CPA1.6 Documentation

Information

Generic objectives apply to other capability process areas and can be used within these CPAs. They are important core organisational objectives that would be required in any institution or infrastructure.

The generic objectives and generic activities of this CPA on documentation should be added to other CPAs where the need for documentation, such as policies and process definitions, has been identified.

GO1.6.1: Effective Documentation

The objective of documentation is to ensure that policies, processes and procedures, and their outputs, are sufficiently documented to support and enhance effectiveness and auditability of services for stakeholders and users.

GRA1.6.1.1: Documentation

There is a single defined and dedicated location and single format for documentation (e.g. a document management system with a versioning system). This is known throughout the organisation.

(0) Not defined:

There is no evidence for a defined and dedicated location for documentation.

(1) Initial:

There is a location for documentation but it is not widely known within the organisation and is rarely, or inconsistently, used. There is no evidence of a documentation management system in use.

(2) Repeated/partial:

Through repeated practice a location and format for documentation is established, but no role is responsible for the management and maintenance of the documentation location. It is widely known throughout the organisation.

(3) Defined:

There is a single dedicated location and single format for documentation in the form of a documentation system. There are roles responsible for the management and maintenance of the documentation location. It is widely known throughout the organisation.

(4) Managed:

The use of the dedicated documentation location is monitored and issues with its use are recorded.

(5) Optimised:

At regular intervals the use, processes and issues of the documentation solution are reviewed. If required changes to the documentation system and procedures are made and communicated in accordance with the communication plan.

 

GRA 1.6.1.2: Documentation control

The procedures for controlling documentation such as, creation and approval, communication and distribution, review, versioning and change tracking, are documented.

(0) Not defined:

There is no evidence of any procedures for documentation control.

(1) Initial:

There are some procedures for controlling documentation, but these are usually carried out by an individual and are not widely used within the organisation.

(2) Repeated/partial:

Procedures for controlling documentation have developed from repeated practice, but are not formally described. The procedures are not formally communicated within the organisation.

(3) Defined:

The procedures for controlling documentation such as, creation and approval, communication and distribution, review, versioning and change tracking, are fully documented in the document location. Information about these procedures are communicated throughout the organisation and if necessary training is provided.

(4) Managed:

The documentation control procedures are monitored and issues are recorded.

(5) Optimised:

At regular intervals the procedures for controlling documentation are reviewed. Any changes to a procedure is documented and communicated in accordance with the communication plan.

GEA1.6.1.3: Service management documentation

Specific documents to be produced and maintained relating to a provided service, such as, service management, policies, plans, and process descriptions, are approved by the responsible service manager and senior management

(0) Not defined:

There is no evidence of an approval process.

(1) Initial:

Approval of key documentation is ad hoc and incomplete; possibly only by the service manager.

(2) Repeated/partial:

There is a process for approval of key or specific documents, but this is not formalised and not always followed.

(3) Defined:

There is a formal and documented approval procedure for all key documentation.

(4) Managed:

The approval procedure is monitored and issues are recorded.

(5) Optimised:

At regular intervals the approval procedure for key documentation is reviewed. Any changes to the procedure is documented and communicated in accordance with the communication plan.