View
7.887
Download
0
Category
Preview:
Citation preview
1
IT Governance Using COBIT 5: An Introduction
BY :AQEL M. AQELA C C R E D I T E D T R A I N E R B Y A P M G
TUESDAY 28-APRIL-2015
E - m a i l : a q e l . a q e l @ g m a i l . c o m
2
P. O. BOX 40496 – 11499
Riyadh - Saudi Arabia
aqel.aqel@gmail.com
+966-502-104-007
Aqel Mohammed Aqel, CISA, MBA, CSSGB, COBIT5
Information Technology & Management Consultant Information Systems Audit & Control Association – Riyadh ChapterCISA Coordinator and Research Director • Certified information System Auditor• Master of Business Administration- UK • Certified as Lean Six Sigma Green Built• Certified COBIT-5 Trainer (Foundation) • Member of Association for Strategic Planning
http://www.linkedin.com/in/aqelmaqel
http://www.facebook.com/aqel.m.aqel
https://www.youtube.com/channel/UCR0wCpIHdhu5TBsWn-Ar5YA
3
Topics for tonight session Overview: COBIT, the past and present
The Five Principles
COBIT Processes
Enablers
Process Assessment Model (PAM)
Implementation Overview
Closure
4
Why Develop COBIT 5? ISACA want “Tie together and reinforce all ISACA knowledge assets with
COBIT.”
Provide a renewed and authoritative governance and management framework for enterprise information and related technology
Integrate all other major ISACA frameworks and guidance
Align with other major frameworks and standards
Governance of Enterprise IT
COBIT 5
IT Governance
COBIT4.0/4.1
Management
COBIT3
Control
COBIT2
Audit
COBIT1
2005/720001998
Evo
lutio
n
1996 2012
Val IT 2.0(2008)
Risk IT(2009)
BMIS(2010)
The Evolution of COBIT 5
5
6
Drivers for the development of a Framework Provide guidance in:
◦ Enterprise architecture◦ Asset and service management◦ Emerging sourcing and organization models◦ Innovation and emerging technologies
End to end business and IT responsibilities
Controls for user-initiated and user-controlled IT solutions
A need for the enterprise to:◦ Achieve increased value creation◦ Obtain business user satisfaction ◦ Achieve compliance with relevant laws, regulations and policies
7
COBIT 5 Product Family
S O U RC E : C O B IT 5 , I S AC A
8
COBIT and Other IT Governance Frameworks
COBIT
ISO 9000ISO 27002
ITIL
COSO
WHAT HOW
SCOPE OF COVERAGE
9
COBIT 5 Mapping Specifics ..1
ISO/IEC 38500o ISO’s 6 principles map to COBIT 5
o ITIL v3 The following 5 areas and domains are covered by ITIL v3:o A subset of process in the DSS domaino A sunset of processes in the BAI domain o Some process in the APO domain
ISO/IEC 27000o Security and IT-related processes in domains EDM, APO and DSSo Some monitoring of security monitoring activities in MEA
ISO/IEC 31000o Risk management related activities in EDM and APO
10
COBIT 5 Mapping Specifics ..2 TOGAF (The Open Group Architecture Framework)o Resource-related processes in EDM o TOGAF components of the architecture board and governance areaso Enterprise architecture processes of APO
PRINCE2o Programme and project management processes in the BAI domaino Portfolio related processes in the APO domain
CMMI ISO 15504o Some organisational and quality-related processes in the APO domaino Application –building and acquisition related processes in BAI
11
COBIT Principles
12
COBIT 5 Principles A Principle general truth, that helps people
determine the appropriate decision, given the circumstance at hand. They are guidelines that provide an indication of what to do, but not how to do it. For example:
◦ Team members ensure they are in attendance when they feel responsibility for the success of the team
Policies or Procedures define specifically what and how to do something - they define specific actions or behaviors. For example:
◦ Team Members who attend late, on more than three occasions, will receive a formal warning.
S O U RC E : C O B I T 5 , I S AC A
13
Principle 1:Meeting Stakeholder Needs
Enterprises have many stakeholders
Governance is about Negotiating, & Deciding amongst different stakeholders’ value interestsConsidering all stakeholders when making benefit, resource and risk assessment decisions
For each decision, ask: ◦ For whom are the benefits? ◦ Who bears the risk? ◦ What resources are required?
14
Principle 1:Meeting Stakeholder Needs
Enterprises exist to create value for their stakeholders
Value creation: realizing benefits at an optimal resource cost while optimizing risk.
SO U RC E : C O B I T 5 , I S AC A
15
Principle 1: Meeting Stakeholder Needs
S O U RC E : C O B IT 5 , I S AC A
16
Principle 1 – Cascade steps Figure 5
17
Principle 1 – Cascade Steps
18
Principle 2:Covering the Enterprise End–to–End
S O U RC E : C O B IT 5 , I S AC A
19
Principle 2:Covering the Enterprise End–to–End
Main elements of the governance approach:
Governance Enablers comprising◦ The organizational resources for governance◦ The enterprise’s resources◦ A lack of resources or enablers may affect the ability of the enterprise to
create value
Governance Scope comprising◦ The whole enterprise◦ An entity, a tangible or intangible asset, etc.
20
Principle 2:Covering the Enterprise End–to–End
Governance roles, activities and relationships◦ Define Who is involved in governance◦ How they are involved◦ What they do and ◦ How they interact
COBIT 5 defines the difference between governance and management activities in principle 5
21
Principle 3:Applying a Single Integrated Framework
COBIT 5:◦ Aligns with the latest relevant standards and frameworks ◦ Is complete in enterprise coverage◦ Provides a basis to integrate effectively other frameworks, standards and
practices used◦ Integrates all knowledge previously dispersed over different ISACA
frameworks◦ Provides a simple architecture for structuring guidance materials and
producing a consistent product set
22
Principle 4:Enabling a Holistic Approach
COBIT 5 defines a set of enablers to support the implementation of a comprehensive governance and management system for enterprise IT.
COBIT 5 enablers are:
Factors that, individually and collectively, influence whether something will work
Driven by the goals cascade
Described by the COBIT 5 framework in seven categories
23
Principle 4:Enabling a Holistic Approach
S O U RC E : C O B IT 5 , I S AC A
24
Principle 4:Enabling a Holistic Approach
Enablers:
1. Principles, policies and frameworks
2. Processes
3. Organizational structures
4. Culture, ethics and behaviour
5. Information
6. Services, infrastructure and applications
7. People, skills and competencies
25
Principle 4:Enabling a Holistic Approach
COBIT 5 enabler dimensions: All enablers have a set of common dimensions that:
◦ Provide a common, simple and structured way to deal with enablers◦ Allow an entity to manage its complex interactions ◦ Facilitate successful outcomes of the enablers
26
Principle 5:Separating Governance from Management
SO U RC E : C O B I T 5 , I S AC A
27
Principle 5:Separating Governance from Management
The COBIT 5 framework makes a clear distinction between governance and management
Governance and management◦ Encompass different types of activities◦ Require different organizational structures◦ Serve different purposes
COBIT 5: Enabling Processes differentiates the activities associated with each
28
Principle 5:Separating Governance from Management
Governance ensures that stakeholder needs, conditions and options are:◦ Evaluated to determine balanced, agreed-on enterprise objectives to be achieved ◦ Setting direction through prioritization and decision making◦ Monitoring performance, compliance and progress against agreed direction and objectives
(EDM)
Management plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives (PBRM)
29
COBIT 5 Processes
30
Concept Based on PLAN-DO-CHECK-ACT
Integrated 5 sets of processes that which covers Governance and management of Enterprise IT:1. Evaluate, Plan and Monitor2. Align, Plan and Organize 3. Build, Acquire and Implement4. Deliver, Service and Support5. Monitor, Evaluate and Assess
31
COBIT 5 Process Reference Model
© 2012 ISACA. All Rights Reserved.
S O U RC E : C O B IT 5 , I S AC A
32
The COBIT 5 Enterprise Enablers
S O U RC E : C O B IT 5 , I S AC A
33
Recap Principle 4:Enabling a Holistic Approach
COBIT 5 enabler dimensions:
34
Enabler 1 Principles, Policies & Frameworks…1 The purpose: to convey the governing body’s and management’s
direction and instructions.
They are instruments to communicate the rules of the enterprise, in support of the governance objectives and enterprise.
o Differences between principles and policies – o Principles need to be limited in numbero Put in simple language, expressing as clearly as possible the core values of the enterpriseo Policies are more detailed guidance on how to put principles into practice
35
Enabler 1 Principles, Policies & Frameworks…2 The characteristics of good policies; they should
o Be effective – achieve their purposeo Be efficient – especially when implementing themo Non-intrusive – Should make sense and be logical to those who have to comply with them.
Policies should have a mechanism (framework) in place where they can be effectively managed and users know where to go. Specifically they should be:
o Comprehensive, covering all required areaso Open and flexible allowing for easy adaptation and change.o Current and up to date
The purpose of a policy life cycle is that it must support a policy framework in order to achieve defined goals.
36
Enabler 2: Processes
COBIT 5 Enablers: Processes complements COBIT 5 and contains a detailed reference guide to the processes that are defined in the COBIT 5 process reference model:
◦ The COBIT 5 goals cascade is recapitulated and complemented with a set of example metrics for the enterprise goals and the IT-related goals. An example is given in the appendix
◦ The COBIT 5 process model is explained and its components defined.◦ The Enabler process guide which is referenced in this module contains the
detailed process information for all 37 COBIT 5 processes shown in the process reference model.
37
Enabler 2 – Process continued – PRM Structure…2 Each process is divided into :
o Process Descriptiono Process Purpose statemento IT-related Goals (from the Goals cascade see example in the Appendix)o Each IT-related goal is associated with a set of generic related metricso Process Goals (Also from the Goals cascade mechanism and is referred to as Enabler Goals.o Each Process Goal is associated or related with a set of generic metrics.o Each Process contains a set of Management Practices o These are associated with a generic RACI chart (Responsible, Accountable, Consulted, Informed)o Each management practices contains a set of inputs and outputs (called work products in
module PC) o Each management Practice is associated with a set of activities
38
Enabler 3 Organisational Structures
A number of Good Practices of organisational structure can be distinguished such as:
o Operating principles – The practical arrangements regarding how the structure will operate, such as meeting frequency documentation and other rules
o Span of control – The boundaries of the organisation structure’s decision rights.o Level of authority – The decisions that the structure is authorised to take.o Delegation of responsibility – The structure can delegate a subset of its decision rights to
other structures reporting to it.o Escalation procedures – The escalation path for a structure describes the required actions in
case of problems in making decisions.
39
Enabler 4 Culture, Ethics and Behaviour Good practices for creating, encouraging and maintaining desired
behaviour throughout the enterprise include:o Communication throughout the enterprise of desired behaviours and
corporate values. o Awareness of desired behaviour, strengthened by senior management
example. o senior management and the executives ‘walk the talk’ so to speak. o Incentives to encourage and deterrents to enforce desired behaviour. o Rules and norms which provide more guidance and will typically be found in
a Code of Ethics
40
Enabler 5 Information Importance of the Information Quality categories and dimensions;o The concept of information criteria was introduced in COBIT 3rd edition in 2000 and played a
key role in COBIT 4.1; these were very important to be able show how to meet business requirements.
Importance of Information Criteriao COBIT 4.1 introduced us to the concept of 7 Key Information criteria to meet Business
requirements. This concept has been retained but translated differently in Figure 9 below: Figure 26 Appendix F.
41
Enabler 6 –Services, Infrastructure and Applications The five architecture principles that govern the implementation and
use of IT-Related resourceso Architecture Principles are overall guidelines that govern the implementation and use of IT-related
resources within the enterprise. Examples of such principles:o Reuse – Common components of the architecture should be used when designing and
implementing solutions as part of the target or transition architectures.o Buy vs. build – Solutions should be purchased unless there is an approved rationale for developing
them internally.o Simplicity – The enterprise architecture should be designed and maintained to be simple as
possible while still meeting enterprise requirements.o Agility – The enterprise architecture should incorporate agility to meet changing business needs in
an effective and efficient manner.o Openness - The enterprise architecture should leverage open industry standards.
42
Enabler 6 –Services, Infrastructure and Applications Cont. Relationship To other Enablerso Information – is a service capability that is leveraged through processes to deliver internal and
external services.o Cultural and behavioural aspects – relevant when a service-oriented culture needs to be builto Process inputs and outputs – Most of the inputs and outputs (work products) of the process
management practices and activities in the PRM include service capabilities.
Consider other frameworks such as:o ITIL 3o TOGAF (www.opengroup.org/togaf ) which provides an integrated information infrastructure
reference model.
43
Enabler 7 – People, Skills and Competencies Identify the good practices of people, Skills and Competencies,
specifically:o Described by different skill levels for different roles.o Defining Skill requirements for each roleoMapping skill categories to COBIT 5 process domains (APO; BAI etc.)o These correspond to the IT-related activities undertaken, e.g. business
analysis, information management etc.o Using external sources for good practices such as:
The Skills Framework for the information age (SFIA)
44
Process Assessment
45
What is a Process Assessment Process assessment: an activity that can be performed either as part
of a process improvement initiative or as part of a capability determination approach
Purpose: to continually improve the enterprise’s effectiveness and efficiency
It provides an understandable, logical, repeatable, reliable and robust methodology for assessing the capability of IT processes.
COBIT 5 switched to ISO 15504 Approach rather than CMMI.
Source: ISO/IEC 15504-4
46
Advantages of the ISO 15504 Approach A robust assessment process based on ISO 15504
An alignment of COBIT’s maturity model scale with the international standard
A new capability-based assessment model which includes:o Specific process requirements derived from COBIT 4.1& COBIT 5o Ability to achieve process attributes based on ISO 15504o Evidence requirements
Assessor qualifications and experiential requirements
Results in a more robust, objective and repeatable assessment
47
Key ISO 15504 definitions ISO 15504 defines the following key terms:
◦ Process purpose – The high-level measurable objectives of performing the process and the likely outcomes of effective implementation of the process.
◦ Process outcomes - An observable result of a process (Note: An outcome is an artefact, a significant change of state or the meeting of specified constraints.)
◦ Base practices – The activities that, when consistently performed, contribute to achieving the process purpose
◦ Work product - An artefact associated with the execution of a process – defined in terms of process ‘inputs’ and process ‘outputs’.
48
Differences between the Capability & Process Dimension ISO 15504 defines two levels:o A Capability Dimension which focuses on the process capability dimension
(levels 1 to 5) based on process attribute indicators (PAI) that are solely deals with Generic attributes
o A Process dimension that contains additional indicators for process for process performance assessment based on very specific performance indicators.
o ** Note that the PRM or process reference model is used only for this dimension at LEVEL 1. Levels 2 to 5 focuses only on the Capability dimension based on generic attributes. The next slide demonstrates this concept.
49
Process capability levels
Level 0 Incomplete process
IncompleteThe process is not implemented or fails to achieve its purpose
Level 1 Performed processPA.1.1 Process Performance attribute
PerformedThe process is implemented and achieves its process purpose
Level 2 Managed ProcessPA.2.1 Performance Management attributePA.2.2 Work Product Management attribute
ManagedThe process is managed i.e. (planned, monitored and adjusted) work products are appropriately established, controlled & maintained.
Level 4 Predictable ProcessPA.4.1 Process Measurement attributePA.4.2 Process Control attribute
PredictableThe process is enacted consistently within defined limits
Level 5 Optimizing processPA.5.1 Process Innovation attributePA.5.2 Process Optimization attribute
OptimizingThe process is continuously improved to meet relevant current and projected business goals
Level 3 Established ProcessPA.3.1 Process Definition attributePA.3.2 Process Deployment attribute
EstablishedA defined process is used based on a standard process.
49
50
Assessment Process Activities
50
1 – Initiation
2 – Planning the Assessment
3 – Briefing
4 – Data Collection
5 – Data Validation
6 – Process Rating
7 – Reporting
51
Implementation
52
COBIT 5 Implementation
S O U RC E : C O B IT 5 , I S AC A
53
Thank you
For Further Questions, Please Communicate With
Aqel:aqel.aqel@gmail.com
+966-502-104-007
For Arabic lectures about IT Governance - تقنية حوكمة حول محاضرات الى استمعالمعلومات
https://www.youtube.com/watch?v=itKgLtT4Les
Recommended