Professional Documents
Culture Documents
What is COBIT?
Connect to, and, where relevant, align with, other major frameworks
and standards in the marketplace, such as
What is COBIT?
COBIT 5 brings together the five principles
that allow the organizations to build an
effective governance and management
framework based on a holistic set of seven
enablers that optimizes information and
technology investment and use for the benefit
of stakeholders.
Why Version 5?
Provide more stakeholders a say
Address the increasing dependency on external
business and IT parties
Deal with the amount of information, which has
increased significantly
Deal with much more pervasive IT
Provide further guidance in the area of
innovation and emerging technologies
Less about audit and more about governance
Why Version 5?
Enterprise Benefits
Organizations and their leaders strive to:
Maintain quality information to support business decisions.
Generate business value from IT-enabled investments, i.e.,
achieve strategic goals and realize business benefits through
effective and innovative use of IT.
Achieve operational excellence through reliable and efficient
application of technology.
Maintain IT-related risk at an acceptable level.
Optimize the cost of IT services and technology.
Stakeholder Value
Delivering organizational stakeholder value requires good
governance and management of information and technology
(IT) assets.
Corporate boards, executives and management have to
embrace IT like any other significant part of the business.
External legal, regulatory and contractual compliance
requirements related to enterprise use of information and
technology are increasing, threatening value if breached.
COBIT 5 provides a comprehensive framework that assists
enterprises to achieve their goals and deliver value through
effective governance and management of enterprise IT.
COBIT Structure
COBIT provides cascading guidance to
align the complex relationship between
business and IT goals by depicting a
cascading relationship between the sets of
goals and enablers.
COBIT provides the What for defining
best practices and their subsequent
measures.
COBIT 5 Principles
Goals Cascade
COBIT Stakeholder
Drivers & Needs
Stakeholders
Needs
These
questions
point us
towards
Enterprise
Goal
focus
Stakeholder
Needs
These
questions
point us
towards
Enterprise
Goal
focus
COBIT 5 Model
P stands for primary, when there is an
important relationship and is primary
support for the achievement of a COBIT
object (e.g. goal).
S stands for secondary, when there is still
a strong, but less important, relationship.
COBIT IT Goals
COBIT provides 17 Generic IT Goals
Enterprise
Goals
Traceability
IT Goals
COBIT IT Goals
Mapping of
Goals
Understanding
the alignment of
Enterprise
Goals with IT
Goals is critical
to leveraging
COBIT 5.
COBIT 5 Enablers
COBIT Enablers
Enablers are factors that, individually and
collectively, influence whether something
will workin this case, governance and
management over enterprise IT.
Enablers are driven by the goals cascade,
i.e., higher-level IT-related goals define
what the different enablers should
achieve.
COBIT Enablers
1. Principles, policies and frameworks are the vehicle to translate the desired
behavior into practical guidance for day-to-day management.
2. Processes describe an organized set of practices and activities to achieve certain
objectives and produce a set of outputs in support of achieving overall IT-related
goals.
3. Organizational structures are the key decision-making entities in an enterprise.
4. Culture, ethics and behavior of individuals and of the enterprise are very often
underestimated as a success factor in governance and management activities.
5. Information is pervasive throughout any organization and includes all information
produced and used by the enterprise. Information is required for keeping the
organization running and well governed, but at the operational level, information is
very often the key product of the enterprise itself.
6. Services, infrastructure and applications include the infrastructure, technology and
applications that provide the enterprise with information technology processing and
services.
7. People, skills and competencies are linked to people and are required for
successful completion of all activities and for making correct decisions and taking
corrective actions.
COBIT Enablers
Some of the enablers defined previously are also
enterprise resources that need to be managed and
governed as well.
This applies to:
Information, which needs to be managed as a
resource. Some information, such as management
reports and business intelligence information, are
important enablers for the governance and
management of the enterprise.
Service, infrastructure and applications
People, skills and competencies
COBIT 5 Enablers
33
Source: COBIT 5. 2012 ISACA
COBIT Enablers
All enablers have a set of common dimensions. This set
of common dimensions:
Provides a common, simple and structured way to deal
with enablers
Allows an entity to manage its complex interactions
Facilitates successful outcomes of the enablers
Process Goals
Process goals can be categorized as:
Intrinsic goalsDoes the process have intrinsic
quality? Is it accurate and in line with good practice? Is it
compliant with internal and external rules?
Contextual goalsIs the process customized and
adapted to the enterprises specific situation? Is the
process relevant, understandable, easy to apply?
Accessibility and security goalsThe process
remains confidential, when required, and is known and
accessible those who need it.
Good Practices
Good practicesCOBIT 5: Enabling
Processes contains a process reference model,
in which process internal good practices are
described in growing levels of detail: practices,
activities and detailed activities.
46
EDM02
EDM03
EDM04
APO02
APO03
Manage Strategy
Manage Enterprise Architecture
APO04
Manage Innovation
APO05
Manage Portfolio
APO06
APO07
APO08
APO09
Manage Relationships
Manage Service Agreements
APO10
APO11
APO12
APO13
Manage Suppliers
Manage Quality
Manage Risk
Manage Security
BAI02
BAI03
BAI04
BAI05
BAI06
BAI07
Manage Changes
Manage Changes Acceptance and
Transitioning
BAI08
Manage Knowledge
BAI09
Manage Assets
BAI10
Manage Configuration
Manage Operations
DSS02
DSS03
Manage Problems
DSS04
Manage Continuity
DSS05
DSS06
MEA02
MEA03
IT Process
to IT Goal
Mapping
IT Process
to IT Goal
Mapping
Process Goals
Process Metrics
Source: COBIT 5. 2012 ISACA
Detailed description
Activities
Source: COBIT 5. 2012 ISACA
Enabler
Goals
Processes
Activities
COBIT Capability
2. In addition, the process (governance or management) practices can be assessed using the
same rating scale, expressing the extent to which the base practices are applied.
3. To further refine the assessment, the work products also may be taken into consideration to
determine the extent to which a specific assessment attribute has been achieved.
Auditor Tips
Evidence of activities (as well as
inputs/outputs) are critical in assessing the
existence of controls
Information, metrics/measurements are
key to any critical IT process.
Remaining Thoughts
Questions?
Thank you