Setting up the business services and their dependencies

Governance, Risk, and Compliance > Operational Resilience >

The Operational Resilience application provides you with a business services view that consolidates the risks, issues, control failures, and other areas of your business services that need attention. You can set up the business services and their dependencies and monitor their operational resilience status on the reporting dashboard.

Overview of business services, parent services, and child services A business service is a service that performs a business-level function. For example, you can use email, IT services, e-commerce, and telephone banking as business services that perform the business-specific functions in your organization.

You can classify a business service as a parent service and child service. A parent service is a broad entity that you can use to service a business function. A parent service may contain its own subentities. A child service inherits its properties from the parent service. For example, the Payments service is a parent service and Mortgage payment or Maintenance payment are its child services.

Synchronizing the services and processes from the CMDB with Operational Resilience In the Operational Resilience application, the parent services, child services, and processes are obtained from the Configuration Management Database (CMDB) . The cmdb_rel_ci table in the CMDB maintains a relationship for the parent services, child services, and processes. You can associate a parent service, child service, or process to the current service by adding a relationship in the cmdb_rel_ci table.

By default, the view is set to Operational Resilience in the Operational Resilience application. The view contains the cmdb_ci_service table with multiple related lists.

For information on the Configuration Management Database (CMDB) , see Configuration Management Database (CMDB) .

Operational Resilience data architecture To understand how the services, processes, and entities are connected in the Operational Resilience application, see the following example. Figure 1. Operational Resilience data architecture

The Operational Resilience application supports a data model that creates the business services and their dependencies as entities that are based on the entity types. You can use the Service entity type to scope the services that you want to monitor daily. Each service in the Service entity type is used to calculate its Operational Resilience data.

As shown in the example, the parent services and child services are associated with the business processes. Business processes are further associated with the assets known as the entities.

You can map your services and processes as explained in the following sample configuration: Map your parent business services and child business services to their associated business processes. Map the business processes to your pre-defined entities. Map the services directly to the related lists (related items). A related item can be an entity, risk, risk assessment, control, incident, change request, outage, issue, or task.

As shown in the diagram, the Operational Resilience application synchronizes the relationship between the services and processes. Consider the following examples:

When you add a parent service to a business service, an entity is automatically created for the added parent service. The new service entity is added to the upstream entity of the business service's entity. When you add a child service to a business service, an entity is automatically created for the added child service. The new service entity is added to the downstream entity of the business service’s entity. When you add a child process to a business service, an entity is created for the child process. The new process entity is added to the downstream entity of the business service’s entity.

Pillars that are provided with the Operational Resilience base system A pillar is a foundational block that contributes to the operational resilience of your organization. You can map your business services and processes to the pillars in the Operational Resilience application so that you can establish a relationship between these entities and monitor their status on the dashboard.

The Operational Resilience application provides the following pillars as part of the base system: Facilities People Suppliers Services Processes Technology

For more information on the pillars, see Exploring Operational Resilience .

The data that is associated with the pillars is displayed on the Operational Resilience dashboard. For example, the controls, risks, or P1 issues that are associated with an entity are displayed on the Operational Resilience dashboard.

If you install the optional applications, such as Business Continuity Management and Vulnerability Response in your instance, you can also view the Business Continuity or Disaster Recovery plan and Vulnerability Response reports on the dashboard.

Scheduled job that gathers the information from different applications In Operational Resilience , the Compute Operational Resilience Compliance scheduled job runs in the background daily. It calculates its reports data by gathering the information from the following integrated applications: GRC : Advanced Risk GRC : Risk Management GRC: Policy and Compliance Management CMDB Business Continuity Management Vulnerability Response

For more information on the integrated applications for Operational Resilience , see Pre-requisites for Operational Resilience .

The scheduled job removes all the data from the previous day before creating the new supporting data for the reports. The job uses different inbuilt conditions to retrieve the data from different sources and saves it to the Operational Resilience staging tables.

The scheduled job generates the Operational Resilience controls, risks, issues, and outages for all the downstream entities of each entity within each entity type automatically.

Information gathering for the services The Operational Resilience application gathers the information from the different sources and conditions for the services. The following table describes the service modules in the Operational Resilience , their source applications, source tables, and filtering conditions that are used to populate the reports on the dashboard. Table 1. Services modules and their source applications, source tables, and filtering conditions Services Modules External source application Source table and filtering conditions Parent Services CMDB Service [cmdb_ci_service] Business criticality = 1 – most critical and Service Classification = Business Service

Child Services CMDB Service [cmdb_ci_service] Business criticality = 1 – most critical and Service Classification = Business Service

Processes CMDB Service [cmdb_ci_service] Assets GRC: Profiles Entity [sn_grc_profile] The entity must be downstream of any business process entity of any service entity.

Services with Priority 1 Issues Policy and Compliance Management Issue [sn_grc_issue] Priority = 1 - Critical and Active = true

High Risks Advanced Risk Assessment Risk Assessment [sn_risk_advanced_risk_assessment_instance] The residual risk for the risk assessment is the highest defined in the qualitative rating criteria for the residual risk assessment type.

Failed Controls Policy and Compliance Management Control [sn_compliance_control] Status = Non-compliant and State = Monitor

Services with Change Requests CMDB Change request (sn_oper_res_change_request): Change request created for the application. Services with Tasks CMDB Task (sn_oper_res_task): Task defined in the application. Services with Incidents Incident Management Incident [incident] Service = one of the critical services and State is New, In progress, and On hold.

Services under Outage CMDB Affected CIs [cmdb_outage_ci_mtom] Any downstream CI of any critical service that is under outage.

Importance and Impact Assessment Not applicable Service Impact Analysis [sn_oper_res_service_impact_analysis] Scenario Analysis Not applicable Scenario Analysis [sn_oper_res_scenario_analysis_service] Vulnerable Entities Vulnerability Response Vulnerable Item [sn_vul_vulnerable_item] Vulnerability field is not empty and the State is not Resolved, Deferred, or Closed.

Services with No BC/DR Plans Business Continuity Management Plan [sn_bcp_plan] State = Approved and the plan is not expired.

Services with Failed BC/DR Plans Business Continuity Management Event [sn_recovery_event] Event state = Exercise in the Closed Complete or Closed Incomplete state. The Result is Unsuccessful, and the associated plan is not expired.

Viewing the services in Operational Resilience If you have the sn_oper_res.manager role, you can view the Services module by navigating to the All > Operational Resilience > Services module as shown in the following example. Figure 2. Services module

As explained in the earlier section, you can view the services that are listed under the Services module depending on the applications that you have installed in your instance. The following services are listed in the Operational Resilience application view: Business Services Assets Services with High Risks Services with Failed Controls Services with Issues Services with Incidents Services under Outage Services with Change Requests Services with Tasks Vulnerable Entities Services with No BC/DR Plans Services with Failed BC/DR Plans

Business services list view When you click the Business Services module in the application navigator, you can view or update the associated services in the Business Services list view as shown in the following example. Figure 3. Business services list view

The Business Service list view shows the details for each service. For example, you can see the name, business criticality, its owner, operational status, and the related parent service.

Adding a business service in Operational Resilience If you have the sn_oper_res.manager role, you can add a service in the Operational Resilience application in one of the following ways in the Business services list view: You can select multiple services in the Business Services module and click Add to OpRes reporting . In the service record, you can click Add to OpRes reporting . You can use the Services related list to associate a service with the current service.

When you add a business service in Operational Resilience , the application populates the information on the service from the CMDB .

For more information on the Operational Resilience roles, see Roles installed with Operational Resilience .

Related lists that are associated with a business service When you add a business service, you can associate its dependencies as its related lists. Some examples are the parent services, child services, or processes on the Service form as shown in the following example. Figure 4. Sample configuration of the related lists

See the following table for more information on the related lists, their description, and the usage of the New and Add actions for each related list. Note: Some of the actions in the following table require the itil role. Users with this role can access the CMDB tables.

Table 2. Related lists on the Service form Name Description New action Add action Parent Services List of the services that are the parent service of the current service. Service form where you can add a parent service. Creates a relationship between the new parent service and the current service.

Role: This action requires the itil role.

Opens a table view where you can select multiple services and add them as the parent services of the current service.

Role: This action requires the itil role.

Child Services List of the services that are the child services of the current service. Service form where you can add a child service. Creates a relationship between the new child service and the current service.

Role: This action requires the itil role.

Table view where you can select multiple services that you can add as the child services of the current service.

Role: This action requires the itil role.

Processes List of the processes that are associated with the current service. Not applicable Table view where you can select multiple processes that you can add as the child services of the current service. Assets List of the assets that are associated with the current service. Not applicable Table view where you can select multiple assets (entities) that you can add as the downstream entities of the current service. Issues List of the overdue issues that are associated with the current service. Issue form. When you submit the Issue form, the application creates a record in the Services with Issues table. Not applicable High Risks List of the high-risk items or the risk assessments in the monitor state that are associated with the service. Not applicable Not applicable Failed List of the controls where the status of the control is non-compliant. Not applicable Not applicable Change Requests List of the open change requests that are associated with the current service. Change Request form. When you submit the Change Request form, the application creates a record in the Services table. Not applicable Tasks List of the open tasks that are associated with the current service. List of the task tables, from where you can select the type of the task that you want to create. When you submit the form, the application creates a record in the Services with the Tasks table. Not applicable Incidents List of the open incidents that are associated with the current service. Incident form. When you submit the Incident form, it creates a record in the Services table. Not applicable Outages List of the open outages that are associated with the current service. Outage form. When you submit the form, the application creates a record in the Services table. Not applicable Importance and Impact Assessment List of the approved records of the Importance and Impact Assessments. Not applicable Not applicable Scenario Analysis List of the approved Scenario Analyses. Not applicable Not applicable Business Continuity Plans List of the approved Business Continuity Plans. Not applicable Not applicable

Note: If the Business Continuity Management application is installed, its related list is displayed in Operational Resilience view.

For more information on the field values in the Service form, see Service form .

Add a business service to the reporting dashboard Add a business service and its related lists, such as the parent services, child services, processes, assets, and issues, in the Operational Resilience application so that you can view their operational resilience status on the reporting dashboard.

Parent Topic: Setting up the features and capabilities in classic Operational Resilience