What is Cobit

40,637 views

Published on

Introduction to cobit

Published in: Technology, Business
3 Comments
44 Likes
Statistics
Notes
  • I read your post . it was amazing.Your thought process is wonderful.The way you tell about things is awesome. They are inspiring and helpful.Thanks for sharing your information and stories.

    iso 9000
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Good description of Cobit!
    Do you see any connection between Cobit and Continuous improvements (Lean)?
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • actually i dont understand yet about how we measure, make a maturity models based on cobit.. any idea or link about cobit?
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
No Downloads
Views
Total views
40,637
On SlideShare
0
From Embeds
0
Number of Embeds
197
Actions
Shares
0
Downloads
3,385
Comments
3
Likes
44
Embeds 0
No embeds

No notes for slide

What is Cobit

  1. 1. Business is evolving, you should too. What is COBIT? Ben Kalland, Tieturi Helsinki, Tampere, Turku, Tukholma, Göteborg | www.tieturi.fi
  2. 2. Governance?
  3. 3. It may actually work! Because we have: • Experience • Luck • A culture of ‘Quick and Dirty’ But what happens when we need to: • Document • Improve • Find an error • Transfer responsibility = we need governance
  4. 4. Why do we need to govern? • Stakeholders expect • Current business is stable and creates value • Responsiveness to changing business models • These contradictory expectations can be achieved with • Governance of enterprise’s IT • Governance responsibilities • Strategy generation • Value Delivery • Risk Management • Performance Measurement 4
  5. 5. IT Governance Focus Areas • The five main focus areas of IT Governance, all driven by stakeholder value IC V EG N T DE AL • Two of them are outcomes TE LI UE RA NM VE ST I G RY • Value Delivery AL • Risk Management • Three of them are drivers IT GOVERNANCE PER SUREM ME A T • Strategic Alignment M EN FO R MAN RISK • Resource Management (which AGE MAN NT overlays them all) • Performance Measurement E CE • IT Governance is a continuous RESOURCE life cycle, which can be entered MANAGEMENT at any point IT Governance Institute, 2003 – Board Briefing on IT Governance, 2nd edition, 2006, COBIT 4.1 Executive Overview, 2007 5
  6. 6. What do we get from governing? • Board and executives have a clear picture of the performance of IT • Better investment decisions • Trust that IT achieves objectives as directed • Clearly assigned roles and responsibilities • Help management to execute strategy and encourage desirable behavior • Transparency in governance • Improves stakeholder confidence in the responsibility, accountability and competitive position of the enterprise • Enable customers to influence services - customer satisfaction • Improves employee satisfaction and reduces retention 6
  7. 7. What do we get from governing? • Balanced operations • IT can respond to the business needs and • at the same time maintain and improve the stability and quality of services in a cost-efficient manner • Outsourced services can be directed and controlled clearly • Enables effective, efficient and adaptable relationships • Improved ROI and VOI • Effective governance eliminates redundancy, overlap and lack of clarity, helps to reduce failures, optimize costs and increase efficiency • Compliance to rules and legislation is achieved and maintained 7
  8. 8. Frameworks, standards and players • ITIL (Information Technology Infrastructure Library) • A set of guidance, a collection of Best Practices for IT Service Management - IT Service Management Framework • ISO/IEC 20000 • International standard for IT Service Management • TOGAF (Open Group Architecture Framework) • A framework for Enterprise Architecture • A comprehensive approach to the design, planning, implementation, and governance of an enterprise information architecture 8
  9. 9. Frameworks, standards and players • CMMI (Capability Maturity Model Integration) • A process improvement approach • helps integrate traditionally separate organizational functions • set process improvement goals and priorities • COBIT • provide guidance for quality processes • created by ISACA and the IT Governance Institute initially in 1996 • provides a generally accepted, practical toolset: • enables good practice for IT control through organization • highlights link between business and IT goals • emphasized regulatory compliance • An authoritative, up-to-date, internationally and generally accepted, internal control framework for IT governance 9
  10. 10. Frameworks, standards and players • ISO/IEC 27001 • an information security standard published in 2005 • intended to be used in conjunction with ISO/IEC 27002, the Code of Practice for Information Security Management • ISO/IEC 27002 • Based on the British Standard (BS) 7799-1:1999 • published in 2005 • renumbered ISO/IEC 27002:2005 in July 2007 • ISO/IEC 27002 provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining Information Security Management Systems (ISMS). 10
  11. 11. Frameworks, standards and players • AS8015 • An Australian standard for IT Governance, published in 2005 • Provides principles, a model and vocabulary as a basic framework for implementing effective corporate governance of ICT • ISO/IEC 38500 (very closely based on AS8015) • Corporate governance of information technology standard • Provides guiding principles for directors of organizations (including owners, board members, directors, partners, senior executives, or similar) on the effective, efficient, and acceptable use of Information Technology (IT) within their organizations. 11
  12. 12. Why COBIT? • COBIT is used in many companies to provide a framework for governance and implementation of internal controls • COBIT includes the essential business and IT process controls and objectives needed to achieve corporate objectives • COBIT is written at the management level and driven by business requirements • COBIT is aligned with other IT practices and standards but is more complete than others • COBIT is generally accepted as the internal IT control framework 12
  13. 13. COBIT • Control Objectives for Information and related Technology • COBIT supports IT governance by providing a framework to ensure that • IT is aligned with the business • IT enables the business and maximises benefits • IT resources are used responsibly • IT risks are managed appropriately • Designed to support • Executive and management boards • Business and IT management • Governance, assurance, control, security professionals 13
  14. 14. COBIT mission • To research, develop, publicise and promote an authorative, up-to-date, internationally accepted IT governance control framework for adaption by enterprises and day-to-day use by business managers, IT professionals and assurance professionals. 14
  15. 15. COBIT fits in • Business-focused • Business goals and IT goals, COBIT’s information criteria, COBIT’s IT resources • Process-oriented • Domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), Monitor and Evaluate (ME) • Controls-based • Process controls, Business and IT controls, IT general controls and application controls • Measurement-driven • Maturity models 15
  16. 16. COBIT is business-focused Business drive the which requirements investments in responds to IT Enterprise Resources COBIT information that are IT to deliver used by Processes 16
  17. 17. COBIT is process-oriented • Plan and Organise • Provides direction to solution Plan and organise delivery (AI) and service delivery (DS) • Acquire and Implement Acquire Deliver • Provides the solutions and passes and and them to be turned into services implement support • Deliver and Support • Receives the solutions and makes them usable for end users Monitor and evaluate • Monitor and Evaluate • Monitors all processes to ensure that the direction provided is followed 17
  18. 18. COBIT is controls-based • COBIT defines • Control objectives for all 34 processes • Overarching process and application controls • Control objectives • Reasonable assurance that business objectives will be achieved and undesired events will be prevented or detected and corrected • Consist of the policies, procedures, practices and organisational structures • Statements of managerial actions to increase value or reduce risk • Some controls apply to all processes • Six overarching process controls • Six overarching application controls 18
  19. 19. COBIT is measurement-driven • COBIT Maturity levels • profiles of IT processes • not a threshold model • Process maturity • Process may be mainly at level 3 • However some parts can be at lower levels • And some even at the highest level of 5 (optimised) • It is misleading to say that the process is not defined if part of it is not complete 19
  20. 20. History of COBIT • A framework and a knowledge base for managing IT • created by ISACA and the IT Governance Institute in 1994 • Former name of IT Governance Institute was the Information Systems Audit and Control Foundation (ISACF) – renamed in 2003 • COBIT was transferred to the IT Governance Institute in 1999 Governance COBIT4 & 4.1 Management COBIT3 Control COBIT2 Audit COBIT1 20
  21. 21. COBIT 4.1 • A single publication consisting of four sections • Executive Overview • The COBIT framework • The core content • Framework processes • Control Objectives • Management Guidelines • Maturity Models • Appendixes I through VIII • I -Tables linking goals and processes • II - Mapping IT processes to IT Governance focus areas, COSO, COBIT IT resources and COBIT Information criteria • V - Cross-references Between COBIT 3rd Edition and COBIT 4.1 21
  22. 22. COBIT 4.1 – the core content • Frameworks • Organize IT Governance objectives and good practices by IT domains and processes, and links them to business requirements • Control Objectives • Provide a complete set of high-level requirements to be considered by management for effective control of each process • Management Guidelines / Maturity Models • Help assign responsibility, measure performance, and benchmark and address gaps in capability 22
  23. 23. Interrelationships of COBIT components requirements information nto ni ow con nd au by troll ke ed b dit bro d y re ed su ea wi m th derived from ce for outcome an m r im rfo by th ple fo wi e ed rp rm me d rm fo te nte at di fo ur er dw au it p ith y based on IT Governance Institute – COBIT 4.1 Executive Overview, 2007 23
  24. 24. The COBIT Cube Business Requirements lity s es ce i ty y i ty tia rity en enc bil ian abil n v ti e l i a g ail omp fid Inte c li f e c Ef f i Re on Av Ef C C Infrastructure People DOMAINS Information Applications IT Processes PROCESSES ACTIVITIES s ce ur o s Re IT IT Governance Institute, COBIT 4.1 24
  25. 25. Basic principle of the COBIT Framework that respond to the Business Requirements Information Criteria IT Goals DOMAINS IT Processes PROCESSES to achieve are managed by ACTIVITIES s ce ur o s Re IT 25
  26. 26. Plan and Organise domain - processes • PO1 Define a Strategic IT Plan • PO2 Define the Information Architecture • PO3 Determine Technological Direction • PO4 Define the IT Processes, Organisation and Relationships • PO5 Manage the IT Investment • PO6 Communicate Management Aims and Direction • PO7 Manage IT Human Resources • PO8 Manage Quality • PO9 Assess and Manage IT Risks • PO10 Manage Projects 26
  27. 27. Acquire and Implement domain - processes • AI1 Identify Automated Solutions • AI2 Acquire and Maintain Application Software • AI3 Acquire and Maintain Technology Infrastructure • AI4 Enable Operation and Use • AI5 Procure IT Resources • AI6 Manage Changes • AI7 Install and Accredit Solutions and Changes 27
  28. 28. Deliver and Support domain - processes • DS1 Define and Manage Service Levels • DS2 Manage Third-party Services • DS3 Manage Performance and Capacity • DS4 Ensure Continuous Service • DS5 Ensure Systems Security • DS6 Identify and Allocate Costs • DS7 Educate and Train Users • DS8 Manage Service Desk and Incidents • DS9 Manage the Configuration • DS10 Manage Problems • DS11 Manage Data • DS12 Manage the Physical Environment • DS13 Manage Operations 28
  29. 29. Monitor and Evaluate domain - processes • ME1 Monitor and Evaluate IT Performance • ME2 Monitor and Evaluate Internal Control • ME3 Ensure Compliance With External Requirements • ME4 Provide IT Governance 29
  30. 30. Process Controls • COBIT defines control objectives for all 34 processes • Each of the COBIT processes has • A high-level control objective – the process description • A number of detailed control objectives • As a whole, they are the characteristics of a well-managed process • COBIT defines also overarching process controls • That apply to all processes • And should be considered together with the process control objectives to have a complete view of control requirements 30
  31. 31. Process Controls • The detailed control objectives are identified by a two- character domain reference (PO, AI, DS, ME) plus a process number and control objective number • E.g., PO10 Manage Projects, has 14 detailed control objectives • From PO10.1 to PO10.14 • When DS2 Manage Third-party Services has four • From DS2.1 to DS2.4 • The overarching Process Controls are numbered • From PC1 to PC6 31
  32. 32. COBIT Maturity model • Similar to CMM • Interpreted for the nature of COBIT’s IT management processes • A generic maturity scale • A specific model generated for each COBIT IT process • Not a threshold model • Designed as profiles of IT processes • Possible current and future states • Using the maturity models management can identify • The actual performance of the enterprise – Where the enterprise is today • the current status of the industry – The comparison • the enterprises target for improvement – Where the enterprise wants to be • The required growth path between as-is and to-be 32
  33. 33. COBIT Maturity model • COBIT Maturity levels • profiles of IT processes • not a threshold model • Process maturity • Process may be mainly at level 3 • However some parts can be at lower levels • And some even at the highest level of 5 (optimised) • It is misleading to say that the process is not defined if part of it is not complete 33
  34. 34. COBIT Maturity Model • Generic Maturity Model • 0 - (Non-existent) management processes are not applied at all • 1 – (Initial/Ad Hoc) processes are ad hoc and disorganised • 2 – (Repeatable but intuitive) processes follow a regular pattern • 3 – (Defined Process) processes are documented and communicated • 4 – (Managed and Measurable) processes are monitored and measured • 5 – (Optimised) good practices are followed and automated 34
  35. 35. Goal Relationship example Maintain enterprise reputation and Leadership. Business Goal Ensure that IT Services can resist and recover from attacks. IT Goals Detect and resolve unauthorised access. Process Goals Understand security requirements, vulnerabilities and threats. Activity Goals 35
  36. 36. Outcome measure, Performance indicator example IT Goal Process Goal Ensure that Detect and resolve IT Services can unauthorised resist and recover Dri access. from attacks. ve Number of actual Number of actual incidents because IT incidents with of unauthorised business impact access Outcome measure Outcome measure Performance indicator Performance indicator 36
  37. 37. COBIT Framework Business Requirements Information Criteria he ot t nd spo Quality Security Fiduciary t re ha t ss lity e ne ncy lity i ty nc tia rity e bil plia iabi iv n ie ct fic nfide nteg vaila om l ffe Ef Re I E o C A C DOMAINS IT Goals Plan and Organise (PO) Infrastructure People Acquire and Implement (AI) to achieve Deliver and Support (DS) Information Monitor and Evaluate (ME) Applications PROCESSES High level and detailed IT goals control objectives Process goals IT Processes Maturity models Activity goals Outcome measures ACTIVITIES Performance indicators s ce ur o s Re IT are managed by 37
  38. 38. COBIT Core Components • Each COBIT IT process has • Section one - Process Description • Process description • Summary of the objectives - presented in a waterfall • Mapping of the process to – Information criteria, IT resources, IT governance focus areas • Section two – Control Objectives • Detailed control objectives for this process • Section three – Management Guideline • Process inputs and outputs, RACI chart, goals and metrics • Section four – Maturity model • Maturity model for this process 38
  39. 39. Cobit Framework
  40. 40. COBIT Framework Navigation IT Governance Institute, COBIT 4.1 40
  41. 41. Example : DS2 • The following slides are an example of the content of COBIT • Process: DS2 Manage Third-party Services
  42. 42. DS2 Mapping to Information Criteria Summary of the objectives in a waterfall Mapping to IT governance focus areas Mapping to IT resources IT Governance Institute, COBIT 4.1 42
  43. 43. DS2 - Process Description DS2 Manage Third-party Services The need to assure that services provided by third parties (suppliers, vendors and partners) meet business requirements requires an effective third-party management process. This process is accomplished by clearly defining the roles, responsibilities and expectations in third-party agreements as well as reviewing and monitoring such agreements for effectiveness and compliance. Effective management of third-party services minimises the business risk associated with non-performing suppliers. 43
  44. 44. DS2 Manage Third-party Services • DS2 mappings to • Information criteria • IT resources • IT Governance focus areas • P primary relationship • S secondary relationship 44
  45. 45. DS2 Waterfall 45
  46. 46. Control Objectives • Control objectives • Reasonable assurance that business objectives will be achieved and undesired events will be prevented or detected and corrected • Consist of the policies, procedures, practices and organisational structures • Statements of managerial actions to increase value or reduce risk • Each of the COBIT processes has • A high-level control objective – the process description • A number of detailed control objectives • As a whole, they are the characteristics of a well-managed process 46
  47. 47. DS2 – Control Objectives IT Governance Institute, COBIT 4.1 47
  48. 48. COBIT Control Practices • Provides guidance on why controls are worth implementing • Why - Value drives and Risk drivers • And how to implement them • Helps to justify and design the specific controls needed to improve IT Governance • How, why and what to implement for each control objective • to improve IT performance • to address IT solution and service delivery risks • Not included in COBIT 4.1 • A separate publication 48
  49. 49. DS2 - Management Guidelines Process Process inputs outputs RACI chart Goals and metrics 49
  50. 50. Management Guidelines • Process inputs • What the process owner needs from others • Inputs come also from other sources than COBIT • Process outputs • What the process owner has to deliver • RACI chart • What has to be delegated and to whom • Goals and metrics • How the process should be measured 50
  51. 51. DS2 – Process inputs and outputs PO1 Define a strategic IT plan PO8 Manage quality AI5 Procure IT resources DS1 Define and manage service levels DS4 Ensure continuous service ME1 Monitor and evaluate IT performance AI5 Procure IT resources PO9 Assess and manage IT risks 51
  52. 52. RACI chart • Responsible • The person or people responsible for getting the job don • Correct execution of the process and the activities • Potential OLA opportunities • Accountable • Only one person can be accountable for each task • Ownership of quality, and end result of the process • Consulted • The people who are consulted and whose opinions are sought • Involvement through input of knowledge and information • Informed • The people who are kept up-to-date on progress • Receiving information about process execution and quality • Helps to expose communication and workflow paths 52
  53. 53. DS2 - RACI chart 53
  54. 54. Outcome measure, Performance indicator example IT Goal Process Goal Ensure that Detect and resolve IT Services can unauthorised resist and recover Dri access. from attacks. ve Number of actual Number of actual incidents because IT incidents with of unauthorised business impact access Outcome measure Outcome measure Performance indicator Performance indicator 54
  55. 55. DS2 – Goals and metrics 55
  56. 56. DS2 – Maturity model – levels 0 through 2 56
  57. 57. DS2 – Maturity model – levels 3 through 5 57
  58. 58. More information? Ben Kalland ITIL Expert and Cobit Foundation certified consultant Accredited ITIL trainer ben.kalland@tieturi.fi Tieturi Oy, HTC Santa Maria Tammasaarenkatu 5 00180 HELSINKI www.tieturi.fi/itil

×