• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
What is Cobit
 

What is Cobit

on

  • 30,121 views

Introduction to cobit

Introduction to cobit

Statistics

Views

Total Views
30,121
Views on SlideShare
29,951
Embed Views
170

Actions

Likes
31
Downloads
2,303
Comments
3

20 Embeds 170

http://www.slideshare.net 94
http://itsmspot.blogspot.com 29
http://www.itmwisdombase.com 14
http://www.itsmspot.blogspot.com 7
http://www.itmwisdombase.org 7
http://itsmspot.blogspot.de 4
http://sondrapadalecki.blogspot.com 2
http://www.itsmspot.blogspot.ae 1
http://www.docseek.net 1
http://itsmspot.blogspot.fi 1
https://www.facebook.com 1
http://itsmspot.blogspot.in 1
http://www.draac.com 1
http://itsmspot.blogspot.ca 1
https://si0.twimg.com 1
http://itsmspot.blogspot.co.uk 1
http://paper.li 1
http://translate.googleusercontent.com 1
http://webcache.googleusercontent.com 1
http://itsmspot.blogspot.hk 1
More...

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel

13 of 3 previous next Post a comment

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
  • I read your post . it was amazing.Your thought process is wonderful.The way you tell about things is awesome. They are inspiring and helpful.Thanks for sharing your information and stories.

    iso 9000
    Are you sure you want to
    Your message goes here
    Processing…
  • Good description of Cobit!
    Do you see any connection between Cobit and Continuous improvements (Lean)?
    Are you sure you want to
    Your message goes here
    Processing…
  • actually i dont understand yet about how we measure, make a maturity models based on cobit.. any idea or link about cobit?
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    What is Cobit What is Cobit Presentation Transcript

    • Business is evolving, you should too. What is COBIT? Ben Kalland, Tieturi Helsinki, Tampere, Turku, Tukholma, Göteborg | www.tieturi.fi
    • Governance?
    • It may actually work! Because we have: • Experience • Luck • A culture of ‘Quick and Dirty’ But what happens when we need to: • Document • Improve • Find an error • Transfer responsibility = we need governance
    • Why do we need to govern? • Stakeholders expect • Current business is stable and creates value • Responsiveness to changing business models • These contradictory expectations can be achieved with • Governance of enterprise’s IT • Governance responsibilities • Strategy generation • Value Delivery • Risk Management • Performance Measurement 4
    • IT Governance Focus Areas • The five main focus areas of IT Governance, all driven by stakeholder value IC V EG N T DE AL • Two of them are outcomes TE LI UE RA NM VE ST I G RY • Value Delivery AL • Risk Management • Three of them are drivers IT GOVERNANCE PER SUREM ME A T • Strategic Alignment M EN FO R MAN RISK • Resource Management (which AGE MAN NT overlays them all) • Performance Measurement E CE • IT Governance is a continuous RESOURCE life cycle, which can be entered MANAGEMENT at any point IT Governance Institute, 2003 – Board Briefing on IT Governance, 2nd edition, 2006, COBIT 4.1 Executive Overview, 2007 5
    • What do we get from governing? • Board and executives have a clear picture of the performance of IT • Better investment decisions • Trust that IT achieves objectives as directed • Clearly assigned roles and responsibilities • Help management to execute strategy and encourage desirable behavior • Transparency in governance • Improves stakeholder confidence in the responsibility, accountability and competitive position of the enterprise • Enable customers to influence services - customer satisfaction • Improves employee satisfaction and reduces retention 6
    • What do we get from governing? • Balanced operations • IT can respond to the business needs and • at the same time maintain and improve the stability and quality of services in a cost-efficient manner • Outsourced services can be directed and controlled clearly • Enables effective, efficient and adaptable relationships • Improved ROI and VOI • Effective governance eliminates redundancy, overlap and lack of clarity, helps to reduce failures, optimize costs and increase efficiency • Compliance to rules and legislation is achieved and maintained 7
    • Frameworks, standards and players • ITIL (Information Technology Infrastructure Library) • A set of guidance, a collection of Best Practices for IT Service Management - IT Service Management Framework • ISO/IEC 20000 • International standard for IT Service Management • TOGAF (Open Group Architecture Framework) • A framework for Enterprise Architecture • A comprehensive approach to the design, planning, implementation, and governance of an enterprise information architecture 8
    • Frameworks, standards and players • CMMI (Capability Maturity Model Integration) • A process improvement approach • helps integrate traditionally separate organizational functions • set process improvement goals and priorities • COBIT • provide guidance for quality processes • created by ISACA and the IT Governance Institute initially in 1996 • provides a generally accepted, practical toolset: • enables good practice for IT control through organization • highlights link between business and IT goals • emphasized regulatory compliance • An authoritative, up-to-date, internationally and generally accepted, internal control framework for IT governance 9
    • Frameworks, standards and players • ISO/IEC 27001 • an information security standard published in 2005 • intended to be used in conjunction with ISO/IEC 27002, the Code of Practice for Information Security Management • ISO/IEC 27002 • Based on the British Standard (BS) 7799-1:1999 • published in 2005 • renumbered ISO/IEC 27002:2005 in July 2007 • ISO/IEC 27002 provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining Information Security Management Systems (ISMS). 10
    • Frameworks, standards and players • AS8015 • An Australian standard for IT Governance, published in 2005 • Provides principles, a model and vocabulary as a basic framework for implementing effective corporate governance of ICT • ISO/IEC 38500 (very closely based on AS8015) • Corporate governance of information technology standard • Provides guiding principles for directors of organizations (including owners, board members, directors, partners, senior executives, or similar) on the effective, efficient, and acceptable use of Information Technology (IT) within their organizations. 11
    • Why COBIT? • COBIT is used in many companies to provide a framework for governance and implementation of internal controls • COBIT includes the essential business and IT process controls and objectives needed to achieve corporate objectives • COBIT is written at the management level and driven by business requirements • COBIT is aligned with other IT practices and standards but is more complete than others • COBIT is generally accepted as the internal IT control framework 12
    • COBIT • Control Objectives for Information and related Technology • COBIT supports IT governance by providing a framework to ensure that • IT is aligned with the business • IT enables the business and maximises benefits • IT resources are used responsibly • IT risks are managed appropriately • Designed to support • Executive and management boards • Business and IT management • Governance, assurance, control, security professionals 13
    • COBIT mission • To research, develop, publicise and promote an authorative, up-to-date, internationally accepted IT governance control framework for adaption by enterprises and day-to-day use by business managers, IT professionals and assurance professionals. 14
    • COBIT fits in • Business-focused • Business goals and IT goals, COBIT’s information criteria, COBIT’s IT resources • Process-oriented • Domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), Monitor and Evaluate (ME) • Controls-based • Process controls, Business and IT controls, IT general controls and application controls • Measurement-driven • Maturity models 15
    • COBIT is business-focused Business drive the which requirements investments in responds to IT Enterprise Resources COBIT information that are IT to deliver used by Processes 16
    • COBIT is process-oriented • Plan and Organise • Provides direction to solution Plan and organise delivery (AI) and service delivery (DS) • Acquire and Implement Acquire Deliver • Provides the solutions and passes and and them to be turned into services implement support • Deliver and Support • Receives the solutions and makes them usable for end users Monitor and evaluate • Monitor and Evaluate • Monitors all processes to ensure that the direction provided is followed 17
    • COBIT is controls-based • COBIT defines • Control objectives for all 34 processes • Overarching process and application controls • Control objectives • Reasonable assurance that business objectives will be achieved and undesired events will be prevented or detected and corrected • Consist of the policies, procedures, practices and organisational structures • Statements of managerial actions to increase value or reduce risk • Some controls apply to all processes • Six overarching process controls • Six overarching application controls 18
    • COBIT is measurement-driven • COBIT Maturity levels • profiles of IT processes • not a threshold model • Process maturity • Process may be mainly at level 3 • However some parts can be at lower levels • And some even at the highest level of 5 (optimised) • It is misleading to say that the process is not defined if part of it is not complete 19
    • History of COBIT • A framework and a knowledge base for managing IT • created by ISACA and the IT Governance Institute in 1994 • Former name of IT Governance Institute was the Information Systems Audit and Control Foundation (ISACF) – renamed in 2003 • COBIT was transferred to the IT Governance Institute in 1999 Governance COBIT4 & 4.1 Management COBIT3 Control COBIT2 Audit COBIT1 20
    • COBIT 4.1 • A single publication consisting of four sections • Executive Overview • The COBIT framework • The core content • Framework processes • Control Objectives • Management Guidelines • Maturity Models • Appendixes I through VIII • I -Tables linking goals and processes • II - Mapping IT processes to IT Governance focus areas, COSO, COBIT IT resources and COBIT Information criteria • V - Cross-references Between COBIT 3rd Edition and COBIT 4.1 21
    • COBIT 4.1 – the core content • Frameworks • Organize IT Governance objectives and good practices by IT domains and processes, and links them to business requirements • Control Objectives • Provide a complete set of high-level requirements to be considered by management for effective control of each process • Management Guidelines / Maturity Models • Help assign responsibility, measure performance, and benchmark and address gaps in capability 22
    • Interrelationships of COBIT components requirements information nto ni ow con nd au by troll ke ed b dit bro d y re ed su ea wi m th derived from ce for outcome an m r im rfo by th ple fo wi e ed rp rm me d rm fo te nte at di fo ur er dw au it p ith y based on IT Governance Institute – COBIT 4.1 Executive Overview, 2007 23
    • The COBIT Cube Business Requirements lity s es ce i ty y i ty tia rity en enc bil ian abil n v ti e l i a g ail omp fid Inte c li f e c Ef f i Re on Av Ef C C Infrastructure People DOMAINS Information Applications IT Processes PROCESSES ACTIVITIES s ce ur o s Re IT IT Governance Institute, COBIT 4.1 24
    • Basic principle of the COBIT Framework that respond to the Business Requirements Information Criteria IT Goals DOMAINS IT Processes PROCESSES to achieve are managed by ACTIVITIES s ce ur o s Re IT 25
    • Plan and Organise domain - processes • PO1 Define a Strategic IT Plan • PO2 Define the Information Architecture • PO3 Determine Technological Direction • PO4 Define the IT Processes, Organisation and Relationships • PO5 Manage the IT Investment • PO6 Communicate Management Aims and Direction • PO7 Manage IT Human Resources • PO8 Manage Quality • PO9 Assess and Manage IT Risks • PO10 Manage Projects 26
    • Acquire and Implement domain - processes • AI1 Identify Automated Solutions • AI2 Acquire and Maintain Application Software • AI3 Acquire and Maintain Technology Infrastructure • AI4 Enable Operation and Use • AI5 Procure IT Resources • AI6 Manage Changes • AI7 Install and Accredit Solutions and Changes 27
    • Deliver and Support domain - processes • DS1 Define and Manage Service Levels • DS2 Manage Third-party Services • DS3 Manage Performance and Capacity • DS4 Ensure Continuous Service • DS5 Ensure Systems Security • DS6 Identify and Allocate Costs • DS7 Educate and Train Users • DS8 Manage Service Desk and Incidents • DS9 Manage the Configuration • DS10 Manage Problems • DS11 Manage Data • DS12 Manage the Physical Environment • DS13 Manage Operations 28
    • Monitor and Evaluate domain - processes • ME1 Monitor and Evaluate IT Performance • ME2 Monitor and Evaluate Internal Control • ME3 Ensure Compliance With External Requirements • ME4 Provide IT Governance 29
    • Process Controls • COBIT defines control objectives for all 34 processes • Each of the COBIT processes has • A high-level control objective – the process description • A number of detailed control objectives • As a whole, they are the characteristics of a well-managed process • COBIT defines also overarching process controls • That apply to all processes • And should be considered together with the process control objectives to have a complete view of control requirements 30
    • Process Controls • The detailed control objectives are identified by a two- character domain reference (PO, AI, DS, ME) plus a process number and control objective number • E.g., PO10 Manage Projects, has 14 detailed control objectives • From PO10.1 to PO10.14 • When DS2 Manage Third-party Services has four • From DS2.1 to DS2.4 • The overarching Process Controls are numbered • From PC1 to PC6 31
    • COBIT Maturity model • Similar to CMM • Interpreted for the nature of COBIT’s IT management processes • A generic maturity scale • A specific model generated for each COBIT IT process • Not a threshold model • Designed as profiles of IT processes • Possible current and future states • Using the maturity models management can identify • The actual performance of the enterprise – Where the enterprise is today • the current status of the industry – The comparison • the enterprises target for improvement – Where the enterprise wants to be • The required growth path between as-is and to-be 32
    • COBIT Maturity model • COBIT Maturity levels • profiles of IT processes • not a threshold model • Process maturity • Process may be mainly at level 3 • However some parts can be at lower levels • And some even at the highest level of 5 (optimised) • It is misleading to say that the process is not defined if part of it is not complete 33
    • COBIT Maturity Model • Generic Maturity Model • 0 - (Non-existent) management processes are not applied at all • 1 – (Initial/Ad Hoc) processes are ad hoc and disorganised • 2 – (Repeatable but intuitive) processes follow a regular pattern • 3 – (Defined Process) processes are documented and communicated • 4 – (Managed and Measurable) processes are monitored and measured • 5 – (Optimised) good practices are followed and automated 34
    • Goal Relationship example Maintain enterprise reputation and Leadership. Business Goal Ensure that IT Services can resist and recover from attacks. IT Goals Detect and resolve unauthorised access. Process Goals Understand security requirements, vulnerabilities and threats. Activity Goals 35
    • Outcome measure, Performance indicator example IT Goal Process Goal Ensure that Detect and resolve IT Services can unauthorised resist and recover Dri access. from attacks. ve Number of actual Number of actual incidents because IT incidents with of unauthorised business impact access Outcome measure Outcome measure Performance indicator Performance indicator 36
    • COBIT Framework Business Requirements Information Criteria he ot t nd spo Quality Security Fiduciary t re ha t ss lity e ne ncy lity i ty nc tia rity e bil plia iabi iv n ie ct fic nfide nteg vaila om l ffe Ef Re I E o C A C DOMAINS IT Goals Plan and Organise (PO) Infrastructure People Acquire and Implement (AI) to achieve Deliver and Support (DS) Information Monitor and Evaluate (ME) Applications PROCESSES High level and detailed IT goals control objectives Process goals IT Processes Maturity models Activity goals Outcome measures ACTIVITIES Performance indicators s ce ur o s Re IT are managed by 37
    • COBIT Core Components • Each COBIT IT process has • Section one - Process Description • Process description • Summary of the objectives - presented in a waterfall • Mapping of the process to – Information criteria, IT resources, IT governance focus areas • Section two – Control Objectives • Detailed control objectives for this process • Section three – Management Guideline • Process inputs and outputs, RACI chart, goals and metrics • Section four – Maturity model • Maturity model for this process 38
    • Cobit Framework
    • COBIT Framework Navigation IT Governance Institute, COBIT 4.1 40
    • Example : DS2 • The following slides are an example of the content of COBIT • Process: DS2 Manage Third-party Services
    • DS2 Mapping to Information Criteria Summary of the objectives in a waterfall Mapping to IT governance focus areas Mapping to IT resources IT Governance Institute, COBIT 4.1 42
    • DS2 - Process Description DS2 Manage Third-party Services The need to assure that services provided by third parties (suppliers, vendors and partners) meet business requirements requires an effective third-party management process. This process is accomplished by clearly defining the roles, responsibilities and expectations in third-party agreements as well as reviewing and monitoring such agreements for effectiveness and compliance. Effective management of third-party services minimises the business risk associated with non-performing suppliers. 43
    • DS2 Manage Third-party Services • DS2 mappings to • Information criteria • IT resources • IT Governance focus areas • P primary relationship • S secondary relationship 44
    • DS2 Waterfall 45
    • Control Objectives • Control objectives • Reasonable assurance that business objectives will be achieved and undesired events will be prevented or detected and corrected • Consist of the policies, procedures, practices and organisational structures • Statements of managerial actions to increase value or reduce risk • Each of the COBIT processes has • A high-level control objective – the process description • A number of detailed control objectives • As a whole, they are the characteristics of a well-managed process 46
    • DS2 – Control Objectives IT Governance Institute, COBIT 4.1 47
    • COBIT Control Practices • Provides guidance on why controls are worth implementing • Why - Value drives and Risk drivers • And how to implement them • Helps to justify and design the specific controls needed to improve IT Governance • How, why and what to implement for each control objective • to improve IT performance • to address IT solution and service delivery risks • Not included in COBIT 4.1 • A separate publication 48
    • DS2 - Management Guidelines Process Process inputs outputs RACI chart Goals and metrics 49
    • Management Guidelines • Process inputs • What the process owner needs from others • Inputs come also from other sources than COBIT • Process outputs • What the process owner has to deliver • RACI chart • What has to be delegated and to whom • Goals and metrics • How the process should be measured 50
    • DS2 – Process inputs and outputs PO1 Define a strategic IT plan PO8 Manage quality AI5 Procure IT resources DS1 Define and manage service levels DS4 Ensure continuous service ME1 Monitor and evaluate IT performance AI5 Procure IT resources PO9 Assess and manage IT risks 51
    • RACI chart • Responsible • The person or people responsible for getting the job don • Correct execution of the process and the activities • Potential OLA opportunities • Accountable • Only one person can be accountable for each task • Ownership of quality, and end result of the process • Consulted • The people who are consulted and whose opinions are sought • Involvement through input of knowledge and information • Informed • The people who are kept up-to-date on progress • Receiving information about process execution and quality • Helps to expose communication and workflow paths 52
    • DS2 - RACI chart 53
    • Outcome measure, Performance indicator example IT Goal Process Goal Ensure that Detect and resolve IT Services can unauthorised resist and recover Dri access. from attacks. ve Number of actual Number of actual incidents because IT incidents with of unauthorised business impact access Outcome measure Outcome measure Performance indicator Performance indicator 54
    • DS2 – Goals and metrics 55
    • DS2 – Maturity model – levels 0 through 2 56
    • DS2 – Maturity model – levels 3 through 5 57
    • More information? Ben Kalland ITIL Expert and Cobit Foundation certified consultant Accredited ITIL trainer ben.kalland@tieturi.fi Tieturi Oy, HTC Santa Maria Tammasaarenkatu 5 00180 HELSINKI www.tieturi.fi/itil