Embed Size (px)
Citation preview
How to get Agile ITwith Smart IT Governance
José Ángel PEÑA IBARRA, CGEIT, CRISC
COBIT 5 Acreddited Trainer
ISACA Curacao Conference 2017
Curaçao Chapter
Former International Vice-President of ISACAand the IT Governance Institute,(2007-2011).
Vice-President of ISACA Monterrey Chapter(2015-2017).
Partner of CCISA México since 2002. Former
partner of PricewaterhouseCoopers in México.
35+ years of experience in IT, including 11 years
in managerial positions in IT, and about 25
years in consulting, auditing and training , with
assignments in 20+ countries.September 2017
I AM MEXICAN
I AM ISACAN
I AM IN CURACAO
José Ángel Peña Ibarra, CGEIT, CRISC,COBIT 5 Accredited Trainer.
Curaçao Chapter
INTRODUCTION
LEVERAGE ON EXISTING TOOLS
HOLISTIC APPROACH AND PRM
01
02
03CONTINUAL IMPROVEMENT 04
Content
ENCORE: COBIT 5 FOR RISKOpt.
Curaçao Chapter
INTRODUCTION
LEVERAGE ON EXISTING TOOLS
HOLISTIC APPROACH AND PRM
01
02
03CONTINUAL IMPROVEMENT 04
Content
Curaçao Chapter
Agile IT means IT can support the
enterprise innovation capabilities andsatisfy the business´s changing needs.
Introduction
Curaçao Chapter
Smart IT governance meansleveraging on existing tools, asthe family of COBIT products,ISACA resources and otherframeworks and methodologies.
Introduction
Curaçao Chapter
INTRODUCTION
LEVERAGE ON EXISTING TOOLS
HOLISTIC APPROACH AND PRM
01
02
03CONTINUAL IMPROVEMENT 04
Content
Curaçao Chapter
Complement with other frameworks,
methodologies and standards
COBIT
ISO 9000
ISO 27002
ITILWHAT?
HOW?
SCOPE
SCRUM
Curaçao ChapterCOBIT 5 Practical Guidance
• COBIT 5 for Business benefits realisation
• Vendor Management using COBIT 5
• IT Control Objectives for SOX using COBIT 5
• Controls and Assurance in the Cloud, using COBIT 5.
Curaçao ChapterCOBIT 5 Practical Guidance
• Risk Scenarios using COBIT 5 for Risk
• Securing mobile devices using COBIT 5 for Information
• Transforming Cybersecurity using COBIT 5
• Configuration Management using COBIT 5
Curaçao ChapterAudit Programs using COBIT 5
• Audit Programs using COBIT 5
– Evaluate, Direct and Monitor
– Align, Plan and Organize
– Build, Acquaire and Implement
– Deliver, Service and Support
Curaçao ChapterAudit Programs using COBIT 5
• ITAF: Professional Practices Framework for Audit/Assurance
Curaçao Chapter
� The COBIT Assessment Program includes:
– COBIT Process Assessment Model (PAM) Using COBIT 5
– COBIT Assessor’s Guide – using COBIT 5
– COBIT Self Assessment Guide – Using COBIT 5
The Process Capability Model based on ISO
15504 replaces the Process Capability Maturity
Model used in earlier COBIT versions.
COBIT 5 Assessment Program
© 2012 ISACA® All rights reserved.
Curaçao Chapter
INTRODUCTION
LEVERAGE ON EXISTING TOOLS
HOLISTIC APPROACH AND PRM
01
02
03CONTINUAL IMPROVEMENT 04
Content
COBIT 5 Generic Enterprise Enablers
1. Principles, Policies and Frameworks
3. Organisational
Structures
4. Culture, Ethics
and Behaviour2. Processes
5. Information
Resources
6. Services,
Infrastructure and
Applications
7. People, Skills
and Competencies
23COBIT 5© 2012 ISACA All rights reserved
Management Practices
Activities
Inputs Outputs
From Description DescriptionFrom
RACI Chart:
The process supports the achievement of a set of primary IT-related goals:
IT-related Goal Related Metrics
Process Goals and Metrics
Process Goal Related Metrics
Process Name Area:Domain:
Process Purpose Statement
Process Description
Related Guidance
Related Standard Detailed Reference
COBIT 5© 2012 ISACA All rights
reserved25
Curaçao ChapterScenario
• A big retailer company, focused in sport shoes, recentlyhired a Marketing and Sales VP because they want toimprove their revenues and also protect its market againstnew competitors. The company has about 600 stores inseveral countries in Latin America.
• The new Marketing and Sales VP has some very innovativeideas and is working with the Operations Director to almostcompletely renovate the concept of their stores. He alsowants to initiate the sales using e-commerce, because untilnow the sales were only through their chain of stores.
Curaçao ChapterScenario (Cont.)
• These two business initiatives, renovated stores and e-commerce, bring important challenges to the IT department,amongst them:
– To improve the customer buying satisfaction in the store, they need tosolve some issues in the inventory management process. Until now ifsome client is asking for some product that is not in the store, it takesone or two days to know if they have this product in other store orthey need to order it. Now they want to tell the client immediatelywhen they will have the product in the store.
– They want also improve the invoicing process. At the moment, when aclient asks for an electronic invoice, they give him/her an internet linkto download the e-invoice. This is not simple and for many customersis so complicated that they prefer not to get the invoice. Now theywant to send the invoice via email at the very moment he/she ispaying the product.
Curaçao Chapter
• Therefore, IT department needs to develop and implement a newinventory management system and a new billing system.
• The e-commerce initiative requires not only to find out a good e-commerce solution, but also to manage all the security risks inherent tothe new platform.
• Additionally they have discovered that the Disaster Recovery Plan isobsolete and not adequate for the new business continuity needs.
• To assure the success of the new initiatives, the CIO decided to use COBIT5 to improve some of the IT processes, and also decided to use RiskScenarios based in COBIT 5 to identify the main risks.
END of SCENARIO
Scenario (Cont.)
29COBIT 5© 2012 ISACA All rights reserved
Delegate Activity, (Teamwork )
Using the provided scenario:
1. Define which processes the IT director needs to select from the COBIT 5 Process Reference Model
2. Explain why you selected those processes
3. Explain also the procedure you think must be followed to select the processes
Curaçao Chapter
INTRODUCTION
LEVERAGE ON EXISTING TOOLS
HOLISTIC APPROACH AND PRM
01
02
03CONTINUAL IMPROVEMENT 04
Content
31COBIT 5© 2012 ISACA All rights
reserved
Curaçao ChapterPhases 1 and 2
Business Goals
Generic Pain Points
Specific Pain Points
IT Goals
Procesos Seleccionados
TOP DOWN
BOTTOM UP
Next PhaseIT Risks
Phase 1
Phase2
Phase2
Phase 1
Phase2 output
Curaçao Chapter
INTRODUCTION
LEVERAGE ON EXISTING TOOLS
HOLISTIC APPROACH AND PRM
01
02
03CONTINUAL IMPROVEMENT 04
Content
05 COBIT 5 FOR RISK
35
COBIT 5
JA
36
COBIT 5
JA
RISK SCENARIOS
Toolkit
Curaçao ChapterRisk
ISO Guide 73:
• Risk is the combination of the probability of a
given event and its consequences (impact).
Note about quantitative Risk Analysis
Impact x prob.=RL
1x1=1
1x2=2
1x3=3
2x1=2
2x2=4
2x3=6
3x1=3
3x2=6
3x3=9
Ris
k L
eve
ls 5
,7 y
8 a
re m
isse
d
6 8 9
3 5 7
1 2 4
Probability
Impact
1 2
1
2
3
3
6 8 9
3 5 7
1 2 4
Probability
Impact
1 2
1
2
3
3
Imp. Prob.= RL
1 X 2 = 2
2 X 1 = 3
Note about quantitative Risk Analysis
Curaçao ChapterRisk Scenarios
01 Portfolio establishment and
maintenance
02 Programme/projects life cycle
management
03 IT investment decision making
04 IT expertise and skills
05 Staff operations
06 Information
07 Architecture
08 Infrastructure
09 Software
10 Business ownership of IT
11 Suppliers
12 Regulatory compliance
13 Geopolitical
14 Infrastructure theft or
destruction
15 Malware
16 Logical attacks
17 Industrial action
18 Environmental
19 Acts of nature
20 Innovation
43
Escenarios de riesgo genéricos
44
Escenarios de riesgo genéricos
45
Escenarios de riesgo genéricos
Curaçao ChapterGRACIAS !
José Ángel PEÑA IBARRA, CGEIT, CRISC
COBIT 5 Acreddited Trainer
