The ITSM Practice: Elevating ITSM and IT Security Knowledge

AI governance maturity can be misleading. Many organizations rely on frameworks, policies, and dashboards that signal control but fail to reflect true understanding of AI systems. This episode explores the Governance–Understanding Gap, highlighting why unclear decision ownership and limited system insight create hidden risks in AI, ITSM, and Enterprise Service Management environments.In this episode, we answer to:What is the worst decision an AI system could realistically make in practice?Which AI system in the organization is least understood and hardest to explain?If an AI system makes a harmful decision, who is accountable for it?Resources Mentioned in this Episode: NIST website, framework "AI Risk Management Framework", link https://www.nist.gov/itl/ai-risk-management-frameworkEuropean Commission website, policy "Artificial Intelligence", link https://digital-strategy.ec.europa.eu/en/policies/artificial-intelligenceISO Standards website, ISO/IEC 42001 standard, link https://www.iso.org/standard/81230.htmlMIT Sloan Management Review website, article "A framework for assessing AI risk", link https://mitsloan.mit.edu/ideas-made-to-matter/a-framework-assessing-ai-riskStanford Human-Centered AI website, article " AI Index 2025", link https://aiindex.stanford.eduConnect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

DevSecOps promises shared security responsibility, but what happens when accountability shifts without decision authority? In this episode of The ITSM Practice Podcast, Luigi Ferri explores governance gaps, risk ownership, Security Champions, burnout, and structural ambiguity in DevSecOps. A sharp reflection for CISOs, AppSec leaders, and ITSM professionals navigating security governance and enterprise risk management.In this episode, we answer to:Who is explicitly allowed to accept risk in a DevSecOps operating model?What happens when developers receive security accountability without authority?Are Security Champions strengthening governance, or masking leadership gaps?Resources Mentioned in this Episode: Blackduck website, article "DevSecOps: The good, the bad, and the ugly", link https://www.blackduck.com/blog/devsecops-challenges-benefits.htmlJit website, article "6 DevSecOps Best Practices that Enable Developers to Deliver Secure Code", link https://www.jit.io/resources/devsecops/a-practical-guide-to-devsecops-making-it-work-for-developersDecipher Bureau website, article "DevSecOps Professionals: Avoiding ‘The Great Burnout’", link https://www.decipherbureau.com/news/articles/devsecops-professionals-avoiding-the-great-burnout/ Security Journey website, article "From Disruption to Integration: Rethinking Just-in-Time Security Training", link https://www.securityjourney.com/post/from-disruption-to-integration-rethinking-just-in-time-security-training Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Enterprise Risk Management (ERM) often looks mature—risk registers, ISO 31000 alignment, MoR processes—yet fails to influence real decisions. In fintech and regulated environments, risk governance must shape judgment, not just document compliance. This episode explores why ISO 31000 and MoR lose impact under pressure, and how to align risk appetite, decision-making, and operational execution before risk accumulates.In this episode, we answer to:How can ISO 31000 truly influence enterprise decision-making in fast-moving fintech environments?Why does Management of Risk (MoR) become procedural compliance instead of strategic risk governance?How can Enterprise Risk Management integrate risk appetite, governance, and operational execution without losing agility?Resources Mentioned in this Episode:Axelos website, white paper "Everything You Wanted to Know About MoR in Less Than 1,000 Words", link https://www.axelos.com/resource-hub/white-paper/everything-you-wanted-to-know-about-m-o-r-in-less-than-1000-words Goodelearning website, article "What is Management of Risk (M_o_R)?", link https://goodelearning.com/articles/what-is-management-of-risk/ Best Practice LMS website, article "M_o_R® - Introduction", link http://www.bestpracticelms.com/mLearn/SPM-App/MOR.html ISO official website, ISO 31000:2018 standard, link https://www.iso.org/standard/65694.html Pacific Certifications, article "ISO 31000: Risk Management Framework Explained for Modern Organizations", link https://blog.pacificcert.com/iso-31000-risk-management-framework-explained/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of the ITSM Practice Podcast, Luigi Ferri explores how ITIL 5 shifts leadership from explaining incidents to owning systemic decisions. In complex service ecosystems, governance must move upstream—before automation, architecture, and risk scale. True IT Service Management leadership is no longer about post-incident justification, but about accountable decision design in Enterprise Service Management.In this episode, we answer to:How does ITIL 5 redefine accountability in modern IT Service Management?Why is governance shifting upstream in complex, automated service environments?Are Heads of Service accountable for decisions they did not design?Resources Mentioned in this Episode: ITIL Training Academy website, article "ITIL® (Version 5): Everything New in ITIL Latest Version", link https://www.itil.org.uk/blog/itil-version-5-a-complete-guidePeopleCert website, article "ITIL, The Language of Growth", link https://www.peoplecert.org/Frameworks-Professionals/ITIL-frameworkPMG Academy website, article "The Definitive Guide to ITIL® Version 5 Foundation", link https://www.pmgacademy.com/en/articles/itil/the-definitive-guide-to-itil-version-5-foundation/ITIL official website, article "ITIL AI Governance White Paper", link https://www.itil.com/Itil-News-and-Announcements/ai-governance-white-paper INOC website, article "5 ITIL Incident Management Best Practices", link https://www.inoc.com/blog/itil-incident-management Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of the ITSM Practice Podcast, Luigi Ferri challenges the illusion of security frameworks and compliance culture. Exploring the Secure Controls Framework (SCF), ISO, NIST and ITIL 5, he exposes governance immaturity, framework sprawl and risk misalignment. A sharp reflection on cybersecurity governance, enterprise risk management and why compliance without thinking weakens leadership.In this episode, we answer to:Is compliance replacing real risk-based security governance?Why do organizations accumulate ISO, NIST and SCF instead of clarifying risk ownership?How does ITIL 5 transform control frameworks into accountable governance?Resources Mentioned in this Episode:Compliance Forge website, article "The Secure Controls Framework (SCF) Is The Common Controls Framework (CCF)", link https://complianceforge.com/scf/what-is-the-scf/ Secure Controls Framework website, article "The SCF Makes Compliance A Natural Byproduct of Secure Practices", link https://securecontrolsframework.com/what-is-the-scf/ Secure Controls Framework on GitHub, article "The Secure Controls Framework (SCF) is a meta-framework (framework of frameworks) that maps to over 100 cybersecurity and privacy-related laws, regulations and industry frameworks", link https://github.com/securecontrolsframework/securecontrolsframework Secure Controls Framework website, article "Security, Compliance & Resilience (SCR) Principles", link https://securecontrolsframework.com/domains-principles/ Secure Controls Framework website, article "Secure, Compliant & Resilient Capability Maturity Model (SCR-CMM)", link https://securecontrolsframework.com/free/capability-maturity-model/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

ITIL 5 marks a decisive shift in IT Service Management. Moving beyond ITIL 4, it reframes services as AI-enabled digital product–service systems governed through data-driven decision models. This episode explores governance, accountability, CIO and CISO implications, and why ITIL 5 transforms service management into system leadership in an AI-native world.In this episode, we answer to:How does ITIL 5 redefine IT Service Management in an AI-native environment?What changes from ITIL 4 to ITIL 5 in governance, digital products, and value streams?What does ITIL 5 mean for CIOs and CISOs managing AI-driven digital services?Resources Mentioned in this Episode:ITIL Training Academy website, article "ITIL® (Version 5): Everything New in ITIL Latest Version", link https://www.itil.org.uk/blog/itil-version-5-a-complete-guideServiceNow website, article "Understanding ITIL 5: What’s New and How It Builds on ITIL 4", link https://www.servicenow.com/community/virtual-agent-forum/understanding-itil-5-what-s-new-and-how-it-builds-on-itil-4/m-p/3478594 Novelvista website, article "ITIL 4 vs ITIL (Version 5): What’s New, Changed, and Refined?", link https://www.novelvista.com/blogs/it-service-management/itil4-vs-itil5 PeopleCert website, article "ITIL Foundation (Version 5)", link https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-5-foundation-version-50-4154Tarun Dewat, LinkedIn post "ITIL 5 has officially arrived, and it’s one of the most transformative updates the IT service management world has seen in years", link https://www.linkedin.com/posts/tarun-dewat-699818222_itil-5-has-officially-arrived-and-its-one-activity-7422705091654275073-6AxT ageeogee user on Reddit, post "Will ITIL 5 look more like 3 or 4?", link https://www.reddit.com/r/ITIL/comments/1l4bak8/will_itil_5_look_more_like_3_or_4/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice Podcast, Luigi Ferri explains why IT maturity is the decisive factor in successful IT carve-outs. From dependency mapping to ITIL v3 governance and continuity stress testing, the episode shows how disciplined IT Service Management prevents disruption, cost overruns, and failed separations during complex enterprise transitions.In this episode, we answer to:Where is the real boundary between what IT owns and what a carved-out unit must take?What breaks first when a shared IT service disappears during a carve-out?Why does IT governance need to come before architecture and migration design?Resources Mentioned in this Episode: AvenDATA website, article "What is a carve-out and why is it important?", link https://avendata.com/blog/what-is-a-carve-out-and-why-does-it-matter Umbrex website, article "Stakeholder Alignment and Governance", https://umbrex.com/resources/carve-out-playbook/stakeholder-alignment-and-governance/ Invgate website, article "The most flexible no-code ITSM solution", link https://invgate.com/itsm/itil/itil-service-lifecycle Rezolve AI website, article "ITIL v3: Framework & Best Practices", link https://www.rezolve.ai/blog/itil-v3-framework-best-practices Alloy Software website, article "5 Stages of the ITIL Service Lifecycle: A Simple Guide to Better IT Service Management", link https://www.alloysoftware.com/blog/itil-lifecycle/ Eurostep website, article "Data carve-out best practices: Insights into streamlining data separation for business units", link https://www.eurostep.com/data-carve-out-best-practices-insights-into-streamlining-data-separation-for-business-units/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

HITRUST certification is not a shortcut to trust. In this episode of The ITSM Practice Podcast, Luigi Ferri explains why real success with HITRUST depends on operational maturity, disciplined processes, and ITIL 4 practices. Learn how process consistency, evidence, and repeatability are the true foundations of sustainable compliance and security.In this episode, we answer to:Why do many mid-size organizations fail HITRUST despite strong technical controls?How do ITIL 4 practices enable sustainable HITRUST certification?Which process maturity gaps block HITRUST readiness the most?Resources Mentioned in this Episode: HITRUST Alliance website, article "HITRUST CSF Framework overview", link https://hitrustalliance.net/hitrust-frameworkHITRUST Alliance website, article "HITRUST CSF Control Maturity Evaluation Guide", link https://hitrustalliance.net/hubfs/Download%20Center%20%2B%20Partner%20Content/Evaluating-Control-Maturity-Using-the-HITRUST-Approach.pdfSchneider Downs website, article "Complete Guide to HITRUST Certification", link https://schneiderdowns.com/guide-to-hitrust-certification/Tevora website, article "HITRUST Certification Top Strategies for Effective Evidence Collection", link https://www.tevora.com/resource/hitrust-certification-top-strategies-for-effective-evidence-collection/Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice Podcast, we explore what FISMA really means for midsize, cloud-native security teams. Using real-world scenarios, we explain why FISMA was built for federal systems, where it clashes with cloud responsibility models, and how a risk-based adoption strengthens governance without falling into compliance theatre.In this episode, we answer to:Do FISMA controls apply to cloud-native and SaaS-based environments?How can midsize companies use FISMA without full federal-style compliance?Why is risk-based adoption more effective than checklist compliance in the cloud?Resources Mentioned in this Episode: CISA website, Federal Information Security Modernization Act page, link https://www.cisa.gov/topics/cyber-threats-and-advisories/federal-information-security-modernization-actNIST website, NIST Special Publication 800-53, link https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdfSecureframe website, article "FISMA Compliance: What It Is and How to Achieve It", link https://secureframe.com/hub/nist-800-53/fisma-complianceSecurity Compass website, article "ISO 27001 vs NIST 800-53", link https://www.securitycompass.com/blog/iso-27001-vs-nist-800-53/Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

As AI expands the security perimeter, CISOs face new questions about data, trust, and accountability. This episode explains how combining ISO/IEC 27001 and ISO/IEC 42001 creates a unified governance engine for information security and AI governance. Learn how mid-size organizations can turn AI risk, transparency, and compliance into a strategic advantage.In this episode, we answer to:How does AI change the traditional security perimeter defined by ISO 27001?Why is ISO 42001 essential to govern AI risk, fairness, and explainability?How can CISOs clearly explain to customers where AI uses and sends their data?Resources Mentioned in this Episode:De.iterate website, article "ISO 42001 Certification: Benefits, Challenges, and Real-World Applications", link https://deiterate.com/2025/02/26/iso-42001-certification-benefits-challenges-and-real-world-applications/Cherry Bekaert website, article "ISO 42001 vs. ISO 27001: Data Protection for Scaling Your Professional Services Firm", link https://www.cbh.com/insights/articles/data-protection-for-professional-services-firms/Mitratech website, article "ISO 42001 & AI Risk: Strengthen Third-Party Compliance", link https://mitratech.com/resource-hub/blog/iso-42001-ai-risk-strengthen-third-party-compliance/ Walter Haydock blog, article "How we implement ISO 42001 control A.10.3 and help clients do the same to manage AI vendor risk", link https://blog.stackaware.com/p/iso-42001-annex-a-control-10-3-supplier-risk-management Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice Podcast, Luigi Ferri explains why PCI P2PE is not just encryption but a security-by-design discipline. Learn how point-to-point encryption eliminates clear-text card data, reduces breach impact, simplifies PCI compliance, and integrates with ITIL governance to protect trust from the first millisecond of payment.In this episode, we answer to:What is PCI P2PE and why is it critical for modern payment security and PCI DSS compliance?How does P2PE reduce breach exposure and change merchant compliance obligations?Why are governance, the PIM, and ITIL practices essential to keeping P2PE effective over time?Resources Mentioned in this Episode: PCI website, white paper "P2PE At a Glance", link https://www.pcisecuritystandards.org/documents/P2PE_At_a_Glance_v3.pdfPCI website, white paper "Point-to-Point Encryption", link https://www.pci-dss.gr/media/1934/p2pe_hybrid_v111.pdfPayway website, article "Protect Cardholder Data with P2PE", link https://www.payway.com/blog/how-to-keep-yourself-out-of-the-news-with-p2pe Bluefin website, article "What is Point-to-Point Encryption (P2PE)?", link https://www.bluefin.com/payment-security/pci-p2pe-faq/Ingenico website, article "3 Things to Know About P2PE v3.0", link https://ingenico.com/de/node/818Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice Podcast, Luigi Ferri explains how ITIL v3 processes enable compliance with GSMA SAS-SM for secure eSIM provisioning. Discover how governance, service design, change, and continual improvement turn security from theory into an auditable, operational discipline in modern telecom environments.In this episode, we answer to:How can ITIL v3 processes support GSMA SAS-SM certification for eSIM management?What operational evidence is required to prove secure remote SIM provisioning?How do governance and continual improvement help maintain long-term SAS-SM compliance?Resources Mentioned in this Episode:GSMA website, article "Security Accreditation Scheme (SAS)", link https://www.gsma.com/solutions-and-impact/industry-services/assurance-services/security-accreditation-scheme-sas/GSMA website, article "eSIM Compliance", link https://www.gsma.com/solutions-and-impact/technologies/esim/compliance/IT Process Maps website, article "IT Security Management", link https://wiki.en.it-processmaps.com/index.php/IT_Security_Management?Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Why do mature ITSM programs still fail? This episode explores the hidden risks behind ITSM stagnation, loss of executive sponsorship, outdated KPIs, rigid processes, and misaligned culture. Learn how to sustain ITSM maturity through continual improvement, business-aligned metrics, leadership engagement, and evolution in the age of automation and AI.In this episode, we answer to:Why do mature ITSM programs fail despite successful ITIL adoption?How does loss of executive sponsorship undermine IT Service Management sustainability?How can ITSM processes and KPIs evolve to support automation, AI, and business agility?Resources Mentioned in this Episode:Keith D. Sutherland, Lawrence J. "Butch" Sheets, book "A Practical Guide to Service Management: Insights from industry experts for uncovering, implementing, and improving service management practices", link https://www.amazon.de/-/en/Keith-D-Sutherland/dp/1804612502TOPdesk website, article "5 ITSM implementation pitfalls to avoid", link https://www.topdesk.com/en/blog/itsm-implementation-pitfalls/ Sunrise website, article "Why ITSM implementations often fail?", link https://www.sunrisesoftware.com/blog/why-itsm-implementations-often-fail ITSM Tools website, article "10 Common ITSM Mistakes and How to Avoid Them", link https://itsm.tools/10-common-itsm-mistakes-and-how-to-avoid-them/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice Podcast, Luigi Ferri moves from AI theory to execution, explaining how medium-sized organizations can define AI use cases, assess data and infrastructure, build skills, and scale pilot projects. The focus is on creating a practical AI roadmap for IT Service Management with measurable, sustainable outcomes.In this episode, we answer to:How can organizations identify the right AI use cases for IT Service Management?What data, infrastructure, and skills are required to scale AI initiatives successfully?How can IT leaders manage risks while building a realistic AI roadmap?Resources Mentioned in this Episode:How to Assess AI Readiness for Service Delivery, link https://theitsmpractice.gumroad.com/l/HowtoAssessAIReadinessforServiceDeliveryKPMG website, article "AI Governance: Factors for Success", link https://kpmg.com/de/en/home/insights/2025/04/ki-governance-these-are-the-factors-for-success.htmlIBM website, article "What is AI governance?", link https://www.ibm.com/think/topics/ai-governanceDeepchecks website, article "Understanding the AI Maturity Model: Advancing Your Organization’s AI Capabilities", link https://www.deepchecks.com/understanding-the-ai-maturity-model-advancing-your-organizations-ai-capabilities/Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice Podcast, Luigi Ferri explores AI readiness for service desks and ITSM in medium-sized organizations. Going beyond tools and automation, the discussion focuses on leadership, governance, culture, and skills needed to adopt and scale AI responsibly and align AI initiatives with real business value.In this episode, we answer to:Are medium-sized organizations really ready for AI in ITSM and service delivery?What does AI readiness mean beyond automation and technology?How can leaders assess governance, skills, and culture before adopting AI?Resources Mentioned in this Episode:How to Assess AI Readiness for Service Delivery, link https://theitsmpractice.gumroad.com/l/HowtoAssessAIReadinessforServiceDeliveryIMD website, article "AI Maturity Index", link https://www.imd.org/artificial-intelligence-maturity-index/Boston Consulting Group website, article "When Companies Struggle to Adopt AI, CEOs Must Step Up", link https://www.bcg.com/publications/2025/when-companies-struggle-to-adopt-ai-ceos-must-step-upCloud Security Alliance website, article "A Guide On How AI Pilot Programs are Shaping Enterprise Adoption", link https://cloudsecurityalliance.org/blog/2025/03/28/a-guide-on-how-ai-pilot-programs-are-shaping-enterprise-adoptionConnect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Learn how to build a solid GRC foundation for fintech growth in the EU. We break down governance, risk management, and compliance essentials to help startups scale, earn investor trust, and meet PSD2, GDPR, DORA, MiCA, AML expectations from day one.In this episode, we answer to:How do you set up an effective GRC framework for a fintech startup in the EU?Why must European fintechs prioritize compliance, risk, and governance early to scale safely?What roles, processes, and oversight are essential to meet PSD2, GDPR, DORA, AML requirements?Resources Mentioned in this Episode:European Central Bank (ECB) website, article "The PSD2 supports innovation and competition in retail payments … and enhances the security of payment transactions and the protection of consumer data.", link https://www.ecb.europa.eu/press/intro/mip-online/2018/html/1803_revisedpsd.en.html?Deloitte website, article "The Revised Payment Services Directive (PSD2)", link https://www.deloitte.com/lu/en/Industries/banking-capital-markets/research/psd2-revised-payment-services-directive.html?European Parliament website, article "GDPR: Overview of the EU General Data Protection Regulation", link https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm?utm_source=chatgpt.comGerman BaFin website, article "Prevention of money laundering and terrorist financing", link https://www.bafin.de/EN/Aufsicht/Geldwaeschepraevention/geldwaeschepraevention_node_en.html?ESMA website, article "Official summary from authoritative EU sources: Digital Operational Resilience Act (DORA)", link https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora?ESMA website, article "Official overview by the European Securities and Markets Authority (ESMA): Markets in Crypto-Assets Regulation (MiCA)", link https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica?utm_source=chatgpt.comConnect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

A deep dive into BSI Grundschutz technical measures, systems, networks, applications, monitoring, and evidence-based security. Learn how to move from compliance to operational resilience and why German clients expect proof, not promises.In this episode, we answer to:How do BSI Grundschutz technical measures strengthen system, network, and application security?What evidence-based controls are required to prove resilience and compliance?How does Grundschutz compare to the NIST Cybersecurity Framework for SaaS and cloud environments?Resources Mentioned in this Episode: Eena 112 website, whitepaper "Cybersecurity Practical Approach", link https://eena.org/wp-content/uploads/2020_05_06_Cybersecurity_PracticalApproach.pdf BSI - German Federal Office for Information Security, publication "BSI Magazin", link https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Magazin/BSI-Magazin_2021-01.pdf?__blob=publicationFile&v=5 ACC Management Consulting, article "BSI - IT Baseline Protection: A Method for Information Security", link https://www.acc-management-consulting.de/bsi-grundschutz-isms BSI - German Federal Office for Information Security, WiBa tool, link https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/WiBA/WiBA_Tool_Excel.xlsx?__blob=publicationFile&v=2 Dr. Datenschutz website, article "The path to basic security for your IT", link https://www.dr-datenschutz.de/der-weg-in-die-basisabsicherung-fuer-ihre-it/ BSI - German Federal Office for Information Security, article + videos "Getting Started - Guidance and videos for raising awareness of cyber security", link https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/KMU/leichter_Einstieg/leichter_Einstieg_node.html Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

BSI Grundschutz is the hidden gatekeeper for U.S. companies entering Germany. This episode breaks down the organizational measures, from ISMS design to governance, staff security, and incident evidence, that shape compliance, build trust, and strengthen IT security maturity.In this episode, we answer to:What is BSI Grundschutz and why does it matter for U.S. companies expanding to Germany?How do organizational measures like ISMS, governance, and role clarity improve security and compliance?How does documenting incidents and responsibilities increase trust with German clients and regulators?Resources Mentioned in this Episode: Secureframe website, article "BSI IT-Grundschutz", link https://secureframe.com/frameworks-glossary/bsi-it-grundschutz Hisolutions website, article "BSI IT-Grundschutz", link https://www.hisolutions.com/security-consulting/informationssicherheit/bsi-it-grundschutz BSI - German Federal Office for Information Security, article "Advanced Protection", link https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/KMU/Expertise/Expertise_node.html BSI - German Federal Office for Information Security, article "IT-Grundschutz", link https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/it-grundschutz.html Secfix website, article "ISO 27001 und BSI-Grundschutz", link https://de.secfix.com/beitrag/iso-27001-bsi-grundschutz Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover why 70% of ITSM initiatives fail and how a strategic Service Management Office (SMO) transforms ITIL from theory into business value. Learn the six-step SMO blueprint, key metrics, and pitfalls to avoid to elevate ITSM maturity and governance.In this episode, we answer to:What is a Service Management Office and why is it critical for ITSM success?How do you build an SMO with governance, value alignment, and CIO-level sponsorship?Which metrics and maturity levels define real ITSM performance and business impact?Resources Mentioned in this Episode: Pink Elephant website, whitepaper "The IT Service Management Office", link https://www.pinkelephant.com/uploadedfiles/Resources/PinkPapers/The-IT-Service-Management-Office.pdf Littlefish website, article "Strategic Power of a Service Management Office (SMO)", link https://www.littlefish.co.uk/insights/service-management-office-smo/ IT Process Maps, article "ITIL Service Strategy", link https://wiki.en.it-processmaps.com/index.php/ITIL_Service_StrategyEcholon website, article "The importance of an effective ITIL® service strategy for success in IT service management", link https://www.echolon.de/en/blog/itil-it-service-strategy/Scrumprep website, article "Answering: Which metrics will help a Product Owner determine if a product is deliverying value?", link https://scrumprep.com/answering-which-metrics-will-help-a-product-owner-determine-if-a-product-is-delivering-value/ Value Delivery Metric website, video https://youtu.be/pjnkWgq7I6IITSM Tools website, article "The Making of an IT Service Management (ITSM) Maturity Model", link https://itsm.tools/the-making-of-a-maturity-model-an-approach-to-culture-and-client-support/ Navvia website, whitepaper "The Making of an IT Service Management (ITSM) Maturity Model", link https://navvia.com/hubfs/MKTG Folder/Learn center - Courses Slides/SMO Service Management Office -Slides.pdf Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice Podcast, Luigi Ferri dives into Financial Modelling for ITIL-based services — the key to shifting IT from a cost center to a value creator. Learn how Activity-Based Costing (ABC), Unit Costing, Lifecycle Costing, and Showback Models can transform IT governance, pricing clarity, and business alignment in IT Service Management (ITSM).In this episode, we answer to:How can IT leaders connect services, costs, and value in ITIL-based organizations?Which financial models (ABC, Unit Cost, Lifecycle) fit your ITSM strategy best?How can financial transparency turn IT from “too expensive” to a strategic partner?Resources Mentioned in this Episode:PeopleCert website, article "ITIL 4 Value Streams Doing Right Things for Customers", link https://www.axelos.com/resource-hub/blog/itil-4-value-streams-doing-right-things-for-customers QRP website, article "ITIL 4 Service Value Chain and Value Stream", link https://www.qrpinternational.be/blog/it-governance-and-service-management/service-value-chain-and-value-stream/ IT Process Map website, article "Financial Management", link https://wiki.en.it-processmaps.com/index.php/Financial_Management PMI website, article "Activity Based Costing (ABC)", link https://www.projectmanagement.com/wikis/232994/activity-based-costing--abc- Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya