Sistema de Gobierno en Base A Factores de Gobierno

The Self-assessment Guide is provided as a ‘stand-alone’ guide, which can be used by enterprises to perform
rigorous assessment of the capability of their IT processes. This may be a precursor to undertaking more rigorous evidenced-ba
assessment. The approach is based on the COBIT PAM used in the COBIT 5 Assessment Programme, but does not require evid
requirements in support of the self assessment, nor does it require use of the COBIT PAM; sufficient information from the PAM
full self-assessment template has been provided that simplifies the process without the need to reference the other two guide
COBIT Assessment Programme.
© ISACA 2013 All rights reserved.
Instructions
1. It is recommended that the assessment be undertaken by a small team or reviewed by a team of IT management and/or ass
although independent assessors are not required for this.
1. Use the Process results tab (example in appendix A of the guide) to summarize your results of the assessments
2. If a more rigoruous assessment is required and/or evidentiary requirements to be produced then use the full assessor guide
templates at 3. and 4. of the toolkit
3. You are required to start at level 1 because that is where the specfic questions are asked about the process outomes and pu
be achieved.
4. At Level 1 For each process be assessed ask if the process is achieveing its outcomes, answer yes or no; include any relevant
comments to support your conclusion.
5. For Level 1 you can RATE each of the outcomes but the assessment approach requires an overall assessment rating at the pr
attribute level PA1.1
6. At higher levels you are no longer looking at specific process outcomes but at overall generic goals shown for each of the le
5.
7. To PASS a particular level the process must be rated Largely or Fully, to move onto the next level all attributes must be rated
for example if PA2.1 is Largely and PA2.2 Fully, you are deemed to be at Level 2 but the overall Level 2 rating must be a Fully to
to assess at higher levels.
8. Use this process as a 'pre-cursor' to a more detailed assessment and not as the definitive assessment of your IT processes.
Determinacion del sistema de Gobierno en base a los factores de Diseño
Process ID Process Name Enterprise Enterprise goals Risk I&T- Threat Complianc Role of Sourcing IT
strategy profile related landscape e IT model for implemen
issues requireme IT tation
nts methods
Processes for Governance of Enterprise IT -

Evaluate, Direct and Monitor
EDM01
Ensured Governance Framework Setting and Maintenance
EDM02 Ensured Benefits Delivery
EDM03 Ensured Risk Optimisation
EDM04 Ensured Resource Optimisation
EDM05 Ensured Stakeholder Transparency
Align, Plan and Organise
APO01 Managed the IT Managedment Framework
APO02 Managed Strategy
APO03 Managed Enterprise Architecture
APO04 Managed Innovation
APO05 Managed Portfolio
APO06 Managed Budget and Costs
APO07 Managed Human Resources
APO08 Managed Relationships
APO09 Managed Service Agreements
APO10 Managed Vendors
APO11 Managed Quality
APO12 Managed Risk
APO13 Managed Security
APO14 Managed Data
Build, Acquire and Implement
BAI01 Managed Programmes
BAI02 Managed Requirements Definition
BAI03 Managed Solutions Identification and Build
BAI04 Managed Availability and Capacity
BAI05 Managed Organisational Change Enablement
BAI06 Managed IT Changes
BAI07 Managed IT Change Acceptance and Transitioning
BAI08 Managed Knowledge
BAI09 Managed Assets
BAI10 Managed Configuration
BAI11 Managed Projects
Deliver, Service and Support
DSS01 Managed Operations
DSS02 Managed Service Requests and Incidents
DSS03 Managed Problems
DSS04 Managed Continuity
DSS05 Managed Security Services
DSS06 Managed Business Process Controls
Monitor, Evaluate and Assess
MEA01 Managed Performance and Conformance Monitoring
MEA02 Managed System of Internal Control
MEA03 Managed with External Requirements
MEA04 Managed Assurance
Technolog Enterprise
y size
adoption
strategy
AS IS TO BES IS
APO07 Managed Human Resources 3 4
Fase 1 Identificar los trabajadores

claves de la empresa
Fase 2 capacitaciones
Fase 3 plan de sucesion
Fase 4
Fase 5
Fase 6
Fase 7
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved
EDM01 Ensure Governance Framework Setting and Maintenance

Satisfy the business requirement of sustaining or extending the business strategy and governance requirements while being transparent
Purpose about benefits, costs and risks
Assess whether the following Criteria Are Partially Largely

Criteria Comment Not Achieved Achieved Fully
outcomes are achieved. Met Y/N
achieved (15% (50% - Achieved
(0-15%) -50%) 85%) (85-100%)
Level 0 The process is not At this level, there is little or no evidence of
Incomplete implemented, or fails to any achievement of the process purpose.
achieve its process purpose.
Level 1 PA 1.1 The implemented The following process outcomes are being Overall rating for the process
Performed process achieves its process achieved:
purpose.
EDM01-O1An optimum strategic decision-

making model for IT is achieved, aligned with
the enterprise's internal and external
environment and stakeholder requirements.
EDM01-O2The governance system for IT is

embedded in the enterprise.
EDM01-O2Assurance is obtained that the
governance system for IT is operating
effectively.
Level 2 PA 2.1 Performance As a result of full achievement of this

Managed Management - A measure of attribute:
the extent to which the
performance of the process is
managed.
Level 2 PA 2.1 Performance
Managed Management - A measure of
performance of the process is a) Objectives for the performance of
managed. the process are identified.
b) Performance of the process is
planned and monitored.
c) Performance of the process is
adjusted to meet plans.
d) Responsibilities and authorities for
performing the process are defined,
assigned and communicated.
e) Resources and information

necessary for performing the process are
identified, made available, allocated and
used.
f) Interfaces between the involved

parties are managed to ensure both
effective communication and also clear
assignment of responsibility.
PA 2.2 Work Product As a result of full achievement of this

Management - A measure of attribute:
the extent to which the work
products produced by the a) Requirements for the work products
process are appropriately of the process are defined.
managed. The work products
(or outputs from the process) b) Requirements for documentation
are defined and controlled. and control of the work products are
defined.
c) Work products are appropriately

identified, documented, and controlled.
d) Work products are reviewed in
accordance with planned arrangements
and adjusted as necessary to meet
requirements.
Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to attribute:
which a standard process is
maintained to support the
deployment of the defined
process.
Level 3 PA 3.1 Process Definition - A
Established measure of the extent to
maintained to support the a) A standard process, including
deployment of the defined appropriate tailoring guidelines, is defined
process. that describes the fundamental elements
that must be incorporated into a defined
process.
b) The sequence and interaction of the

standard process with other processes is
determined.
c) Required competencies and roles

for performing a process are identified as
part of the standard process.
d) Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.
e) Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.
PA 3.2 Process Deployment - As a result of full achievement of this

A measure of the extent to attribute:
which the standard process is
effectively deployed as a a) A defined process is deployed based
defined process to achieve its upon an appropriately selected and/or
process outcomes. tailored standard process.
b) Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.
c) Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.
d) Required resources and
information necessary for performing the
defined process are made available,
allocated and used.
e) Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.
f) Appropriate data are collected and

analysed as a basis for understanding
the behaviour of, and to demonstrate
the suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process
can be made.
Level 4 PA 4.1 Process Measurement As a result of full achievement of this

Predictable - A measure of the extent to attribute:
which measurement results
are used to ensure that a) Process information needs in support
performance of the process of relevant defined business goals are
supports the achievement of established.
relevant process performance
objectives in support of b) Process measurement objectives are
defined business goals. derived from process information needs.
c) Quantitative objectives for process

performance in support of relevant
business goals are established.
d) Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.
e) Results of measurement are
collected, analysed and reported in order to
monitor the extent to which the
quantitative objectives for process
performance are met.
f) Measurement results are used to

characterise process performance.
PA 4.2 Process Control - A As a result of full achievement of this
measure of the extent to attribute:
which the process is
quantitatively managed to a) Analysis and control techniques are
produce a process that is determined and applied where applicable.
stable, capable and
predictable within defined
limits. b) Control limits of variation are
established for normal process
performance.
c) Measurement data are analysed for

special causes of variation.
d) Corrective actions are taken to address
e) Control limits are re-established (as
necessary) following corrective action.
Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to As a result of full achievement of this
which changes to the process attribute:
are identified from analysis of a) Pprocess improvement objectives for
common causes of variation the process are defined that support the
in performance, and from relevant business goals.
investigations of innovative
approaches to the definition b) Appropriate data are analysed to
and deployment of the identify common causes of variations in
process. process performance.
c) Appropriate data are analysed to

identify opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is

established to achieve the process
improvement objectives.
PA 5.2 Process optimisation -

A measure of the extent to As a result of full achievement of this
which changes to the attribute:
definition, management and a) Impact of all proposed changes is
performance of the process assessed against the objectives of the
result in effective impact that defined process and standard process.
achieves the relevant process
improvement objectives. b) Implementation of all agreed changes is
managed to ensure that any disruption to
the process performance is understood and
acted upon.
c) Based on actual performance,
effectiveness of process change is evaluated
against the defined product requirements
and process objectives to determine
whether results are due to common or
special causes.
Self-assessmentTemplate (Appendix B of the Self-assessment Guide)
Process Name Level 0 Level 1 Level 2
EDM02 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
EDM02 Ensure Value Optimisation

Purpose Satisfy the business requirement of being agile in responding to requirements; provide reliabl
processes.
about benefits, costs and risks
Assess whether the following Criteria Are

Criteria
Level 0 The process is not implemented, or At this level, there is little or no evidence of any
Incomplete fails to achieve its process purpose. achievement of the process purpose.
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for the p
Performed achieves its process purpose.
EDM02-O1 The enterprise is securing optimal value

from its portfolio of approved IT-enabled initiatives,
services and assets.
EDM02-O2 Optimum value is derived from IT

investment through effective value management
practices in the enterprise.
EDM02-O3 Individual IT-enabled investments

contribute optimal value.
Level 2 Managed PA 2.1 Performance Management - As a result of full achievement of this attribute:
A measure of the extent to which
the performance of the process is
managed. a) Objectives for the performance of the
process are identified.
b) Performance of the process is planned and
monitored.
c) Performance of the process is adjusted to
meet plans.
performing the process are defined, assigned
and communicated.
e) Resources and information necessary for

performing the process are identified, made
available, allocated and used.
f) Interfaces between the involved parties

are managed to ensure both effective
communication and also clear assignment of
responsibility.
PA 2.2 Work Product Management - As a result of full achievement of this attribute:

the work products produced by the
process are appropriately managed. a) Requirements for the work products of the
The work products (or outputs from process are defined.
the process) are defined and
controlled. b) Requirements for documentation and
control of the work products are defined.

d) Work products are reviewed in accordance
with planned arrangements and adjusted as
necessary to meet requirements.
Level 3 PA 3.1 Process Definition - A As a result of full achievement of this attribute:

Established measure of the extent to which a
standard process is maintained to
support the deployment of the a) A standard process, including appropriate
defined process. tailoring guidelines, is defined that describes the
fundamental elements that must be
incorporated into a defined process.

determined.
c) Required competencies and roles for

performing a process are identified as part of the
standard process.

environment for performing a process are
identified as part of the standard process.

effectiveness and suitability of the process are
determined.
PA 3.2 Process Deployment - A As a result of full achievement of this attribute:

measure of the extent to which the
standard process is effectively
deployed as a defined process to a) A defined process is deployed based upon
achieve its process outcomes. an appropriately selected and/or tailored
standard process.

c) Personnel performing the defined process

are competent on the basis of appropriate
education, training, and experience.
d) Required resources and information
necessary for performing the defined process
are made available, allocated and used.

maintained.

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the process,
and to evaluate where continuous
improvement of the process can be made.
Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this attribute:

Predictable measure of the extent to which
measurement results are used to
ensure that performance of the a) Process information needs in support of
process supports the achievement of relevant defined business goals are established.
objectives in support of defined
business goals. b) Process measurement objectives are
derived from process information needs.
performance in support of relevant business
goals are established.
d) Measures and frequency of measurement

are identified and defined in line with process
measurement objectives and quantitative
objectives for process performance.
e) Results of measurement are collected,

analysed and reported in order to monitor the
extent to which the quantitative objectives for
process performance are met.

PA 4.2 Process Control - A measure As a result of full achievement of this attribute:

of the extent to which the process is
quantitatively managed to produce
a process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.
b) Control limits of variation are established for

normal process performance.
c) Measurement data are analysed for special

causes of variation.
Optimizing. measure of the extent to which
changes to the process are identified As a result of full achievement of this attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the relevant
investigations of innovative business goals.
approaches to the definition and
deployment of the process. b) Appropriate data are analysed to identify
common causes of variations in process
performance.
deployment of the process.
c) Appropriate data are analysed to identify

opportunities for best practice and innovation.
d) Improvement opportunities derived from

new technologies and process concepts are
identified.
e) An implementation strategy is established to

achieve the process improvement objectives.
PA 5.2 Process optimisation - A

measure of the extent to which
changes to the definition, As a result of full achievement of this attribute:
management and performance of a) Impact of all proposed changes is assessed
the process result in effective impact against the objectives of the defined process and
that achieves the relevant process standard process.
b) Implementation of all agreed changes is
managed to ensure that any disruption to the
process performance is understood and acted
upon.
c) Based on actual performance, effectiveness of
process change is evaluated against the defined
product requirements and process objectives to
determine whether results are due to common
or special causes.
Level 2 Level 3 Level 4
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
onding to requirements; provide reliable, consistent information, and seamlessly integrate applications into business
Comment Partially Largely

Not achieved Achieved (15% Achieved (50% Fully Achieved
(0-15%) -50%) - 85%) (85-100%)
Overall rating for the process

EDM03 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
EDM03 Ensure Risk Optimisation

Purpose Satisfy the business requirement of having stable, cost-effective, integrated and standard app
that meet current and future business requirements.

Criteria
EDM03-O1 Risk thresholds are defined and

communicated and key IT-related risks are known.
EDM03-O2 The enterprise is managing critical IT-

related enterprise risks effectively and efficiently.
EDM03-O3 IT-related enterprise risks do not exceed

risk appetite and the impact of IT risk to enterprise
value is identified and managed.
monitored.
meet plans.
and communicated.


responsibility.



fundamental elements that must be
incorporated into a defined process.

determined.

standard process.


determined.

standard process.

authorities for performing the defined process
are assigned and communicated.


maintained.








performance.


identified.


upon.
determine whether results are due to common
or special causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
-effective, integrated and standard application systems, resources and capabilities

(0-15%) -50%) - 85%) (85-100%)

EDM04 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
EDM04 Ensure Resource Optimisation

Purpose Satisfy the business requirement of being agile in responding to the business strategy while c
points of contact.

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for t
EDM04-O1 The resource needs of the enterprise are met

in the most optimal manner.
EDM04-O2 The consistent adoption of resource

management principles are achieved.
EDM04-O3 Optimal use of resources is achieved

throughout their full economic lifecycle.
managed. a) Objectives for the performance of the process
are identified.
monitored.
c) Performance of the process is adjusted to meet
plans.
d) Responsibilities and authorities for performing
the process are defined, assigned and
communicated.
f) Interfaces between the involved parties are

managed to ensure both effective communication
and also clear assignment of responsibility.

controlled. b) Requirements for documentation and control of
the work products are defined.
c) Work products are appropriately identified,
documented, and controlled.
d) Work products are reviewed in accordance with
planned arrangements and adjusted as necessary to
meet requirements.

fundamental elements that must be incorporated
into a defined process.
b) The sequence and interaction of the standard

process with other processes is determined.

standard process.


determined.

deployed as a defined process to a) A defined process is deployed based upon an
achieve its process outcomes. appropriately selected and/or tailored standard
process.

authorities for performing the defined process are
c) Personnel performing the defined process are

competent on the basis of appropriate education,
training, and experience.

necessary for performing the defined process are
made available, allocated and used.

environment for performing the defined process
are made available, managed and maintained.
f) Appropriate data are collected and analysed
as a basis for understanding the behaviour of,
and to demonstrate the suitability and
effectiveness of the process, and to evaluate
where continuous improvement of the process can
be made.

business goals. b) Process measurement objectives are derived
from process information needs.
performance in support of relevant business goals
are established.
d) Measures and frequency of measurement are

identified and defined in line with process
measurement objectives and quantitative objectives
for process performance.
e) Results of measurement are collected, analysed

and reported in order to monitor the extent to which
the quantitative objectives for process performance
are met.
f) Measurement results are used to characterise

process performance.

a process that is stable, capable and a) Analysis and control techniques are determined
predictable within defined limits. and applied where applicable.
c) Measurement data are analysed for special causes
of variation.
d) Corrective actions are taken to address special
e) Control limits are re-established (as necessary)
following corrective action.
from analysis of common causes of a) Pprocess improvement objectives for the process
variation in performance, and from are defined that support the relevant business goals.
performance.

d) Improvement opportunities derived from new

technologies and process concepts are identified.

b) Implementation of all agreed changes is managed
to ensure that any disruption to the process
performance is understood and acted upon.
c) Based on actual performance, effectiveness of process
change is evaluated against the defined product
requirements and process objectives to determine
whether results are due to common or special
causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
ing to the business strategy while complying with governance requirements and providing defined and competent

(0-15%) -50%) - 85%) (85-100%)

EDM05 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
EDM05 Ensure Stakeholder Transparency

Purpose Satisfy the business requirement of continuously and demonstrably improving IT’s cost-efficie
standardised services that satisfy end-user expectations.

Criteria
EDM05-O1 The basis for reporting to stakeholders is

established.
EDM05-O2 Reporting is complete, timely and

accurate.
EDM05-O3 Stakeholder communication is effective

and requirements are met.
monitored.
meet plans.
performing the process are defined, assigned and
communicated.

responsibility.



determined.

standard process.


determined.

standard process.



maintained.


are established.






performance.



upon.
requirements and process objectives to
determine whether results are due to common or
special causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
demonstrably improving IT’s cost-efficiency and its contribution to business profitability with integrated and
s.

(0-15%) -50%) - 85%) (85-100%)

APO01 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO01 Define the Management Framework for IT

Purpose
Satisfy the business requirement of supplying accurate and timely control over current and fu

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for the
APO01-O1 An up-to-date and effective IT control

framework are defined and maintained
- APO01-O1A The IT organisation structure is fully

defined including management structures, roles and
responsibilities
- APO01-O1B Operational and communication

guidelines for the IT organisation are defined
- APO01-O1C The ownership of information and

systems is clearly defined.
- APO01-O1D The structure and processes of the IT

organisation support the enterprise strategy and
operating model.
APO1-O2. A set of policies is defined and maintained

- APO01-O2A IT policies have been fully defined
- APO01-O2B IT objectives and policies are

understood and followed by all relevant staff and
stakeholders
APO01-O3 The IT control framework is effectively
implemented and communicated
- APO01-O3A Supporting enablers, for the IT control

framework are effectively implemented and
communicated
- APO01-O3B IT personnel and stakeholders

understand their roles and responsibiltiies
monitored.
meet plans.
communicated.


responsibility.

controlled. b) Requirements for documentation and control
of the work products are defined.


determined.

standard process.

determined.

process.




maintained.

behaviour of, and to demonstrate the suitability
and effectiveness of the process, and to
evaluate where continuous improvement of the
process can be made.

are established.




a process that is stable, capable and
predictable within defined limits.
PA 4.2 Process Control - A measure


performance.




upon.
causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
and timely control over current and future IT services, associated risks and responsibilities.

(0-15%) -50%) - 85%) (85-100%)

APO02 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO02 Define Strategy

Purpose Satisfy the business requirement of acquiring competent and motivated people to create and

Criteria
APO02-O1 All aspects of the information technology

strategy are aligned with the enterprise strategy.
APO02-O2 The information technology strategy is cost-

effective, appropriate, realistic, achievable, enterprise-
focused and balanced.
APO02-O3 Clear and concrete short-term goals can be

derived from and traced back to specific long-term
initiatives, and can then be translated into operational
plans.
APO02-O4 IT is a value driver for the enterprise.
APO02-O5 There is awareness of the IT strategy and a

clear assignment of accountability for delivery.
managed.
Level 2 Managed PA 2.1 Performance Management -
are identified.
monitored.
plans.
communicated.



meet requirements.



standard process.


determined.

process.




be made.

are established.


are met.


of variation.
changes to the process are identified
from analysis of common causes of
variation in performance, and from
performance.




causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
and motivated people to create and deliver IT services.

(0-15%) -50%) - 85%) (85-100%)

APO03 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO03 Manage Enterprise Architecture

Purpose Satisfy the business requirement of ensuring continuous and measurable improvement in the

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating f
APO03-O1 A enterprise-appropriate and sustainable

enterprise architecture capability is in place.
APO03-O2 A portfolio of enterprise architecture services

supports agile enterprise change.
APO03-O3 Appropriate and up-to-date domain and/or

federated architectures exist that provide reliable
architecture information.
APO03-O4 A common enterprise architecture framework

and methodology as well as an integrated architecture
repository are used to enable re-use efficiencies across the
enterprise.
the performance of the process is a) Objectives for the performance of the process are
managed. identified.
monitored.
managed.

plans.
d) Responsibilities and authorities for performing the
process are defined, assigned and communicated.

performing the process are identified, made available,
allocated and used.


process are appropriately managed. a) Requirements for the work products of the process
The work products (or outputs from are defined.
controlled. b) Requirements for documentation and control of the
work products are defined.
meet requirements.

standard process is maintained to a) A standard process, including appropriate tailoring
support the deployment of the guidelines, is defined that describes the fundamental
defined process. elements that must be incorporated into a defined
process.

c) Required competencies and roles for performing a

process are identified as part of the standard process.
d) Required infrastructure and work environment

for performing a process are identified as part of the
standard process.
e) Suitable methods for monitoring the effectiveness

and suitability of the process are determined.

standard process is effectively a) A defined process is deployed based upon an
deployed as a defined process to appropriately selected and/or tailored standard process.
achieve its process outcomes.
b) Required roles, responsibilities and authorities
for performing the defined process are assigned and
communicated.

d) Required resources and information necessary

for performing the defined process are made
e) Required infrastructure and work environment
available, managed and maintained.
f) Appropriate data are collected and analysed as

a basis for understanding the behaviour of, and to
demonstrate the suitability and effectiveness of the
process, and to evaluate where continuous

ensure that performance of the a) Process information needs in support of relevant
process supports the achievement of defined business goals are established.
business goals. b) Process measurement objectives are derived from
process information needs.
c) Quantitative objectives for process performance in
support of relevant business goals are established.

identified and defined in line with process measurement
objectives and quantitative objectives for process
performance.

and reported in order to monitor the extent to which the
quantitative objectives for process performance are met.


a process that is stable, capable and a) Analysis and control techniques are determined and
predictable within defined limits. applied where applicable.
b) Control limits of variation are established for normal
c) Measurement data are analysed for special causes of
variation.
d) Corrective actions are taken to address special causes
of variation.
Optimizing. measure of the extent to which As a result of full achievement of this attribute:
changes to the process are identified a) Pprocess improvement objectives for the process are
from analysis of common causes of defined that support the relevant business goals.
approaches to the definition and b) Appropriate data are analysed to identify common
deployment of the process. causes of variations in process performance.

e) An implementation strategy is established to achieve

the process improvement objectives.
management and performance of
the process result in effective impact
that achieves the relevant process
changes to the definition,
management and performance of a) Impact of all proposed changes is assessed against
the process result in effective impact the objectives of the defined process and standard
that achieves the relevant process process.
b) Implementation of all agreed changes is managed to
ensure that any disruption to the process performance is
understood and acted upon.
whether results are due to common or special causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
measurable improvement in the quality of IT services delivered.

(0-15%) -50%) - 85%) (85-100%)

Process Name Level 0 Level 1
APO04 PA 1.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO04 Manage Innovation

Purpose
Satisfy the business requirement of analysing, communicating and managing IT risks and thei
Assess whether the following Criteria

outcomes are achieved.
Level 0 The process is not implemented, or At this level, there is little or no evidence of any achievement of
Incomplete fails to achieve its process purpose. the process purpose.
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved:
APO04-O1 Enterprise value is created through the qualification

and staging of the most appropriate advances and innovations
in technology, IT methods and solutions.
APO04-O2 Enterprise objectives are met with improved quality

benefits and/or reduced cost as a result of the identification
and implementation of innovative solutions.
APO04-O3 Innovation is promoted and enabled and forms part

of the enterprise culture.
b) Performance of the process is planned and monitored.
c) Performance of the process is adjusted to meet plans.

e) Resources and information necessary for performing

the process are identified, made available, allocated and
used.

managed to ensure both effective communication and
also clear assignment of responsibility.

process are appropriately managed. a) Requirements for the work products of the process are
The work products (or outputs from defined.
planned arrangements and adjusted as necessary to meet
requirements.

defined process. elements that must be incorporated into a defined process.
b) The sequence and interaction of the standard process

with other processes is determined.
d) Required infrastructure and work environment for

standard process.
e) Suitable methods for monitoring the effectiveness and

suitability of the process are determined.

b) Required roles, responsibilities and authorities for
performing the defined process are assigned and
communicated.

competent on the basis of appropriate education, training,
and experience.
d) Required resources and information necessary for

performing the defined process are made available,
allocated and used.
e) Required infrastructure and work environment for

managed and maintained.
f) Appropriate data are collected and analysed as a
basis for understanding the behaviour of, and to
process, and to evaluate where continuous improvement
of the process can be made.

objectives in support of defined b) Process measurement objectives are derived from
business goals. process information needs.

performance.
e) Results of measurement are collected, analysed and

reported in order to monitor the extent to which the
f) Measurement results are used to characterise process

performance.

variation.
d) Corrective actions are taken to address special causes of
variation.
c) Appropriate data are analysed to identify opportunities

for best practice and innovation.
e) An implementation strategy is established to achieve the
process improvement objectives.
management and performance of a) Impact of all proposed changes is assessed against the
the process result in effective impact objectives of the defined process and standard process.
c) Based on actual performance, effectiveness of process change is

evaluated against the defined product requirements and
process objectives to determine whether results are due to
common or special causes.
PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
mmunicating and managing IT risks and their potential impact on business processes and goals.
Criteria Are Partially Largely

Comment
Met Y/N Not achieved Achieved (15% Achieved (50% Fully Achieved
(0-15%) -50%) - 85%) (85-100%)

APO05 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO05 Manage Portfolio

Purpose
Satisfy the business requirement of ensuring the delivery of project results within agreed-upo

Criteria
APO05-O1 An appropriate investment mix is defined and

aligned with enterprise strategy.
APO05-O2 Sources of investment funding are identified

and available.
APO05-O3 Programme business cases are evaluated and

prioritised before funds are allocated.
APO05-O4 A comprehensive and accurate view of the

investment portfolio performance exists.
APO05-O5 Investment programme changes are reflected

in the relevant IT service, asset and resource portfolios.
APO05-O6 Realised benefits have been measured.
managed.
are identified.
monitored.
plans.
the process are defined, assigned and communicated.



meet requirements.

fundamental elements that must be incorporated into
a defined process.


standard process.


determined.

process.




be made.

c) Quantitative objectives for process performance
in support of relevant business goals are established.


are met.


of variation.
deployment of the process. b) Appropriate data are analysed to identify common
causes of variations in process performance.




PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
of project results within agreed-upon time frames, budget and quality.

(0-15%) -50%) - 85%) (85-100%)

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO06 Manage Budget and Costs

Satisfy the business requirement of sustaining or extending the business strategy and governance requirements while being transparent
Purpose about benefits, costs and risks
Assess whether the following Criteria Are Partially Largely

Criteria Comment Not Achieved Achieved Fully
achieved (15% (50% - Achieved
(0-15%) -50%) 85%) (85-100%)
purpose.
APO06-O1 A transparent and complete

budget for IT is established and maintained.
APO06-O2 The allocation of IT resources for

IT initiatives is prioritised effectively.
APO06-O3 A model to allocate costs for

services is used and maintained.
APO06-O4 A cost management process that
compares budgets to actual costs is in place.

used.


products produced by the a) Requirements for the work
process are appropriately products of the process are defined.
managed. The work products
(or outputs from the process) b) Requirements for documentation
are defined and controlled. and control of the work products are
defined.

requirements.

process.
b) The sequence and interaction of

the standard process with other processes
is determined.


process.
e) Suitable methods for monitoring

the effectiveness and suitability of the
process are determined.

effectively deployed as a a) A defined process is deployed
defined process to achieve its based upon an appropriately selected
process outcomes. and/or tailored standard process.
A measure of the extent to
effectively deployed as a
defined process to achieve its
process outcomes.
b) Required roles, responsibilities

and authorities for performing the
defined process are assigned and
communicated.

experience.

information necessary for performing
the defined process are made

process are made available, managed
and maintained.
f) Appropriate data are collected

and analysed as a basis for
understanding the behaviour of, and to
demonstrate the suitability and
effectiveness of the process, and to
evaluate where continuous

are used to ensure that a) Process information needs in
performance of the process support of relevant defined business goals
supports the achievement of are established.
objectives in support of b) Process measurement objectives
defined business goals. are derived from process information
needs.
objectives in support of
defined business goals.


measurement are identified and defined
in line with process measurement
objectives and quantitative objectives for

collected, analysed and reported in order
to monitor the extent to which the

quantitatively managed to a) Analysis and control techniques are
produce a process that is determined and applied where applicable.
stable, capable and
limits. b) Control limits of variation are
established for normal process
performance.

d) Corrective actions are taken to
address special causes of variation.

identify opportunities for best practice
and innovation.



improvement objectives. b) Implementation of all agreed changes
is managed to ensure that any disruption
to the process performance is understood
and acted upon.
effectiveness of process change is
evaluated against the defined product
determine whether results are due to
APO07 PA 1.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO07 Manage Human Resources

Purpose
Satisfy the business requirement of aligning available applications with business and security

APO07-O1 The IT organisational structure and relationships

are flexible and responsive.
- APO07-O1A The IT organisation structure provides the

necessary roles and responsibilities to achieve organisational
goals.
- APO07-O1B Risks of overdependence on key resources are

mitigated
APO07- O2 Human resoures are effectively and efficiently

managed.
- APO07-O2A The enterprise has sufficient human resources to

achieve organisational goals
- APO07-O2B Personnel have the required skills, competencies

and abilities to achieve organsiational goals.
- APO07-O2C Staff performance is regularly reviewed and

evaluated.
- APO07-O2D Consultants and contract staff comply with
policies and contractual agreements


used.


requirements.



standard process.


communicated.
and experience.

allocated and used.




performance.


performance.

variation.
variation.
e) Control limits are re-established (as necessary) following
corrective action.


PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
ble applications with business and security requirements, and doing so in a timely manner and at a reasonable cost.

Comment
(0-15%) -50%) - 85%) (85-100%)

APO08 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO08 Manage Relationships

Purpose
Satisfy the business requirement of acquiring and maintaining an integrated and standardised

Criteria
Level 0 The process is not implemented, or At this level, there is little or no evidence of any achievement
Incomplete fails to achieve its process purpose. of the process purpose.
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating
APO08-O1 Business strategies, plans and requirements are

well understood, documented and approved.
APO08-O2 Good relationships exist between enterprise and IT.
APO08-O3 Business stakeholders are aware of technology-

enabled opportunities.
monitored.
plans.
used.


requirements.

process.



standard process.


communicated.

and experience.

allocated and used.



performance.


performance.

variation.
of variation.


c) Based on actual performance, effectiveness of process change

is evaluated against the defined product requirements and
process objectives to determine whether results are due
to common or special causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
an integrated and standardised IT infrastructure.

(0-15%) -50%) - 85%) (85-100%)

APO09 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO09 Manage Service Agreements

Purpose Satisfy the business requirement of ensuring stakeholder satisfaction with service offerings a
solutions throughout the business.

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for
APO09-O1 IT services are identified, defined and

catalogued according to enterprise needs.
APO09-O2 Service agreements reflect enterprise needs

and the capabilities of IT.
APO09-O3 IT services perform as stipulated in service

agreements.
the performance of the process is a) Objectives for the performance of the process
managed. are identified.
monitored.
plans.
allocated and used.


meet requirements.

standard process is maintained to a) A standard process, including appropriate
support the deployment of the tailoring guidelines, is defined that describes the
defined process. fundamental elements that must be incorporated into
a defined process.

c) Required competencies and roles for performing

a process are identified as part of the standard
process.

for performing a process are identified as part of
the standard process.

determined.

deployed as a defined process to appropriately selected and/or tailored standard
achieve its process outcomes. process.

for performing the defined process are assigned
and communicated.



as a basis for understanding the behaviour of, and
to demonstrate the suitability and effectiveness of
the process, and to evaluate where continuous



are met.


of variation.
changes to the process are identified a) Pprocess improvement objectives for the process
from analysis of common causes of are defined that support the relevant business goals.




PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
atisfaction with service offerings and service levels and seamlessly integrating the use of applications and technology

(0-15%) -50%) - 85%) (85-100%)

APO10 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO10 Manage Suppliers

Purpose
Satisfy the business requirement of improving IT’s adherence to acquisition processes to enh

Criteria
APO10-O1 Suppliers perform as agreed.
APO10-O2 Supplier risks are assessed and properly addressed.
APO10-O3 Supplier relationships are working effectively.
monitored.
plans.

used.

requirements.




standard process.


communicated.

and experience.

allocated and used.



performance.


performance.

variation.
of variation.


PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
acquisition processes to enhance effectiveness, cost-efficiency and contribution to business profitability.

(0-15%) -50%) - 85%) (85-100%)

APO11 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO11 Manage Quality

Purpose
Satisfy the business requirement of managing IT changes in alignment with the business strat

Criteria
APO11-O1 Stakeholders are satisfied with the quality

of solutions and services.
APO11-O2 Project and service delivery results are

predictable.
APO11-O3 Quality requirements are implemented in

all processes.
monitored.
meet plans.
communicated.

responsibility.



determined.

standard process.


determined.

process.



maintained.


are established.






performance.



upon.
causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
es in alignment with the business strategy to reduce solution and service delivery defects and rework.

(0-15%) -50%) - 85%) (85-100%)

APO12 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO12 Manage Risk

Purpose
Satisfy the business requirement of implementing new or changed systems that function with

Criteria
APO12-O1 Relevant data are identified and captured to

enable effective IT-related risk identification, analysis,
management and reporting.
APO12-O2 A current and complete risk profile exists.
APO12-O3 Risk management actions are managed as a

portfolio of significant incidents not identified and
included in the risk management portfolio.
APO12-O4 Effective measures for seizing opportunities

or limiting the magnitude of loss are launched in a
timely manner.
are identified.
monitored.
managed.

plans.
communicated.



meet requirements.



standard process.


determined.

process.




be made.

are established.


are met.


of variation.
performance.



causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
changed systems that function without major problems after installation.

(0-15%) -50%) - 85%) (85-100%)

APO13 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
APO13 Manage Security

Purpose
Satisfy the business requirement of ensuring the alignment of key IT services with the busine

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating fo
APO13-O1 A system is in place that considers and

effectively addresses enterprise information security
requirements.
APO13-O2 A security plan has been established, accepted

and communicated throughout the enterprise.
APO13-O3 Information security solutions are implemented

and operated consistently throughout the enterprise.
monitored.
plans.
allocated and used.


meet requirements.

process.





communicated.





performance.

the quantitative objectives for process performance are
met.


variation.


PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
f key IT services with the business needs.

(0-15%) -50%) - 85%) (85-100%)

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI01 Manage Programmes and Projects

Purpose
Satisfy the business requirement of providing satisfactory third-party services while being transparent about benefits, costs and risks.
Assess whether the following Criteria Criteria Are Comment Partially Largely
outcomes are achieved. Met Y/N Not achieved Achieved (15% Achieved (50% Fully Achieved
(0-15%) -50%) - 85%) (85-100%)
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for the process
BAI01-O1 Relevant stakeholders are engaged in the

programmes and projects.
BAI01-O2 The scope and outcomes of programmes and

projects are linked to enterprise objectives and confirmed to
be viable.
BAI01-O3 Programme and project activities are planned to

address the scope and achieve the expected outcomes.
BAI01-O4 The programme and project activities are

monitored, controlled and reported to achieve the plans.
BAI01-O5 There are sufficient programme and project

resources to perform activities according to the plans.
BAI01-O6 The programme and project expected benefits are
achieved and accepted,.
monitored.
plans.

used.


requirements.

process.


standard process.


communicated.

and experience.

allocated and used.



business goals.

performance.


performance.

variation.
of variation.


BAI02 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI02 Define Requirements

Purpose
Satisfy the business requirement of optimising the performance of IT infrastructure, resource

Criteria
BAI02-O1 Business functional and technical requirements are

defined to reflect enterprise needs and expectations.
BAI02-O2 The proposed solution satisfies business functional,

technical and compliance requirements.
BAI02-O3 Risks associated with the requirements have been

addressed in the proposed solution.
BAI02-O4 Requirements and proposed solutions meet

business case objectives (value expected and likely costs).
monitored.
plans.

used.


requirements.

process.



standard process.


communicated.

and experience.

allocated and used.



performance.


performance.

variation.
of variation.


PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
e of IT infrastructure, resources and capabilities in response to business needs.

(0-15%) -50%) - 85%) (85-100%)

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI03 Identify and Build Solutions

Purpose
Satisfy the business requirement of ensuring minimal business impact in the event of an IT service interruption.
Partially Largely
Assess whether the following Criteria Are Not Achieved Achieved Fully
Criteria Comment achieved (15% (50% - Achieved
(0-15%) -50%) 85%) (85-100%)
purpose.
BAI03-O1 The solution design, including
relevant components, meets enterprise
needs, aligns with standards and addresses
all identified risks.
BAI03-O2 The solution conforms to the
design, is in accordance with organisational
standards, and has appropriate control,
security and auditability.
BAI03-O3 The solution is of acceptable
quality and has been successfully tested.
BAI03-O4 Approved changes to requirements

are correctly incorporated into the solution.
BAI03-O5 Maintenance activities successfully

address business and technological needs.

used.


managed. The work products b) Requirements for documentation
(or outputs from the process) and control of the work products are
are defined and controlled. defined.

requirements.

process.
the standard process with other processes
is determined.


process.


communicated.
experience.


process are made available, managed
and maintained.
understanding the behaviour of, and to
demonstrate the suitability and

performance of the process support of relevant defined business goals
supports the achievement of are established.
needs.

measurement are identified and defined
in line with process measurement
objectives and quantitative objectives for

collected, analysed and reported in order
to monitor the extent to which the

which the process is a) Analysis and control techniques are
quantitatively managed to determined and applied where applicable.
produce a process that is
stable, capable and
predictable within defined b) Control limits of variation are
limits. established for normal process
performance.


approaches to the definition
and deployment of the
process.
Optimizing. measure of the extent to
which changes to the process
are identified from analysis of
common causes of variation
in performance, and from

and innovation.



improvement objectives. b) Implementation of all agreed changes
is managed to ensure that any disruption
to the process performance is understood
and acted upon.
BAI04 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI04 Manage Availability & Capacity

Purpose Satisfy the business requirement of maintaining the confidentiality, integrity and availability o
minimising the impact of security vulnerabilities.

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for
BAI04-O1 The availability plan anticipates the business

expectation of critical capacity requirements.
BAI04-O2 Capacity, performance and availability meet

requirements.
BAI04-O3 Availability, performance and capacity issues

are identified and routinely resolved.
the performance of the process is a) Objectives for the performance of the process
managed. are identified.
monitored.
plans.
allocated and used.


meet requirements.

standard process is maintained to a) A standard process, including appropriate
support the deployment of the tailoring guidelines, is defined that describes the
defined process. fundamental elements that must be incorporated into
a defined process.


standard process.


determined.

deployed as a defined process to appropriately selected and/or tailored standard
achieve its process outcomes. process.

for performing the defined process are assigned
and communicated.



as a basis for understanding the behaviour of, and
to demonstrate the suitability and effectiveness of
the process, and to evaluate where continuous



are met.


of variation.
changes to the process are identified a) Pprocess improvement objectives for the process
from analysis of common causes of are defined that support the relevant business goals.




PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
entiality, integrity and availability of information and the processing infrastructure aligned to business needs and

(0-15%) -50%) - 85%) (85-100%)

BAI05 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI05 Enable Organisational Change

Purpose
Satisfy the business requirement of ensuring transparency and understanding of IT costs and

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for th
BAI05-O1 Stakeholder desire for the change has been

understood.
BAI05-O2 Implementation team is competent and able

to drive the change.
BAI05-O3 Desired change is understood and accepted

by stakeholders.
BAI05-O4 Role players are empowered to deliver the

change.
BAI05-O5 Role players are enabled to operate, use and

maintain the change.
BAI05-O6 The change is embedded and sustained.
are identified.
monitored.
managed.

meet plans.
communicated.


responsibility.




standard process.


determined.

process.





are established.





performance.




process performance is understood and acted upon.
causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
cy and understanding of IT costs and improving cost-efficiency through well-informed use of IT services.

(0-15%) -50%) - 85%) (85-100%)

BAI06 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI06 Manage Changes

Purpose
Satisfy the business requirement of effectively and efficiently using applications and technolo

Criteria
BAI06-O1 Authorised changes are made in a timely

manner and with minimal errors.
BAI06-O2 Impact assessments reveal the effect of

the change on all affected components.
BAI06-O3 All emergency changes are reviewed and

authorised after the change.
BAI06-O4 Key stakeholders are kept informed of all

aspects of the change.
monitored.
meet plans.
communicated.


responsibility.



determined.

standard process.


determined.

standard process.



maintained.








performance.




upon.
determine whether results are due to common or
special causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
ciently using applications and technology solutions and ensuring user compliance with policies and procedures.

(0-15%) -50%) - 85%) (85-100%)

BAI07 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI07 Accept and Transition Changes

Purpose
Satisfy the business requirement of enabling effective use of IT systems by ensuring resolutio

Criteria
BAI07-O1 Acceptance testing meets stakeholders' approval

and takes into account all aspects of the implementation and
conversion plans.
BAI07-O2 Releases are ready for promotion into production

with stakeholder readiness and support.
BAI07-O3 Releases are promoted successfully, are stable and

meet expectations.
BAI07-O4 Lessons learned contribute to future releases.
monitored.
plans.

used.


requirements.

process.



standard process.


communicated.

and experience.

allocated and used.



performance.


performance.

variation.
of variation.



PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
systems by ensuring resolution and analysis of end-user queries, questions and incidents

(0-15%) -50%) - 85%) (85-100%)

BAI08 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI08 Manage Knowledge

Purpose
Satisfy the business requirement of optimising the IT infrastructure, resources and capabilitie

Criteria
BAI08-O1 Sources of information are identified and

classified.
BAI08-O2 Knowledge is used and shared.
BAI08-O3 Knowledge sharing is embedded in the

culture of the enterprise.
BAI08-O4 Knowledge is updated and improved to

support requirements.
are identified.
monitored.
meet plans.
communicated.


responsibility.




standard process.


determined.

process.





are established.





performance.




upon.
causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
rastructure, resources and capabilities; and accounting for IT assets.

(0-15%) -50%) - 85%) (85-100%)

BAI09 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI09 Manage Assets

Purpose
Satisfy the business requirement of ensuring end users’ satisfaction with service offerings and

Criteria
BAI09-O1 Licences are compliant and aligned with

business need.
- BAI09-O1A There are an optimum number of licences to

ensure compliance and meet business needs
BAI09-O2 Assets are maintained at optimal levels.
- BAI09-O2A Up-to-date and accurate information on all IT

assets is maintained in a central repository
- BAI09-O2B Assets are maintained to provdie the necessary

levels of reliability and availability to support business
needs
- BAI09-O2C All assets are tracked and managed through

their full lifecycle: from procurement to disposal
-BAI09-O2D The estate is continually reviewed and assessd
to ensure assets provide optimal value while meeting
business needs.
monitored.
plans.

allocated and used.


meet requirements.

process.





PA 3.2 Process Deployment - A
deployed as a defined process to
communicated.






measurement objectives and quantitative objectives for

met.


variation.


ensure that any disruption to the process performance
is understood and acted upon.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
faction with service offerings and service levels by reducing solution and service delivery defects and rework.

(0-15%) -50%) - 85%) (85-100%)

BAI10 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
BAI10 Manage Configuration

Purpose
Satisfy the business requirement of optimising the use of information and ensuring that infor

Criteria
BAI10-O1 Configuration repository is accurate, complete

and up to date.
-BAI10-O1A A detailed logical model of the IT infrastructure

is managed and correlates IT services and IT components
-BAI10-O1B A centralsied database exists for all

configuration items
-BAI10-O1C Configuration items are identified, classified,

labelled, assigned, described and linked as appropriate
-BAI10-O1D Modifications to configuration items are

controlled
-BAI10-O1E Configuration data is verified and audited
-BAI10-O1F Accurate configuration information is provided

to all relevant people to be able to make decisions at the
right time.
monitored.
plans.

allocated and used.


meet requirements.

process.





communicated.





measurement objectives and quantitative objectives for

met.


variation.

ensure that any disruption to the process performance
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
ormation and ensuring that information is available as required.

(0-15%) -50%) - 85%) (85-100%)

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
DSS01 Manage Operations

Purpose Satisfy the business requirement of managing the physical environment to protect computer accesses and business data to minimise the risk of
business disruption.
Partially Largely
Criteria Comment achieved (15% (50% - Achieved
(0-15%) -50%) 85%) (85-100%)
Level 0 The process is not At this level, there is little or no evidence of any
Incomplete implemented, or fails to achievement of the process purpose.
purpose.
DSS01-O1 Operational activities are performed as
required and scheduled.
-DSS01-O1A Operational activities are performed
reliably and consistently against a schedule
-DSS01-O1B Data is handled and managed in

accordance with information security polcies
DSS01-O2 Operations are monitored, measured,

reported and remediated.
-DSS01-O2A Event information and history is
captured for significant assets
-DSS01-O2B The appropriate control actions for

events are determined and are communicated to,
and trigger, the appropriate functions.
-DSS01-O2C Facilities are protected against
environemtnetal factors
-DSS01-O2D Facilties are in complaince with
relevant health & safety laws, regulations,
guidleines and vendor specifications.
Level 2 PA 2.1 Performance As a result of full achievement of this attribute:

performance of the process is a) Objectives for the performance of the
managed. process are identified.
b) Performance of the process is planned
and monitored.
c) Performance of the process is adjusted
to meet plans.
and communicated.


PA 2.2 Work Product As a result of full achievement of this attribute:

Management - A measure of
products produced by the a) Requirements for the work products of
process are appropriately the process are defined.
managed. The work products b) Requirements for documentation and
(or outputs from the process) control of the work products are defined.
are defined and controlled.

(or outputs from the process)

accordance with planned arrangements and
adjusted as necessary to meet requirements.

deployment of the defined appropriate tailoring guidelines, is defined that
process. describes the fundamental elements that must
be incorporated into a defined process.

determined.

performing a process are identified as part of


determined.
PA 3.2 Process Deployment - As a result of full achievement of this attribute:
defined process to achieve its upon an appropriately selected and/or tailored
process outcomes. standard process.

experience.

necessary for performing the defined
process are made available, allocated and
used.

maintained.
Level 4 PA 4.1 Process Measurement As a result of full achievement of this attribute:

Predictable - A measure of the extent to
are used to ensure that a) Process information needs in support of
performance of the process relevant defined business goals are established.
supports the achievement of

measurement are identified and defined in line
with process measurement objectives and
performance.

PA 4.2 Process Control - A As a result of full achievement of this attribute:
measure of the extent to
stable, capable and b) Control limits of variation are established
predictable within defined for normal process performance.
limits.

which changes to the process As a result of full achievement of this attribute:
are identified from analysis of a) Pprocess improvement objectives for the
common causes of variation process are defined that support the relevant
in performance, and from business goals.
approaches to the definition b) Appropriate data are analysed to identify
and deployment of the common causes of variations in process
process. performance.


identified.
e) An implementation strategy is established
to achieve the process improvement objectives.

which changes to the As a result of full achievement of this attribute:
definition, management and a) Impact of all proposed changes is assessed
performance of the process against the objectives of the defined process
result in effective impact that and standard process.
upon.
c) Based on actual performance, effectiveness
of process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
DSS02 Manage Service request and Incidents

Purpose Satisfy the business requirement of maintaining the management of operations to ensure that operational service levels can be achieved and IT
infrastructure can resist and recover from errors and failures.
Partially Largely
Criteria Are Not Achieved Achieved Fully
Assess whether the following Criteria Met Y/N Comment
outcomes are achieved. achieved (15% (50% - Achieved
(0-15%) -50%) 85%) (85-100%)
Level 0 The process is not At this level, there is little or no evidence of any
Incomplete implemented, or fails to achievement of the process purpose.
Level 1 PA 1.1 The implemented The following process outcomes are being Overall rating for the process L
purpose.
DSS02-O1 IT-related services are available for S
use.
DSS02-O2 Incidents are resolved according to N
agreed-on service levels.
DSS02-O3 Service requests are dealt with S
according to agreed-on service levels and to the
satisfaction of users.
Level 2 PA 2.1 Performance As a result of full achievement of this attribute:
performance of the process is a) Objectives for the performance of the
managed. process are identified.
b) Performance of the process is planned
and monitored.
c) Performance of the process is adjusted
to meet plans.
and communicated.
e) Resources and information necessary

for performing the process are identified,

PA 2.2 Work Product As a result of full achievement of this attribute:

Management - A measure of
products produced by the a) Requirements for the work products of
process are appropriately the process are defined.
managed. The work products b) Requirements for documentation and
(or outputs from the process) control of the work products are defined.

accordance with planned arrangements and
adjusted as necessary to meet requirements.

process.
determined.
performing a process are identified as part of


effectiveness and suitability of the process
are determined.
PA 3.2 Process Deployment - As a result of full achievement of this attribute:
defined process to achieve its upon an appropriately selected and/or
process outcomes. tailored standard process.


experience.

necessary for performing the defined
process are made available, allocated and
used.

maintained.
Level 4 PA 4.1 Process Measurement As a result of full achievement of this attribute:

Predictable - A measure of the extent to
are used to ensure that a) Process information needs in support
performance of the process of relevant defined business goals are
supports the achievement of established.


measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

quantitatively managed to
stable, capable and
limits.
PA 4.2 Process Control - A
measure of the extent to
stable, capable and
limits. established for normal process performance.

which changes to the process As a result of full achievement of this attribute:
are identified from analysis of a) Pprocess improvement objectives for the
common causes of variation process are defined that support the relevant
in performance, and from business goals.
approaches to the definition b) Appropriate data are analysed to identify
and deployment of the common causes of variations in process
process. performance.

opportunities for best practice and
innovation.

identified.
e) An implementation strategy is established

to achieve the process improvement
objectives.

which changes to the As a result of full achievement of this attribute:
performance of the process assessed against the objectives of the defined
result in effective impact that process and standard process.
which changes to the
definition, management and
performance of the process
result in effective impact that
upon.
effectiveness of process change is evaluated
against the defined product requirements
and process objectives to determine whether
results are due to common or special causes.
DSS03 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
DSS03 Manage Problems

Purpose
Satisfy the business requirement of transparency and understanding of IT cost, benefits, strat

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating f
DSS03-O1 IT-related problems are resolved so that they do

not reoccur.
- DSS03-O1A A process is in place to be able to identify &

classsify problems
- DSS03-O1B A proactive problem management system

allows for the resolution & closing of problems
- DSS03-O1C Known Errors are effetively investigated &

diagnosed
- DSS03-O1D Problems and resulting incidents are reduced
monitored.
plans.

allocated and used.


meet requirements.

process.





communicated.





performance.

and reported in order to monitor the extent to which the


variation.
of variation.


PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
anding of IT cost, benefits, strategy, policies and service levels in accordance with governance requirements.

(0-15%) -50%) - 85%) (85-100%)

DSS04 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
DSS04 Manage Continuity

Purpose
Satisfy the business requirement of protecting the achievement of IT objectives while comply

Criteria
Level 1 PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for th
DSS04-O1 Business critical information is available to the

business in line with minimum required service levels.
DSS04-O2 Sufficient resilience is in place for critical

services.
DSS04-O3 Service continuity tests have verified the
effectiveness of the plan.
DSS04-O4 An up to date continuity plan reflects current

business requirements.
DSS04-O5 Internal and external parties have been

trained in the Continuity Plan.
are identified.
monitored.
plans.
communicated.



meet requirements.



standard process.


determined.

process.




be made.

are established.


are met.



of variation.
performance.



process performance is understood and acted upon.
causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
ement of IT objectives while complying with internal controls.

(0-15%) -50%) - 85%) (85-100%)

DSS05 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
DSS05 Manage Security Services

Purpose
Satisfy the business requirement of ensuring compliance with laws, regulations and contractu

Criteria
DSS05-O1 Networks and communications security meet

business needs.
DSS05-O2 Information processed on, stored on and

transmitted by endpoint devices is protected.
DSS05-O3 All users are uniquely identifiable and have access

rights in accordance with their business role.
DSS05-O4 Physical measures to protect information from

unauthorised access, damage and interference when being
processed, stored or transmitted have been implemented.
DSS05-O5 Electronic information is properly secured when

strored, transmitted or destroyed
managed.
monitored.
plans.

used.


requirements.

process.



standard process.


communicated.

and experience.

allocated and used.



performance.


performance.

variation.
of variation.



PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
aws, regulations and contractual requirements.

(0-15%) -50%) - 85%) (85-100%)

DSS06 PA 1.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
DSS06 Manage Business Process Controls

Purpose
Satisfy the business requirement of integrating IT governance with enterprise governance an

DSS06-O1 Coverage and effectiveness of key controls to meet

business requirements for processing information are complete.
DSS06-O2 The inventory of roles, responsibilities and access

rights is aligned with authorised business needs.
DSS06-O3 Business transactions are retained completely and as

required in logs.

used.


requirements.



standard process.


communicated.

and experience.

allocated and used.



performance.


performance.

variation.
variation.
e) Control limits are re-established (as necessary) following
corrective action.


PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
governance with enterprise governance and complying with laws, regulations and contracts.

Comment
(0-15%) -50%) - 85%) (85-100%)

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
MEA01 Monitor and Evaluate Performance and Conformance

Purpose Satisfy the business requirement of integrating IT governance with enterprise governance and complying with laws, regulations and
contracts.
Partially Largely
outcomes are achieved. Criteria Met Y/N Comment achieved (15% (50% - Achieved
(0-15%) -50%) 85%) (85-100%)
Level 0 The process is not At this level, there is little or no evidence
Incomplete implemented, or fails to of any achievement of the process
achieve its process purpose. purpose.
purpose.
MEA01-O1 Stakeholders approve the goals
and metrics.
MEA01-O2 Processes are measured against
agreed-upon goals and metrics.
MEA01-O3 The enterprise monitoring,

assessing and informing approach is
effective and operational.
MEA01-O4 Goals and metrics are

integrated within enterprise monitoring
systems.
MEA01-O5 Process reporting on

performance and conformance is useful
and timely.

d) Responsibilities and authorities
for performing the process are defined,

necessary for performing the process
are identified, made available, allocated
and used.
f) Interfaces between the

involved parties are managed to
ensure both effective communication
and also clear assignment of
responsibility.

managed. The work products b) Requirements for documentation
(or outputs from the process) and control of the work products are
are defined and controlled. defined.

requirements.

deployment of the defined appropriate tailoring guidelines, is
process. defined that describes the fundamental
elements that must be incorporated
the standard process with other
processes is determined.
c) Required competencies and

roles for performing a process are
identified as part of the standard
process.
d) Required infrastructure and

work environment for performing a
process are identified as part of the
standard process.


communicated.
c) Personnel performing the
defined process are competent on the
basis of appropriate education, training,
and experience.

e) Required infrastructure and

work environment for performing the
defined process are made available,
understanding the behaviour of, and
to demonstrate the suitability and
improvement of the process can be
made.

performance of the process support of relevant defined business
supports the achievement of goals are established.
needs.
c) Quantitative objectives for

process performance in support of
relevant business goals are established.
measurement are identified and
defined in line with process
measurement objectives and
performance.

collected, analysed and reported in
order to monitor the extent to which
the quantitative objectives for process

quantitatively managed to determined and applied where
produce a process that is applicable.
stable, capable and
limits. established for normal process
performance.


common causes of variation the process are defined that support
in performance, and from the relevant business goals.
approaches to the definition
and deployment of the
process.
which changes to the process
are identified from analysis of
common causes of variation
in performance, and from

and innovation.



b) Implementation of all agreed
changes is managed to ensure that any
disruption to the process performance
MEA02 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
MEA02 Monitor System of Internal Control

Purpose

Criteria
MEA02-O1 Processes, resources and information meet

enterprise internal control system requirements.
MEA02-O2 All assurance initiatives are planned and

executed effectively.
MEA02-O3 Independent assurance that the system of

internal control is operational and effective is provided.
MEA02-O4 Internal control is established and

deficiencies are identified and reported on.
are identified.
monitored.
plans.
communicated.



meet requirements.



standard process.


determined.

process.




be made.

are established.


are met.


of variation.
performance.



causes.
PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
nce with enterprise governance and complying with laws, regulations and contracts.

(0-15%) -50%) - 85%) (85-100%)

MEA03 PA 1.1 PA 2.1
Rating by
Criteria
Capability
Level Achieved
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%
N – Not Achieved
F- Fully Achieved
MEA03 Monitor and Evaluate Compliance with External Requirements

Purpose

Criteria
MEA03-O1 All external compliance requirements are

identified.
MEA03-O1A Organisational policies, standards, procedures

and methodologies are regularly reviwed to ensure
complaince with legal and regulatory requirements
MEA03-O2 External compliance requirements are adequately

addressed.
MEA03-O2A Compliance assurance reports
managed. a) Objectives for the performance of the process are
identified.
monitored.
plans.

used.


requirements.




standard process.


communicated.

and experience.

allocated and used.



performance.


performance.

variation.
of variation.


PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2
ith enterprise governance and complying with laws, regulations and contracts.

(0-15%) -50%) - 85%) (85-100%)

Sistema de Gobierno en Base A Factores de Gobierno

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sistema de Gobierno en Base A Factores de Gobierno

Uploaded by

Copyright:

Available Formats

The Self-assessment Guide is provided as a ‘stand-alone’ guide, which can be used by enterprises to perform

Processes for Governance of Enterprise IT -

Fase 1 Identificar los trabajadores

EDM01 Ensure Governance Framework Setting and Maintenance

Assess whether the following Criteria Are Partially Largely

EDM01-O1An optimum strategic decision-

EDM01-O2The governance system for IT is

Level 2 PA 2.1 Performance As a result of full achievement of this

e) Resources and information

f) Interfaces between the involved

PA 2.2 Work Product As a result of full achievement of this

c) Work products are appropriately

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

b) The sequence and interaction of the

c) Required competencies and roles

d) Required infrastructure and work

e) Suitable methods for monitoring the

PA 3.2 Process Deployment - As a result of full achievement of this

b) Required roles, responsibilities and

c) Personnel performing the defined

e) Required infrastructure and work

f) Appropriate data are collected and

Level 4 PA 4.1 Process Measurement As a result of full achievement of this

c) Quantitative objectives for process

d) Measures and frequency of

f) Measurement results are used to

c) Measurement data are analysed for

Level 5 PA 5.1 Process innovation - A

c) Appropriate data are analysed to

e) An implementation strategy is

PA 5.2 Process optimisation -

Process Name Level 0 Level 1 Level 2

EDM02 PA 1.1 PA 2.1

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

EDM02 Ensure Value Optimisation

Assess whether the following Criteria Are

EDM02-O1 The enterprise is securing optimal value

EDM02-O2 Optimum value is derived from IT

EDM02-O3 Individual IT-enabled investments

e) Resources and information necessary for

f) Interfaces between the involved parties

PA 2.2 Work Product Management - As a result of full achievement of this attribute:

c) Work products are appropriately

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this attribute:

b) The sequence and interaction of the

c) Required competencies and roles for

d) Required infrastructure and work

e) Suitable methods for monitoring the

PA 3.2 Process Deployment - A As a result of full achievement of this attribute:

b) Required roles, responsibilities and

c) Personnel performing the defined process

e) Required infrastructure and work

f) Appropriate data are collected and

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this attribute:

d) Measures and frequency of measurement

e) Results of measurement are collected,

f) Measurement results are used to

PA 4.2 Process Control - A measure As a result of full achievement of this attribute:

b) Control limits of variation are established for

c) Measurement data are analysed for special

c) Appropriate data are analysed to identify

d) Improvement opportunities derived from

e) An implementation strategy is established to