Business-Level overview

This section provides an overview of the business benefits of managing compliance with HPE ITOC.

The HPE ITOC UI provides an easy-to-navigate dashboard that shows the HPE ITOC core objects: The core objects in OCM are: the Policy, the Controls, the Business Service, the Service Components, and IT Resources. The Policy is essentially a collection of Rules. The Business Service is a collection of service components. The Statement of Applicability (SoA) ties together the Policy and the Business Service.

• Policies - A policy is a system representation of a government or corporate regulatory policy. Policies have a set of requirements and requirements can have one or many rules.
• Business Services - A business service is a collection of IT resources with defined relationships to one another that can be viewed in a topology.
• Controls - A control is a reusable, shareable function or test that can be used in a policy to create a rule.
• Resources - Resources are the ITOC representation of an IT resource in the customer's environment. IT resources are associated with business services, and the same IT resource can be used across different business services.
• Statement of Applicability - The SoA ties a business service to a policy and defines the SLOs, maintenance windows, and exceptions. Scan compliance and remediation jobs are manually run within the maintenance windows.

View the HPE ITOC big picture

A VP or other executive is interested in ITOC primarily for the compliance big picture, or overview. The VP uses the ITOC dashboard to see the overall compliance view, discover possible areas of non-compliance, and pull reports for compliance audits. From the dashboard, the VP can navigate easily to areas of concern and view details about policies, business services, and the performance of the SoAs associated with them.

To prepare for an upcoming compliance audit, an executive can see business services within the system that need to be compliant with regulatory policies such as PCI. The executive can run a preliminary report to discover any issues that need to be addressed through remediation or an exception. If any are found, the executive can contact the business service owner to say that his business service is not compliant with PCI and needs either remediation or an exception before the audit next week.

The Business Service Owner follows up to see which service components need to be remediated and which may be applicable for an exception.