CobiT Strategy and
Long Term Vision
Urs Fischer
VP Head IT Risk Mgmt, Security & ICS
Seite 3
März
Seite 5
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
Session Objective
Provide those interested stakeholders with a
clear and single consensus view of CobiT
goals, products and activities
Some findings of the ITGI survey
°
of over 500 executives
18%
18%
27%
27%
2003 2005
Executive awareness
of COBIT
C
OBI
T - Global Status
COBIT is the preferred way to
implement effective IT governance
Executive awareness is up
Perception that it is difficult to
implement
More than half
of those who
know it, know
its contents
More than
1/3rd of those
who know the
Seite 7
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
•
The COBIT strategy depends on the organisational structure, processes and
reporting mechanisms established by ISACA and ITGI to support the goals of
COBIT through:
– Attracting thought leaders,
– Resourcing projects, product support and volunteer development groups,
– Marketing and selling the products, and
– Providing effective oversight and governance
C
OBI
T - the organisation
Core
Team
Strategy
Strategy
Execution
Execution
Brussels
Brussels
London
London
Chicago
Chicago
DC
DC
Cape
Cape
Town
Town
Regional Teams
Development
Lab
Development
Lab
Development
Lab
C
OBI
T - the organisation
CobiT
Steering
Committee
Ad Hoc
Canberra
Canberra
Copen
Copen
-
-hagen
hagen
San
San
Francisco
Francisco
ITG
Committee
Los
Los
Angeles
Seite 9
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
Governance
2005
C
OBI
T4
Management
2000
C
OBI
T3
Control
1998
C
OBI
T2
An open standard at
www.isaca.org
CobiT : An IT control framework
E
volution
Audit
1996
C
OBI
T1
Is internationally accepted
Maps to all major related frameworks and standards and is recognised as an integrator
for such frameworks, standards and best practices
Supports the IT-related component of existing and emerging regulations, particularly
those related to corporate governance and compliance
Is a complete family of products that evolves continuously
Is supported by tools and training
Is maintained by a reputable not for profit organisation
Is technology / platform neutral and independent
Is based on expert volunteer input
Is both management and assurance oriented
Appeals to a broad IT community
Seite 11
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
C
OBI
T - Value and Limitations
CobiT Mission Statements
• CobiT to remain the de-facto standard of IT governance
• ITGI to be the recognized global leader in IT Governance,
control and assurance, and to provide the organisational
support and thought leadership for sustaining COBIT
developments
• ISACA to enhance the reputation, independence and
professionalism of ISACA and provide member benefits,
while leveraging the knowledge of the membership,
volunteers, subject matter experts (SME) and other
advisors as appropriate
Seite 13
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
CobiT Mission Statements
•
Focus on the target group as identified by the ‘IT Governance
global Status Report – 2006’, that is aware of the IT governance
concept, knows IT governance solution providers, prefers CobiT
for it but has not implemented it.
CobiT Strategic Goals
•
CONTENT Ensure currency and quality of the CobiT knowledge
base
•
SUPPORT Enable individual and enterprise users to get value out
of the CobiT products
•
ADOPTION Achieve wide global adoption amongst all audiences
--Board and Executive, IT management and professionals,
in the domains of IT Governance, Assurance and
Security
•
REVENUE Operate a business model that makes access to CobiT
products and services non-prohibitive while being
financially prudent and able to sustain.
Seite 15
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
Support ISACA/ITGI Strategy
COBIT
-
product portfolio
Seite 17
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
COBIT
-
product hierarchy
An open standard at
www.isaca.org
•
Resourcing the development
of CobiT is an immense
challenge
•
CobiT 4.0 has been a 2 year
effort with many
interconnected projects
•
Empirical Analysis to
prove return on IT
governance practices
•
Mapping to other
standards
•
Support for regulatory
compliance
•
Workbench
IT Management Processes
IT Management Processes
IT Governance Processes
IT Governance Processes
IT Management Processes
IT Management Processes
IT Governance Processes
IT Governance Processes
Current Development
Current Development
Future Research
Future Research
Research and Development
Seite 19
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
CobiT Certification
Trainer accreditation
Trainer accreditation
CobiT Implementer Certification
CobiT Implementer Certification
Education Certificates
Education Certificates
Enterprise
Enterprise
compliance
compliance
Product certification
Product certification
People
People
capability
capability
and
and
experience
experience
Strategic Direction
Strategic Direction
YES
YES
NO
NO
CobiT Education
Internet based training for CobiT “Foundation” level
– 3rd party development, volunteer design, ISACA’s IP
– Rolled out July 2005
– Course delivered via network of Distributors; ISACA site
advertises and provides click-through
– Business model is based on royalty to ISACA and a
discount to its members (350$ for 3 months)
– Individuals: 500 sold, 100 exams and 500 prospects
– Corporates: 8 sold and 100+ prospects
Foundation
Implementation
Assurance
Education Strategy
Education Strategy
Implementation – being
aligned to CobiT4.0
Assurance – design done,
under development
Foundation – rolled out
C
OBI
T
FO
U
N
D
AT
IO
N
Seite 21
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
Current Development Activity
• CobiT Online now has CobiT 4.0 content
included; 3.2 still available to support transition
• Updated Implementation Guide, Control
Practices, and Assurance Guide (replaces Audit
Guidelines) will be published 19.4.2007
• Updating Quickstart, Security Baseline and
others to reflect new CobiT Framework
• Updating/expanding CobiT Mapping research
papers and will include maps to CMM, PMBOK,
Prince 2, NIST FISMA standards, and others
• Improving alignment of CobiT to Val IT content
Urs Fischer
CobiT Steering Committee
ISACA
ISACA
is our name.
IT Governance
IT Governance
is our brand.
CobiT
CobiT
is our product.
Conclusion
Seite 23
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
Outlook to the Future
• The IT Governance Framework dates back to 1998 and
is only very high level and IT Governance guidance is
not completely covered (yet).
• The current frameworks, CobiT and ValIT, being owned
and having grown organically through different
committees contain a mix of Management and
Governance guidance.
• The tendency of each new initiative to develop its own
framework can be an obstacle for alignment.
• There is the perception that the target audience for the
current frameworks is not well defined or too broad in
some instances or only audit and control focused.
Seite 25
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
• A simple and complete framework for
IT Governance that
– enhances our ability to communicate
about the IT Governance BOK
– enables adoption by
• Boards
• enterprise management
• IT management
Our Need is for …
We should be providing a Governance
Framework or a clear generic model of the
processes required so that enterprises can
develop and implement a governance
architecture suitable for their requirements ..
But which is aligned to needs of IT
Seite 27
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
• We need to draw loose boundaries
between
– Enterprise (corporate) governance
– IT governance
– IT management
• .. in order to subsequently define the
structure of the ITGF
Boundaries
Portfolio
Management
Performance
Measurement
set
report
set
report
report
report
Value
Management
(investments &
benefits)
Risk
Management
(operational &
compliance)
direct
direct
Enterprise
Governance &
Strategy
Value
Governance
Governance
Risk
drive
report
drive
report
Enterprise governance
framework
drives overall
value and risk
governance in IT
IT Governance drives
Value and Risk
Management
Value and Risk
Management drives
IT service delivery
Systematic
Performance
Measurement tools
as essential feedback
Enterprise
Architecture
Plan
Deliver
Operate
Enterprise
Governance
IT
Governance
IT
Management
Seite 29
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
IT GOVERNANCE
IT MANAGEMENT
Translate strategy into action
•
Make the business more effective and efficient
•
Make IT more effective and efficient
•
Manage risks (security, reliability & compliance)
•
Manage service delivery consistency
Set Objectives
•
Align business and IT
•
Enable the business and maximise benefits
•
Ensure effective and efficient use of resources
•
Manage IT risk as part of ERM
•
Fulfil compliance requirements
Translate
direction into
strategy
Measure and
report
performance
Provide
direction
Evaluate
performance
Governance and Management
ENTERPRISE GOVERNANCE
Set Objectives
•
Set enterprise objectives and directions
•
Build control environment
•
Establish decision rights and responsibilities
•
Manage Enterprise Risk
•
Fulfil compliance requirements
Provide
direction
Evaluate
performance
An IT Governance Framework is a defined
conceptual structure to support
governance expectations by organising IT
tasks and activities into discrete processes
while providing a business focus. It
supplies a common language for IT
activities and key management practices
involved and is consistent with generally
accepted IT good practices and corporate
governance standards.
Seite 31
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
• ITGI has developed
– Guidance
• Board Briefings
– Frameworks
• CobiT
• Val IT
– and more to come?
• Both frameworks contain components at
Governance layer and Management layer
• Frameworks overlap to certain degree
Where we are now …
IT Governance
IT Management
View 1 – Board Briefing
Seite 33
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
IT Governance
PO
Plan and Organise
AI
Acquire and Implement
Deliver and Support
DS
ME
Monitor and Evaluate
IT Management
View 2 - CobiT
IT Governance
View 3a – Val IT
Seite 35
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
IT Governance
View 3b – Val IT
IT Management
IT Governance
PO
Plan and Organise
AI
Acquire and Implement
DS
Deliver and Support
ME
Monitor and Evaluate
IT Management
View 4 – Board Briefing, CobiT
& ValIT
VG
Value Governance
PM
Portfolio Management
IM
Investment Management
Board Briefing
Seite 37
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
Alternative 1 – “As Is”
Maintain and develop all frameworks in a ‘loosely’
coupled way
IT GOVERNANCE
IT MANAGEMENT
Translate strategy into action
•
Make the business effective
•
Make the business efficient
•
Manage risks (security, reliability & compliance)
•
Manage service delivery consistency
Set Objectives
•
Align business and IT
•
Enable the business and maximise benefits
•
Ensure effective and efficient use of resources
•
Manage IT risk as part of ERM
•
Fulfil compliance requirements
Translate
direction into
strategy
Measure and
report
performance
Provide
direction
Evaluate
performance
ValIT
RiskIT
CobiT
Alternative 2
Integrated Framework
Integrate existing frameworks into a new ITGF
IT GOVERNANCE
Translate strategy into action
•
Make the business effective
•
Make the business efficient
•
Manage risks (security, reliability & compliance)
Set Objectives
•
Align business and IT
•
Enable the business and maximise benefits
•
Ensure effective and efficient use of resources
•
Manage IT risk as part of ERM
•
Fulfil compliance requirements
Translate
direction into
strategy
Measure and
report
performance
Provide
direction
Evaluate
performance
IT Governance Framework
Seite 39
März
2007 ISACA After Hours Seminar - CobiT Strategy and Long Term Vision - Herr Urs Fischer
