Reading time: ~ 5 min.

The inflection point has arrived. After years of incremental improvements to ticketing systems and process frameworks, IT service management is experiencing a fundamental transformation that will reshape how organizations deliver value through technology services.

Reading time: ~ 2 min.

• Ensure that AI systems respect fundamental rights and European values;
• Foster legal certainty to encourage investment and innovation;
• Strengthen governance and oversight mechanisms for AI deployment;
• Promote a single European market for legitimate, trustworthy AI solutions.

Reading time: ~ 4 min.

The global economic landscape is increasingly marked by strategic competition that goes beyond simple trade rivalry. Tariffs, technological restrictions, and conflicting regulations are testing supply chains and companies’ operating models.

In this complex scenario, European businesses, including Swiss firms, must balance two opposing needs: maintaining historical ties with the United States while pursuing greater strategic autonomy.

• Diversifying technological partnerships: reducing reliance on a single provider by exploring global alternatives.
• Investing in European technologies: favouring cloud and software providers based in Europe, fully compliant with local regulations such as LPD/GDPR.
• Advanced data management: implementing strategies to map and control data flows, minimizing extra-European transfers.

• Immediate assessment of data flows: identifying and quantifying transfers to the U.S. to prioritize interventions.
• Accelerated transition to European providers: speeding up migration to EU-compliant alternatives such as sovereign clouds or hybrid solutions.
• Development of data localization strategies: implementing data residency policies to keep both sensitive and non-sensitive data within European borders.
• Training and internal governance: aligning IT teams and executives on risk protocols, with scenario-based disruption simulations.

Reading time: ~ 6 min.

The concept of the value stream — the sequence of all activities, from initial customer request to delivery of value — is fundamental to modern business efficiency and lean thinking. It's the circulatory system of an organization, determining how quickly and effectively customer needs are met.

The reasons for a lack of formal value stream documentation are rarely malicious; they are typically rooted in a combination of cultural inertia, strategic misfires, and resource contraints.

• Reliance on key individuals: over time, processes become embedded in the minds of long-standing employees. Asking them to document it feels like a waste of time, as they can execute it faster than they can write it down.
• «We're too busy» syndrome: The immediate pressure of day-to-day work (firefighting, meeting deadlines) consistently overrides the non-urgent task of documentation. Formalization is often seen as a low-priority "nice-to-have" rather than a core strategic enabler. 
  

Value streams, by definition, cross organizational and departmental boundaries. The inherent structure of many companies actively works against documenting them.

• Siloed metrics and goals: when departments (e.g., Sales, Operations, IT Development, IT Operations) have conflicting or highly localized Key Performance Indicators (KPIs), they are incentivized to optimize their local step rather than the end-to-end flow. Documenting the full value stream exposes these handoffs and potential failure points, which can be perceived as threatening.
• Fear of exposure: formal documentation brings transparency. It highlights bottlenecks, unnecessary rework loops, and non-value-add steps (waste). In a blame-centric culture, documenting these issues can lead to fear of accountability, creating an incentive to keep processes vague.

Value stream formalization is often treated as an optional IT or process improvement project, rather than a strategic business imperative.

• Missing Executive mandate: without clear, sustained sponsorship from executive leadership (e.g., the COO, CTO, or CEO), documentation efforts lack the necessary authority to demand time and resources from all required departments.
• Focus on local optimizations: companies often invest heavily in local process improvements (e.g., better testing tools, faster code deployments) without understanding their impact on the overall value stream. If the bottleneck is a legal review step before deployment, optimizing the deployment pipeline won't reduce end-to-end lead time. 
  

• The ITSM integration gap: frameworks like ITIL 4 provide excellent guidance on practices (e.g., Incident Management, Change Enablement, Deployment Management). However, the stated objective for each practice is often local (e.g., restoring normal service operation as quickly as possible) and does not explicitly articulate how or why that practice must integrate with a larger, cross-functional value stream to deliver a product or service. This means practitioners optimize the practice itself, rather than optimizing the flow that uses the practice as a step. As a result, the value stream remains undocumented because there is no widely adopted model for mapping these practices as connected steps in a single business flow.
• Complexity and scope creep: Value streams can be incredibly complex. Teams often attempt to document every minute detail, leading to massive, unreadable "shelfware" diagrams that are immediately outdated.
• Lack of a common language/Tool: Different departments use different tools (Visio, BPMN/VDML tools, simple whiteboards) and terminologies. A lack of a standardized, company-wide visualization and measurement language for value streams makes cross-functional documentation difficult to reconcile.  
  

Moving from undocumented chaos to a formalized, continuously improving flow requires a multi-faceted approach that addresses culture, strategy, and execution. 

The most effective way to gain executive and organizational buy-in is to link documentation directly to customer value and business outcomes. 

• Identify the core business Value Streams: focus on the 5-7 streams that generate the most revenue or are most critical to the customer experience (e.g., "Onboarding a New Customer," "Fulfilling an Order," "Resolving a Major Incident").
• Value Stream Mapping (VSM) workshops: conduct focused, time-boxed VSM workshops that bring together all key stakeholders, from the customer-facing teams to the final delivery/support teams. The focus should be on measuring the flow:
• Lead Time: The total time from start to finish.
• Process Time: The time actually spent working on the request.
• Percent Complete and Accurate (%C&A): The rate at which work is correctly passed from one step to the next.
• Wait Time (Waste): The time the request sits idle between steps. 
  

• Measure the work, not the people: Executive sponsors must clearly communicate that the goal is to find waste in the process, not fault in the people. The metrics (Lead Time, Wait Time) provide an objective basis for continuous improvement.
• Cross-functional ownership: Assign a Value Stream Owner (VSO) who has executive authority and is responsible for the performance of the end-to-end flow, not just one silo. This individual drives a holistic perspective. 
  

Reading time: ~ 2 min.

The ISO/IEC 38505-1 standard on «Information technology — Governance of IT — Governance of data» provides effective guidelines to apply the ICT governance principles set by the ISO 38500 and ISO 38501 standards to the data governance.

We should keep in mind that the ISO/IEC 38505-1:2017 standard is applicable to every kind of organizations, such as companies (private or public ownership), government (agencies, departments, bureaus and other public bodies) and nonprofit organizations.

Both small and large organizations can take advantage of the application of ISO/IEC 38505-1 standard, no matters how big can be the dependence on data of their activities. The guidance provided by this standard can be useful to professionals as:

• executive managements
• external specialists (business or technical): legal, accounting, retail, industrial,...
• external and internal service providers (consultants too)
• auditors

The ISO/IEC 38505-1 standard has 11 main chapters. This is an overview on the structure:

• Chapter 1: scope
• Chapter 2: normative reference
• Chapter 3: terms and definitions

• Chapter 4: good governance of data
• 4.1 benefits of good governance of data
• 4.2 responsibilities of the governing body
• 4.3 governing body and oversight mechanisms
• Chapter 5: principles, model and aspects for good governance of data
• Chapter 6: data accountability
• 6.1 General
• 6.2 Collect
• 6.3 Store
• 6.4 Report
• 6.5 Decide
• 6.6 Distribute
• 6.7 Dispose
• Chapter 7: guidance for the governance of data – principles
• 7.1 General
• 7.2 Principle 1 – responsibility
• 7.3 Principle 2 – strategy
• 7.4 Principle 3 – acquisition
• 7.5 Principle 4 – performance
• 7.6 Principle 5 – conformance
• 7.7 Principle 6 – human behaviour
• Chapter 8: guidance for the governance of data – model
• 8.1 Applying the model
• 8.2 Internal requirements
• 8.3 External requirements
• 8.4 Evaluate
• 8.5 Direct
• 8.6 Monitor
• Chapter 9: guidance for the governance of data – data-specific aspects
• 9.1 General
• 9.2 Value
• 9.3 Risk
• 9.4 Contraints
• Chapter 10: application of the data accountability map

To better figure out  the «big picture» about the ISO 38505-1 standard, take a look at our infographic:

If we consider the ISO/IEC 38505-1:2017 standard, we find direct and natural correlations with the following standards:

• ISO 20000-1 on «Information technology – service management»
• ISO 27001 on «Information security, cybersecurity and privacy protection — Information security management systems — Requirements»

Among the references with the regulations or laws, we find several them in particular on protection of personal data, such as: European GDPR, Swiss FAPD (known also as LPD and DSG).

Reading time: ~ 2 min.

• (EC) N. 1060/2009, commonly known as «Credit Rating Agencies»;
• (EU) N. 648/2012, commonly known as «EMIR», OTC derivatives;
• (EU) N. 600/2014, commonly known as «MIFIR», Markets in Financial Instruments;
• (EU) N. 909/2014, commonly known as «CSDR»;
• (EU) 2016/1011, commonly known as «Benchmark Regulation».

The Digital Operational Resilience Act (DORA) defines a set of requirements to ensure both digital resilience and security especially in the following chapters:

• 📘 I. General Provisions
• 📘 II. ICT Risk Management
• 📘 III. ICT Related Incident Management Process
• 📘 IV. Digital operational resilience test
• 📘 V. Managing of ICT third party risk
• 📘 VI. Information sharing arrengement

• ISO 38500 (Governance)
• ISO 31000 (Risk Management)
• ISO 37301 (Compliance)

The GRC approach provides a useful basis for addressing and integrating the main aspects of:

• ISO 22301 (Resilience and business continuity)
• ISO 27001 (Information security)
• ISO 20000-1 (ICT services; such as: asset and configuration, management, threats and vulnerabilities)
• ISO 27035 (incident and problem management)
• backup and disaster recovery, etc.

To better figure out  the «big picture» about the DORA regulation and the ISO Management Systems according to the suggested GRC approach, take a look at this infographic:

Tempo di lettura stimato: ~ 5 min.

• Ressources Humaines (RH) : Les services RH gèrent des fonctions critiques telles que l'intégration des employés, le traitement des salaires, la gestion des performances, l'administration des avantages sociaux et les programmes de formation et de développement. Ces services sont essentiels pour maintenir une main-d'œuvre qualifiée, engagée et conforme aux réglementations.
• Finance et comptabilité : Cette fonction fournit des services tels que la planification budgétaire, le suivi des dépenses, le reporting financier, la conformité fiscale et la gestion des risques. Sans ces services, les entreprises auraient du mal à allouer efficacement leurs ressources et à maintenir leur santé financière.
• Services Informatiques (IT) : Les départements IT sont responsables de la gestion de l'infrastructure réseau, du support applicatif, de la cybersécurité, de la gestion des accès utilisateurs et du support informatique. Ils assurent la continuité numérique qui permet aux employés d'effectuer leur travail efficacement.
• Gestion des actifs : Assurer un lieu de travail sûr, propre et fonctionnel est la responsabilité des équipes de gestion des installations. Leurs services incluent la gestion des espaces de bureau, la sécurité au travail, la durabilité environnementale et la sûreté des locaux.
• Approvisionnement et chaîne d'Approvisionnement : Ce département est responsable de la gestion des fournisseurs, de la négociation des contrats, du contrôle des stocks et de la logistique, garantissant que l'entreprise dispose des ressources nécessaires pour fonctionner.
• Juridique et conformité : Les équipes juridiques fournissent des conseils réglementaires, gèrent les contrats, protègent la propriété intellectuelle et élaborent des stratégies de gestion des risques pour protéger l'entreprise contre les litiges et les violations de conformité.
• Communication d'entreprise : Les équipes de communication interne veillent à ce que les employés soient informés des politiques de l'entreprise, des changements organisationnels et des objectifs stratégiques, favorisant ainsi une culture d'entreprise cohérente.
  

Voici une aperçu sur les advantages de l'ESM:

Tempo di lettura stimato: ~ 4 min.

Di seguito, alcuni esempi di attività ricorrenti e pratiche di manutenzione essenziali tramite le quali si concretizza il concetto di resilienza aziendale all'interno di un'organizzazione:

• Ottimizzazione dei processi: conduzione di audit periodici dei processi aziendali per verificare che le pratiche operative siano aggiornate e flessibili. Implementare miglioramenti continui per garantire che i processi possano adattarsi rapidamente ai cambiamenti di mercato o interni.
• Revisione della logistica e dell'approvvigionamento: aggiornare costantemente le strategie logistiche per affrontare potenziali interruzioni e garantire un approvvigionamento stabile e sicuro.

Ecco come leggere e utilizzare la tabella:

Autore: Aurelio Stefanoni

Senior Manager, iuXta Management Consulting