Service Management Policy

1. Purpose

This policy sets out what top management commits to, and what every person and supplier involved in services must do, so that the Organisation's services meet customer requirements, are delivered consistently, and keep improving. It provides the framework against which the SMS Objectives are set and reviewed.

• Give customers a clear statement of how the Organisation will manage the services they rely on.
• Give staff and suppliers rules that are specific enough to be followed and checked.
• Give top management a basis for decisions on resources, priorities and exceptions.

2. Scope

The policy applies to every service in the scope of the SMS, as defined in the SMS Scope and Service Management Plan, and to every process in the Service Management System Manual. It applies to employees, contractors, temporary staff, and suppliers delivering part of a service.

• In scope: the whole service lifecycle from request and design to retirement; all environments used to deliver a service; the SMS processes and the people who run them.
• In scope: services provided to internal customers where they are listed in the catalogue.
• Out of scope: [named services, pilots or units] listed as exclusions in the scope statement, approved by top management and reviewed at each management review.

3. Policy Commitments

Top management of the Organisation commits to the following, and has approved them as the Service Management Policy.

1. The Organisation will understand its customers and users, and will agree and meet documented service requirements.
2. The Organisation will provide the people, tools, budget and information needed to run the SMS and to deliver services at the agreed levels.
3. The Organisation will plan, measure and review services and processes against objectives and will act on the results.
4. The Organisation will meet applicable legal, regulatory, contractual and customer requirements, including those for information security and privacy.
5. The Organisation will control suppliers and internal groups that contribute to services and remain accountable for the outcome.
6. The Organisation will continually improve the SMS and the services, and will correct nonconformities and prevent their recurrence.

4. Roles and Responsibilities

5. Policy Statements

5.1 Customer focus and service requirements

• The Organisation must identify the customers and users of each service, and name a service owner and a customer representative for each, within [10 working days] of a service entering the catalogue.
• Service requirements must be documented and agreed with the customer before a service is accepted into live operation, and reconfirmed at each SLA review.
• Customer satisfaction must be measured at least [twice a year], and every complaint must be acknowledged within [1 working day] and followed through to closure.
• A requirement that the Organisation cannot meet must be stated to the customer in writing and recorded; it must not be accepted silently.

5.2 Leadership, governance and planning

• Top management must review the SMS at least every [6 months], using the inputs listed in the Internal Audit and Management Review Procedure.
• SMS objectives must be set annually, be measurable, have an owner, and be recorded in SMS Objectives.
• Risks and opportunities to the SMS and services must be held in one register and reviewed at least every [3 months].
• Process owners and service owners must have the authority and time to carry out their roles; vacant roles must be filled or covered within [10 working days].

5.3 Service portfolio, catalogue and configuration

• Every live service must be in the service catalogue; a live service that is not in the catalogue is a nonconformity.
• Each service must have a plan, an SLA or equivalent documented target, an owner, a support tier and a list of dependencies.
• Assets and configuration items that support in-scope services must be identified, owned and recorded in the configuration management database, and the records verified against reality at least every [12 months].
• Software must be used only within licence terms, and compliance must be checked at least every [12 months].

5.4 Relationships, agreements and suppliers

• Every service must have an agreed service level agreement signed by the customer representative or an equivalent record of agreement; internal teams must support it with operational level agreements.
• Service targets must not be promised if the supporting OLAs and underpinning contracts cannot meet them.
• Every supplier that contributes to a service must be recorded, classified by criticality, bound by a written agreement, and reviewed at the frequency set for its tier.
• Critical suppliers must have an exit or substitution plan reviewed at least every [12 months].

5.5 Supply and demand

• Costs of services must be recorded by service and compared with budget at least [monthly].
• Demand must be forecast for each service at least every [quarter], and capacity must be planned so that agreed service levels can be met for the next [12 months].
• No new customer commitment that materially changes demand may be accepted without a capacity check by the capacity manager.

5.6 Design, change and release

• New and substantially changed services must go through the Service Design and Transition Procedure and must meet their acceptance criteria before live use.
• Every change to a live service, component or SMS process must be recorded, assessed for risk and approved at the right level before implementation; unauthorised changes must be treated as incidents.
• Releases must have a tested rollback, and the configuration records must be updated within [1 working day] of deployment.
• Emergency changes must be limited to cases where delay would cause serious harm, and must be reviewed within [2 working days].

5.7 Resolution and fulfilment

• All incidents and requests must be logged in the ticketing tool with the mandatory fields set out in the Service Operating Model.
• Incidents must be prioritised by impact and urgency and resolved within the targets in the SLA; major incidents must be managed by an incident manager with a post-incident review within [5 working days].
• Users must be told what is happening to their ticket, and tickets must be closed only after the user confirms or [5 working days] have passed without objection.
• Problems must be identified from trends and repeated incidents, and their causes removed through the change process.

5.8 Availability, continuity and security

• Availability and continuity requirements must be agreed with customers; plans must be tested at the frequency in the Availability and Service Continuity Management Procedure.
• Information security requirements must be defined for each service and tested before acceptance; security controls must follow the Information Security Policy and Information Security Management for Services.
• Security incidents that affect services must be recorded as incidents and handled under the Information Security Incident Management Policy.

5.9 People, communication and documented information

• People who do service work must be competent for the role, and training must be recorded; new joiners must complete induction within [30 days].
• Communication with customers, users and suppliers must follow the Communication Procedure; changes that affect users must be announced at least [5 working days] ahead unless urgent.
• SMS documents must be controlled under the Documents and Records Management Procedure: current, approved, versioned and available to those who need them.
• Knowledge needed to run a service must be written down and not held by one person alone.

5.10 Measurement, review and improvement

• Every process must have measures and targets, and results must be reviewed by the process owner at least [monthly].
• Internal audits must cover every part of the SMS at least once in [12 months].
• Nonconformities must be recorded, analysed for cause, corrected, and checked for effectiveness within the times in the Service Management System Manual.
• Improvement ideas from anyone must be recorded, assessed within [10 working days], and either planned or declined with a reason.

6. Decision Authority

The table sets the level at which decisions that affect the policy are taken. Authorities may be delegated in writing; accountability remains with the named role.

7. Compliance and Monitoring

Results are reported to the management representative, who includes them in the SMS performance report. Breaches of this policy are recorded as nonconformities and handled under the Service Management System Manual.

8. Records and Evidence

The following are kept as evidence that the policy is applied. Retention follows the Documents and Records Management Procedure and the register of SMS records in the Service Management System Manual.

• Signed copy of the policy, with approval date and version history [5 years after supersession].
• Induction and refresher records [employment plus 3 years].
• Exception register and approvals [until closed plus 3 years].
• Internal audit reports and management review minutes [5 years].
• Service desk samples and process adherence checks [3 years].

9. Supporting Procedures

The detailed rules for each commitment are in the Service Management System Manual and the procedures it names. The principal ones are listed below.

Where this policy and a procedure differ, this policy prevails and the difference is raised as a nonconformity.

Annexure A: Policy statement for display

The Organisation provides services that customers can rely on. We agree clear requirements and service levels with our customers, we deliver and support services through controlled, measured processes, we protect the information entrusted to us, we work with suppliers under clear agreements, and we meet the legal, regulatory and contractual requirements that apply to us. We measure our performance, we listen to our customers, and we continually improve our services and our service management system. Signed: [Chief Executive], dated [dd-mm-yyyy].

Annexure B: Document history

10. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

11. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

12. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 20000-1:2018 references

Related documents

• Service Management System Manual
• SMS Objectives
• Service Operating Model
• Information Security Policy
• Service Reporting and Continual Improvement Procedure
• Internal Audit and Management Review Procedure