Multi-Factor risk assessment for Devops changes

DevOps and IT Change Governance teams need change requests to be approved quickly so that the required updates can be deployed faster to support the business. However, the business should also be protected from bad changes by enforcing risk evaluation. To evaluate the risk level of a change created from Atlassian Jira Software,  Excerpt named productname was not found in document xwiki:Service-Management.IT-Service-Management.BMC-Helix-Multi-Cloud-Broker.mcbroker213._InclusionsLibrary.WebHome. provides the Risk Calculation service that calculates the risk level of a change request when it is brokered from Jira Software to BMC Helix ITSM. The calculated risk level data is automatically added to the BMC Helix ITSM Change record. 

Risk Management configurations

As an administrator, you can view and update the risk management configurations to define the risk value and weightage for Jira development groups and services that are used to calculate the risk level of a change request. 

The following configurations are available in the Risk Management section:

For more information about how the risk values are calculated, see How the risk values are calculated.

To activate the risk calculation service

To activate risk calculation, you must complete the following tasks:

To update a field mapping for integration templates developed by using BMC Helix Integration Service

1. Log in to BMC Helix Integration Studio, and navigate to My Flows.
2. Open the Create Change flow.
3. Click the Details tab.
4. Expand Field Mapping. 
5. Map the following Excerpt named productname was not found in document xwiki:Service-Management.IT-Service-Management.BMC-Helix-Multi-Cloud-Broker.mcbroker213._InclusionsLibrary.WebHome. fields to the third-party application field used to define the risk calculation factors:
   • Vendor Group to the field used to define the development group.
   • Service to the field used for defining the service. 
6. Save the flow.

To update field mappings  for integration templates developed by using BMC Helix iPaaS, powered by Jitterbit

1. Log in to BMC Helix iPaaS, and navigate to the Cloud Studio. 

2. Open the integration template project. 

   Important

   Risk rules are applicable only for integrations with BMC Helix ITSM change requests.

3. Select the Components tab, and search for the Prepare Create Change Data From Issue transformation of the Create MCB Change from Jira operation in Vendor Workflow.
4. Select the transformation, click the Ellipses (...), and select View/Edit.

5. In the target section, click the script icon for the [ 0, 1 ] Vendor_Group (string) field and add the script to map the field ID of the field associated with a development group in the third-party application in the following format:
   <trans>
   $jsonObj["issue"]["fields"]["customfield_<fieldId>"]["value"];
   </trans>

   For example, if you have a custom field Vendor Group with field ID 10155 defined in Jira, add the following script:
   <trans>
   $jsonObj["issue"]["fields"]["customfield_10155"]["Criteria"];
   </trans>

   Important

   • Out of the box, the third-party application may not have specific fields for development groups or services. You can use existing fields or add custom fields for the values of development groups or services associated with the third-party application record.
   • If the [ 0, 1 ] Risk_Level (string) is mapped in the Prepare Create Change Data From Issue transformation, this value takes precedence over the calculated risk value.

To define a risk rule

1. Log in to BMC Helix Multi-Cloud Broker and click Settings.
2. Navigate to Risk Management > 4. Risk Rules > Map Risk Rules.
3. To add a new risk rule, click +Risk Rule.

4. Add the following values: 

   Field Name	Description
   Source Metrics	Select the value based on the source for which you are defining the metrics: Risk Metric - Development Group—Rule for a development group metric Risk Metric - Technology Service—Rule for a service metric Risk Metric - CI property—Rule for a CI property metric
   Weight	The weight percentage to be used for this metric when calculating the risk level.
   Technology Provider	Select the name of the third-party application.
   Status	Select Enable activate the rule.
   Description	Enter a short description of the rule.
   CI Property Field ID	Enter the ID of the CI property field, as defined in the Manage CI Property To Risk Value Mapping. This field is mandatory if you have selected Risk Metric - CI properties option in Source Metrics field.
   CI Search Qualification	Use this field to determine additional search qualifications for requests that are sent to the AST:BaseElement form. This is useful when customers have multiple records with the same CI name.

5. Click Save.

You can define multiple risk rules and add the weight percentage for each rule. The total weightage of all risk rules defined must be 100.

Example of how the risk values are calculated

1. When an issue is created in Jira, the user selects a service and development group. 
2. In the corresponding BMC Helix Multi-Cloud Broker record that is created, the Risk Calculation service calculates the risk level based on the Development Group, Service metrics, or CI rules defined in BMC Helix Multi-Cloud Broker.  These metrics include the risk value and the weightage for the Development Group and Service. 
   • Weightages are defined in the risk rules
   • Risk value of the development group is defined in the Development Groups configuration

   • Risk value of a service is defined from the Risk Metrics - Service record of the Risk Management service

     Example

     The risk values defined for a specific development group and Service are 5 and 50 respectively, and the risk rule defines the weightage of the development group as 70% and service as 30%, risk level is calculated as follows:

     ((5 * 70) + (50 * 30)) / (70+30) = 18.5

     Since the valid risk level for a Change record has a value ranging from 0-4 (Level 1 - Level 5), the risk value is normalized to match the range of the enum value:

     18.5 / 100 * 4 = 0.74 = 1 (round off) = Risk Level 1

   • Risk value of the development group is defined in the Development Groups configuration, and that of a CI is defined in Manage CI Property To Risk Value Mappings configuration.

     Example

     The risk values defined for a specific development group and CI are 5 and 50 respectively, and the risk rule defines the weightage of the development group as 70% and CI as 30%, risk level is calculated as follows:

     ((5 * 70) + (50 * 30)) / (70+30) = 18.5

     Since the valid risk level for a Change record has a value ranging from 0-4 (Level 1 - Level 5), the risk value is normalized to match the range of the enum value:

     18.5 / 100 * 4 = 0.74 = 1 (round off) = Risk Level 1

     Important

     The Development, Service, or CI rules cannot be applied simultaneously. Either Development and Service or Development and CI rules are applied. CI rule takes precedence over the service rule in risk calculation. If Excerpt named productname was not found in document xwiki:Service-Management.IT-Service-Management.BMC-Helix-Multi-Cloud-Broker.mcbroker213._InclusionsLibrary.WebHome. cannot find the CI sent by JIRA in BMC Helix ITSM, it searches for the service in the Risk Management library. The risk is calculated as per the risk weight associated with the applied rule.

3. The risk level is added to the change record created in BMC Helix ITSM: Smart IT from the BMC Helix Multi-Cloud Broker record. 

   Important

   You can configure auto-approval rules in BMC Helix ITSM so that low risk changes are automatically approved and high risk changes are evaluated before being approved. 

   When the change request is approved and moves to Planning in Progress, the Jira issue is updated with the approval status providing the DevOps team with the current status of a change request.

4. The Risk Calculation service tracks the status of the change requests. When the change is completed, based on the success or failure of the change, the risk level of the development team is increased or decreased by 20. However, the range of the risk level is maintained between 0 - 100, which ensures the risk levels are realistic and based on the capability of a development team to deliver a change.

   Example

   For example, the risk level defined for the development team working on the change request is set to 40. If the change they are implementing is closed successfully, the risk level of the development team is automatically reduced to (40-20)=20.

   If the change they are implementing is closed as a failure, the risk level of the development team is automatically increased to (40+20)=60.

   Note, if the risk value is 90, it is incremented to 100 for a successful change. Similarly, if the risk value is 10, it is decreased to 0 for an unsuccessful change.