Policy Development & The 4 Cobit Domain Processes

Policy Development
& The 4 COBIT

Domain Processes
Policy Development based on COBIT
Implementation
Craig R. Gray, Director of IS&T

cgray@leeuniversity.edu
Agenda
Policy Development: Basis & Application
The Mechanics of Control
COBIT-What?
COBIT-4 Domains
High Level Control Examples?
Dr
iv ing
Bu
sin
es
sN
ee
ds
IT Funct
ions
Traditional Tools of the Trade
Policy Development Flow
The control of
IT Processes
which satisfy
Business
Requirements is enabled by
Control
Statements and considers
Control
Practices
Control Cycle
Identify Key Controls Standards
Adjust Measurement
as Control Focus System
Necessary
Measure
What is COBIT?
COBIT (Control Objectives for Information and Related Technology) is
globally accepted as being the most comprehensive work for IT
governance, organization, as well as IT process and risk management
COBIT provides good practices for the management of IT processes in

a manageable and logical structure, meeting the multiple needs of
enterprise management by bridging the gaps between business
risks, technical issues, control needs and performance
measurement requirements.
The COBIT mission is to research, develop, publicize and promote an

authoritative, up-to-date, international set of generally accepted
information technology control objectives for day-to-day use by
business managers and auditors.
Starts from the premise that IT needs to deliver the
Planning
information that the enterprise needs to achieve its
objectives. Acquiring & Implementing
Promotes process focus and process ownership Delivery & Support
Divides IT into 34 processes belonging to four domains Monitoring
and provides a high level control objective for each
Looks at fiduciary, quality and security needs of
enterprises,providing seven information criteria that can Effectiveness
be used to generically define what the business Efficiency
requires from IT Availability
Integrity
Is supported by a set of 318 detailed control objectives
Confidentiality
Reliability
Compliance
Deals with information being
relevant and pertinent to the Relates to the information being
EFFECTIVENESS business process as well as being AVAILABILITY available when required by the
delivered in a timely, correct, business process now and in the
consistent and usable manner future
Concerns the provision of the Deals with complying with laws,

EFFICIENCY information through the optimal COMPLIANCE regulations and contractual
use of resources arrangements.
Concerns the protection of Relates to the provision of

RELIABILITY OF appropriate information for the
CONFIDENTIALITY sensitive information from
unauthorized disclosure INFORMATION workforce of the organization
Relates to the accuracy and

completeness of information as
INTEGRITY well as to its validity in
accordance with business values
and expectations
Information Risk Criteria
Events can be defined in terms of the processes, technology (systems) and organization
(people) that compose them
RISK
DATA CRITERIA
EVENTS Effectiveness
Business Operations
Efficiency
Business Opportunities PROCESS
Confidentiality
External Requirements
TECHNOLOGY
Regulations Integrity
ORGANIZATION Availability
Compliance
Reliability
MESSAGE INPUT SERVICE OUTPUT

The 4 COBIT Domains
Planning & Organization

Acquisition & Implementation
Delivery & Support
Monitoring
Planning and Organization
This domain covers strategy and tactics, and concerns
the identification of the way IT can best contribute to the
achievement of the business objectives.
Furthermore, the realization of the strategic vision needs

to be planned, communicated and managed for different
perspectives.
Finally, a proper organization as well as technological

infrastructure must be put in place.
Acquisition and Implementation
To realize the IT strategy, IT solutions need to be

identified, developed or acquired, as well as
implemented and integrated into the business process.
In addition, changes in and maintenance of existing

systems are covered by this domain to make sure that
the life cycle is continued for these systems.
Delivery and Support
This domain is concerned with the actual delivery of
required services, which range from traditional
operations over security and continuity aspects to
training.
In order to deliver services, the necessary support

processes must be set up.
This domain includes the actual processing of data by

application systems, often classified under application
controls.
Monitoring
All IT processes need to be regularly assessed

over time for their quality and compliance with
control requirements.
This domain thus addresses managements

oversight of the organization's control process
and independent assurance provided by internal
and external audit or obtained from alternative
sources.
COBIT Components
Executive Summary There is a method
Framework The method is
Control Objectives Minimum controls are
Audit Guidelines Here is how you audit
Implementation Here is how you implement

Toolset
Management Here is how you measure
Guidelines
COBIT History
Technical Standards
ISO, EDIFACT
Codes of Conduct
Council of Europe, ISACA, OECD
Qualification Criteria for IT Systems and Processes

ITSEC, TCSEC, ISO 9000, SPICE, TICKIT, Common Criteria
Professional Standards
COSO, IFAC, AICPA, CICA, ISACA, IIA, PCIE, GAO
Industry Practices and Requirements

Industry forums (ESF, 14), Government-sponsored platforms (IBAG,
NIST, DTI, BS7799)
Thanks!
Questions?
cgray@leeuniversity.edu

Policy Development & The 4 Cobit Domain Processes

Uploaded by

Copyright:

Available Formats

Policy Development & The 4 Cobit Domain Processes

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Policy Development & The 4 Cobit Domain Processes

Uploaded by

Copyright:

Available Formats

Policy Development

& The 4 COBIT

Craig R. Gray, Director of IS&T

COBIT provides good practices for the management of IT processes in

The COBIT mission is to research, develop, publicize and promote an

Concerns the provision of the Deals with complying with laws,

Concerns the protection of Relates to the provision of

Relates to the accuracy and

MESSAGE INPUT SERVICE OUTPUT

Planning & Organization

Furthermore, the realization of the strategic vision needs

Finally, a proper organization as well as technological

To realize the IT strategy, IT solutions need to be

In addition, changes in and maintenance of existing

In order to deliver services, the necessary support

This domain includes the actual processing of data by

All IT processes need to be regularly assessed

This domain thus addresses managements

Framework The method is

Control Objectives Minimum controls are

Audit Guidelines Here is how you audit

Implementation Here is how you implement

Qualification Criteria for IT Systems and Processes

Industry Practices and Requirements

You might also like