ISACA and COBIT 2019 Framework

• ISACA is nearing its 50th year as a global associaiton

ISACA's Purpose

• ISACA exists to help individuals and enterprises achieve the positive poteintial of technology
• IT equips professionals with knowledge, credientails, education, and community in order to advance careers and transform organizations
• ISACA leverages the expertise of its half-million professionals in fields like info and cyber security, governance, assurance, risk, and innovation
• ISACA's CMMI institute helps advance innoviation through tehcnology
• ISACA has presence in more than 188 countries with more than 217 chapters and offices in the US and China

Disclaimer

• ISACA created COBIT 2019 Framework as an educational resource for enterprise governance of info/tech, assurance, risk, and security professionals
• ISACA makes no claim that the use of the Work will assure a successful outcome
• A professional should apply their own professional judgement

Introduction to Enterprise Governance of Information and Technology (EGIT)

• I&T is crucial for support, sustainability, and growth of enterprises due to digital transformation
• Stakeholder value creation includes realizing benefits at an optimal resource cost while optimizing risks
• Centrality of I&T for risk management and value generation has led to focus on EGIT
• EGIT is an integral part of corporate governance and is exercised by the board

Benefits of Information and Technology Governance

• EGIT is concerned with value delivery from digital transformation and the mitigation of business risk resulting from that transformation
• Successful EGIT adoption will have the following
  • Benefits realization includes creating value for the enterprise through I&T, maintaining/increasing value from existing investments while eliminating initiatives not creating sufficient value
  • The basic value of I&T is the delivery of fit-for-purpose services and solutions on time and within budget, generating financial and non financial benefits aligned with business values
    • IT value should show the impact and contribution of IT-enabled investment in the enterprise's value creation
  • Risk optimization is addressing the business risks associated with using, owning, operating, involving, influencing, and adopting I&T
    • Manageing I&T-related risk should ensure a focus on IT by the enterprise
  • Resource optimization makes sure appropriate capabilities are in place to execute plans providing sufficient, appropriate and effective resources
    • Resource optimizations ensure and integrated, economical IT infrastructure is provided Strategic alignment and performance measurements are important for all activities aligning I&T-related objectives w/ enterprise goals

COBIT as an I&T Governance Framework

• Best-practice frameworks have been developed to support understanding, designing and implementing EGIT
• COBIT has developed into a broader and more comprehensive I&T governance and management framework that's generally accepted

What is COBIT? (and What Isn't?)

• COBIT is a framework for governance and management of enterprise information and technology aimed at the whole enterprise Enterprise I&T is all the technology and information processing to achieve goals, wherever it happens

Guiding Principles

• Governance ensures that:

  • Stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives
  • Direction is set through prioritization and decision making
  • Performance and compliance are monitored

• Management:

  • Plans, builds, runs, and monitors
  • Aligned with direction set by governance
  • Achieves enterprise objectives

• COBIT defines components to build and sustain a governance system:

  • Processes
  • Organizational structures
  • Policies and procedures
  • Information flows
  • Culture and behaviors
  • Skills and infrastructure

Principles for a Governance System

• Enterprises require a governance system to satisfy needs and generate value through I&T balancing benefits, risk, and resources with an actionable strategy
• A governance system for I&T is built of components working together
• Governance systems should be tailored, covering the enterprise end-to-end, distinguishing governance from management, and be dynamic

Three principles for a governance framework include the following aspects

• Based on a conceptual model
• Open and flexible
• Aligned to major standards

COBIT 2019 improvements include

• Flexibility and openness using design factors for tailoring
• Currency and relevance referencing in alignment to outside concepts
• Prescriptive applications constructing the concept to match what's needed
• Performance management of IT integrating the maturity with CMMI

COBIT's Product Family

• The product is open-ended and designed for customization. The products is include the following
  • COBIT 2019 Framework: Intro and Method
  • COBIT 2019 Framework: governance and management objectives
  • COBIT 2019 design guide: Designing Information and Technology Governance Solution
  • COBIT 2019 Implementation Guide

Focus Areas

• Identified content contains detailed guidance on specific things, it's based on COBITS, is aligned to several standards and frameworks, with content updates for users

Terms and Concepts

• A governance/management objective is always related to one process + some related components
• Governance objectives correspond to governance processes in dark blue, whereas management ones are lighter, executive boards vs senior management

COBIT is Grouped into Five Domains

• EDM (evaluate, direct, monitor): Governance options in domain. Governing body evaluated, directs senior management, and monitors achievement of strategy
• APO (align, plan, organize): Overall organization, strategy, activities involved for I&T
• BAI (build, acquire, implement): Definition/acquisition/implementation of the solutions of I&T and integration in business processes
• DSS (deliver, service, support): Delivery/support of I&T services, security included
• MEA (monitor, evaluate, assess): Monitoring and conformance of I&T by internal and external requirements

Components of a Governance System

• Required to satisfy governance and objectives
• Components work to provide good operations

Components Breakdown

• Processes are organized practices and activities achieving objectives and producing support
• Organizational structures are key decision-making entities
• Principles, policies, frameworks translate desired behavior from management
• Information is important to the function of the governance system
• Culture/ethics/behavior
• People/competencies/skills
• Services, infrastructure, applications are inclusive of technology/applications from processing

Designs Factors

• Various factors that can influence a governance system for an enterprise
• This publication distinguishes three different types of impact that may vary in differing styles (see publication for examples)
  • Management Objective Priority/Selection
  • Components Variation
  • Need for specific focus area

Key Design Factors

• Enterprise strategy design
• Enterprise goals design
• Risk Profile
• I&T-related issues
• Threat landscape
• Compliance Requirements
• Role of IT
• Sourcing model for IT
• IT implementation methods
• Technology Adoption strategy
• Enterprise size

Goals Cascade

• Stakeholder needs turns into actionable strategy.
• Supports governance while prioritizing goals
• Used thoroughly in COBIT versions

COBIT Product Family

• COBIT standards and guidelines used include:
  • American web services
  • CMMI development
  • HITRUST common security framework
  • IOS/IEC standards
  • ISF standards for IS
  • ITIL
  • US national standards of technology

COBIT and Performance Managment

• performance managment is and essential part of goverence and managment system

Capability Level Model Alignments

• largely lines up with CMMI developement, the processes are assocated with "Capability Levels" and the focus areas are associated with "Maturity levels
• Maturity levels are associated with focus areas, and with what is achieved once all capabilities are achieved
• capability schemes uses a CMMI setup. It measures how well a process performs well
• capability levels = a measure of how well a process is in order and performed
• COBIT core models assigns capability levels to ensure activities are achieved

Ratings of process activities from low-to-high

• not
• partially
• largely
• fully

Maturity levels express performance without granularity