COBIT 5 Online Collaborative Environment - Glenfis · PDF fileCOBIT 5 Product Family Source: COBIT 5, figure 11 COBIT® 5 COBIT 5 Online Collaborative Environment COBIT 5 Enabler Guides

COBIT 5 Product Family

Source: COBIT 5, figure 11

COBIT® 5

COBIT 5 Online Collaborative Environment

COBIT 5 Enabler Guides

COBIT 5 Professional Guides

COBIT® 5 Implementation

COBIT® 5:Enabling Information

COBIT® 5:Enabling Processes

Other EnablerGuides

COBIT® 5for Assurance

COBIT® 5for Information

Security

COBIT® 5for Risk

Other ProfessionalGuides

COBIT 5 Principles


1. MeetingStakeholder

Needs

5. SeparatingGovernance

FromManagement

4. Enabling aHolistic

Approach

3. Applying aSingle

IntegratedFramework

2. Covering theEnterpriseEnd-to-end

COBIT 5Principles

3701 Algonquin Road, Suite 1010 • Rolling Meadows, IL 60008 USA

Phone: +1.847.253.1545 • Fax: +1.847.253.1443 • Email: [email protected]

Web site: www.isaca.org

© 2 0 1 2 I S A C A . A l l r I g h t S r e S e r v e d . F o r u S A g e g u I d e l I n e S , S e e w w w . i s a c a . o r g / c o B i T u s e .

Governance and Management in COBIT 5


Key Roles, Activities and Relationships


Roles, Activities and Relationships

Owners andStakeholders

GoverningBody Management

Operationsand

Execution

Instruct andAlign

Report

Set Direction

Monitor

Delegate

Accountable

BenefitsRealisation

GovernanceEnablers

Roles, Activities and Relationships

GovernanceScope

ResourceOptimisation

RiskOptimisation

Governance Objective: Value Creation

COBIT 5 Governance and Management Key Areas


Governance

Management

Evaluate

Direct Monitor

Plan(APO)

Build(BAI)

Run(DSS)

Monitor(MEA)

Management Feedback

Business Needs


The Seven Phases of the Implementation Life Cycle

Source: COBIT 5, figure 17 and COBIT 5 Implementation, figure 6

7 H

ow do

we keep

the momentum going?

6 Di

d we

get

ther

e?

5 How do we get there?

4 What needs to be done?

3 Where

do w

e wan

t to

be?

2 Where are we now?

1 What are the drivers?

• Programme management (outer ring)

• Change enablement (middle ring)

• Continual improvement life cycle (inner ring)

Initiate programme

Define problems and

opportunities

Define r

oad

map

Plan programme

Execute plan

Real

ise

bene

fits

Review

effectiveness

Operate

Identify roleCommun

icat

e

team

to change

and use

players

outcom

e

Form im

plementation

Establish desire

Embe

d ne

w

Sustain

appr

oach

es

Implem

ent

improvements

state

Assess

RecogniseMonitor

Oper

ate

improvements Build

target

current

need toand

and

Defin

e

state

acteva

luate

mea

sure

Summary of the COBIT 5 Process Capability Model


Generic Process Capability Attributes

COBIT 5 Process AssessmentModel–Capability Indicators

COBIT 5 Process AssessmentModel—Performance Indicators

Base Practices(Management/

GovernancePractices)

Process Outcomes

WorkProducts(Inputs/Outputs)

Generic Practices Generic Resources Generic Work Products

IncompleteProcess

PerformedProcess

ManagedProcess

EstablishedProcess

PredictableProcess

OptimisingProcess

PerformanceAttribute (PA) 1.1

ProcessPerformance

PA 2.1PerformanceManagement

PA 2.2Work

ProductManagement

PA 3.1Process

Definition

PA 3.2Process

Deployment

PA 4.1Process

Management

PA 4.2ProcessControl

PA 5.1Process

Innovation

PA 5.2Process

Optimisation

0 1 2 3 4 5


COBIT 5 Enterprise Enablers


2. Processes3. Organisational

Structures

1. Principles, Policies and Frameworks

6. Services,Infrastructure

and Applications

7. People,Skills and

Competencies

Resources

5. Information

4. Culture, Ethicsand Behaviour

COBIT 5 Enablers: Generic


Enab

ler D

imen

sion Stakeholders Goals Life Cycle Good Practices

• Internal Stakeholders• External Stakeholders

• Practices• Work Products (Inputs/Outputs)

• Intrinsic Quality• Contextual Quality (Relevance, Effectiveness)• Accessibility and Security

• Plan• Design• Build/Acquire/ Create/Implement• Use/Operate• Evaluate/Monitor• Update/Dispose

Enab

ler P

erfo

rman

ceM

anag

emen

t Are StakeholdersNeeds Addressed?

Are EnablerGoals Achieved?

Metrics for Achievement of Goals(Lag Indicators)

Metrics for Application of Practice(Lead Indicators)

Is Life CycleManaged?

Are Good PracticesApplied?


COBIT 5 Goals Cascade Overview


BenefitsRealisation

Stakeholder Drivers(Environment, Technology Evolution, …)

Enterprise Goals

IT-related Goals

Enabler Goals

Influence

Cascade to

Cascade to

Appendix B

Appendix C

Figure 5

Figure 6

ResourceOptimisation

RiskOptimisation

Stakeholder Needs

Cascade to Appendix D


Figure 7—Governance and Management Questions on IT Internal Stakeholders Internal Stakeholder Questions

Board Chief Executive Officer (CEO) Chief financial Officer (CFO) Chier Information Officer (CIO) Chief Risk Officer (CRO) Business Executives Business process owners Business Managers Risk Managers Security Managers Service Managers Human Resource (HR)

Managers Internal audit Privacy officers IT Users IT Managers etc.

How do I get value from the use of IT? Are end users satisfied with the quality of the IT Service? How do I manage performance of IT? How can I best exploit new technology for new strategic opportunities? How do I best build and structure my IT department? How dependent am I on external providers? How well are IT outsourcing agreements being managed? How do I obtain assurance of external providers? What are the (control) requirements of information? Did I address all IT-related risks? Am I running an efficient and resilient IT operation? How do I control the cost of IT? How do I use IT resources in the most effective and efficient manner? What are the most effective and efficient sourcing options? Do I have enough people for IT? How do I develop and maintain their skills, and how do I manage their performance? How do I get assurance over IT? Is the information I am processing well secured? How do I improve business agility through a more flexible IT environment? Do IT projects fail to deliver what they promised – and if so, why? Is IT standing in the way of executing the business

strategy? How critical is IT to sustaining the enterprise? What do I do if IT is not available? What critical business processes are dependent on IT, and what are the requirements of business processes? What has been the average overrun on the IT operational budget? How often and how much do IT projects go over

budget? How much of the IT effort goes to fighting fires than to enabling business improvements? Are sufficient IT resources and infrastructure available to meet required enterprise strategic objectives? How long does it takes to make major IT decisions? Are the total IT effort and investments transparent? Does IT support the enterprise in complying with regulators and service levels? How do I know whether I am compliant with

all the applicable regulations?

External Stakeholders External Stakeholder Questions

Business Partners Suppliers Shareholders Regulators/government External users Customers Standardisation organisations External auditors Consultans etc.

How do I know my business partner’s operations are secure and reliable? How do I know the enterprise is compliant with applicable rules and regulations? How do I know the enterprise is maintaining an effective system of internal control? Do business partners have the information chain between them under control?

maan

Typewritten Text

Stakeholder Needs Internal and external Stakeholder Questions

APPENDIX D STAKEHOLDER NEEDS AND ENTERPRISE GOALS

55

APPENDIX DSTAKEHOLDER NEEDS AND ENTERPRISE GOALS

Chapter 4 showed the individual steps of the goals cascade, starting from stakeholder needs down to enabler goals. Chapter 2 included a table with typical governance and management questions on IT. From a stakeholder point of view it is interesting to know how these questions relate to the enterprise goals. For that reason, figure 24 is included; it shows how a list of internal stakeholder needs can be linked to the enterprise goals.

This table can be used to help setting and prioritising specific enterprise goals or IT-related goals, based on specific stakeholder needs. The same precautions should be used when using these tables as with the other goals cascade tables, i.e., every enterprise’s individual situation differs, and these tables should not be used in a mechanical way, but only as a suggested generic set of relationships. In figure 24, the intersection of a stakeholder need and enterprise goal is filled in if that need should be considered for that goal.

Figure 24—Mapping COBIT 5 Enterprise Goals to Governance and Management Questions

STAKEHOLDER NEEDS

Stak

ehol

der v

alue

of b

usin

ess

inve

stm

ents

Portf

olio

of c

ompe

titiv

e pr

oduc

ts

and

serv

ices

Man

aged

bus

ines

s ris

k (s

afeg

uard

ing

of a

sset

s)

Com

plia

nce

with

ext

erna

l law

s an

d re

gula

tions

Fina

ncia

l tra

nspa

renc

y

Cust

omer

-orie

nted

ser

vice

cu

lture

Busi

ness

ser

vice

con

tinui

ty a

nd

avai

labi

lity

Agile

resp

onse

s to

a c

hang

ing

busi

ness

env

ironm

ent

Info

rmat

ion-

base

d st

rate

gic

deci

sion

mak

ing

Optim

isat

ion

of s

ervi

ce d

eliv

ery

cost

s

Optim

isat

ion

of b

usin

ess

proc

ess

func

tiona

lity

Optim

isat

ion

of b

usin

ess

proc

ess

cost

s

Man

aged

bus

ines

s ch

ange

pr

ogra

mm

es

Oper

atio

nal a

nd s

taff

prod

uctiv

ity

Com

plia

nce

with

inte

rnal

pol

icie

s

Skill

ed a

nd m

otiv

ated

peo

ple

Prod

uct a

nd b

usin

ess

inno

vatio

n cu

lture

1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17.

with the quality of the IT

technology for new strategic

are IT outsourcing agreements

obtain assurance over external

What are the (control)

Am I running an efficient and

the most effective and efficient

effective and efficient sourcing

their skills, and how do I

56

Figure 24—Mapping COBIT 5 Enterprise Goals to Governance and Management Questions (cont.)

STAKEHOLDER NEEDS

Stak

ehol

der v

alue

of b

usin

ess

inve

stm

ents

Portf

olio

of c

ompe

titiv

e pr

oduc

ts

and

serv

ices

Man

aged

bus

ines

s ris

k (s

afeg

uard

ing

of a

sset

s)

Com

plia

nce

with

ext

erna

l law

s an

d re

gula

tions

Fina

ncia

l tra

nspa

renc

y

Cust

omer

-orie

nted

ser

vice

cu

lture

Busi

ness

ser

vice

con

tinui

ty a

nd

avai

labi

lity

Agile

resp

onse

s to

a c

hang

ing

busi

ness

env

ironm

ent

Info

rmat

ion-

base

d st

rate

gic

deci

sion

mak

ing

Optim

isat

ion

of s

ervi

ce d

eliv

ery

cost

s

Optim

isat

ion

of b

usin

ess

proc

ess

func

tiona

lity

Optim

isat

ion

of b

usin

ess

proc

ess

cost

s

Man

aged

bus

ines

s ch

ange

pr

ogra

mm

es

Oper

atio

nal a

nd s

taff

prod

uctiv

ity

Com

plia

nce

with

inte

rnal

pol

icie

s

Skill

ed a

nd m

otiv

ated

peo

ple

Prod

uct a

nd b

usin

ess

inno

vatio

n cu

lture

1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17.

Is the information I am

agility through a more flexible IT

Do IT projects fail to deliver

way of executing the business

What concrete vital primary business processes are dependent on IT, and what are the requirements of business

What has been the average overrun of the IT operational

much do IT projects go over

goes to fighting fires rather than to enabling business

Are sufficient IT resources and infrastructure available to meet required enterprise strategic

Are the total IT effort and

Does IT support the enterprise in complying with regulations

know whether I am compliant

maan

Typewritten Text

Appendix D (cont) Mapping Stakeholder Needs and Enterprise Goals

maan

Typewritten Text

CHAPTER 2

P RINCIPLE 1: M EETING STAKEHOLDER NEEDS

19

Figure 5—COBIT 5 Enterprise Goals

BSC Dimension Enterprise Goal

Relation to Governance Objectives

Benefits Realisation

Risk Optimisation

Resource Optimisation

Financial 1. Stakeholder value of business investments P S

2. Portfolio of competitive products and services P P S

3. Managed business risk (safeguarding of assets) P S

4. Compliance with external laws and regulations P

5. Financial transparency P S S

Customer 6. Customer-oriented service culture P S

7. Business service continuity and availability P

8. Agile responses to a changing business environment P S

9. Information-based strategic decision making P P P

10. Optimisation of service delivery costs P P

Internal 11. Optimisation of business process functionality P P

12. Optimisation of business process costs P P

13. Managed business change programmes P P S

14. Operational and staff productivity P P

15. Compliance with internal policies P

Learning and Growth 16. Skilled and motivated people S P P

17. Product and business innovation culture P

Figure 6—IT-related Goals

IT BSC Dimension Information and Related Technology Goal

Financial 01 Alignment of IT and business strategy

02 IT compliance and support for business compliance with external laws and regulations

03 Commitment of executive management for making IT-related decisions

04 Managed IT-related business risk

05 Realised benefits from IT-enabled investments and services portfolio

06 Transparency of IT costs, benefits and risk

Customer 07 Delivery of IT services in line with business requirements

08 Adequate use of applications, information and technology solutions

Internal 09 IT agility

10 Security of information, processing infrastructure and applications

11 Optimisation of IT assets, resources and capabilities

12 Enablement and support of business processes by integrating applications and technology into business processes

13 Delivery of programmes delivering benefits, on time, on budget, and meeting requirements and quality standards

14 Availability of reliable and useful information for decision making

15 IT compliance with internal policies

Learning and Growth 16 Competent and motivated business and IT personnel

17 Knowledge, expertise and initiatives for business innovation

maan

Typewritten Text

Enterprise Goals Balanced Scorecard BSC IT-related Balanced Scorecard IT-BSC

maan

Typewritten Text

maan

Typewritten Text

50

When using the table in figure 22, please consider the remarks made in chapter 2 on how to use the COBIT 5 goals cascade.

Figure 22—Mapping COBIT 5 Enterprise Goals to IT-related Goals

Enterprise Goal

Stak

ehol

der v

alue

of b

usin

ess

inve

stm

ents

Portf

olio

of c

ompe

titiv

e pr

oduc

ts a

nd s

ervi

ces

Man

aged

bus

ines

s ris

k (s

afeg

uard

ing

of a

sset

s)

Com

plia

nce

with

ext

erna

l law

s an

d re

gula

tions

Fina

ncia

l tra

nspa

renc

y

Cust

omer

-orie

nted

ser

vice

cul

ture

Busi

ness

ser

vice

con

tinui

ty a

nd a

vaila

bilit

y

Agile

resp

onse

s to

a c

hang

ing

busi

ness

env

ironm

ent

Info

rmat

ion-

base

d st

rate

gic

deci

sion

mak

ing

Optim

isat

ion

of s

ervi

ce d

eliv

ery

cost

s

Optim

isat

ion

of b

usin

ess

proc

ess

func

tiona

lity

Optim

isat

ion

of b

usin

ess

proc

ess

cost

s

Man

aged

bus

ines

s ch

ange

pro

gram

mes

Oper

atio

nal a

nd s

taff

prod

uctiv

ity

Com

plia

nce

with

inte

rnal

pol

icie

s

Skill

ed a

nd m

otiv

ated

peo

ple

Prod

uct a

nd b

usin

ess

inno

vatio

n cu

lture

1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17.

IT-related Goal Financial Customer Internal

Learning and

Growth

Fina

ncia

l

01 Alignment of IT and business strategy P P S P S P P S P S P S S

02 IT compliance and support for business compliance with external laws and regulations

S P P

03 Commitment of executive management for making IT-related decisions P S S S S S P S S

04 Managed IT-related business risk P S P S P S S S

05 Realised benefits from IT-enabled investments and services portfolio P P S S S S P S S

06 Transparency of IT costs, benefits and risk S S P S P P

Cust

omer

07 Delivery of IT services in line with business requirements P P S S P S P S P S S S S

08 Adequate use of applications, information and technology solutions S S S S S S S P S P S S

Inte

rnal

09 IT agility S P S S P P S S S P

10 Security of information, processing infrastructure and applications P P P P

11 Optimisation of IT assets, resources and capabilities P S S P S P S S S

12 Enablement and support of business processes by integrating applications and technology into business processes

S P S S S S P S S S S

13 Delivery of programmes delivering benefits, on time, on budget, and meeting requirements and quality standards

P S S S S S P S

14 Availability of reliable and useful information for decision making S S S S P P S

15 IT compliance with internal policies S S P

Lear

ning

an

d Gr

owth

16 Competent and motivated business and IT personnel S S P S S P P S

17 Knowledge, expertise and initiatives for business innovation S P S P S S S S P

maan

Typewritten Text

Appendix B Mapping COBIT 5 Enterprise Goals to IT-related Goals

maan

Typewritten Text

52

When using the table in figure 23, please consider the remarks made in chapter 2 on how to use the COBIT 5 goals cascade.

Figure 23—Mapping COBIT 5 IT-related Goals to Processes

IT-related Goal

Alig

nmen

t of I

T an

d bu

sine

ss s

trate

gy

IT c

ompl

ianc

e an

d su

ppor

t for

bus

ines

s co

mpl

ianc

e w

ith

exte

rnal

law

s an

d re

gula

tions

Com

mitm

ent o

f exe

cutiv

e m

anag

emen

t for

mak

ing

IT-r

elat

ed d

ecis

ions

Man

aged

IT-r

elat

ed b

usin

ess

risk

Real

ised

ben

efits

from

IT-e

nabl

ed in

vest

men

ts a

nd

serv

ices

por

tfolio

Tran

spar

ency

of I

T co

sts,

ben

efits

and

risk

Deliv

ery

of IT

ser

vice

s in

line

with

bus

ines

s re

quire

men

ts

Adeq

uate

use

of a

pplic

atio

ns, i

nfor

mat

ion

and

tech

nolo

gy

solu

tions

IT a

gilit

y

Secu

rity

of in

form

atio

n, p

roce

ssin

g in

frast

ruct

ure

and

appl

icat

ions

Optim

isat

ion

of IT

ass

ets,

reso

urce

s an

d ca

pabi

litie

s

Enab

lem

ent a

nd s

uppo

rt of

bus

ines

s pr

oces

ses

by

inte

grat

ing

appl

icat

ions

and

tech

nolo

gy in

to

busi

ness

pro

cess

es

Deliv

ery

of p

rogr

amm

es d

eliv

erin

g be

nefit

s, o

n tim

e, o

n bu

dget

, and

mee

ting

requ

irem

ents

and

qua

lity

stan

dard

s

Avai

labi

lity

of re

liabl

e an

d us

eful

info

rmat

ion

for d

ecis

ion

mak

ing

IT c

ompl

ianc

e w

ith in

tern

al p

olic

ies

Com

pete

nt a

nd m

otiv

ated

bus

ines

s an

d IT

per

sonn

el

Know

ledg

e, e

xper

tise

and

initi

ativ

es fo

r bus

ines

s in

nova

tion

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17

COBIT 5 Process Financial Customer Internal

Learning and

Growth

Eval

uate

, Dire

ct a

nd M

onito

r EDM01 Ensure Governance Framework Setting and Maintenance

P S P S S S P S S S S S S S S S

EDM02 Ensure Benefits Delivery P S P P P S S S S S S P

EDM03 Ensure Risk Optimisation S S S P P S S P S S P S S

EDM04 Ensure Resource Optimisation S S S S S S S P P S P S

EDM05 Ensure Stakeholder Transparency S S P P P S S S S

Alig

n, P

lan

and

Orga

nise

APO01 Manage the IT Management Framework P P S S S P S P S S S P P P

APO02 Manage Strategy P S S S P S S S S S S S S P

APO03 Manage Enterprise Architecture P S S S S S S P S P S S S

APO04 Manage Innovation S S P P P P S S P

APO05 Manage Portfolio P S S P S S S S S P S

APO06 Manage Budget and Costs S S S P P S S S S

APO07 P S S S S S S P P S P P

APO08 Manage Relationships P S S S S P S S P S S S P

APO09 Manage Service Agreements S S S S P S S S S S P S

APO10 Manage Suppliers S P S S P S P S S S S S S

APO11 Manage Quality S S S P P S S S P S S S S

APO12 Manage Risk P P P S S S P P S S S S

APO13 Manage Security P P P S S P P

maan

Typewritten Text

Appendix C Detailed Mapping IT-related Goals - IT-related Processes

APPENDIX C DETAILED MAPPING IT-RELATED GOALS—IT-RELATED PROCESSES

53

Figure 23—Mapping COBIT 5 IT-related Goals to Processes (cont.)

IT-related Goal

Alig

nmen

t of I

T an

d bu

sine

ss s

trate

gy

IT c

ompl

ianc

e an

d su

ppor

t for

bus

ines

s co

mpl

ianc

e w

ith

exte

rnal

law

s an

d re

gula

tions

Com

mitm

ent o

f exe

cutiv

e m

anag

emen

t for

mak

ing

IT-

rela

ted

deci

sion

s

Man

aged

IT-r

elat

ed b

usin

ess

risk

Real

ised

ben

efits

from

IT-e

nabl

ed in

vest

men

ts a

nd

serv

ices

por

tfolio

Tran

spar

ency

of I

T co

sts,

ben

efits

and

risk

Deliv

ery

of IT

ser

vice

s in

line

with

bus

ines

s re

quire

men

ts

Adeq

uate

use

of a

pplic

atio

ns, i

nfor

mat

ion

and

tech

nolo

gy

solu

tions

IT a

gilit

y

Secu

rity

of in

form

atio

n, p

roce

ssin

g in

frast

ruct

ure

and

appl

icat

ions

Optim

isat

ion

of IT

ass

ets,

reso

urce

s an

d ca

pabi

litie

s

Enab

lem

ent a

nd s

uppo

rt of

bus

ines

s pr

oces

ses

by

inte

grat

ing

appl

icat

ions

and

tech

nolo

gy in

to

busi

ness

pro

cess

es

Deliv

ery

of p

rogr

amm

es d

eliv

erin

g be

nefit

s, o

n tim

e, o

n bu

dget

, and

mee

ting

requ

irem

ents

and

qua

lity

stan

dard

s

Avai

labi

lity

of re

liabl

e an

d us

eful

info

rmat

ion

for d

ecis

ion

mak

ing

IT c

ompl

ianc

e w

ith in

tern

al p

olic

ies

Com

pete

nt a

nd m

otiv

ated

bus

ines

s an

d IT

per

sonn

el

Know

ledg

e, e

xper

tise

and

initi

ativ

es fo

r bus

ines

s in

nova

tion

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17

COBIT 5 Process Financial Customer Internal

Learning and

Growth

Build

, Acq

uire

and

Impl

emen

t

BAI01 Manage Programmes and Projects P S P P S S S S P S S

BAI02 Manage Requirements Definition P S S S S P S S S S P S S S

BAI03 Manage Solutions Identification and Build S S S P S S S S S S

BAI04 Manage Availability and Capacity S S P S S P S P S

BAI05 Manage Organisational Change Enablement S S S S P S S S P S P

BAI06 Manage Changes S P S P S S P S S S S S S

BAI07 Manage Change Acceptance and Transitioning S S S P S P S S S S

BAI08 Manage Knowledge S S S S P S S S S P

BAI09 Manage Assets S S P S S S P S S

BAI10 Manage Configuration P S S S S S P P S

Deliv

er, S

ervi

ce a

nd S

uppo

rt DSS01 Manage Operations S P S P S S S P S S S S

DSS02 Manage Service Requests and Incidents P P S S S S S

DSS03 Manage Problems S P S P S S P S P S S

DSS04 Manage Continuity S S P S P S S S S S P S S S

DSS05 Manage Security Services S P P S S P S S S S

DSS06 Manage Business Process Controls S P P S S S S S S S S

Mon

itor,

Eval

uate

and

Ass

ess MEA01 Monitor, Evaluate and

Assess Performance and Conformance

S S S P S S P S S S P S S P S S

MEA02 Monitor, Evaluate and Assess the System of Internal Control

P P S S S S S P S

MEA03 Monitor, Evaluate and Assess Compliance With External Requirements

P P S S S S S

© 2012 ISACA ‐ Glenfis AG

Domain ID CO5 Processes Governance / Management PracticeEDM01.01 Evaluate the governance system.EDM01.02 Direct the governance system.EDM01.03 Monitor the governance system.EDM02.01 Evaluate value optimisation.EDM02.02 Direct value optimisation.EDM02.03 Monitor value optimisation.EDM03.01 Evaluate risk management.EDM03.02 Direct risk management.EDM03.03 Monitor risk management.EDM04.01 Evaluate resource management.EDM04.02 Direct resource management.EDM04.03 Monitor resource management.EDM05.01 Evaluate stakeholder reporting requirements.EDM05.02 Direct stakeholder communication and reporting.EDM05.03 Monitor stakeholder communication.APO01.01 Define the organisational structure.APO01.02 Establish roles and responsibilities.APO01.03 Maintain the enablers of the management system.APO01.04 Communicate management objectives and direction.APO01.05 Optimise the placement of the IT function.APO01.06 Define information (data) and system ownership.APO01.07 Manage continual improvement of processes.APO01.08 Maintain compliance with policies and procedures.APO02.01 Understand enterprise direction.APO02.02 Assess the current environment, capabilities and performance.APO02.03 Define the target IT capabilities.APO02.04 Conduct a gap analysis.APO02.05 Define the strategic plan and road map.APO02.06 Communicate the IT strategy and direction.APO03.01 Develop the enterprise architecture vision.APO03.02 Define reference architecture.APO03.03 Select opportunties and solutions.APO03.04 Define architecture implementation.APO03.05 Provide enterprise architecture services.APO04.01 Create an environment conducive to innovation.APO04.02 Maintain an understanding of the enterprise environment.APO04.03 Monitor and scan the technology environment.APO04.04 Assess the potential of emerging technologies and innovation ideas.APO04.05 Recommend appropriate further initiatives.APO04.06 Monitor the implementation and use of innovation.APO05.01 Establish the target investment mix.APO05.02 Determien the availability and sources of funds.APO05.03 Evaluate and select programmes to fund.APO05.04 Monitor, optimise and report on investment portfolio performance.APO05.05 Maintain portfolios.APO05.06 Manage benefits achievement.APO06.01 Manage finance and accounting.APO06.02 Prioritise resource allocation.APO06.03 Create and maintain budgets.APO06.04 Model and allocate costs.APO06.05 Manage costs.APO07.01 Maintain adequate and appropriate staffing.APO07.02 Identify key IT personnel.APO07.03 Maintain the skills and competencies of personnel.APO07.04 Evaluate employee job performance.APO07.05 Plan and track the usage of IT and business human resources.APO07.06 Manage contract staff.APO08.01 Understand business exepctations.APO08.02 Identify opportunities, risk and constraints for IT to enhance the business.APO08.03 Manage the business relationship.APO08.04 Co-ordinate and communicate.APO08.05 Provide input to the continual improvement of services.APO09.01 Identify IT services.APO09.02 Catalogue IT-enabled services.APO09.03 Define and prepare service agreements.APO09.04 Monitor and report service levels.APO09.05 Review service agreements and contracts.APO10.01 Identify and evaluate supplier relationships and contracts.APO10.02 Select suppliers.APO10.03 Manage supplier relationships and contracts.APO10.04 Manage supplier risk.APO10.05 Monitor supplier performance and compliance.APO11.01 Establish a quality management system (QMS).APO11.02 Define and manage quality standards, practices and procedures.APO11.03 Focus quality management on customers.APO11.04 Perform quality monitoring, control and reviews.APO11.05 Integrate quality management into solutions for development and service delivery.APO11.06 Maintain continuous improvement.APO12.01 Collect data.APO12.02 Analyse risk.APO12.03 Maintain a risk profile.APO12.04 Articulate risk.APO12.05 Define a risk management action portfolio.APO12.06 Respond to risk.APO13.01 Establish and maintain an ISMS.APO13.02 Define and manage an information security risk treatment plan.APO13.03 Monitor and review the ISMS.BAI01.01 Maintain a standard approach for programme and project management.BAI01.02 Initiate a programme.BAI01.03 Manage stakeholder engagement.BAI01.04 Develop and maintain the programme plan.BAI01.05 Launch and execute the programme.BAI01.06 Monitor, control and report on the programme outcomes.BAI01.07 Start up and initiate projects within a programme.BAI01.08 Plan projects.BAI01.09 Manage programme and project quality.BAI01.10 Manage programme and project risk.BAI01.11 Monitor and control projects.BAI01.12 Manage project resources and work packages.BAI01.13 Close a project or iteration.BAI01.14 Close a programme.BAI02.01 Define and maintain business functional and technical requirements.BAI02.02 Perform a feasibility study and formulate alternative solutions.BAI02.03 Manage requirements risk.BAI02.04 Obtain approval of requirements and solutions.BAI03.01 Design high-level solutions.BAI03.02 Design detailed solution components.BAI03.03 Develop solution components.BAI03.04 Procure solution components.BAI03.05 Build solutions.BAI03.06 Perform quality assurance.BAI03.07 Prepare for solution testing.BAI03.08 Execute solution testing.BAI03.09 Manage changes to requirements.BAI03.10 Maintain solutions.BAI03.11 Define IT services and maintain the service portfolio.BAI04.01 Assess current availability, performance and capacity and create a baseline.

Manage Programmes and Projects

Manage Requirements Definition

Manage SolutionsIdentification and Build

BAI02

BAI03

Manage Relationships

Manage Service Agreements

Manage Suppliers

Manage Quality

Manage Risk

Manage Security

APO11

APO12

APO13

Manage the IT Management Framework

Manage Strategy

Manage Enterprise Architecture

Manage Innovation

Manage Portfolio

Manage Budget and Costs

Manage Human Resources

APO05

APO06

APO07

APO08

APO09

APO10

Man

agem

ent

Ensure Risk Optimisation

Ensure Resource Optimisation

Ensure Stakeholder Transparency

Alig

n, P

lan

and

Org

anis

em

ent

APO01

APO02

APO03

APO04

BAI01

Activities associated with each of the governance and management practices in COBIT 5.G

over

nanc

e

Eval

uate

, Dire

ct a

nd M

onito

r

EDM01 Ensure Governance Framework Setting and Maintenance

EDM02

EDM03

EDM04

EDM05

Ensure Benefits Delivery

© 2012 ISACA ‐ Glenfis AG

Domain ID CO5 Processes Governance / Management Practice

Activities associated with each of the governance and management practices in COBIT 5.

BAI04.02 Assess business impact.BAI04.03 Plan for new or changed service requirements.BAI04.04 Monitor and review availability and capacity.BAI04.05 Investigate and address availability, performance and capacity issues.BAI05.01 Establish the desire to change.BAI05.02 Form an effective implementation team.BAI05.03 Communicate desired vision.BAI05.04 Empower role players and identify short-term wins.BAI05.05 Enable operation and use.BAI05.06 Embed new approaches.BAI05.07 Sustain changes.BAI06.01 Evaluate, prioritise and authorise change requests.BAI06.02 Manage emergency changes.BAI06.03 Track and report change status.BAI06.04 Close and document the changes.BAI07.01 Establish an implementation plan.BAI07.02 Plan business process, system and data conversion.BAI07.03 Plan acceptance tests.BAI07.04 Establish a test environment.BAI07.05 Perform acceptance tests.BAI07.06 Promote to production and manage releases.BAI07.07 Provide early production support.BAI07.08 Perform a post-implementation review.BAI08.01 Nurture and facilitate a knowledge-sharing culture.BAI08.02 Identify and classify sources of information.BAI08.03 Organise and contextualise information into knowledge.BAI08.04 Use and share knowledge.BAI08.05 Evaluate and retire information.BAI09.01 Identify and record current assets.BAI09.02 Manage critical assets.BAI09.03 Manage the asset life cycle.BAI09.04 Optimise asset costs.BAI09.05 Manage licences.BAI10.01 Establish and maintain a configuration model.BAI10.02 Establish and maintain a configuration repository and baseline.BAI10.03 Maintain and control configuration items.BAI10.04 Produce status and configuration reports.BAI10.05 Verify and review integrity of the configuration repository.DSS01.01 Perform operational procedures.DSS01.02 Manage outsourced IT services.DSS01.03 Monitor IT infrastructure.DSS01.04 Manage the environment.DSS01.05 Manage facilities.DSS02.01 Define incident and service request classification schemes.DSS02.02 Record, classify and prioritise requests and incidents.DSS02.03 Verify, approve and fulfil service requests.DSS02.04 Investigate, diagnose and allocate incidents.DSS02.05 Resolve and recover from incidents.DSS02.06 Close service requests and incidents.DSS02.07 Track status and produce reports.DSS03.01 Identify and classify problems.DSS03.02 Investigate and diagnose problems.DSS03.03 Raise known errors.DSS03.04 Resolve and close problems.DSS03.05 Perform proactive problem management.DSS04.01 Define the business continuity policy, objectives and scope.DSS04.02 Maintain a continuity strategy.DSS04.03 Develop and implement a business continuity response.DSS04.04 Exercise, test and review the BCP.DSS04.05 Review, maintain and improve the continuity plan.DSS04.06 Conduct continuity plan training.DSS04.07 Manage backup arrangements.DSS04.08 Conduct post-resumption review.DSS05.01 Protect against malware.DSS05.02 Manage network and connectivity security.DSS05.03 Manage endpoint security.DSS05.04 Manage user identity and logical access.DSS05.05 Manage physical access to IT assets.DSS05.06 Manage sensitive documents and output devices.DSS05.07 Monitor the infrastructure for security-related events.DSS06.01 Align control activities embedded in business processes with enterprise objectives.DSS06.02 Control the processing of information.DSS06.03 Manage roles, responsibilities, access privileges and levels of authority.DSS06.04 Manage errors and exceptions.DSS06.05 Ensure traceability of information events and accountabilities.DSS06.06 Secure information assets.MEA01.01 Establish a monitoring approach.MEA01.02 Set performance and conformance targets.MEA01.03 Collect and process performance and conformance data.MEA01.04 Analyse and report performance.MEA01.05 Ensure the implementation of corrective actions.MEA02.01 Monitor internal controls.MEA02.02 Review business process controls effectiveness.MEA02.03 Perform control self-assessments.MEA02.04 Identify and report control deficiencies.MEA02.05 Ensure that assurance providers are independent and qualified.MEA02.06 Plan assurance initiatives.MEA02.07 Scope assurance initiatives.MEA02.08 Execute assurance initiatives.MEA03.01 Identify external compliance requirements.MEA03.02 Optimise response to external requirements.MEA03.03 Confirm external compliance.MEA03.04 Obtain assurance of external compliance.

MEA01

MEA02

MEA03

Monitor, Evaluate and Assess Performance and Conformance

Monitor, Evaluate and Assess the System of Internal Control

Monitor, Evaluate and Assess Compliance with External Requirements

DSS04

DSS05

DSS06

Manage Operations

Manage Service Requests and Incidents

Manage Problems

Manage Continuity

Manage Security Services

Manage Business Process Controls

Manage Knowledge

Manage Assets

Manage Configuration

DSS01

DSS02

DSS03

BAI08

BAI09

BAI10

Manage Availability and Capacity

Manage Organisational Change Enablement

Manage Changes

Manage Change Acceptance and Transitioning

BAI04

BAI05

BAI06

BAI07

Del

iver

, Ser

vice

and

Sup

port

Mon

itor,

Eval

uate

and

Ass

ess

Man

agem

ent

Man

agem

ent

Man

agem

ent

Bui

ld, A

cqui

re a

nd Im

plem

Glenfis AG Seite 1 von 1

ITIL© Edition 2011 - COBIT© 5 Mapping

Stra

tegy

man

agem

ent f

or IT

ser

vice

s

Serv

ice

port

folio

man

agem

ent

Fina

ncia

l man

agem

ent f

or IT

ser

vice

s

Dem

and

man

agem

ent

Bus

ines

s re

latio

nshi

p m

anag

emen

t

Des

ign

coor

dina

tion

Serv

ice

cata

logu

e m

anag

emen

t

Serv

ice

Leve

l Mgm

t

Ava

ilabi

lity

man

agem

ent

Cap

acity

man

agem

ent

IT s

ervi

ce c

ontin

uity

man

agem

ent

Info

rmat

ion

secu

rity

man

agem

ent

Supp

lier m

anag

emen

t

Tran

sitio

n pl

anni

ng a

nd s

uppo

rt

Cha

nge

man

agem

ent

Rel

ease

and

dep

loym

ent m

anag

emen

t

Serv

ice

valid

atio

n an

d te

stin

g

Cha

nge

eval

uatio

n

Kno

wle

dge

man

agem

ent

Even

t man

agem

ent

Inci

dent

man

agem

ent

Req

uest

fulfi

lmen

t

Prob

lem

man

agem

ent

Acc

ess

man

agem

ent

Serv

ice

Rep

ortin

g

The

seve

n-st

ep im

prov

emen

t pro

cess

EDM Evaluate, Direct and Monitor

EDM01 Ensure Governance Framework Setting and Maintenance

EDM02 Ensure Benefits Delivery x

EDM03 Ensure Risk Optimisation

EDM04 Ensure Resource Optimisation x

EDM05 Ensure Stakeholder Transparency x

APO Align, Plan and Organise

APO01 Manage the IT Management Framework x

APO02 Manage Strategy x

APO03 Manage Enterprise Architecture

APO04 Manage Innovation

APO05 Manage Portfolio x x

APO06 Manage Budget and Costs x

APO07 Manage Human Resources x

APO08 Manage Relationships x x

APO09 Manage Service Agreements x x x x x

APO10 Manage Suppliers x

APO11 Manage Quality x

APO12 Manage Risk x

APO13 Manage Security x

BAI Build, Acquire and Implement

BAI01 Manage Programmes and Projects x

BAI02 Manage Requirements Definition x

BAI03 Manage Solutions Identification and Build

BAI04 Manage Availability and Capacity x x

BAI05 Manage Organisational Change Enablement

BAI06 Manage Changes x

BAI07 Manage Change Acceptance and Transitioning x x x x x

BAI08 Manage Knowledge x

BAI09 Manage Assets x

BAI10 Manage Configuration x

DSS Deliver, Service and Support

DSS01 Manage Operations x

DSS02 Manage Service Requests and Incidents x x

DSS03 Manage Problems x

DSS04 Manage Continuity x

DSS05 Manage Security Services x

DSS06 Manage Business Process Controls x

MEA Monitor, Evaluate and Assess

MEA01 Monitor, Evaluate and Assess Performance and Conformance x

MEA02 Monitor, Evaluate and Assess the System of Internal Control x

MEA03 Monitor, Evaluate and Assess Compliance with External Requirements x

ITIL® is a Registered Trade Mark, and a Registered Community Trade Mark of the Cabinet Office, and is Registered in the U.S. Patent and Trademark Office, and is used hereby GLENFIS AG

under licence from and with the permission of OC.

COBIT® is a trademark of ISACA registered in the U.S. and other countries. COBIT 5 is an ISACA publication (www.isaca.org) and portions of COBIT 5 appear in this document with permission

from ISACA

Service Operation CSIService

DesignService

TransitionServiceStrategy

Serv

ice

asse

t and

con

figur

atio

n m

anag

emen

t

ITIL© Edition 2011 - COBIT® 5 Mapping

COBIT

Evaluate

Direct Monitor

Plan (APO)

Build (BAI)

Run (DSS)

Monitor (MEA)

Governance of Enterprise IT

(c) Glenfis AG

www.glenfis.ch

www.itil.org

www.ISO20000.chV 2.0

Proc

esse

s fo

r Man

agem

ent o

f Ent

erpr

ise

IT

Eval

uate

, Dire

ct a

nd M

onito

r

Proc

esse

s fo

r Gov

erna

nce

of E

nter

pris

e IT

Alig

n, P

lan

and

Orga

nise

Mon

itor,

Eval

uate

and

Asse

ss

Build

, Acq

uire

and

Impl

emen

t

Deliv

er, S

ervi

ce a

nd S

uppo

rt

EDM

01 E

nsur

eGo

vern

ance

Fram

ewor

k Se

tting

and

Mai

nten

ance

APO0

1 M

anag

eth

e IT

Man

agem

ent

Fram

ewor

k

APO0

8 M

anag

eRe

latio

nshi

ps

APO0

2 M

anag

eSt

rate

gy

APO0

9 M

anag

eSe

rvic

eAg

reem

ents

APO0

3 M

anag

eEn

terp

rise

Arch

itect

ure

APO1

0 M

anag

eSu

pplie

rs

APO0

4 M

anag

eIn

nova

tion

APO1

1 M

anag

eQu

ality

APO0

5 M

anag

ePo

rtfol

io

APO1

2 M

anag

eRi

sk

APO0

6 M

anag

eBu

dget

and

Cos

tsAP

O07

Man

age

Hum

an R

esou

rces

MEA

01 M

onito

r,Ev

alua

te a

nd A

sses

sPe

rform

ance

and

Conf

orm

ance

MEA

02 M

onito

r,Ev

alua

te a

nd A

sses

sth

e Sy

stem

of I

nter

nal

Cont

rol

MEA

03 M

onito

r,Ev

alua

te a

nd A

sses

sCo

mpl

ianc

e W

ithEx

tern

al R

equi

rem

ents

APO1

3 M

anag

eSe

curit

y

DSS0

1 M

anag

eOp

erat

ions

DSS0

2 M

anag

eSe

rvic

e Re

ques

tsan

d In

cide

nts

DSS0

3 M

anag

ePr

oble

ms

DSS0

4 M

anag

eCo

ntin

uity

DSS0

5 M

anag

eSe

curit

ySe

rvic

es

DSS0

6 M

anag

eBu

sine

ssPr

oces

s Co

ntro

ls

BAI0

1 M

anag

ePr

ogra

mm

es a

ndPr

ojec

ts

BAI0

8 M

anag

eKn

owle

dge

BAI0

2 M

anag

eRe

quire

men

tsDe

finiti

on

BAI0

9 M

anag

eAs

sets

BAI0

3 M

anag

eSo

lutio

nsId

entif

icat

ion

and

Build

BAI0

10 M

anag

eCo

nfig

urat

ion

BAI0

4 M

anag

eAv

aila

bilit

y an

d Ca

paci

ty

BAI0

5 M

anag

eOr

gani

satio

nal

Chan

geEn

able

men

t

BAI0

6 M

anag

eCh

ange

s

BAI0

7 M

anag

eCh

ange

Acce

ptan

ce a

ndTr

ansi

tioni

ng

EDM

02 E

nsur

eBe

nefit

s De

liver

yED

M03

Ens

ure

Risk

Opt

imis

atio

n

EDM

04 E

nsur

eRe

sour

ceOp

timis

atio

n

EDM

05 E

nsur

eSt

akeh

olde

rTr

ansp

aren

cy

CO

BIT

5 Pr

oces

s Re

fere

nce

Mod

el

Sour

ce:

COBI

T 5,

figu

re 1

6


Documents

COBIT 5 Online Collaborative Environment - Glenfis · PDF fileCOBIT 5 Product Family Source: COBIT 5, figure 11 COBIT® 5 COBIT 5 Online Collaborative Environment COBIT 5 Enabler Guides