DORA CSDM Implementation Guide - DRAFT version

[KristineNaess]

Hi all,

The introduction of the DORA regulation is approaching, and we have launched the DORA Accelerator on Store. But many have asked us if we have more instructions on how to make use of the CSDM for better and more automated reporting. In this draft version of a DORA ITS Reporting Framework implementation guide, we try do just that: provide tips and tricks that will make your reporting so much better.

The Digital Resilience Third-party Information Register app is now available in the ServiceNow store.

It takes time to get this finalised and approved internally, and we could not let you wait any longer. So please report back to me if you find anything that doesn't make sense, is very hard to understand or is wrong in the guide. 

Have a good time reading through the material!

Cheers,

Kristine

[Stig Brandt]

Thanks, great paper, thanks for sharing, a question

• about products models - application model link to BA, which is fine, and the you have Software Model linked to application service, but you also have service model, restricted to Application Service, how is this to be understood, when we serveral service type - technical, business ?

• In the system, we don't have a relationship, between Business Service Offering -> Product Sold, which I actually was expecting, in this in future releases?
• Introducing Business Function, wow, this can be linked to capability or business process, more layers to explain, will Business Function / Module be in CSDM Data model and when is this expected to be in the system?

[KristineNaess]

Hi Stig,

Thank you for your questions. I am sure many are wondering about the same, so I have added some small paragraphs on these topics in the guide. 

• Product Models can (and in my opinion should) be extended also to technical and business service offerings (or business or technical services) . If you want to sell your offering, you need to create a product equivalent for it. If all your business offerings are designed to be sold, you can consider creating a cmdb_service_product _model for each of them via a script. Once you have done this, you can add an item for each of them so your customers can order them, which again will lead to the sold product. 
• There is already a reference from the Sold Product to the Business Service Offering. 
• Yes, if you start using the Digital Resilience Third-party Information Register app (available now in the ServiceNow Store), it will install a new Function table (sn_dora_accel_function_list). If you don't have any Business Capabilities, and you need to get going quickly, you can create these stand-alone Function records, or reference either a Business Service, Business Process or a Service Offering to pull up data from those tables. New possibilities will be added in future releases, but this can be a good start. For those who want to use Business Capabilities a top "layer" in their ITS reporting, it is possible to configure the reference so that it is possible to select a Business Capability as offset of the Business Functions. 
  • Se the store release here: https://store.servicenow.com/sn_appstore_store.do#!/store/application/a71da767eb030210be32b1a2385228...
  • Read about the release here: https://www.servicenow.com/docs/bundle/xanadu-governance-risk-compliance/page/product/grc-operationa...

Cheers,

Kristine

[Stig Brandt]

Hi Kristine,

Thanks for your answer/clarification, and sorry for being pedantic, but, I have still a few issues:

• Product Models -> in the tool is different from what this drawing is showing, unless I'm mistaken:
• A software Model is restricted to only reference Software or License Category, so Is ServiceNow recommend customization/configuration here to support a Software Model can be linked to Application service?
• 
• Also in the Tool - Service Model can be created but restricted to Application Service, not shown on your model - so here I, we have a problem based on the model above, so will be good to have guideline for handling these models? 
•  

With regards to Sold product - I don't see the reference to Business Service Offering OOTB, sorry this is missing, but there is a reference to Product Offering-> but here we need imo a reference from product offering to the business service(service description, scope etc.) - something like that: 

[KristineNaess]

Hi Stig,

I greatly appreciate all questions, and the fact that you help me improving the document on its way to a final version. 

About your first question: It took me some time to see that the figure could be interpreted as you describe, but now I think I do. I will clarify in the description, and also modify the figure itself. What I tried to show was that:

• a business application should reference an application product model
• an application service should reference a software product model
• a physical CI should reference a hardware model, etc.

This is because by doing so, you can also keep track of what versions you have within your networks, allowing to pull in life cycle data from SAM and HAM to each of your specific environments. It may be that you are on one software version, ie. a software model, on a pilot environment, thereby having other potential risks and vulnerabilities in that versus your ordinary production environment, for example. 

As you quite correctly write, there's no support for doing it the other way around: letting a software model reference one and only one application service. 

As for your second question: there's no out of the box support for creating dedicated service product models for your service offerings. But you are free to create your own. By doing so, you have to define a category for it, and configure what data the system should show on these. In the industry solutions, such as Financial Services Operations, new categories are added that can be used immediately after installing the product. @Mark Bodman: do you know if having a service offering (service as a product) product category has been added to the roadmap?

About your third point: I have also seen that a Sold Product related list that shows your Sold Products has to be configured by our customers, as this doesn't come out of the box for others than those who are using our industry products with a ready to use Product Offering. Again asking @Mark Bodman for further insight into this part of our current version of the data model and what comes in the next. 

I will clarify this in the document (will add a new subversion soon), again thanks for your input!

Best regards,

Kristine