Service Standards

We mentioned service standards. We need, within our identity and access management, to have a good understanding of what our service standards are. We may be an internal service provider to the business. This doesn’t negate the need or the value of defining service standards. We should have a good understanding of our capabilities, what our identity and access management system can do, and we also need to report against whether we are meeting the defined criteria, the defined key performance indicators. So we need to define the key performance indicators with the business. We need to measure and report against them. Typical key performance indicators may relate to the availability of systems or services.

They may relate to the speed of provisioning or deprovisioning, for example. And when we have federation, this may not be an instant process. This may be an overnight batched process, for example. With cloud providers we start to see this become more difficult to manage sometimes, because the cloud provider– we may not understand always, with our cloud provider, what their future performance will be like. So we may be reliant on historical averages. I say this because if we look at Amazon Web Services or Microsoft’s Azure platform, they’re typically reliable, but occasionally there are problems. And often the service standards are not backed up with a payment mechanism.

We don’t have the ability to fine Microsoft or Amazon if there’s a problem in terms of the service that they provide. Key things that we want to understand

are the response times: how quickly can we talk to somebody about any potential problems?

The resolution times: how quickly will any issues be resolved?

And the remediation time: if there’s a problem, how quickly before it can be remediated? And the payment mechanism or service credits, if there are any involved. Possible to see these with an internal provider arrangements. Usually the payments relate to the where you are providing a service to a customer, or where you, as a customer, are claiming payment service credits from a supplier upstream.