2009 ISACAITGI All rights reserved IT Management Frameworks

© 2009 ISACA/ITGI. All rights reserved. IT Management Frameworks A Valued Approach to Strengthening IT Management John Beveridge Office of the State Auditor Massachusetts Digital Government Summit Boston, Massachusetts October 19, 2009

John Beveridge, CISA, CISM, CGFM, CFE, CGEIT, CQA • Deputy Auditor Office of the State Auditor Room 1819, One Ashburton Place Boston, MA 021087 • Co-Chair of Commonwealth’s Enterprise Security Board • Adjunct faculty member • 617. 727. 6200 e-mail: john. beveridge@sao. state. ma. us

© 2009 ISACA/ITGI. All rights reserved. In This Presentation. . . • Driving forces for IT governance and Control Objectives for Information and related Technology (COBIT®) • An introduction to: – The COBIT framework – COBIT supporting materials • Where COBIT fits with other frameworks and standards

© 2009 ISACA/ITGI. All rights reserved. The Governance Environment

© 2009 ISACA/ITGI. All rights reserved. Forces Driving IT Governance Compliance Business/IT Alignment ROI Project Execution Security

Need for IT Governance Do these conditions sound familiar? § § § Increasing pressure to leverage technology in business strategies Growing complexity of IT environments Fragmented IT infrastructure; fragmented security infrastructures Communication gaps between business and IT managers IT service levels from internal IT functions that appear disappointing

Need for IT Governance Do these conditions sound familiar? § Lack of assurance of adequate security by § § outsourced IT providers IT costs perceived to be out of control; yet under-funded IT security Marginal or unknown ROI/productivity gains on IT investments Impaired organizational flexibility and nimbleness to change User frustration leading to ad hoc solutions

© 2009 ISACA/ITGI. All rights reserved. IT Governance Needs a Management Framework R Man isk agem ent IT Governance Focus Areas Domains nece rmaancen tt en roform em rerm PPeerfasausu ee MM Driving Forces Map Onto the IT Governance Focus Areas ic t D Val g ue te en e a l ive r St ignm ry l A IT Resource Management

© 2009 ISACA/ITGI. All rights reserved. IT Governance Objectives • IT is aligned with the business enabling the business to maximize benefit • IT resources are safeguarded and used in a responsible and ethical manner • IT-related risks are addressed through appropriate controls and managed to minimize risk and exposure • IT performance is measured and evaluated for ROI

© 2009 ISACA/ITGI. All rights reserved. To Manage and Control IT, the Organization needs to: • Employ the fundamentals of IT governance • Have a clear understanding of the strategic value of technology • Have appropriate frameworks of control • Build and exercise mechanisms to provide adequate assurance that IT governance objectives are addressed

© 2009 ISACA/ITGI. All rights reserved. How Does COBIT Link to IT Governance? Direction and Resourcing Requirements Goals Control Objectives Business Governance IT Information the business needs to achieve its objectives Responsibilities Information executives and board need to exercise their responsibilities IT Governance

© 2009 ISACA/ITGI. All rights reserved. IT Governance Institute References Governance Business and Technology Management Governance, Security and Assurance Management IT Governance C OBI T Control Board Information Briefing on IT Assurance Val IT COBIT 4. 1 Implementation Practices Security IT Governance Guide

© 2009 ISACA/ITGI. All rights reserved. An Overview of COBIT

© 2009 ISACA/ITGI. All rights reserved. Cobi. T is a valuable IT governance tool that helps in the understanding and management of risks and benefits associated with information integrity, security, and availability, and the management of related technology.

© 2009 ISACA/ITGI. All rights reserved. How it Appears to the Instructor

© 2009 ISACA/ITGI. All rights reserved. l Authoritative, up-to-date, international set of generally accepted IT control objectives and control practices for day-to-day use by business managers and auditors. l Structured and organized to provide a powerful control model

© 2009 ISACA/ITGI. All rights reserved. • “Right” information, to only the “right” party, in the “right” format, at the “right” time, at the “right” cost. • Information that is relevant, reliable, secure, and available. • Information provided by systems that have integrity by means of a well-managed and properly controlled IT environment.

© 2009 ISACA/ITGI. All rights reserved. COBIT 4. 1—The IT Governance Framework CCobi. T OBIT good best practices repository for IT Processes IT Management Processes IT Governance Processes The only IT management and control framework that covers the end-to-end IT life cycle Internationally accepted good practices Management-oriented Supported by tools and training Freely available Sharing knowledge and leveraging expert volunteers Continually evolving Maintained by reputable notfor-profit organisation Maps 100 percent to COSO Maps strongly to all major related standards

© 2009 ISACA/ITGI. All rights reserved. COBIT 4. 1—The IT Governance Framework CCobi. T OBIT good best practices repository for IT Processes IT Management Processes IT Governance Processes Cobi. T is a reference, a set of best practices, not an ‘off-the-shelf’ cure Enterprises still to need to analyse their control requirements and customise based on: Ø Value drivers Ø Risk profile Ø IT infrastructure, organisation and project portfolio

© 2009 ISACA/ITGI. All rights reserved. Cobi. T Sources Professional standards for internal control and auditing Professional standards for internal and (COSO, AICPA, IIA, AICPA, etc) auditing. IFAC, (COSO, IFAC, IIA, etc) Technical standards (ISO, EDIFACT, etc. ) Codes of Conduct Qualification criteria for IT systems and processes Qualification criteria (ISO 9000, ITSEC, TCSEC, for etc. )IT systems and processes (ISO 9000, ITSEC, TCSEC, etc. ) forums Industry practices and requirements from industry (ESF, I 4) practices and requirements from Industry Emerging industry-specific industry forums (ESF, I 4)requirements from banking, e -com, IT manufacturing.

© 2009 ISACA/ITGI. All rights reserved. Cobi. T Framework

© 2009 ISACA/ITGI. All rights reserved. Cobi. T Framework Ø Documents relationships among information criteria, IT resources, and IT processes Ø Links control objectives and control practices to business processes and business objectives Ø Assists in confirming that appropriate IT processes (and practices) are in place Ø Facilitates evaluation and assurance methods

© 2009 ISACA/ITGI. All rights reserved. IT Resource Management Cobi. T underscores and demonstrates that IT resources need to be managed in order to provide organizations with type and quality of information required to achieve organizational objectives.

© 2009 ISACA/ITGI. All rights reserved. Framework’s Three Components Ø Business Requirements for Information Ø IT Resources Ø IT Processes

© 2009 ISACA/ITGI. All rights reserved. Information Criteria -- The 1 st Component • Effectiveness • Efficiency • Confidentiality • Integrity • Availability • Compliance • Reliability of Information

© 2009 ISACA/ITGI. All rights reserved. IT Resources -- The 2 nd Component • Application Systems • Information • Infrastructure Facilities • People

© 2009 ISACA/ITGI. All rights reserved. Process Orientation Domains Natural grouping of processes, often matching an organisational domain of responsibility A series of joined activities with natural control breaks Processes Activities or Tasks Actions needed to achieve a measurable result—activities have a life cycle whereas tasks are discrete

Key Driving Forces for COBIT © 2009 ISACA/ITGI. All rights reserved. The resources made available to—and built up by—IT IT Resources Ü Data Ü Application systems Ü Technology Ü Facilities Ü People How IT is organised to respond to the requirements IT Processe s Ü Plan and Organise Ü Aquire and Implement Ü Deliver and Support Ü Monitor and Evaluate What the stakeholders expect from IT Business Requirements Ü Ü Ü Ü Effectiveness Efficiency Confidentiality Integrity Availability Compliance Information reliability

© 2009 ISACA/ITGI. All rights reserved. Process Orientation IT Domains • Plan and Organise • Acquire and Implement • Deliver and Support • Monitor and Evaluate Natural grouping of processes, often matching an organisational domain of responsibility IT Processes • • IT strategy Computer operations Incident handling Acceptance testing Change management Contingency planning Problem management A series of joined activities with natural (control) breaks Activities • • • Record new problem. Analyse. Propose solution. Monitor solution. Record known problem. Etc. Actions needed to achieve a measurable result—activities have a life cycle whereas tasks are discrete

© 2009 ISACA/ITGI. All rights reserved. COBIT Domains: ck a b Plan and Organize d e Fe Monitor and Evaluate Feedback Fe ed ba c k Deliver and Support Acquire and Implement

© 2009 ISACA/ITGI. All rights reserved. COBIT Processes Plan and Organise Acquire and Implement PO 1 PO 2 PO 3 PO 4 PO 5 PO 6 PO 7 PO 8 PO 9 PO 10 Define an IT Strategic Plan Define the Information Architecture Determine Technological Direction Define the IT Processes, Organisation and Relationships Manage the IT Investment Communicate Management Aims and Direction Manage IT Human Resources Manage Quality Assess and Manage IT Risks Manage Projects

© 2009 ISACA/ITGI. All rights reserved. COBIT Processes Deliver and Support Monitor and Evaluate ME 1 ME 2 ME 3 ME 4 Monitor and Evaluate IT Performance Monitor and Evaluate Internal Control Ensure Compliance With External Requirements Provide IT Governance

© 2009 ISACA/ITGI. All rights reserved. Domains Process Orientation Plan and Organise • • • Description – This domain covers strategy and tactics, and concerns the identification of the way IT can best contribute to the achievement of the business objectives. Furthermore, the realisation of the strategic vision needs to be planned, communicated and managed for different perspectives. Finally, a proper organisation as well as technological infrastructure must be put in place. Topics – Strategy and tactics – Vision planned – Organisation and infrastructure Questions – Are IT and the business strategy aligned? – Is the enterprise achieving optimum use of its resources? – Does everyone in the organisation understand the IT objectives? – Are IT risks understood and being managed? – Is the quality of IT systems appropriate for business needs?

© 2009 ISACA/ITGI. All rights reserved. Digging Into COBIT

© 2009 ISACA/ITGI. All rights reserved. COBIT Framework • COBIT framework provides guidance on IT governance and the role of IT control. • Generic controls: – Controls that relate to IT processes and Control Objectives

© 2009 ISACA/ITGI. All rights reserved. Process-level Navigating in COBIT

The WATERFALL Navigation Aid -High Level Control Objectives for Each Process High-Level Control Objective The control of IT Processes which satisfy Business Requirements is focusing on Control Statements Is achieved by Control Practices Is measured by Users satisfaction

© 2009 ISACA/ITGI. All rights reserved. Which Domain?

© 2009 ISACA/ITGI. All rights reserved. Process Description All changes, including emergency maintenance and patches, relating to infrastructure and applications within the production environment are formally managed in a controlled manner. Changes (including those to procedures, processes, system and service parameters) are logged, assessed and authorized prior to implementation, and reviewed against planned outcomes following implementation. This assures mitigation of the risks of negatively impacting the stability or integrity of the production environment.

© 2009 ISACA/ITGI. All rights reserved. The Waterfall of Control c

© 2009 ISACA/ITGI. All rights reserved. Information Criteria

© 2009 ISACA/ITGI. All rights reserved. IT Resources

© 2009 ISACA/ITGI. All rights reserved. IT Governance

© 2009 ISACA/ITGI. All rights reserved. Control Objectives AI 6. 5 Change Closure and Documentation Whenever changes are implemented, update the associated system and user documentation and procedures accordingly.

© 2009 ISACA/ITGI. All rights reserved. Management Guidelines

© 2009 ISACA/ITGI. All rights reserved. Management Guidelines

© 2009 ISACA/ITGI. All rights reserved. Input-output Matrix Managing the Life Cycle Inputs coming from other processes Outputs going to other processes

© 2009 ISACA/ITGI. All rights reserved. Primary Inputs and Outputs § § Cobi. T identifies from where primary inputs are obtained for each process The inputs are identifies and where they came from Also identifies to which IT processes the process provides output to The outputs (from the process) are identified to where they would be directed

© 2009 ISACA/ITGI. All rights reserved. Managing the Life Cycle Whilst COBIT represents the life cycle of IT investments, it must also manage inter-process interdependencies.

© 2009 ISACA/ITGI. All rights reserved. RACI Charts

© 2009 ISACA/ITGI. All rights reserved. “RACI” Chart § § § Identifies who is Responsible, Accountable, Consulted and/or Informed Addresses considerations for points of accountability Addresses issues of communication and desired input (who would be consulted) Rather than titles, think of positions in terms of roles Depending on the size of the organization or the IT function, several roles may be combined

© 2009 ISACA/ITGI. All rights reserved. RACI chart Standard Organisation Chart Typical Process Activities Who is Responsible, Accountable Consulted and Informed?

© 2009 ISACA/ITGI. All rights reserved. Goals and Metrics

© 2009 ISACA/ITGI. All rights reserved. Metrics • Activity Goals tells us how well the process is performing – Measured by KPIs • Process Goals tell us what IT must deliver – Measured by Key Goal indicators • IT Goals tell us what we expect from IT – Measured by Key Goal Indicators

© 2009 ISACA/ITGI. All rights reserved. Maturity Model

© 2009 ISACA/ITGI. All rights reserved. Use of Maturity Models • The assessment of process capability based on the COBIT maturity models is a key part of IT governance implementation. • Enables gaps in capability to be identified and demonstrated to management. • Action plans can then be developed

© 2009 ISACA/ITGI. All rights reserved. Maturity Levels in COBIT Non-existent Initial Repeatable Defined Managed Optimised 0 1 2 3 4 5 0 - Management processes are not applied at all. 1 - Processes are ad hoc and disorganised. 2 - Processes follow a regular pattern. 3 - Processes are documented and communicated. 4 - Processes are monitored and measured. 5 - Best practices are followed and

© 2009 ISACA/ITGI. All rights reserved. Dimensions of Process Maturity in COBIT Capture process maturity data on each of six dimensions: § Awareness and communication § Policies, standards and procedures § Tools and automation § Skills and expertise § Responsibility and accountability § Goal setting and measurement

© 2009 ISACA/ITGI. All rights reserved. Collecting Maturity Model Data Awareness and Communication Policies, Standards and Procedures Tools and Automation Skills and Expertise Responsibility and Accountability Goal Setting and Measurement 0 1 2 3 4 5

© 2009 ISACA/ITGI. All rights reserved. Business Goals Business Requirements require Governance Requirements Information Services imply influence How Do Governance and the Business Drive IT? Information Criteria IT Goals IT Processes deliver run IT Processes need Information Applications Infrastructure and People & People

© 2009 ISACA/ITGI. All rights reserved. COBIT and Other Frameworks and Standards

© 2009 ISACA/ITGI. All rights reserved. The Need for IT Governance Control Frameworks § Many organizations recognize the potential benefits that technology can yield Successful organizations understand manage what needs to be achieved and the risks associated with implementing new technologies § This understanding is key to control and IT governance. § Control Frameworks and generally accepted practices

© 2009 ISACA/ITGI. All rights reserved. Impact of Technology on Control è Operational and control objectives do not change, or change a little – Some technology-specific control objectives change è There is a significant impact on the “mix” of controls used to address the control objectives. – Technology can facilitate achieving control objectives

Control Models: § Structured or organized to present a control framework relative to control objectives and respective internal controls or control practices. § Provide statements of responsibilities for control § Provide guidance regarding mechanisms to assess the need for control, and to design, develop, implement and exercise control § Requires that controls be monitored and evaluated.

© 2009 ISACA/ITGI. All rights reserved. IT IT Governance Management Governance Layer Where COBIT Typically Sits COS King O COBIT ITIL 17799 CMM Tick. IT

© 2009 ISACA/ITGI. All rights reserved. How COBIT Relates to Frameworks and Standards § Integrator of technical standards § Interface to business standards

© 2009 ISACA/ITGI. All rights reserved. Strategic Process Control COBIT XY XY ## ## XY XY XY ## ## ## CMM Process Execution Work Instruction 17799 How COBIT Relates to Frameworks and Standards • Work instruction • 2 • 3 • 4, 5, 6…. ITIL • Work instruction • 2 • 3 • 4, 5, 6….

© 2009 ISACA/ITGI. All rights reserved. Strategic Process Control COBIT XY XY ## ## XY XY XY ## ## ## CMM Process Execution Work Instruction 17799 How COBIT Relates to Frameworks and Standards • Work instruction • 2 • 3 • 4, 5, 6…. ITIL • Work instruction • 2 • 3 • 4, 5, 6….

© 2009 ISACA/ITGI. All rights reserved. How COBIT Relates to Frameworks and Standards 318 100 80 27001 maps 100% onto COBIT 60 40 20 66 Plugging 27001 into COBIT Processes 25% 21 O Co bj nt ec ro tiv l es IT Pr oc es se s 0 30% 34 20% 15% 10% ME 4 ME 3 ME 2 ME 1 DS 12 DS 13 DS 11 DS 10 DS 9 DS 8 DS 7 DS 6 DS 5 DS 4 DS 3 DS 2 AI 6 AI 7 DS 1 AI 5 AI 4 AI 3 AI 2 AI 1 PO 10 PO 9 PO 8 PO 7 PO 6 PO 5 PO 4 PO 3 PO 1 0% PO 2 5% COBIT Eleme nts 27001 Reach

© 2009 ISACA/ITGI. All rights reserved. How COBIT Relates to Frameworks and Standards Gartner Advisory on COBIT and ITIL

© 2009 ISACA/ITGI. All rights reserved. Control (as defined by COBIT) The policies, procedures, practices and organizational structures designed to provide reasonable assurance that business objectives will be achieved and that undesired events will be prevented or detected and corrected.

© 2009 ISACA/ITGI. All rights reserved. To Achieve Business Objectives To Avoid Risks, Threats and Exposures Control (as defined by COBIT) The policies, procedures, practices and organizational structures designed to provide reasonable assurance that business objectives will be achieved and that undesired events will be prevented or detected and corrected. Source: COBIT Control Objectives. P. 12.

© 2009 ISACA/ITGI. All rights reserved. IT Control Objective A statement of desired result or purpose to be achieved by implementing control procedures in a particular IT activity

© 2009 ISACA/ITGI. All rights reserved. To understand internal control and what mean by “reasonable assurance”, one needs to understand risk • What is “reasonable assurance”? • What is the relationship of reasonable assurance to residual risk?

© 2009 ISACA/ITGI. All rights reserved. Assurance Level 100% Reasonable assurance 0% Residual Risk

© 2009 ISACA/ITGI. All rights reserved. Control Responsibilities • Management -- primary responsibility for ensuring that controls are in place and in effect to provide reasonable assurance that operational and control objectives will be met. • Users -- exercise controls. • Audit -- evaluates, advises and provides statements of assurance regarding the adequacy of controls.

© 2009 ISACA/ITGI. All rights reserved. COBIT® The COBIT family of products includes: • • COBIT® 4. 1—Emphasizes regulatory compliance, helps organizations increase the value attained from IT, enables alignment and simplifies implementation of the COBIT framework COBIT Advisor, 3 rd Edition IT Governance Implementation Guide, Using COBIT and Val IT, 2 nd Edition IT Governance Based on COBIT 4. 1 COBIT Online COBIT Quickstart, 2 nd Edition COBIT Security Baseline, 2 nd Edition Mappings of COBIT to other international frameworks and standards www. isaca. org/cobit