• ITIL - IT Infrastructure Library - British IT Service Mgmt Approach
• ISACA - Information Systems Audit and Control Association - Home of (among other things Cobit which is a generally applicable and accepted standard for good Information Technology (IT) security and control practices that provides a reference framework for management, users, and IS audit, control and security practitioners.

Today's focus:  Toward IT maturity

By Mark Ehr and Scott Crawford

Management vendors today are promoting their version of what 
promises to be a giant step toward greater IT maturity.

This sea change involves shifting IT from today's 
management-by-crisis, in which IT reacts to problems after they 
have occurred, to a brave new world featuring fully automated, 
autonomic systems that include Buck Rogers-style "adaptive," 
"dynamic," "on-demand," "real-time" technologies.

What can IT do today to prepare for this brave new world? Baby 
steps.

One key technology IT can use today is application performance 
management (APM). APM allows IT to manage business-critical 
services by state, from the end-user perspective. Instead of 
culling tens of thousands of IT metrics and sifting through them 
to determine the root cause of a problem, APM determines if a 
problem exists from the perspective of the end user, and then 
guides IT to the source of the problem through its knowledge of 
the infrastructure upon which the service relies. Enterprise 
Management Associates (EMA) believes that APM use is a key 
indicator of a maturing IT organization.

In September EMA conducted a research study entitled "Next 
Generation IT Organizations: An Evolutionary Approach to 
On-Demand Computing." In this study, EMA developed an IT 
maturity taxonomy that classifies organizations into one of the 
following four levels:

Level 1: Active. These IT organizations manage by crisis, 
utilizing management technologies in a purely tactical way. Not 
surprisingly, roughly 60% of enterprises fall within this 
category. At this stage, APM is not used, as these organizations 
utilize point tools to gather elemental metrics such as network 
utilization and device up/down status. Outages are usually 
reported via the phone - users call to complain to the help desk 
that a service is not working right (in the best case), or IT is 
blissfully unaware that a problem even exists (in the worst 
case).

Level 2: Efficient. Approximately 30% of IT organizations have 
taken the next step in management maturity by integrating 
management into a single reporting console and by beginning to 
integrate data from some of the IT silos. Management may be 
integrated, but reporting is rarely real-time. Problem detection 
remains indirect but is more application-aware. The beginning of 
an APM mentality is seen at this phase, but IT has not yet 
become a fully APM-oriented organization.

Level 3: Responsive. Perhaps 10% of enterprises are at this 
level, which is characterized by application-aware, responsive 
APM. APM systems monitor specific applications from the top 
down, correlating events generated by the underlying 
infrastructure when a problem is detected. Monitoring is 
enhanced by direct measurement of "real world" usage experience. 
Outside the firewall, hosted application monitoring services 
provide detailed reporting. Inside the enterprise, proxies may 
be employed to capture real-time performance data.

Level 4: Business-driven. This is EMA's term for the adaptive, 
on-demand enterprise. EMA believes that no organization has yet 
attained this level of maturity. Business-driven IT is 
characterized by management technologies that have fully 
automated day-to-day tasks, integrating proactive management 
with closed-loop feedback mechanisms. Correlation of top-down 
and bottom-up management events, combined with virtualization, 
provisioning, and other key technologies, effectively takes 
human interaction out of the loop for all but the most serious 
problems.