
| Capacity | Is capacity sufficient for the planned demand, and is growth monitored? | Capacity plan |
| Cost | Is the cost known and the pricing or internal allocation agreed? | Budget record; price list |
| Monitoring | Are alerts and measures set up to detect failure and report the targets? | Monitoring configuration review |
| Legal and contract | Do contract terms and applicable law allow the service as designed? | Legal review note |
11. Service catalogue management procedure
11.1 Add a new service
- ProposeThe service owner submits a proposal and draft entry (Annexure A) after design has defined the service. Input: business case, requirements. Output: draft entry. Owner: service owner. Target: when the design phase begins.
- AssessThe catalogue manager checks completeness and consistency with existing entries, and checks for overlap with other services. Output: assessment note. Owner: catalogue manager. Target: [3 working days].
- EvaluateThe service is tested against the evaluation criteria below, with security and continuity checks. Output: evaluation record. Owner: service owner with process owners. Target: before go-live.
- ApproveThe Management Representative approves the entry and service levels, after the governance group confirms support readiness. Output: approval. Target: [5 working days] from evaluation.
- Create linksThe configuration manager links configuration items; the service desk loads categories and routing rules in the ticketing tool. Output: working categories. Target: before go-live.
- PublishThe catalogue manager publishes the entry, sends a revision notice and archives the previous version. Target: on go-live day.
11.2 Change an existing service
- TriggerA change request, review result, customer request or incident analysis shows that an entry is wrong or must change. Any employee may report the gap to the catalogue manager.
- UpdateThe service owner updates the draft with the change, within [5 working days] of the live change being completed.
- CheckThe catalogue manager checks the update and its effect on service levels, categories and dependencies.
- ApproveThe service owner approves minor changes (text, contact, category). The process owner approves changes to hours, scope, support or price. Customer-visible changes are shared with the relationship manager before publication.
- Publish and notifyThe revised entry is published and staff and affected customers are told of what changed and the effective date.
11.3 Retire a service
- DecideThe service owner proposes retirement with reasons, impact, alternatives and a notice date. The Management Representative approves.
- NotifyCustomers are given the notice required by the agreement, and at least [90 days] where none is stated. The relationship manager manages the conversation.
- Wind downService is withdrawn in steps: new orders stop, migration support is given, data is returned or deleted as agreed, access is removed, and assets are disposed of under the Asset Disposal Process.
- CloseAgreements are ended, configuration items marked retired, categories closed and the entry moved to the retired archive with the retirement record.
11.4 Periodic review
Each entry is reviewed at least every [6 months] and after any significant incident or change. The reviewer checks the owner and deputy, hours, support model, dependencies, agreements, categories and links against the live situation, and records the date. Entries not reviewed within [3 months] of their due date are reported to the governance group.
11.5 Process flow
- Proposal or change trigger arrives with draft information.
- Catalogue manager checks completeness and consistency.
- Service evaluated against criteria; shortfalls fixed or accepted.
- Approval by the right authority.
- Links, categories and routing created in the tools.
- Publication, notification and archive of the previous version.
- Monitoring and periodic review; return to the start when a change is needed.
12. Service evaluation criteria and sample test case
A new or changed service is evaluated before go-live and in review. The criteria below are applied to all services; the service owner can add criteria suited to the service. A service passes when all mandatory criteria are met, or any gap is accepted in writing by the Management Representative with a date to close it.
12.1 Evaluation criteria
| Criterion | Measure | Pass condition | Mandatory |
|---|
| Fit to requirements | Traceability from each requirement to a feature or control | [100 percent] of agreed requirements met or formally deferred | Yes |
| Operability | Runbooks, monitoring, alerts and on-call arrangements exist and are tested | A supporting engineer unfamiliar with the build completes [3 of 3] sample fixes from runbooks | Yes |
| Performance | Response time and throughput at forecast load | Within the agreed targets at [150 percent] of forecast peak load | Yes |
| Availability and recovery | Failover, backup and recovery test results | Recovery time and recovery point objectives met in a test within the last [6 months] | Yes |
| Security | Security assessment and vulnerability findings | No open critical or high findings without an accepted risk | Yes |
| Support readiness | Training and knowledge articles | [100 percent] of tier 1 staff trained; articles published | Yes |
| Customer acceptance | Acceptance test or pilot outcome | Signed acceptance or documented pilot result | Where a customer is involved |
| Financial | Cost and price | Cost within [10 percent] of the business case | Yes |
| Ongoing health | Customer satisfaction, incident rate, SLA attainment | At or above target over the last [2 quarters] | In review |
A service already live that fails its health criteria for [2 consecutive quarters] is placed on an improvement plan by the service owner. If the plan fails, the governance group considers withdrawal or redesign.
12.2 Sample test case
The sample below shows how an evaluation test case is recorded. Each service has its own set.
| Field | Entry |
|---|
| Test case ID | [SM07-TC-01] |
| Service | [Customer web portal] |
| Objective | Show that support staff can restore the service after the application process stops, using only the runbook |
| Preconditions | Test environment matches live; monitoring configured; runbook version recorded |
| Steps | 1. Stop the application process. 2. Wait for the alert. 3. Receive and triage the alert as on-call. 4. Follow the runbook to restart. 5. Confirm login and report download work. |
| Expected result | Alert raised within [2 minutes]; service restored within [15 minutes]; ticket logged with correct category and severity |
| Actual result | |
| Pass or fail and evidence | |
| Tester and date | |
| Actions | |
13. Interfaces with other processes
- Service level management: each entry points to its agreement; agreement changes trigger entry updates.
- Configuration and asset management: entries link to configuration items and dependency maps.
- Change management and release management: live changes that affect an entry trigger an update; release acceptance depends on a draft entry.
- Service design and transition: new services arrive with draft entries; transition checks use the evaluation criteria.
- Incident and request management: categories and routing derive from entries.
- Supplier management: supporting services are listed with their supplier agreements.
- Business relationship management: the customer view is the source for sales and account discussions.
- Information security management for services: data classification and security owner come from the entry.
14. Key performance indicators
| Measure | Target | Source | Frequency |
|---|
| Services in scope with a published entry | [100 percent] | Catalogue | [Monthly] |
| Entries reviewed on time | [95 percent] | Review log | [Quarterly] |
| Entries updated within [5 working days] of a live change | [95 percent] | Change records against revision dates | [Quarterly] |
| Entries with all mandatory fields complete | [100 percent] | Catalogue check | [Monthly] |
| Tickets using a catalogue category | [98 percent] | Ticketing tool | [Monthly] |
| New services accepted with all mandatory criteria met | [90 percent] | Evaluation records | [Quarterly] |
| Discrepancies found by audit between catalogue and live services | Zero material | Audit report | [Annual] |
15. Records and evidence
- Current and previous versions of every catalogue entry, with approval records, kept for [3 years] after retirement.
- Evaluation records and sample test case results for each new or changed service, kept for [3 years].
- Review log with dates, reviewers and changes, kept for [3 years].
- Retirement records with notices to customers, kept for [6 years] or the contract term plus [1 year], whichever is longer.
- Catalogue health reports, kept for [3 years].
Annexure A: Service catalogue entry form
| Field | Entry |
|---|
| Service name and code | |
| Service owner and deputy | |
| Type (customer-facing or supporting) | |
| Description and outcomes | |
| Customers, users and volumes | |
| Features, options and exclusions | |
| Hours of service and support | |
| Support model and contacts | |
| Dependencies and configuration items | |
| Agreement reference | |
| Request categories and fulfilment times | |
| Incident categories and default severity | |
| Recovery targets and continuity plan reference | |
| Data classification and security owner | |
| Charges | |
| Next review date and approver | |
Annexure B: Service catalogue register
| Service | Code | Owner | Status | Last review | Next review | Agreement |
|---|
| | | | | | |
| | | | | | |
| | | | | | |
Annexure C: Service evaluation record
| Criterion | Result | Evidence | Pass or gap | Action and owner |
|---|
| Fit to requirements | | | | |
| Operability | | | | |
| Security | | | | |
| | | | |
Annexure D: Document history
| Version | Date | Author | Change | Approved by |
|---|
| 1.0 | [date] | [name] | Initial release | [Process owner] |
| | | | |
16. Exception
Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.
17. Enforcement
Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.
18. Review
This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.
ISO/IEC 20000-1:2018 references
| Reference | Title |
|---|
| 8.2.4 | Service catalogue management |
| 4.3 | Determining the scope of the service management system |
| 8.1 | Operational planning and control |
| 8.3.3 | Service level management |