IT control metrics that matter

* High performance organizations are defined in 'IT Process Institute (ITPI) IT Controls Performance' study done in April 2006. These organizations are characterized by two factors:

1) Actively monitor systems for changes
2) Defined consequences for unauthorized intentional changes

* Metrics that matter in ITSM:
Mean time to repair: 80% of outages are due to a change and lot of mean time to repair gets spent in figuring out what exactly changed.

First fix rate
Incidents that get fixed in first fix attempt. Microsoft Operations Framework (MOF) study shows that high-performing IT organizations reboot servers 20 times less than average and have fewer blue screens of death.

Change success rate
Changes implemented without causing incidents, service impairment or disruption. In addition a change that didn't well as per plan is also a process exception. Variance (consistently achieving targets) is a factor in successful changes

Server to system administration ratio
High performance organizations have 1 system admin for more than 100 systems. Normally, this ratio is related with %age of time spent on unplanned work.

80/20 rule applies in this case as well. 20% of set of IT controls results in 80% of realized benefits.