SMS Scope and Service Management Plan

1. Purpose

This plan states exactly what the service management system (SMS) covers, what it deliberately leaves out, what the covered services depend on, and how the work of running and improving the SMS is planned, resourced and governed. It is the document an auditor, a customer or a new service owner reads to learn where the boundary of the SMS lies and who answers for what is inside it.

It turns the commitments in the Service Management Policy and the targets in SMS Objectives into a dated plan with named owners, and it is the reference for every decision to add, change or remove a service from the SMS.

2. Objectives of the plan

• Give one authoritative statement of scope that matches the Service Catalogue Management Procedure, the contracts in force and the context recorded in Context of the Organization.
• Make every service, site, team and supplier inside the boundary identifiable, with a named owner.
• Keep dependencies and legal, regulatory and contractual requirements visible so that planned change does not break them.
• Plan SMS activities for each year: process reviews, audits, management reviews, training and improvement work, with dates, owners and budget.
• Set the service commitment that the Organisation makes to customers and the governance forums that check it is kept.

3. Scope of the service management system

The SMS applies to the design, transition, delivery and improvement of the services listed in the service scope table below, for the customers named in the service catalogue, from the sites and cloud environments listed in the location table. The boundary is reviewed at least every [12 months] and whenever a service is launched, retired or moved.

3.1 Services in scope

Each service in the table has an entry in the service catalogue with its hours, support tier, dependencies and service level reference. A service that is not in the catalogue is not in scope of the SMS, and any service that is delivered to a customer must be added to the catalogue before it is accepted into live operation.

3.2 Locations and environments

Remote working is in scope because services are delivered from endpoints outside the offices. The Mobile Device and Teleworking Policy governs the controls that apply.

3.3 Exclusions and their justification

• Out of scope: [internal finance and payroll systems], because no customer service depends on them and they are managed under the finance function's own controls.
• Out of scope: [pre-sales demonstration environments with no customer data], which are not offered as a service and carry no service level.
• Out of scope: [research and development projects] until they pass the acceptance criteria in the Service Design and Transition Procedure.
• Out of scope: processes or parts of services that a customer runs itself; the Organisation takes responsibility only for its own part as described in the agreement.
• No exclusion may reduce the Organisation's ability to meet the requirements of ISO/IEC 20000-1 or the service requirements of any customer. Each exclusion is reviewed at every management review.

3.4 Processes in scope

All processes required by ISO/IEC 20000-1 are within the SMS: service catalogue, asset and configuration, business relationship, service level, supplier, budgeting and accounting, demand, capacity, change, design and transition, release and deployment, incident, service request, problem, availability, continuity and information security. Where a process is performed by a supplier or another party on the Organisation's behalf, the Organisation keeps accountability and shows control through the Supplier Management Procedure.

4. Dependencies

The scope above is only deliverable while the following conditions hold. Each dependency has an owner who tells the Management Representative when it is at risk. Dependencies are re-checked at every management review and when a service is changed.

Dependencies on other management systems, such as the information security management system, are managed through the Information Security Management for Services procedure and the ISMS Manual. Shared controls are assessed once and referenced by both.

5. Legal, regulatory and contractual requirements

The Service Management Plan records the requirements that apply to the in-scope services. The register is owned by the Management Representative with advice from [legal counsel], and is refreshed at least every [6 months] and whenever a new contract or law is noted.

Nothing in this plan is legal advice. Where a requirement changes, the Management Representative opens a change to this plan and the affected procedures, and records the decision in the next management review.

6. Roles and Responsibilities

6.1 Management Representative

Top management appoints the Management Representative in writing and records the appointment in the management review minutes. The role is held by a senior person who is independent of the day-to-day operation of any single service and who has direct access to top management. A named deputy covers absences longer than [5 working days].

• Ensures the SMS is established, documented, implemented and maintained, and that the plan in this document is carried out.
• Ensures that service management processes are defined, that each has an owner, and that roles and responsibilities are communicated and understood.
• Reports to top management at least every [quarter] on SMS performance, nonconformities, risk, customer feedback and resource needs.
• Promotes awareness of customer requirements and of the service management policy across the Organisation.
• Chairs the SMS governance group and decides what is escalated to top management.
• Approves changes to documents of the SMS under the Documents and Records Management Procedure.
• Has authority to halt a service transition into live operation that has not met agreed acceptance criteria and to require corrective action.

6.2 Top management

• Demonstrates leadership by communicating the importance of effective service management and the policy, and by taking part in the management review.
• Provides the resources the plan needs and approves the annual budget for the SMS, including training and tools.
• Ensures the policy and objectives are compatible with the direction of the Organisation, and are reviewed against results.
• Appoints the Management Representative and ensures that authorities and responsibilities for service management roles are assigned.
• Decides on exclusions from scope and accepts residual risk that cannot be treated within the plan.

7. Service management plan

The plan covers [12 months] from [the start of the financial year] and is approved by top management at the first management review of the period. It is a rolling plan: the Management Representative adjusts dates as priorities change and records every change in the plan tracker (Annexure B).

7.1 Planning inputs

• Service management policy and SMS objectives, with the measurable targets for the period.
• Output of the last management review, audit findings, open nonconformities and the improvement register.
• Customer requirements and feedback from the Business Relationship Management Procedure, including survey results and complaints.
• Risks and opportunities recorded for the SMS, with treatment actions.
• Forecast demand, capacity and budget, and the pipeline of new and changed services.
• Changes to the legal, regulatory and contractual register and to the dependency register.

7.2 Planned activities

7.3 Resources and budget

The plan states the people, time and tools needed. Process owners submit resource requests by [the end of month 2 of the financial year], and top management approves the SMS budget by [the end of month 3]. A change to the budget of more than [10 percent] requires approval by top management and is recorded in the plan tracker.

7.4 Risks to the plan

Risks to achieving the plan are recorded in the risk register under the Risk Management Policy and reviewed at each governance meeting. Typical risks are loss of key staff, supplier failure, tool outage, scope creep from new services, and delay caused by competing projects. Each risk has an owner, a treatment and a trigger that is monitored. Opportunities, such as automation of routine requests, are recorded alongside risks and evaluated in the same way.

7.5 Communication of the plan

The approved plan is published on the [intranet] and summarised for all staff within [10 working days] of approval. Process owners brief their teams. Customers receive the part of the plan that concerns them, such as planned review dates and the scope of their services, through their relationship manager. The Communication Procedure sets the channels.

8. Service commitment

The Organisation commits to deliver each in-scope service to the service levels agreed in the service level agreement for that service and to the requirements of the relevant customers, and to operate the SMS so that it continues to meet ISO/IEC 20000-1 requirements. This does not claim certification; it states the standard the Organisation works to.

• Every service has a named owner, an entry in the service catalogue and an agreed set of measures, reported on the cycle in the Service Level Management Procedure.
• Customers are told in advance of planned change that affects them, within the notice period in the agreement or at least [5 working days].
• Incidents are managed to the severity targets in the Service Operating Model, and customers with agreed notification terms are told within the agreed time.
• Customer complaints are acknowledged within [1 working day] and a response given within [10 working days], as set out in the Business Relationship Management Procedure.
• Information held for customers is protected as agreed in the contract and the information security controls of the Organisation.
• Service performance is reviewed with customers at the frequency in the agreement, and improvements are recorded and tracked.

9. Governance

Governance is delivered through three forums with clear decision rights. Minutes are kept for each and actions are tracked in the improvement register.

9.1 Escalation of SMS issues

A process owner who cannot resolve a conflict, resource shortfall or repeated nonconformity raises it to the SMS governance group at the next meeting, or within [2 working days] if it threatens a customer commitment. If the governance group cannot resolve it within [10 working days], the Management Representative escalates to top management, who decide and record the outcome.

9.2 Control of this plan

This plan is controlled under the Documents and Records Management Procedure. Any change to scope is made through a scope change request (Annexure A), assessed for impact on services, contracts, risks and resources, approved by the Management Representative, and by top management where services are added or removed, and then reflected in the service catalogue within [5 working days].

10. Interfaces with other documents

• Service Management Policy: provides the commitments this plan implements.
• SMS Objectives: provides the measurable targets planned here.
• Context of the Organization: provides the issues and interested parties that shape scope.
• Service Catalogue Management Procedure: keeps the list of in-scope services.
• Service Level Management Procedure: keeps the agreements that make up the service commitment.
• Internal Audit and Management Review Procedure: runs the audits and reviews that check this plan.

11. Measures

12. Records and evidence

The following records are kept in the [document management system] for [3 years] or the length of the longest customer contract, whichever is longer.

• Approved versions of this plan and the minute that approved each.
• Scope change requests with impact assessment and decision.
• Dependency register and legal, regulatory and contractual register, with review dates.
• Plan tracker, resource and budget approvals.
• Minutes of management review, governance group and customer service reviews.

Annexure A: Scope change request

Annexure B: Plan tracker

Annexure C: Document history

13. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

14. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

15. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 20000-1:2018 references

Related documents

• Service Management System Manual
• Service Management Policy
• SMS Objectives
• Context of the Organization
• Service Operating Model
• Service Catalogue Management Procedure
• Service Level Management Procedure
• Internal Audit and Management Review Procedure