Ruankao System Planning and Management Engineer (Senior) cheat sheet

Strategy hierarchy: mission → vision → goals → objectives → initiatives; IT strategy must trace every initiative upward to at least one enterprise goal or it is unfunded scope.

Porter's generic strategies (cost leadership, differentiation, focus) set the IT investment posture: cost leadership favors standardization and shared services; differentiation favors analytics, customer experience, and rapid experimentation.

Value chain analysis splits activities into primary (inbound logistics, operations, outbound, marketing/sales, service) and support (firm infrastructure, HR, technology development, procurement); IT opportunities are mapped per activity.

McFarlan strategic grid classifies applications on two axes - strategic impact today vs. impact in future - producing Support, Factory, Turnaround, and Strategic quadrants; quadrant drives funding and governance intensity.

Enterprise architecture layers: business → data/information → application → technology; TOGAF ADM is a cyclic 8-phase method (Preliminary, A–H) with requirements management at the center.

Zachman framework is a 6x6 classification matrix (What, How, Where, Who, When, Why against planner, owner, designer, builder, subcontractor, functioning enterprise); it is a taxonomy, not a process.

Capability maturity for planning: Level 1 ad hoc, 2 repeatable, 3 defined, 4 managed/measured, 5 optimizing; each level requires documented process plus measured outcomes before the next is credible.

Portfolio triage rule: rank investments by business value against risk and dependency; fund a balanced mix of run-the-business, grow-the-business, and transform-the-business, with explicit percentages agreed annually.

ITIL 4 centers on the service value chain (Plan, Improve, Engage, Design and Transition, Obtain/Build, Deliver and Support) plus 34 management practices grouped as general, service, and technical.

ITIL 4's four dimensions: organizations and people; information and technology; partners and suppliers; value streams and processes - every practice must be assessed across all four.

Seven guiding principles: focus on value, start where you are, progress iteratively with feedback, collaborate and promote visibility, think and work holistically, keep it simple and practical, optimize and automate.

ISO/IEC 20000-1 is the certifiable requirement standard for a service management system (SMS); ISO/IEC 20000-2 gives guidance. Certification covers the SMS, not individual processes or tools.

COBIT 2019 separates governance (EDM: Evaluate, Direct, Monitor) from management (APO, BAI, DSS, MEA domains) and uses design factors to tailor the governance system.

ISO/IEC 27001 specifies an information security management system with Annex A controls; ISO/IEC 27002 supplies implementation guidance and is not certifiable on its own.

CMMI and ISO 9001 address process capability and quality management respectively; they can complement ITIL/ISO 20000 but neither replaces the service lifecycle requirements.

Framework selection rule: use ITIL 4 for practice design vocabulary, ISO/IEC 20000-1 when third-party certification is required, COBIT when board-level governance evidence is needed, and DevOps/SRE practices for flow and reliability metrics.

Service level agreement content: service description, hours of operation, availability target, response and resolution targets by priority, exclusions, reporting cadence, review cycle, and remedies for breach.

Availability formula: agreed service time minus downtime, divided by agreed service time, expressed as a percentage; 99.9% over a 30-day month allows about 43 minutes of unplanned downtime.

Priority is derived from impact times urgency, not from caller seniority; a documented impact/urgency matrix prevents priority inflation.

Service design package (SDP) covers requirements, design, architecture, capacity, availability, continuity, security, and acceptance criteria; it is the input to transition and the baseline for change evaluation.

Capacity planning uses three inputs: business demand forecast, current utilization trends, and component performance baselines; output is a capacity plan with thresholds and trigger points.

Single point of failure analysis: for each critical service, map components with no redundancy, then rank by probability of failure times business impact to sequence remediation.

Continuity design distinguishes RTO (time to restore service) from RPO (acceptable data loss); recovery tiers and DR test frequency must be justified by business impact analysis results.

Service catalogue has two views: business-facing (what users can request, in business language) and technical (supporting services and CIs); only the business view is published to end users.

Incident management restores service fast; problem management removes root cause. A major incident triggers a separate communications path and post-implementation review within an agreed interval.

Known error record fields: symptom, root cause or working hypothesis, workaround, affected CIs, status, and owner; it links to the problem record and to the knowledge base article.

Change types: standard (pre-authorized, low risk, repeatable), normal (assessed and approved by change authority), emergency (expedited approval with retrospective review).

Change advisory board decides on normal changes using risk, impact, and resource assessment; emergency changes follow a defined expedited path and are reviewed afterward.

Continual improvement register tracks improvement opportunities with owner, expected benefit, effort, priority, and status; a Deming cycle (Plan-Do-Check-Act) or ITIL continual improvement model structures each entry.

Key operational metrics: first-contact resolution rate, mean time to restore service, percentage of incidents resolved within SLA, backlog age, change success rate, and unplanned downtime.

Problem prioritization rule: rank by the aggregate impact of recurring incidents plus the risk of the unresolved root cause, not by the age of the ticket.

Shift-left and self-service reduce cost per contact only when the knowledge base is accurate and searchable; measure deflection rate and reopen rate together to detect false savings.

Cost classification: direct vs. indirect, fixed vs. variable, capital expenditure vs. operating expenditure; service costing requires allocating shared and indirect costs by a documented driver.

Total cost of ownership spans acquisition, implementation, operations, support, and retirement; comparing options on license price alone omits run costs and exit costs.

Charging models: cost recovery (no margin), cost plus (margin added), market price, and notional charging (showback without money movement); the choice affects user behavior and demand.

Unit cost metric = total cost of a service divided by a defined volume driver (per ticket, per transaction, per user per month); it enables benchmarking and trend analysis.

Return on investment = (benefit minus cost) divided by cost; payback period = initial investment divided by annual net cash inflow. Use both, since ROI ignores timing while payback ignores returns after breakeven.

Balanced scorecard perspectives: financial, customer, internal process, and learning and growth; each perspective needs 3–5 measures with targets and owners.

Good service metrics are SMART and paired with a counter-metric (for example, resolution speed paired with reopen rate) to prevent gaming.

Budget variance analysis separates volume-driven variance from price and efficiency variance; only the controllable portion should be attributed to the service owner.

Governance vs. management: governance sets direction and monitors through Evaluate-Direct-Monitor; management plans, builds, runs, and monitors execution.

Three lines model: first line owns and manages risk; second line provides oversight, frameworks, and challenge; third line is internal audit providing independent assurance.

Risk = likelihood times impact; a risk register records description, owner, inherent rating, existing controls, residual rating, treatment (avoid, reduce, transfer, accept), and review date.

Risk appetite is the amount of risk the organization is willing to pursue; risk tolerance is the acceptable variation around a specific objective. Both must be approved at board or executive level.

Compliance obligations come from law, regulation, contract, and internal policy; a compliance register maps each obligation to a control, an owner, and evidence of operation.

Segregation of duties prevents one person from initiating, approving, and recording the same transaction; where headcount prevents it, compensating monitoring controls are required.

IT audit evidence hierarchy: system-generated logs and independent observation rank above self-reported attestations; sampling must be documented with population, method, and size.

Business continuity governance requires a business impact analysis, approved recovery objectives, tested plans, and a review cycle; an untested plan is an assumption, not a control.

CIA triad: confidentiality (authorized disclosure only), integrity (accurate and complete), availability (accessible when needed); controls are justified by which leg they protect.

Defense in depth layers preventive, detective, and corrective controls; no single control is assumed sufficient, and each layer has an owner and monitoring method.

Identity and access principles: least privilege, need to know, separation of duties, and periodic recertification; privileged accounts require stronger authentication and session logging.

Data lifecycle: create/collect, store, use, share, archive, destroy; retention periods derive from legal, regulatory, and business requirements, and destruction must be evidenced.

Data classification tiers (for example public, internal, confidential, restricted) drive handling rules for encryption, access, sharing, and disposal; classification is owned by the data owner.

Privacy principles: lawful basis, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability; breach notification timelines are jurisdiction-specific.

Cryptography rule: protect data in transit with current TLS versions and at rest with managed keys; key management (generation, rotation, revocation, custody) is a control in its own right.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; evidence handling must preserve chain of custody.

Tuckman stages: forming, storming, norming, performing, adjourning; leadership style shifts from directing early to delegating at performing.

Situational leadership matches style to follower readiness: directing for low competence and low commitment, coaching, supporting, and delegating for high readiness.

Stakeholder analysis plots power against interest; high power and high interest are managed closely, high power and low interest kept satisfied, low power and high interest kept informed.

Communication plan fields: audience, message, channel, frequency, owner, and feedback mechanism; escalation paths and decision rights are stated explicitly.

Kotter's eight steps: urgency, guiding coalition, vision, communicate, empower action, short-term wins, consolidate gains, anchor in culture; skipping early steps is the common failure mode.

ADKAR sequences change at the individual level: awareness, desire, knowledge, ability, reinforcement; a gap at any one point blocks the change regardless of project progress.

Resistance to change is diagnosed by source (loss of competence, loss of status, workload, distrust); the response differs per source, so generic communication does not resolve it.

Conflict modes: competing, collaborating, compromising, avoiding, accommodating; collaborating suits high-stakes issues with time available, while avoiding suits trivial or escalating situations.