DORA CSDM Implementation Guide - DRAFT version

[KristineNaess]

Hi all,

The introduction of the DORA regulation is approaching, and we have launched the DORA Accelerator on Store. But many have asked us if we have more instructions on how to make use of the CSDM for better and more automated reporting. In this draft version of a DORA ITS Reporting Framework implementation guide, we try do just that: provide tips and tricks that will make your reporting so much better.

The Digital Resilience Third-party Information Register app is now available in the ServiceNow store.

It takes time to get this finalised and approved internally, and we could not let you wait any longer. So please report back to me if you find anything that doesn't make sense, is very hard to understand or is wrong in the guide. 

Have a good time reading through the material!

Cheers,

Kristine

[PaulKilkelly]

Hi Kristine.  This is awesome, thank you.  You have put a lot of work into this and it shows.  Could we have a version of the PDF without all the white space on the right please? 

Like Stig, I'm not comfortable with the assertion that a DORA 'business function is a ServiceNow 'Business Capability'.  That appears to undermine the original concept for that part of the CSDM as a neutral architectural entity that represents the 'needs' of the organisation.  

I can understand the temptation for adding a new entity for 'function' but do we really need it?  I worry that it creates yet another view on the work of the organisation for people to manage.  I'd much prefer to build very good operational data using CSDM that are used daily to run the business, then use Risk Assessments to identify those parts that are in scope for regulations like DORA.  I'm sure you considered that angle. Did you discount it?

I do agree that Sold Product is an essential part of that story. 

[KristineNaess]

Hi Paul,

Thank for your comments and questions. I have uploaded a new version soon without so much white space. 

As to your question about the Business Function = Business Capability: I agree with you. The design is not yet fully completed, and it's good to know that there are customers who support the idea of having a data model that is not "couped" by any regulation. The suggestion of having Business Function as a CI class was abandoned at an early stage in our design process, leaving the data model uncompromised. The Function table is not part of the CSDM, and will most likely never be. Thus sharing destiny with Risk Entities, which are allowed to be "shadowing" CIs or created independently according to customers' design. 

The Function records can be looked upon as extensions of the records in the table you make use of as offsets. But narrowing the scope down to the subset of records you need to report on for DORA (only the critical and important ones). You can make do without the Digital Resilience Third-party Information Register app by using the BC records directly, but then you would need to add some custom "ITS data fields" so that you can fetch the data required for doing ITS Reporting, and most likely do some additional configuration to roll up data. OR you can make use of the app and allow the generation of Function records based on your Business Process/Service/Offering records. OR use the app and configure a reference to the Business Capability table as described in the guide. 

Though some appreciate this flexibility, others find it very confusing. That's why I lean more towards giving concrete advise in the guide, trying to be mindful of this being a new, ground breaking topic that may evolve over time. 

Let's hope the product team can cater for the reference to Business Capabilities in the next version - I will certainly remind them of the importance. 

Cheers,

Kristine

[Robin J_]

Big kudos for this one Kristine! Great work. Looking forward to seeing the future updates on this also. The accelerator you launched for DORA sounds exciting. Will be exciting to follow the maturity journey of both CSDM and DORA. Having something similar for DORA in ServiceNow as the "CSDM Data Foundations" dashboard would be cool, but I feel that dashboard is not the most updated one. Think the customers would love to have a "see where you are" dashboard or similar for DORA especially tied in together with CSDM!

Increasing everyone's understanding of CSDM + DORA together with ServiceNow is really appreciated and important work. 

Will take some time to read fully through and see if I have some good question 🙂

Kind Regards from a fellow Norwegian,
- Robin

[KristineNaess]

Hi Robin,

and thanks for your feedback. We are working on improving the reporting functionalities on DORA but also on operational resilience in general. Good to know there will be a need for it :-).

Have a great day!

Kristine

[ivangulta]

Hi Kristine,

I just wanted to understand the comparison between a Business Function and a Value Stream as both are ultimately made of a collection of business processes and capabilities:

I understand that the Value Stream depict the chronological flow of capabilities, but what benefit do we get by introducing the concept of Business Function? People and Org is already linked to Business Process which is linked to the Value Stream. 
Thank you