Config and outsource question

[Greg_08]

Hi everyone!
I got a question(actually many) about config mgmt for you (experienced) experts. I try to put togheter the process but struggle with the fact that 90% of the infrastructure is outsourced to a supplier (infrastructure provider which is larger than us). The supplier has no ITIL processes (to talk about) and therefore I find it tricky to implement the process (to get consistant data). I dwell if to try to implement the process internally in the IT organisation or only manage the process by putting requirements on the supplier, like reports on current server configurations. Do you have any good experiences in doing this IT - supplier relationship management in configration management? What can you expect to achieve with a "native" service provider? I believe this will be frequent questions in near future.

[Diarmid]

Hi Greg,

probably not a nice position. Two basic points:

- Whatever components are under your control, make sure they are under good configuration control including identifying relationships with the outsourced components.
- The outsource contract(s) is/are vital; your objective is co-operation with the supplier, but the bottom line is contractual; if you don't get co-operation, then start asking how they propose to meet the contract with respect to things like (and be as specific as possible) service availability, incident response, problem resolution. It should be in the supplier's interest for you to deliver your service effectively, but if he is being predatory, then your own good processes and asking pointed questions are your best defense.

Tactically, it might be good to keep demanding specific reporting levels at service review with the supplier. If they are doing a proper job then they should have the data.

If they are co-operative at all, then see if you can involve them in jointly developing procedures.

Consider audit type questions ("How do you ensure that that the impact of proposed configuration changes is correctly identified?" kind of thing); you will either get the information you need about their processes or you will find weaknesses in their service management.

In extreme circumstances you could ask/insist to audit their management system, but you probably would need leverage such as evidence of problems.

Don't just use the front door. Remember that Configuration Management is there to serve various other purposes. Raise issues for change and problem and incident and capacity and ...

Oh. I think I'm repeating myself. One last point: rope them in to improvement initiatives.
_________________
"Method goes far to prevent trouble in business: for it makes the task easy, hinders confusion, saves abundance of time, and instructs those that have business depending, both what to do and what to hope."
William Penn 1644-1718