ISACA¯ليل-حاكمية-وإدارة... · ISACA 45 55--05 Description Category Dimension Intrinsic Accuracy Objectivity. اهل ةبحاصملا ايجولونكتلاو تامولعملا

2017

56/2016

5

ISACA

دليل حاكمية وإدارة المعلومات والتكنولوجيا المصاحبة لها

Page 2

1 .............................................................................................................................................................................................. 3

2 ................................................................................................................................................................................................. 4

3 .............................................................................................................................................................................................. 5

4 ........................................................................................ 6

5 ............................................................................................................................................................................. 6

51............................................................................................................................................................................................................ 6

52 ..................................................................................................................... 9

53 .......................................................................................................................................................... 9

54 ........................................................................................................................................................................................ 11

55 ................................................................................................................................................................ 11

56 ........................................................................................................................................................................................ 12

57 ................................................................................................................................................ 12

58 ................................................................................................................................................................... 12

59 ................................................................................................................................................................. 12

6. ................................................................................................................................................. 33

1Meeting Stakeholder Needs ....................................................................................................... 11

2Covering the Enterprise End-to-end ............................................................................... 11

1Applying A Single integrated Framework ....................................................................................... 11

4 Enabling A Holistic Approach ............................................................................................................................ 11

5 Separating Governace from Management ............................................................................................... 14

7 ................................................................................................................................................................ 34

Enterprise Goals ............................................................................................................................ 37

......................................................................................................... 02

....................................................................................................................... 04

.................................................................................................................................................... 36

........................................................................................................................................... 42

......................................................................................................... 43

.......................................................................... 40

.................................................................................................................................................................................. 45

............................................................................................................................................................................. 46


Page 3

5561055

COBIT5

5COBIT5

5COBIT5

End-to-End


Page 4

1

.ال

.

ال

.

.

COBIT 5 Foundation COBIT 5 Assessor,

COBIT 5 Implementation, CGEIT

(EDM 01 – EDM 05)

EDM 01

APO12


Page 5

2

31

325COBIT5

33

34

(7 Enablers

:

.

35


Page 6

3

4

5561055

COBIT5

5COBIT5

ISACA

51

-


Page 7

-

-

0

6

COBIT

3

4 RACI Chart

Responsible

AccountableConsultedInformed

5 Enabling Processes5COBIT.

5

5

7

8

9

-


Page 8

-

-

0

6

3

4

5

5


Page 9

7

52

-

5

-

-

53

-

-

-

Audit Charter


Page 10

-

Information

Technology Assurance Framework

ISACA

Information Technology Assurance Framework

ISACA

54

55

-

-

05

DimensionCategoryDescription

Intrinsic

Accuracy

Objectivity


Page 11

Believability

Reputation

Contextual

Relevancy

Completeness

Currency

Appropriate

Amount

Concise Representation

Consistent

Representation

Interpretability

Understandability

Ease of Manipulation

Security/Accessibility

Availability

Restricted Access

-

-


Page 12

56

57

-

58

-

-

59

-


Page 13

5

5COBIT5

1Meeting Stakeholder Needs

2Covering the Enterprise End-to-end

5COBIT5

End-to-End

3Applying A Single integrated Framework

4 Enabling A Holistic Approach

5COBIT5


Page 14

0

6

3

4

5

5

7

5 Separating Governace from Management

5COBIT5

-

-

6

5COBIT5


Page 15

5COBIT5

Balanced Score Card

(

IT Balanced Score Card5COBIT5


Page 16

-

-

-

-

-

-

-

5COBIT5


Page 17

Enterprise Goals

35

5

·

10

·

·

16

(Risk Profile)

13

·

14

·

15


Page 18

·

15

17

18

19

01

00

06

03


Page 19

·

·

/

·

04

05

·

·

05

·

·

07


Page 20

01, 03, 05, 07, 11 13

•

•

0

01, 05, 07, 09, 12, 17

•

•

•

•

6

04, 10, 16 •

•

•

3

02, 10 •

4


Page 21

•

•

• Risk

Profile

15 •

•

5

10,17 •

•

5

04, 10, 14 •

•

(SLA, OLA)

7

01, 07, 09, 17 •

8


Page 22

•

•

01, 14 •

•

•

9

04, 06 11 •

•

•

•

01

01, 07, 08, 09, 12

•

•

•

00

05, 06, 11 •

•

06


Page 23

•

•

01,03,13 •

•

·

•

•

03

08, 16 •

•

•

04

02, 10, 15 •

·

•

·

•

·

•

05

05 •

·

•

05


Page 24

05

5

.

5

35

5.

5

i

Evaluate, Direct and Monitor (EDM)

10,13,17

Ensure GovernanceFramework Setting and

Maintenance

EDM 10

·

•

19,07 •

•

•

07


Page 25

i

10,15,15,17,07

EnsureBenefits Delivery

EDM 16

04,06,10,15

Risk

Appetite

Risk Tolerance

Ensure RiskOptimization

EDM 13

09,11,16

EDM 14


Page 26

i

Ensure Resource Optimization

03,06,07

Ensure Stakeholder Transparency.

EDM 05

Align, Plan and Organize (APO)

01,02,09,11,15,16,17

.

Manage the ITManagementFramework.

APO 01


Page 27

i

01,07,17

.

Manage Strategy

APO 02

01,09,11

Manage Enterprise Architecture.

APO 03

05,08,09,11,17

.

Manage Innovation.

APO 04


Page 28

i

01,05,13

.

Manage Portfolio.

APO 05

05,06

.

Manage Budget and Cost.

APO 06


Page 29

i

01,11,13,16,17

.

Manage Human Resources.

APO 07

01,07,12,17

.

Manage Relationships.

APO 08

07,14

.

Manage Service Agreements

APO 09

04,07,09

.

Suppliers.Manage

APO 01


Page 30

i

05,07,13

QualityManage

APO 11

02,04,06,10,13

.

Risk.Manage

APO 12

02,04,06,10,14

.

Manage Security.

APO 13

Build , Acquire & Implement (BAI)

01,04,05,13

.

Manage Programmers and Projects.

BAI 01

01,07,12

Manage Requirement

BAI 02


Page 31

i

/

.

Definition

07

.

(Configuration

Management)

/

.

Manage Solutions Identification and

Build.

BAI 03

07,11,14

.

Manage Availability andCapacity.

BAI 04

08,13,17

ManageOrganizational Change Enablement

BAI 05


Page 32

i

04,07,10

ChangesManage

BAI 06

08,12

.

Manage Change Acceptance and Transition

BAI 07

09,17

.

. :

KnowledgeManage

BAI8

06,11

.

Manage Assets

BAI 09


Page 33

i

02,11,14

.

ConfigurationManage

BAI 10

Delivery, Service and Support (DSS)

04,07,11

OperationsManage

DSS 01

04,07

.

ManageService Requests and Incidents

DSS 02

04,07,11,14

.

Problems.Manage

DSS 03


Page 34

i

04,07,14

Manage Continuity

DSS 04

02,04,10

Manage Security Services

DSS 05

04,07

Manage Business Process

Controls

DSS 06

Monitor, Evaluate and Assess (MEA)

04,07,11,15

Monitor, Evaluate and Assess

Performance and Conformance

MEA 01

02,04,15

Monitor,Evaluate and Assess the System of

MEA 02


Page 35

i

(Residual

Risk)

Internal Control

02,04

.

Monitor, Evaluate and Assess Compliance withExternal Requirements

MEA 03


Page 36

65

.

.

.

ISO-IEC 27001/2)

.

.

.

.

.

.

.

IT Compliance)

.

.

Data Privacy

.

(In-sourcing)

(Outsourcing)

On-site)(Off-site, Near-site, Off-shore

(Outsourcing)


Page 37

(Service Levels) (Audit Right)

.

Quality Requirements

(Confidentiality Requirements)

.

Project Portfolio

Management

.

.

(Asset Management)

.

.

.

.

(Change Management)

.

.

.

.

Laptop, PDA, Smart )

.


Page 38

Phone, USB Memory

(Cards, …etc.

.

.

User Access Management

.

/

.

/

(System Development Life Cycle)

.

.

Service Level Management

.

.

Back-up and Restore

.

On Line Data

.

(Retention)

.

.

(Purchasing)

.

Remote Access


Page 39

(Frame relay , ISDN,VPN,DSL, MPLS)

.

.

(Networks)

.

.

(Wireless Networks)

(Firewalls)

DMZ, Proxy, External )

DNS, VPN, Routers, .(Switches, Servers,

…etc.

(Firewalls)

.

(Firewalls)

.

.

Penetration Testing and Vulnerability Assessment

.

.

Public Branch Exchange


Page 40

75

الال 0

6

3

4

5 RACI Chart

5

7

8

9 Risk Universe, Appetite and Tolerance

01

00 Risk Taxonomy 06 Risk and Control Activity Matrix (RCAM)

03

04 MIS Report

05

05

07

ال 08

09

61

60


Page 41

0

6

3

4

5

5

7


Page 42


Page 43


Page 44


Page 45

.

5

5

.

ISACA


Page 46

556105

5.

0530059

Documents

ISACA¯ليل-حاكمية-وإدارة... · ISACA 45 55--05 Description Category Dimension Intrinsic Accuracy Objectivity. اهل ةبحاصملا ايجولونكتلاو تامولعملا