Educause Security Discussion mailing list archives

IT Process Institute Study Reveals Specific Change, Configuration and Release Practices That Predict Top Levels of Performance


From: Dan Swanson <dswanson_2005 () YAHOO COM>
Date: Mon, 3 Dec 2007 20:42:30 -0800

IT Process Institute Study Reveals Specific Change, Configuration and Release Practices That Predict Top Levels of 
Performance

  Five key findings can help direct ITIL implementation priorities

  EUGENE, Oregon, September 18, 2007 – The IT Process Institute today released the results of a research study and 
benchmarking tool designed to help IT organizations identify change, configuration and release practices that are shown 
to improve IT operating performance.  Many IT organizations turn to industry-recognized best practices frameworks such 
as ITIL to standardize key IT service management processes.  However, according to ITPI’s research, most organizations 
implement only a small subset of recommended practices based on the needs of their organization.

  IT organizations can leverage ITPI’s study findings to focus their process standardization and improvement efforts on 
a number of key performance drivers that, according to the research, are shown to predict top levels of performance.

  ITPI, an independent research organization that identifies practices proven to improve the performance of IT 
organizations, surveyed 341 IT organizations and identified twelve sets of commonly implemented best practices. Seven 
of those sets of practices best predict top levels of performance for those organizations in the study, while five of 
them do not have a statistically significant impact

  “While we confirmed several widely held beliefs about relevant priorities for IT organizations, our research also 
revealed a number of unexpected findings that will help IT organizations refocus their efforts on practices 
demonstrated to result in top performance,” said Kurt Milne, managing director of the IT Process Institute.

  Among the most notable findings of the ITPI study:
      1) Change Management is starting point – but Release Management should be the destination – Rigorous practices 
for release build, testing and rollback have broad impact on individual measures and overall performance. Change 
tracking and change oversight practices are necessary, but not sufficient on their own, to achieve performance 
improvement.  Change management often is identified as a logical starting point in the ITIL journey.  However, release 
management should be the destination for those organizations wanting to achieve performance gains from standardizing 
ITIL change and release practices.

  2) Process discipline matters – With regard to change, configuration and release, there are no silver bullets.  
Building a process-focused culture and monitoring and responding to process exceptions is a more accurate predictor of 
top performance than many of the industry-recognized best practices in these areas. Regardless of such practices that 
an organization employs, they are not likely to achieve the desired results if they are not implemented within a 
culture of adhering to documented process and procedures.

  3) Standardized configuration works – Practices that are built around using specific production system 
configurations, providing IT personnel with necessary information about the approved and current configuration, and 
detecting configuration changes are primary predictors of a stable and secure computing environment.  Controlled 
configuration practices are an effective way to minimize configuration drift and increase security posture.

  4) Controlled production access improves performance – Defined roles and responsibilities, clear separation of duties 
and reduced access to the production environment predict higher levels of performance.  Controlled production access is 
fundamental to integrating development into an end-to-end development and release cycle that results in a predictable 
and secure production environment.

  5) CMDB enables powerful change practices – The use of a Configuration Management Data Base is not yet widespread.  
Only 19 percent of survey respondents have a CMDB broadly in use.  However, CMDB-enabled change linkage practices 
predict higher levels of performance. Only 47percent of top performers in the study have CMDB-enabled change practices 
such as linking change requests to infrastructure, business need and incident tickets.  Yet these practices are a 
statistically significant predictor of top levels of performance.

  The ITPI Change, Configuration and Release Performance Study provides a comprehensive look at 57 specific practices, 
including a number of significant performance drivers and their performance improvement potential related to 15 key 
performance measures.  The ITPI Change, Configuration and Release Performance Benchmark is an easy-to-use online 
assessment tool for organizations that want to quickly compare their use of key change, configuration and release 
practices and 15 performance measures with 341 top, medium, and low performers identified in the study.

  “The ITPI study findings offer a clear path toward becoming a top performer,” says Gene Kim, CTO of Tripwire Inc. “IT 
organizations should leverage the key performance drivers identified in this study to bring production systems into a 
known, trusted and risk-reduced state. By minimizing production access, clarifying roles and responsibilities, and only 
allowing modifications to the production environment through a carefully controlled process, IT organizations can 
transform from good to great.”

  “The combination of statistically significant research packaged with a simple benchmarking tool is a powerful 
combination,” says Jeff Weber, managing director with Protiviti and leader of the company’s IT Infrastructure 
Management practice.  “This type of data-driven guidance helps our clients focus specifically on change, configuration 
and release practices that are proven to work.”

  ITPI’s independent research study was sponsored by Protiviti, CA, Tripwire and BMC Software.

  An executive summary of the study findings is available for download at http://www.itpi.org/home/white_papers.php


About the ITPI
The IT Process Institute (ITPI) is an independent research organization that exists to support the membership of IT 
operations, security, and audit professionals. Our mission is to advance IT management science through independent 
research, benchmarking, and the development of prescriptive guidance. Our primary objective is to identify common 
practices that are proven to improve the performance of IT organizations. Our shared research model allows 
participating organizations to receive data about what is proven to work, that is shared among those participating in 
the research. www.itpi.org



---------------------------------
Be a better sports nut! Let your teams follow you with Yahoo Mobile. Try it now.

Current thread: