Mapping Important Business Services: A Practical Approach

Identifying important business services (IBS) sounds simple in principle — a service whose disruption could cause harm to consumers or market integrity — but in practice, firms either define them too broadly (turning every service into an IBS) or too narrowly (missing services that genuinely warrant the designation).

Start from outcomes, not org charts. Rather than asking 'which department owns this?', ask 'what would a customer, counterparty, or the market actually experience if this stopped working for four hours? For four days?' This reframing consistently produces a tighter, more defensible IBS list than a department-by-department review.

Once identified, mapping requires tracing each IBS down through the people, processes, technology, facilities, and third parties that deliver it end-to-end. This is where a CMDB-driven approach pays off — rather than a static diagram that goes stale within months, the mapping lives as relationships between CI records that update as the estate changes.

Setting impact tolerances is a cross-functional exercise, not something risk or compliance can set in isolation. Business owners need to define the maximum tolerable disruption, and that figure needs to be tested — not assumed — against your actual recovery capability using severe-but-plausible scenarios.

The final step, and the one most often skipped, is keeping the mapping current. New systems get deployed, vendors change, and organisational structures shift constantly. Building IBS mapping directly into your ServiceNow CMDB governance process — so any significant change automatically flags for IBS review — is the only sustainable way to keep this accurate.