ITIL AND COBIT EXPLAINED

Transcription

1 ITIL AND COBIT EXPLAINED 1

2 AGENDA Overview of Frameworks Similarities and Differences Details on COBIT Framework (based on version 4.1) Details on ITIL Framework, focused mainly on version.2. Comparison of COBIT and ITIL v.2 sections. Maturity Capacity Models Q&A Copyright of Elevate Consulting LLC, All Rights Reserved 2

3 POSITIONING THE FRAMEWORKS CMM = capability maturity model Specific CobiT = Control Objectives for Information and Related Technology TCO CMMI ITIL ISO ITIL = IT Infrastructure Library TCO = total cost of ownership CobiT IT Relevance IS = IT service mgt standard People CMM ISO 9000 = quality mgt standard Point solutions are useful, but a broader, holistic approach to process and quality improvement is POWERFUL. Six Sigma ISO 9000 Holistic Low Level of Abstraction National Awards (e.g., Baldrige) Scorecards High 3

4 ITIL and COBIT can enable organizations to achieve key objectives: Establish proven best practice IT service management processes to manage IT from a business perspective and achieve business goals, including that of compliance Put in place clear process goals, based on the organization s business goals, and provide a means of measuring progress against them Ensure effective IT governance and control at the process level, and enable IT to demonstrate that it meets or exceeds the requirements set forth by government or external regulations Frameworks are highly complementary, and together provide greater value than using just one or the other. COBIT outlines what 4 you need to do to meet these challenges and ITIL shows you how to get there.

5 Why is IT governance and best practices implementation needed? The effective management of information, information systems, communication and IT services is of critical important and survival of most enterprises. This criticality arises from: - The pervasiveness of and dependence on information, the services and the infrastructure that deliver the information - The increasing scale and cost of current and future technology- related investments - The potential for technologies to enable transformation of enterprises and business practices 5

6 Some Facts: - ITIL strong in IT HOW to carry on processes (delivery and support), but limited in security and system development - COBIT is strong in IT controls and IT metrics, it concentrates on WHAT should be achieved rather than how (e.g. process flows) to achieve effective governance, management and control. No contradictions or real overlaps, they complement No discussion on specific technologies or configuration requirements (e.g. unlike PCI) 6

7 Control OBjectives for Information and related Technology Originally released in 1996 by the Information Systems Audit and Control Foundation (ISACF) (1st Edition) Current primary publisher is the IT Governance Institute( ITGI) - formed by the Information Systems Audit and Control Association (ISACA) in 1998 (2nd Edition) By 2000, ISACF and ITGI became one entity, and the 3 rd Edition was issued. In 2005, 4th Edition was issued. COBIT was formed through research of sources such as the technical standards from ISO, codes of conduct issued by the Council of Europe and ISACA, professional standards for internal control and auditing issued by COSO, AICPA, GAO, etc. The above sources were used to formulate COBIT to be both pragmatic and responsive to business needs while being 7 independent of the technical IT platforms adopted in an organization.

8 COBIT EDUCATION: The COBIT curriculum includes the following courses: COBIT Awareness Course (2 hours, self paced elearning) COBIT Foundation Course (8 hours, self paced elearning or 14 hours, classroom) COBIT Foundation Exam (1 hour, online 40 questions) IT Governance Implementation Course (14 hours, classroom) COBIT for Sarbanes-Oxley Compliance (5 hours, self paced e-learning) 8

9 COBIT ONLINE: o Provides full browsing capabilities by enabling you to download the selected COBIT content as either a Microsoft Word or Access template, for subsequent use offline. oall or selected COBIT components can be accessed, and they can be filtered based on several search criteria: Framework Control Objectives Inputs/Outputs RACI Charts Goals and Metrics Maturity Models Control Practices Assurance Steps 9

10 COBIT ON IT GOVERNANCE.. IT governance is the responsibility of executives and the board of directors, and consists of the leadership, organizational structures and processes that ensure that the enterprise s IT sustains and extends the organization's strategies and objectives. For IT to be successful in delivering against business requirements, management should put an internal control system or framework in place. The business orientation of COBIT consists of linking business goals to IT goals, providing metrics and maturity models to measure their achievement, and identifying the 10 associated responsibilities of business and IT process owners.

11 COBIT Family of Products 11

12 COBIT IT Domains and Processes 12

13 COBIT COMPONENTS 4 Domains Planning & Organization (PO) Acquire & Implement (AI) Delivery & Support (DS) Monitor and Evaluate (ME) 34 Control Objectives 318 Detailed Control Activities 13

14 14

15 INTERRELATIONSHIPS WITH COBIT COMPONENTS 15

16 How Does Governance and the Business Drive IT? 16

17 How Does Governance and the Business Drive IT? 17

18 How Does Governance and the Business Drive IT? IT Goals: 18

19 How Does Governance and the Business Drive IT? COBIT information Criteria 19

20 How Does Governance and the Business Drive IT? 20

21 How Does Governance and the Business Drive IT? COBIT information Criteria 21

22 COBIT FRAMEWORK NAVIGATION 22

23 COBIT FRAMEWORK NAVIGATION- EXAMPLE 23

24 COBIT FRAMEWORK NAVIGATION- EXAMPLE 24

25 CHANGE MANAGEMENT ITIL PROCESS FLOW SUMMARY CMDB Change to: Hardware Software Documentation Infrastructure Training Engineering specs Tactical planning Assessments Change Management Release Management RFC Reasons: Fix a Problem Changing business requirements Changing technology Continuous SIP External forces (e.g. competition, legislations) Change Advisory Board Service Management Technical Experts Customers and Users Interested Parties 25

26 ITIL Information Technology Library 26

27 INTRODUCTION TO ITIL During the late 1980 s the Central Computer and Telecommunication Agency (CCTA) in the United Kingdom started to work on what is now known as ITIL, the Information Technology Infrastructure Library ITIL is a set of books that provides comprehensive and interrelated codes of practice in achieving the efficient support and delivery of high quality, cost effective IT services Version 2 available in 2000 Version 3 available in

28 ITIL EDUCATION PATH 28

29 ITIL MYTH As Jan Van Bon (author and editor of many IT Service Management publications) notes: There is a lot of confusion about ITIL, stemming from all kinds of misunderstandings about its nature. ITIL is a set of best practices. The there is no claim that ITIL s best practices describe pure processes.. That is what most of its users make of it, probably because they have such a great need for such a model CIO Magazine columnist Dean Meyer has also presented some cautionary views of ITIL, including five pitfalls such as "becoming a slave to outdated definitions" and "Letting ITIL become religion." As he notes, "...it doesn't describe the complete range of processes needed to be world class. It's focused on... managing ongoing services." 29

30 ITIL V.2 AND V.3 ITIL v2, seven books with two main areas: Service Support Service Delivery In ITIL v3 moves from a process approach to a service life cycle approach: Service strategy- which type of services, to which customers and markets Service design- identifies service req s, devices new service offerings Service transition- builds and deploys new or modified services Service operation- carries out operational tasks Continual service improvement- learns from the past, improve the effectiveness and efficiencies of services and process 30

31 What is the difference between Version 2 and Version 3? V3 articulates the relationship between IT and the business far more clearly than earlier versions of ITIL. Instead of focusing on processes as in V2, V3 considers a wider view of IT by considering the Lifecycle of a service from its initial planning, which should be aligned to the business need, through to its final retirement. V3 focuses more on the treatment of strategic options, functions, roles and responsibilities as well as continual improvement. The existing processes from earlier ITIL versions remain in V3 but have been improved and added to. ITIL V3 also looks more closely 31 at alignment with other best practices and standards.

32 ITIL V.2 AND V.3 PROCESSES 32

33 COBIT Control Objectives Linked with ITIL V.2 Plan and Organize Direct link with ITIL Acquire and Implement 33

34 COBIT Control Objectives Linked with ITIL Define and Support Direct link with ITIL Monitor and Evaluate 34

35 ONE TO ONE COMPARISON COBIT 4.1 AND ITIL V.2 Process Description V.2 Section COBIT Section Financial Management Provides cost effective stewardship of IT assets used in providing IT services Service Delivery PO.5 Release Management Ensure that all technical and non technical aspects of a release are dealt with in a coordinated approach. Service Support AI.4 Change Management Ensure standardized methods and approaches are followed for efficient, prompt and authorized handling of all IT changes. Service Support AI.6 Incident Management Restore normal service operations as quickly as possible Service Support DS.8 Configuration Management Provide a logical model of the IT infrastructure by identifying, verifying, maintaining and controlling all version of IT Configuration items (CIs) Service Support DS.9 35

36 ONE TO ONE COMPARISON COBIT 4.1 AND ITIL V.2 Process Description V.2 Section COBIT Sectio n Problem Management Prevent and identify the business errors in the IT infrastructure. Service Support DS.10 Service Level Management Maintain and improve IT service quality through a constant cycle of agreeing, monitoring and reporting IT service level agreements Service Delivery DS1. and some of DS.2 Availability Management Optimize the capacity of the IT infrastructure and supporting organization to deliver cost effective and sustained level of availability to satisfy business objectives. Service Delivery DS.3 Capacity Management Ensure the capacity and performance aspects of the business requirements are provided timely and cost effectively. Service Delivery DS.3 IT Service Continuity Ensuring that the required IT services and facilities can be recovered within the agreed times Service Delivery DS.4 36

37 MATURITY MODELING Maturity modeling for management and control over IT processes is based on a method of self-evaluation by the organization. In COBIT and ITIL a maturity model has been defined for each section, providing an incremental measurement scale from 0, non-existent, through 5, optimized. Using the maturity models developed for each IT process, management can identify: The actual performance of the enterprise Where the enterprise is today The current status of the industry The comparison The enterprise s target for improvement Where the enterprise wants to be The maturity attributes list the characteristics of how IT processes are managed and describes how they evolve from a non-existent to an optimized process. These attributes can be used for more comprehensive assessment, gap analysis and improvement planning. 37

38 MATURITY LEVEL RANKING 38

39 Maturity Model- Where Does Your Organization Stack? Defined Process Repeatable/ Intuitive Control/ Proactive Awareness/ Reactive Managed and Measurable Integration/ Service Level 4 Optimization/ Value Level 5 IT as strategic business partner Initial/ Ad Hoc Level 3 IT as a service IT and business provider metric linkage Initiation/ Chaotic Level 2 Analyze trends Define services, IT/business Set thresholds classes, pricing Level 1 collaboration Fight fires Understand costs Predict improves Inventory problems Guarantee SLAs business Ad hoc Initiate process Measure appli- Measure & report problem mgt cation Undocumented service availability Real-time process availability infrastructure Integrate Manage IT as a Business Unpredictable Alert and Automate processes Business event mgt Multiple help planning Service and Account Management Mature Capacity desks Measure problem, mgt component Service Delivery Process Engineering configuration, Minimal IT availability change, asset operations (up/down)operational Process Engineering and 39 User call performance notification Tool Leverage mgt processes

40 PROCESS MATURITY MODEL 40

41 IN SHORT- WHAT ARE SOME OF THE BENEFITS obetter alignment of IT environment based on business focus and customer needs oa view, understandable to management of what IT does oclear ownership and responsibilities based on process orientation ogeneral acceptability with third parties and regulators ocommon language spoken by IT (specially for ITIL) ointegration of the processes oimproved decision support by better management information 41

42 SO, HOW THEN DO WE IMPLEMENT A GOVERNANCE FRAMEWORK? 42

43 QUESTIONS & ANSWERS Questions & Answers THANK YOU!!!! 43

44 Contact Information: Angela Polania, CPA, CISA Elevate Consulting 5757 Blue Lagoon Drive Suite 350 Miami FL C Elevate Consulting is a premier South Florida based firm, specialized in: IT Compliance and Governance, Internal Controls and IT Auditing, ITIL Assessments and Implementations Project Management and IT Project Management. 44