What is Cobit

Business is evolving, you should too.

Helsinki, Tampere, Turku, Tukholma, Göteborg | www.tieturi.fi

What is COBIT?Ben Kalland, Tieturi

Governance?

It may actually work!

Because we have:• Experience• Luck• A culture of ‘Quick and Dirty’

But what happens when we need to:• Document• Improve• Find an error• Transfer responsibility= we need governance

Why do we need to govern?

• Stakeholders expect• Current business is stable and creates value• Responsiveness to changing business models

• These contradictory expectations can be achieved with• Governance of enterprise’s IT

• Governance responsibilities • Strategy generation• Value Delivery• Risk Management• Performance Measurement

4

IT Governance Focus Areas

• The five main focus areas of IT Governance, all driven by stakeholder value

• Two of them are outcomes• Value Delivery• Risk Management

• Three of them are drivers• Strategic Alignment• Resource Management (which

overlays them all)• Performance Measurement

• IT Governance is a continuous life cycle, which can be entered at any point

5

STRATEGIC

ALIGNMENT

RESOURCEMANAGEMENT

PERFORM

ANCE

MEASUREM

ENT

RISK

MAN

AGEM

ENT

VALUEDELIVERY

IT GOVERNANCE

IT Governance Institute, 2003 – Board Briefing on IT Governance, 2nd edition, 2006, COBIT 4.1 Executive Overview, 2007

What do we get from governing?

• Board and executives have a clear picture of the performance of IT

• Better investment decisions• Trust that IT achieves objectives as directed

• Clearly assigned roles and responsibilities • Help management to execute strategy and encourage desirable

behavior• Transparency in governance

• Improves stakeholder confidence in the responsibility, accountability and competitive position of the enterprise

• Enable customers to influence services - customer satisfaction• Improves employee satisfaction and reduces retention

6

What do we get from governing?

• Balanced operations• IT can respond to the business needs and • at the same time maintain and improve the stability and quality of

services in a cost-efficient manner• Outsourced services can be directed and controlled clearly

• Enables effective, efficient and adaptable relationships• Improved ROI and VOI

• Effective governance eliminates redundancy, overlap and lack of clarity, helps to reduce failures, optimize costs and increase efficiency

• Compliance to rules and legislation is achieved and maintained

7

Frameworks, standards and players

• ITIL (Information Technology Infrastructure Library)

• A set of guidance, a collection of Best Practices for IT ServiceManagement - IT Service Management Framework

• ISO/IEC 20000• International standard for IT Service Management

• TOGAF (Open Group Architecture Framework)

• A framework for Enterprise Architecture• A comprehensive approach to the design, planning, implementation,

and governance of an enterprise information architecture

8


• COBIT • created by ISACA and the IT Governance Institute initially in 1996• provides a generally accepted, practical toolset: • enables good practice for IT control through organization• highlights link between business and IT goals• emphasized regulatory compliance• An authoritative, up-to-date, internationally and generally

accepted, internal control framework for IT governance

9

• CMMI (Capability Maturity Model Integration) • A process improvement approach

• helps integrate traditionally separate organizational functions

• set process improvement goals and priorities• provide guidance for quality processes


• ISO/IEC 27001• an information security standard published in 2005• intended to be used in conjunction with ISO/IEC 27002, the Code of

Practice for Information Security Management

• ISO/IEC 27002 • Based on the British Standard (BS) 7799-1:1999 • published in 2005• renumbered ISO/IEC 27002:2005 in July 2007• ISO/IEC 27002 provides best practice recommendations on information

security management for use by those who are responsible for initiating, implementing or maintaining Information Security Management Systems (ISMS).

10


• AS8015• An Australian standard for IT Governance, published in 2005• Provides principles, a model and vocabulary as a basic framework

for implementing effective corporate governance of ICT

• ISO/IEC 38500 (very closely based on AS8015)

• Corporate governance of information technology standard• Provides guiding principles for directors of organizations (including

owners, board members, directors, partners, senior executives, or similar) on the effective, efficient, and acceptable use of Information Technology (IT) within their organizations.

11

Why COBIT?

• COBIT is used in many companies to provide a framework for governance and implementation of internal controls

• COBIT includes the essential business and IT process controls and objectives needed to achieve corporate objectives

• COBIT is written at the management level and driven by business requirements

• COBIT is aligned with other IT practices and standards but is more complete than others

• COBIT is generally accepted as the internal IT control framework

12

COBIT

• Control Objectives for Information and related Technology

• COBIT supports IT governance by providing a frameworkto ensure that

• IT is aligned with the business• IT enables the business and maximises benefits• IT resources are used responsibly• IT risks are managed appropriately

• Designed to support• Executive and management boards• Business and IT management• Governance, assurance, control, security professionals

13

COBIT mission

• To research, develop, publicise and promote an authorative, up-to-date, internationally accepted IT governance control framework for adaption byenterprises and day-to-day use by business managers, IT professionals and assurance professionals.

14

COBIT fits in

• Business-focused• Business goals and IT goals, COBIT’s information criteria, COBIT’s IT

resources• Process-oriented

• Domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), Monitor and Evaluate (ME)

• Controls-based• Process controls, Business and IT controls, IT general controls and

application controls• Measurement-driven

• Maturity models

15

COBIT is business-focused

16

Businessrequirements

ITResources

IT Processes

Enterpriseinformation COBIT

drive the investments in

that areused byto deliver

whichresponds to

COBIT is process-oriented

• Plan and Organise• Provides direction to solution

delivery (AI) and service delivery (DS)

• Acquire and Implement• Provides the solutions and passes

them to be turned into services

• Deliver and Support• Receives the solutions and makes

them usable for end users

• Monitor and Evaluate• Monitors all processes to ensure

that the direction provided is followed

17

Plan and organise

Monitor and evaluate

Acquireand

implement

Deliverand

support

COBIT is controls-based

• COBIT defines• Control objectives for all 34 processes• Overarching process and application controls

• Control objectives• Reasonable assurance that business objectives will be achieved

and undesired events will be prevented or detected and corrected• Consist of the policies, procedures, practices and organisational

structures• Statements of managerial actions to increase value or reduce risk

• Some controls apply to all processes• Six overarching process controls• Six overarching application controls

18

COBIT is measurement-driven

• COBIT Maturity levels • profiles of IT processes• not a threshold model

• Process maturity• Process may be mainly at

level 3• However some parts can be at

lower levels• And some even at the highest

level of 5 (optimised)

• It is misleading to say that the process is not defined if part of it is not complete

19

History of COBIT

• A framework and a knowledge base for managing IT• created by ISACA and the IT Governance Institute in 1994

• Former name of IT Governance Institute was the Information Systems Audit and Control Foundation (ISACF) – renamed in 2003

• COBIT was transferred to the IT Governance Institute in 1999

20

GovernanceCOBIT4 & 4.1Management

COBIT3ControlCOBIT2Audit

COBIT1

COBIT 4.1

• A single publication consisting of four sections• Executive Overview• The COBIT framework• The core content

• Framework processes• Control Objectives• Management Guidelines• Maturity Models

• Appendixes I through VIII• I -Tables linking goals and processes• II - Mapping IT processes to IT Governance focus areas, COSO,

COBIT IT resources and COBIT Information criteria• V - Cross-references Between COBIT 3rd Edition and COBIT 4.1

21

COBIT 4.1 – the core content

• Frameworks• Organize IT Governance objectives and good practices by IT

domains and processes, and links them to business requirements

• Control Objectives• Provide a complete set of high-level requirements to be

considered by management for effective control of each process

• Management Guidelines / Maturity Models• Help assign responsibility, measure performance, and benchmark

and address gaps in capability

22

Interrelationships of COBIT components

23

based on

requirements information

implemented withaudite

d with

broken down into

measu

red by

audited with

controlled by

derivedfrom

for maturityfor o

utco

me

for pe

rform

ance

perform

ed by

IT Governance Institute – COBIT 4.1 Executive Overview, 2007

The COBIT Cube

24

Effectiveness

Availability

Integrity

Confidentiality

Efficiency

Business Requirements

Compliance

Peop

le

Infr

astr

uctu

re

Info

rmat

ion

App

licat

ions

DOMAINS

PROCESSES

ACTIVITIES

IT P

roce

sses

IT Resources

Reliability

IT Governance Institute, COBIT 4.1

Basic principle of the COBIT Framework

25


DOMAINS

PROCESSES

ACTIVITIES

IT P

roce

sses

IT Resources

Information Criteria

that respond to the

to achieve

are managed by

IT Goals

Plan and Organise domain - processes

• PO1 Define a Strategic IT Plan• PO2 Define the Information Architecture• PO3 Determine Technological Direction• PO4 Define the IT Processes, Organisation and Relationships• PO5 Manage the IT Investment• PO6 Communicate Management Aims and Direction• PO7 Manage IT Human Resources• PO8 Manage Quality• PO9 Assess and Manage IT Risks• PO10 Manage Projects

26

Acquire and Implement domain - processes

• AI1 Identify Automated Solutions• AI2 Acquire and Maintain Application Software• AI3 Acquire and Maintain Technology Infrastructure• AI4 Enable Operation and Use• AI5 Procure IT Resources• AI6 Manage Changes• AI7 Install and Accredit Solutions and Changes

27

Deliver and Support domain - processes• DS1 Define and Manage Service Levels• DS2 Manage Third-party Services• DS3 Manage Performance and Capacity• DS4 Ensure Continuous Service• DS5 Ensure Systems Security• DS6 Identify and Allocate Costs• DS7 Educate and Train Users• DS8 Manage Service Desk and Incidents• DS9 Manage the Configuration• DS10 Manage Problems• DS11 Manage Data• DS12 Manage the Physical Environment• DS13 Manage Operations

28

Monitor and Evaluate domain - processes

• ME1 Monitor and Evaluate IT Performance• ME2 Monitor and Evaluate Internal Control• ME3 Ensure Compliance With External Requirements• ME4 Provide IT Governance

29

Process Controls

• COBIT defines control objectives for all 34 processes

• Each of the COBIT processes has• A high-level control objective – the process description• A number of detailed control objectives• As a whole, they are the characteristics of a well-managed

process

• COBIT defines also overarching process controls• That apply to all processes• And should be considered together with the process control

objectives to have a complete view of control requirements

30

Process Controls

• The detailed control objectives are identified by a two-character domain reference (PO, AI, DS, ME) plus a process number and control objective number

• E.g., PO10 Manage Projects, has 14 detailed control objectives• From PO10.1 to PO10.14

• When DS2 Manage Third-party Services has four• From DS2.1 to DS2.4

• The overarching Process Controls are numbered• From PC1 to PC6

31

COBIT Maturity model

• Similar to CMM• Interpreted for the nature of COBIT’s IT management processes• A generic maturity scale• A specific model generated for each COBIT IT process• Not a threshold model• Designed as profiles of IT processes

• Possible current and future states• Using the maturity models management can identify

• The actual performance of the enterprise – Where the enterprise is today• the current status of the industry – The comparison• the enterprises target for improvement – Where the enterprise wants to be• The required growth path between as-is and to-be

32

COBIT Maturity model

• COBIT Maturity levels • profiles of IT processes• not a threshold model

• Process maturity• Process may be mainly at

level 3• However some parts can be at

lower levels• And some even at the highest

level of 5 (optimised)

• It is misleading to say that the process is not defined if part of it is not complete

33

COBIT Maturity Model

• Generic Maturity Model• 0 - (Non-existent) management processes are not applied at all• 1 – (Initial/Ad Hoc) processes are ad hoc and disorganised• 2 – (Repeatable but intuitive) processes follow a regular pattern• 3 – (Defined Process) processes are documented and communicated• 4 – (Managed and Measurable) processes are monitored and measured• 5 – (Optimised) good practices are followed and automated

34

Goal Relationship example

35

Process Goals

Activity Goals

Maintainenterprise

reputation andLeadership.

Understand security requirements,

vulnerabilities and threats.

Ensure thatIT Services can

resist and recover from attacks.

Detect and resolveunauthorised

access.

IT Goals

Business Goal

Outcome measure, Performance indicator example

36




access.

IT Goal Process Goal

Number of actualincidents because

of unauthorisedaccess

Number of actualIT incidents withbusiness impact

Outcome measure

Performance indicator

Outcome measure

Performance indicatorDrive

COBIT Framework

37

IT goalsProcess goalsActivity goals

Outcome measuresPerformance indicators

Effectiveness

Availability

Integrity

Confidentiality

Efficiency


Compliance

Peop

le

Infr

astr

uctu

re

Info

rmat

ion

App

licat

ions

DOMAINSPlan and Organise (PO)Acquire and Implement (AI)Deliver and Support (DS)Monitor and Evaluate (ME)

PROCESSESHigh level and detailed

control objectivesMaturity models

ACTIVITIES

IT Resources

Reliability

Information Criteria

Quality FiduciarySecurity

IT P

roce

sses

that respond to the

to achieve

are managed by

IT Goals

COBIT Core Components

• Each COBIT IT process has• Section one - Process Description

• Process description• Summary of the objectives - presented in a waterfall• Mapping of the process to

– Information criteria, IT resources, IT governance focus areas• Section two – Control Objectives

• Detailed control objectives for this process• Section three – Management Guideline

• Process inputs and outputs, RACI chart, goals and metrics• Section four – Maturity model

• Maturity model for this process

38

Cobit Framework

COBIT Framework Navigation

40


Example : DS2

• The following slides are an example of the content of COBIT

• Process: DS2 Manage Third-party Services

DS2

42


Mapping toInformationCriteria

Summary of the objectivesin a waterfall

Mapping to IT resources

Mapping to IT governancefocus areas

DS2 - Process Description

DS2 Manage Third-party Services

The need to assure that services provided by third parties (suppliers, vendors and partners) meet business requirements requires an effective third-party management process. This process is accomplished by clearly defining the roles, responsibilities andexpectations in third-party agreements as well as reviewing and monitoring such agreements for effectiveness and compliance. Effective management of third-party services minimises the business risk associated with non-performing suppliers.

43

DS2 Manage Third-party Services

44

• DS2 mappings to• Information criteria• IT resources• IT Governance focus areas

• P primary relationship• S secondary relationship

DS2 Waterfall

45

Control Objectives

• Control objectives• Reasonable assurance that business objectives will be achieved

and undesired events will be prevented or detected and corrected• Consist of the policies, procedures, practices and organisational

structures• Statements of managerial actions to increase value or reduce risk

• Each of the COBIT processes has• A high-level control objective – the process description• A number of detailed control objectives• As a whole, they are the characteristics of a well-managed

process

46

DS2 – Control Objectives

47


COBIT Control Practices

• Provides guidance on why controls are worth implementing• Why - Value drives and Risk drivers

• And how to implement them• Helps to justify and design the specific controls needed to

improve IT Governance• How, why and what to implement for each control objective

• to improve IT performance • to address IT solution and service delivery risks

• Not included in COBIT 4.1• A separate publication

48

DS2 - Management Guidelines

49

Processoutputs

Processinputs

RACIchart

Goals andmetrics

Management Guidelines

• Process inputs• What the process owner needs from others

• Inputs come also from other sources than COBIT• Process outputs

• What the process owner has to deliver• RACI chart

• What has to be delegated and to whom• Goals and metrics

• How the process should be measured

50

DS2 – Process inputs and outputs

51

PO1 Define a strategic IT planPO8 Manage qualityAI5 Procure IT resourcesDS1 Define and manage service levelsDS4 Ensure continuous service

ME1 Monitor and evaluate IT performanceAI5 Procure IT resourcesPO9 Assess and manage IT risks

RACI chart

• Responsible• The person or people responsible for getting the job don• Correct execution of the process and the activities• Potential OLA opportunities

• Accountable• Only one person can be accountable for each task• Ownership of quality, and end result of the process

• Consulted• The people who are consulted and whose opinions are sought• Involvement through input of knowledge and information

• Informed• The people who are kept up-to-date on progress• Receiving information about process execution and quality• Helps to expose communication and workflow paths

52

DS2 - RACI chart

53

Outcome measure, Performance indicator example

54




access.

IT Goal Process Goal

Number of actualincidents because

of unauthorisedaccess

Number of actualIT incidents withbusiness impact

Outcome measure

Performance indicator

Outcome measure

Performance indicatorDrive

DS2 – Goals and metrics

55

DS2 – Maturity model – levels 0 through 2

56

57

DS2 – Maturity model – levels 3 through 5

More information?

Ben KallandITIL Expert and Cobit Foundation certified consultantAccredited ITIL trainer

[email protected]

Tieturi Oy, HTC Santa MariaTammasaarenkatu 500180 HELSINKIwww.tieturi.fi/itil