Reading time: ~ 5 min.

The inflection point has arrived. After years of incremental improvements to ticketing systems and process frameworks, IT service management is experiencing a fundamental transformation that will reshape how organizations deliver value through technology services.

Reading time: ~ 2 min.

• Ensure that AI systems respect fundamental rights and European values;
• Foster legal certainty to encourage investment and innovation;
• Strengthen governance and oversight mechanisms for AI deployment;
• Promote a single European market for legitimate, trustworthy AI solutions.

Reading time: ~ 4 min.

The global economic landscape is increasingly marked by strategic competition that goes beyond simple trade rivalry. Tariffs, technological restrictions, and conflicting regulations are testing supply chains and companies’ operating models.

In this complex scenario, European businesses, including Swiss firms, must balance two opposing needs: maintaining historical ties with the United States while pursuing greater strategic autonomy.

• Diversifying technological partnerships: reducing reliance on a single provider by exploring global alternatives.
• Investing in European technologies: favouring cloud and software providers based in Europe, fully compliant with local regulations such as LPD/GDPR.
• Advanced data management: implementing strategies to map and control data flows, minimizing extra-European transfers.

• Immediate assessment of data flows: identifying and quantifying transfers to the U.S. to prioritize interventions.
• Accelerated transition to European providers: speeding up migration to EU-compliant alternatives such as sovereign clouds or hybrid solutions.
• Development of data localization strategies: implementing data residency policies to keep both sensitive and non-sensitive data within European borders.
• Training and internal governance: aligning IT teams and executives on risk protocols, with scenario-based disruption simulations.

Reading time: ~ 6 min.

The concept of the value stream — the sequence of all activities, from initial customer request to delivery of value — is fundamental to modern business efficiency and lean thinking. It's the circulatory system of an organization, determining how quickly and effectively customer needs are met.

The reasons for a lack of formal value stream documentation are rarely malicious; they are typically rooted in a combination of cultural inertia, strategic misfires, and resource contraints.

• Reliance on key individuals: over time, processes become embedded in the minds of long-standing employees. Asking them to document it feels like a waste of time, as they can execute it faster than they can write it down.
• «We're too busy» syndrome: The immediate pressure of day-to-day work (firefighting, meeting deadlines) consistently overrides the non-urgent task of documentation. Formalization is often seen as a low-priority "nice-to-have" rather than a core strategic enabler. 
  

Value streams, by definition, cross organizational and departmental boundaries. The inherent structure of many companies actively works against documenting them.

• Siloed metrics and goals: when departments (e.g., Sales, Operations, IT Development, IT Operations) have conflicting or highly localized Key Performance Indicators (KPIs), they are incentivized to optimize their local step rather than the end-to-end flow. Documenting the full value stream exposes these handoffs and potential failure points, which can be perceived as threatening.
• Fear of exposure: formal documentation brings transparency. It highlights bottlenecks, unnecessary rework loops, and non-value-add steps (waste). In a blame-centric culture, documenting these issues can lead to fear of accountability, creating an incentive to keep processes vague.

Value stream formalization is often treated as an optional IT or process improvement project, rather than a strategic business imperative.

• Missing Executive mandate: without clear, sustained sponsorship from executive leadership (e.g., the COO, CTO, or CEO), documentation efforts lack the necessary authority to demand time and resources from all required departments.
• Focus on local optimizations: companies often invest heavily in local process improvements (e.g., better testing tools, faster code deployments) without understanding their impact on the overall value stream. If the bottleneck is a legal review step before deployment, optimizing the deployment pipeline won't reduce end-to-end lead time. 
  

• The ITSM integration gap: frameworks like ITIL 4 provide excellent guidance on practices (e.g., Incident Management, Change Enablement, Deployment Management). However, the stated objective for each practice is often local (e.g., restoring normal service operation as quickly as possible) and does not explicitly articulate how or why that practice must integrate with a larger, cross-functional value stream to deliver a product or service. This means practitioners optimize the practice itself, rather than optimizing the flow that uses the practice as a step. As a result, the value stream remains undocumented because there is no widely adopted model for mapping these practices as connected steps in a single business flow.
• Complexity and scope creep: Value streams can be incredibly complex. Teams often attempt to document every minute detail, leading to massive, unreadable "shelfware" diagrams that are immediately outdated.
• Lack of a common language/Tool: Different departments use different tools (Visio, BPMN/VDML tools, simple whiteboards) and terminologies. A lack of a standardized, company-wide visualization and measurement language for value streams makes cross-functional documentation difficult to reconcile.  
  

Moving from undocumented chaos to a formalized, continuously improving flow requires a multi-faceted approach that addresses culture, strategy, and execution. 

The most effective way to gain executive and organizational buy-in is to link documentation directly to customer value and business outcomes. 

• Identify the core business Value Streams: focus on the 5-7 streams that generate the most revenue or are most critical to the customer experience (e.g., "Onboarding a New Customer," "Fulfilling an Order," "Resolving a Major Incident").
• Value Stream Mapping (VSM) workshops: conduct focused, time-boxed VSM workshops that bring together all key stakeholders, from the customer-facing teams to the final delivery/support teams. The focus should be on measuring the flow:
• Lead Time: The total time from start to finish.
• Process Time: The time actually spent working on the request.
• Percent Complete and Accurate (%C&A): The rate at which work is correctly passed from one step to the next.
• Wait Time (Waste): The time the request sits idle between steps. 
  

• Measure the work, not the people: Executive sponsors must clearly communicate that the goal is to find waste in the process, not fault in the people. The metrics (Lead Time, Wait Time) provide an objective basis for continuous improvement.
• Cross-functional ownership: Assign a Value Stream Owner (VSO) who has executive authority and is responsible for the performance of the end-to-end flow, not just one silo. This individual drives a holistic perspective. 
  

Reading time: ~ 2 min.

The ISO/IEC 38505-1 standard on «Information technology — Governance of IT — Governance of data» provides effective guidelines to apply the ICT governance principles set by the ISO 38500 and ISO 38501 standards to the data governance.

We should keep in mind that the ISO/IEC 38505-1:2017 standard is applicable to every kind of organizations, such as companies (private or public ownership), government (agencies, departments, bureaus and other public bodies) and nonprofit organizations.

Both small and large organizations can take advantage of the application of ISO/IEC 38505-1 standard, no matters how big can be the dependence on data of their activities. The guidance provided by this standard can be useful to professionals as:

• executive managements
• external specialists (business or technical): legal, accounting, retail, industrial,...
• external and internal service providers (consultants too)
• auditors

The ISO/IEC 38505-1 standard has 11 main chapters. This is an overview on the structure:

• Chapter 1: scope
• Chapter 2: normative reference
• Chapter 3: terms and definitions

• Chapter 4: good governance of data
• 4.1 benefits of good governance of data
• 4.2 responsibilities of the governing body
• 4.3 governing body and oversight mechanisms
• Chapter 5: principles, model and aspects for good governance of data
• Chapter 6: data accountability
• 6.1 General
• 6.2 Collect
• 6.3 Store
• 6.4 Report
• 6.5 Decide
• 6.6 Distribute
• 6.7 Dispose
• Chapter 7: guidance for the governance of data – principles
• 7.1 General
• 7.2 Principle 1 – responsibility
• 7.3 Principle 2 – strategy
• 7.4 Principle 3 – acquisition
• 7.5 Principle 4 – performance
• 7.6 Principle 5 – conformance
• 7.7 Principle 6 – human behaviour
• Chapter 8: guidance for the governance of data – model
• 8.1 Applying the model
• 8.2 Internal requirements
• 8.3 External requirements
• 8.4 Evaluate
• 8.5 Direct
• 8.6 Monitor
• Chapter 9: guidance for the governance of data – data-specific aspects
• 9.1 General
• 9.2 Value
• 9.3 Risk
• 9.4 Contraints
• Chapter 10: application of the data accountability map

To better figure out  the «big picture» about the ISO 38505-1 standard, take a look at our infographic:

If we consider the ISO/IEC 38505-1:2017 standard, we find direct and natural correlations with the following standards:

• ISO 20000-1 on «Information technology – service management»
• ISO 27001 on «Information security, cybersecurity and privacy protection — Information security management systems — Requirements»

Among the references with the regulations or laws, we find several them in particular on protection of personal data, such as: European GDPR, Swiss FAPD (known also as LPD and DSG).

Reading time: ~ 3 min.

We can have different reasons why we need to lead an internal investigation, such as:

• civil actions (liability, responsibility,...);
• whistleblowing reports (discern between substantiated or unsubstantiated allegation);
• external investigations led by regulators (need for reporting);
• decision-making process (requirements set by laws, regulations, codes, policies,...).

The ISO/TS 37008 standard has 11 main chapters and an «ANNEX A». This is an overview on the structure:

• Chapter 1: scope
• Chapter 2: normative reference
• Chapter 3: terms and definitions

• Chapter 4: Principles
• 4.1 Independent
• 4.2 Confidential
• 4.3 Competent and professional
• 4.4 Objective and impartial
• 4.5 Legal and lawful
  
• Chapter 5: Support of internal investigations
• 5.1 Resources
• 5.2 Leadership and commitment
• Chapter 6: Establishment of investigation policy or procedure
• Chapter 7: Safety and protection measures
• 7.1 Preserving and securing evidence
• 7.2 Protection of and support to personnel involved in investigations
• 7.3 Anti-retaliation
• 7.4 Safeguarding
  
• Chapter 8: Investigative process
• 8.1 Investigation team
• 8.2 Preliminary assessment
• 8.3 Determining the scope of the investigation
• 8.4 Investigation planning
• 8.5 Maintaining confidentiality
• 8.6 Liability caution to deter disclosure
• 8.7 No interference
• 8.8 Evidence
• 8.9 Interviews
• 8.10 Finalization process
• 8.11 Investigation report
  
• Chapter 9: Potential remedial measures or improvements
• 9.1 Proposal of remedial measures and improvements
• 9.2 Interim remedial measures
• 9.3 A final plan for post-investigation remedial measures
• 9.4 Proportionality of remediation and improvement measures
• 9.5 Monitoring and enforcement of remedial measures
  
• Chapter 10: Interaction with stakeholders
• 10.1 General
• 10.2 Planning
• 10.3 Measures for the communication process
• 10.4 Effective communication channels
• 10.5 Government and regulator communication
• 10.6 Self-disclosure to the authorities
  
• Chapter 11: Disciplinary actions

The ISO/TS 37008 standard is logically downstream of whistleblowing reports (we can consider for example the Italian Legislative Decree 24/2023 on whistleblowing).

This standard is also useful in correlation with:

• ISO 37002:2021«Whistleblowing management systems – Guidelines»;
• ISO 37001:2016«Anti-bribery management systems standard».

ISO 37008 provides support also in the implementation of the organization and management models (OMM) set by the Italian Legislative Decree 231/01 (corporate criminal Liability).

To better figure out  the «big picture» about the ISO/TS 37008 standard, take a look at our infographic:

Reading time: ~ 2 min.

• (EC) N. 1060/2009, commonly known as «Credit Rating Agencies»;
• (EU) N. 648/2012, commonly known as «EMIR», OTC derivatives;
• (EU) N. 600/2014, commonly known as «MIFIR», Markets in Financial Instruments;
• (EU) N. 909/2014, commonly known as «CSDR»;
• (EU) 2016/1011, commonly known as «Benchmark Regulation».

The Digital Operational Resilience Act (DORA) defines a set of requirements to ensure both digital resilience and security especially in the following chapters:

• 📘 I. General Provisions
• 📘 II. ICT Risk Management
• 📘 III. ICT Related Incident Management Process
• 📘 IV. Digital operational resilience test
• 📘 V. Managing of ICT third party risk
• 📘 VI. Information sharing arrengement

• ISO 38500 (Governance)
• ISO 31000 (Risk Management)
• ISO 37301 (Compliance)

The GRC approach provides a useful basis for addressing and integrating the main aspects of:

• ISO 22301 (Resilience and business continuity)
• ISO 27001 (Information security)
• ISO 20000-1 (ICT services; such as: asset and configuration, management, threats and vulnerabilities)
• ISO 27035 (incident and problem management)
• backup and disaster recovery, etc.

To better figure out  the «big picture» about the DORA regulation and the ISO Management Systems according to the suggested GRC approach, take a look at this infographic:

Reading time: ~ 2 min.

• ISO 13485 standard on «quality in the medical device sector»

• ISO 20000-1 standard on «IT Services»

• ISO 27001 standard on «Information security and data protection requirements» (GDPR).

To better figure out  the «big picture» about the requirements set by regulations on SaaMD and the correlated ISO standards, take a look at our infographic:

Tempo di lettura stimato: ~ 5 min.

• L'excellence des services informatiques:
• Transpose la définition générale au domaine de l'informatique. Il ne s'agit pas seulement de temps de disponibilité et de résolution de tickets.
• Englobe:
• Fiabilité et Disponibilité : Les systèmes sont constamment opérationnels et performants.
• Réactivité : Résolution rapide et efficace des problèmes et des demandes.
• Proactivité : Identification et atténuation des problèmes potentiels avant qu'ils n'impactent les utilisateurs.
• Expérience Utilisateur (UX) : Interfaces intuitives, processus fluides et solutions conviviales.
• Alignement Commercial : Les services informatiques soutiennent et permettent directement les objectifs commerciaux, devenant un partenaire stratégique plutôt qu'un simple centre de coûts.
• Communication : Communication claire, transparente et empathique avec les utilisateurs et les parties prenantes.
• Innovation : Recherche continue de nouvelles et meilleures façons de fournir des services informatiques.

Différencier l'excellence de service de la qualité de service:

• Qualité de service : Souvent perçue comme le respect de spécifications et de normes prédéfinies. Il s'agit de faire les choses correctement (par exemple, respecter les SLA, faible taux d'erreurs, systèmes fonctionnels). C'est une exigence fondamentale.
• Excellence de service : S'appuie sur la qualité. Il s'agit de faire les bonnes choses exceptionnellement bien et d'aller au-delà des attentes. Cela implique la valeur émotionnelle et perçue.
• Analogie : La qualité, c'est une voiture bien construite qui roule en douceur. L'excellence, c'est cette voiture qui offre une expérience de conduite luxueuse, personnalisée et agréable, anticipant vos besoins avant même que vous ne les réalisiez.
  

Pourquoi est-ce important?

• Avantage concurrentiel : Sur un marché encombré, d'excellents services informatiques peuvent être un différenciateur clé, attirant et fidélisant les clients.
• Satisfaction et fidélisation accrues des clients/utilisateurs : Les utilisateurs ravis deviennent des ambassadeurs, améliorant la réputation et réduisant le désabonnement.
• Augmentation de la productivité et de l'efficacité : Des expériences informatiques fluides permettent aux employés d'être plus productifs, réduisant la frustration et le temps perdu.
• Amélioration des résultats commerciaux : Lorsque l'informatique permet réellement à l'entreprise, elle contribue directement à la croissance des revenus, à la réduction des coûts et aux objectifs stratégiques.
• Meilleur moral des employés : Les équipes informatiques fières de leur travail et reconnues pour leur excellence sont plus engagées et motivées.
• Atténuation des risques : Les approches proactives inhérentes à l'excellence peuvent réduire les pannes, les failles de sécurité et d'autres risques opérationnels.
• Réputation et image de marque : Les organisations reconnues pour l'excellence de leurs services informatiques inspirent confiance et bâtissent une image de marque positive.

• Orientation client et expérience : Au fond, la norme met l'accent sur la compréhension approfondie des besoins, des attentes et des perceptions des clients. Elle encourage la conception de services qui non seulement répondent à ces attentes, mais les dépassent de manière proactive, ce qui conduit à des expériences mémorables et positives. Pour l'informatique, cela signifie passer de la simple résolution de problèmes à l'optimisation des parcours utilisateurs, à l'anticipation des besoins (par exemple, la maintenance prédictive, le support proactif) et à l'assurance d'interactions intuitives et agréables avec la technologie.
• Leadership et stratégie : L'excellence du service doit être impulsée par la direction. La norme souligne le rôle essentiel du leadership dans l'établissement d'une vision de l'excellence, son intégration dans la stratégie organisationnelle et la promotion d'une culture où l'excellence est une valeur partagée. Dans un contexte informatique, cela se traduit par une collaboration active des dirigeants informatiques avec les unités commerciales, la compréhension des objectifs stratégiques et l'alignement des services informatiques pour permettre directement ces objectifs.
• Personnel et culture : Reconnaissant que l'excellence du service est fournie par les personnes, la norme souligne l'importance de l'autonomisation, de l'engagement et du développement des employés. Elle préconise une culture où l'apprentissage continu, l'empathie et une mentalité axée sur le client sont ancrés. Pour les équipes informatiques, cela signifie favoriser un sentiment d'appropriation, promouvoir le développement des compétences techniques et interpersonnelles (comme la communication et la résolution de problèmes), et célébrer les succès dans la prestation de services exceptionnels.
• Gestion des processus et innovation : Bien que des processus efficaces soient fondamentaux, l'ISO 23592 pousse à l'amélioration continue et à l'innovation au sein de ces processus. Elle encourage les organisations à analyser la prestation de services de manière holistique, à identifier les domaines d'amélioration et à adopter de nouvelles technologies ou méthodologies pour élever l'expérience de service. En informatique, cela pourrait impliquer l'exploitation de l'automatisation, de l'IA pour un support proactif, ou l'adoption de méthodologies agiles pour un développement et une prestation de services plus rapides et plus réactifs.
• Mesure et amélioration : La norme souligne la nécessité de mécanismes robustes pour mesurer la performance des services, recueillir les commentaires et identifier les opportunités d'amélioration. Il ne s'agit pas seulement de respecter les accords de niveau de service (SLA), mais de rechercher activement des données qui indiquent la satisfaction des clients et les domaines où le service peut être amélioré davantage. Cela inclut l'analyse des métriques du parcours client, des scores de promoteur net (NPS) et des commentaires qualitatifs pour stimuler les améliorations itératives.
  

• Retour d'information des utilisateurs/clients : Des scores de satisfaction (NPS, CSAT) constamment élevés, des témoignages positifs non sollicités et des taux de rétention élevés.
• Résolution proactive des problèmes : Les utilisateurs subissent rarement des interruptions ; les problèmes sont souvent traités avant qu'ils ne se généralisent.
• Expérience utilisateur fluide : Systèmes intuitifs, accès facile au support et friction minimale dans les interactions informatiques.
• Impact commercial : Preuve claire de la contribution directe de l'informatique à la croissance, à l'innovation et à l'efficacité de l'entreprise.
• Culture d'amélioration continue : Examens réguliers, boucles de rétroaction et initiatives visibles d'amélioration.
• Personnel informatique autonome et engagé : Des équipes qui démontrent de l'appropriation, de l'initiative et une mentalité axée sur le client.
• Leadership informatique stratégique : Des leaders informatiques qui participent activement à la stratégie commerciale, et non pas seulement des managers opérationnels.
  

Reading time: ~ 3 min.

The ISO/IEC 23894:2023 standard has 6 main chapters and 3 «ANNEX» (A, B and C). This is an overview on its structure:

• Chapter 1: scope
• Chapter 2: normative reference
• Chapter 3: terms and definitions

• Chapter 4: principles of AI risk management
• Chapter 5: framework
• 5.1 General
• 5.2 Leadership
• 5.3 Integration
• 5.4 Design
• 5.5 Implementation
• 5.6 Evaluation
• 5.7 Improvement
• Chapter 6: Risk management process
• 6.1 General
• 6.2 Communication and consultation
• 6.3 Scope, context and criteria
• 6.4 Risk assessment
• 6.5 Risk treatment
• 6.6 Monitoring and review
• 6.7 Recording and reporting

To better figure out  the «big picture» on the ISO 23894 standard, take a look at our infographic: