Annex 1
(Integrated frameworks on Business/IT alignment)
#
Enabler
1
Principles, policies, and frameworks Turn desired behaviors into practical directions to management
2
Processes
Composed by a set of activities/practices to produce a certain output
3
Organizational structures
Key decision making bodies
4
Culture, ethics, and behavior
Beliefs, morals, and customs of the members of the company
5
Information
Includes all the information produced and used by the enterprise
6
Services, infrastructure, and applicatiIT processing and services
7
People, skills, and competencies
Needed to perform activities, make decisions, and take corrective actions
Description
R
Responsible
The one(s) who performs the activit
A
Accountable
The one with decision authority
C
Consulted
The one(s) who give input
I
Informed
Entity(ies) who receive information
Annex 2
–
RACI chart for EDM01, Retrieved from COBIT5
Description:
Annex 4
–
Complete list of COBIT’s processes
Area
Domain
Process
EDM1
Set and Maintain the Governance Framework
EDM2
Ensure Value Optimization
EDM3
Ensure Risk Optimization
EDM4
Ensure Resource Optimization
EDM5
Ensure Stakeholder Transparency
APO1
Define the Management Framework for IT
APO2
Manage Strategy
APO3
Manage Enterprise Architecture
APO4
Manage Innovation
APO5
Manage Portfolio
APO6
Manage Budget and Cost
APO7
Manage Human Resources
APO8
Manage Relationships
APO9
Manage Service Agreements
APO10
Manage Suppliers
APO11
Manage Quality
APO12
Manage Risk
APO13
Manage Security
BAI1
Manage Programs and Projects
BAI2
Define Requirements
BAI3
Identify and Build Solutions
BAI4
Manage Availability and Capacity
BAI5
Manage Organizational Change Enablement
BAI6
Manage Changes
BAI7
Manage Change Acceptance and Transitioning
BAI8
Manage Knowledge
BAI9
Manage Assets
BAI10
Manage Configuration
DSS1
Manage Operations
DSS2
Manage Service Requests and Incidents
DSS3
Manage Problems
DSS6
Manage Continuity
DSS5
Manage Security Services
DSS6
Manage Business Process Controls
MEA1
MEA Performance and Conformance
MEA2
MEA the System of Internal Control
MEA3
MEA Compliance with External Requirements
MEA
PBRM
EDM
APO
BAI
EDM
DSS
#
Principle
1
Meeting Stakeholders' Needs
Goals Cascade
2
Covering the Enterprise End-to-end
RACI charts
3
Applying a single, integrated framework
Integrates previous ISACA’s frameworks , the latest standards
and frameworks, and offers GEIT and management best practices
4
Enabling a holistic approach
Enablers
5
Separating Governance from Management Division of processes in two domains, EDM and PBRM
Point of reference
#
Capability level
#
Process Attributes
1
Incomplete
0
-
The purpose is not achieved; non-implemented process.
2
Performed
1
Process Performance
The purpose is achieved
2
Performance Management
3
Work product Management
4
Process Definition
5
Process Deployment
6
Process Measurement
7
Process Control
8
Process Innovation
9
Process Optimization
The established process is confined to attaining its specified objectives
Continuous improvement of the process to meet current and future enterprise goals
Predictable
Optimizing
6
5
4
3
Process Capability
Managed
Established
Implementation of the managed process
The purpose is achieved, and the process is managed (planned, monitored, adjusted)
Annex 5
–
5 principles of COBIT5
Annex 6
–
Implementation Cycle, Retrieved from COBIT 5 implementation Guide
APO01
Purpose
Assess whether the following
outcomes are achieved. Criteria
Criteria Are
Met Y/N Comment Not achieved (0-15%) Partially Achieved (15% -50%) Largely Achieved (50% - 85%)
Fully Achieved
(85-100%)
Level 0 Incomplete
The process is not implemented, or fails to achieve its process purpose.
At this level, there is little or no evidence of any
achievement of the process purpose. Y X
PA 1.1 The implemented process achieves its process
The following process outcomes are being
achieved: X
APO01-O1 An effective set of policiesis defined
and maintained. Y X
APO1-O2 Everyone is aware of the policies and
how they should be implemented. Y X As a result of full achievement of this attribute: Y
a) Objectives for the performance of the process are identified. Y b) Performance of the process is planned and monitored. Y c) Performance of the process is adjusted to meet plans. Y d) Responsibilities and authorities for performing the process are defined, assigned and communicated.
Y
e) Resources and information necessary for performing the process are identified, made available, allocated and used.
Y
f) Interfaces between the involved parties are managed to ensure both effective communication and also clear assignment of responsibility.
Y
As a result of full achievement of this attribute:
Y
a) Requirements for the work products of the process are defined. Y b) Requirements for documentation and control of the work products are defined. Y c) Work products are appropriately identified, documented, and controlled. Y d) Work products are reviewed in accordance with planned arrangements and adjusted as necessary to meet requirements.
Y
As a result of full achievement of this attribute: N
a) A standard process, including appropriate tailoring guidelines, is defined that describes the fundamental elements that must be incorporated into a defined process.
N
b) The sequence and interaction of the standard process with other processes is determined.
N
c) Required competencies and roles for performing a process are identified as part of the standard process.
N
d) Required infrastructure and work environment for performing a process are identified as part of the standard process.
N
e) Suitable methods for monitoring the effectiveness and suitability of the process are determined. N As a result of full achievement of this attribute: N
a) A defined process is deployed based upon an appropriately selected and/or tailored standard process.
N
b) Required roles, responsibilities and authorities for performing the defined process are assigned and communicated. N
c) Personnel performing the defined process are competent on the basis of appropriate education, training, and experience. N d) Required resources and information necessary for performing the defined process are made available, allocated and used.
N
e) Required infrastructure and work environment for performing the defined process are made available, managed and maintained.
N
f) Appropriate data are collected and analysed as a basis for understanding the behaviour of, and to demonstrate the suitability and effectiveness of the process, and to evaluate where continuous improvement of the process can be made.
N
As a result of full achievement of this attribute:
N
a) Process information needs in support of relevant defined business goals are established. N
b) Process measurement objectives are derived from process information needs. N c) Quantitative objectives for process performance in support of relevant business goals are established.
N
d) Measures and frequency of measurement are identified and defined in line with process measurement objectives and quantitative objectives for process performance.
N
e) Results of measurement are collected, analysed and reported in order to monitor the extent to which the quantitative objectives for process performance are met.
N
f) Measurement results are used to
characterise process performance. N As a result of full achievement of this attribute:
N
a) Analysis and control techniques are determined and applied where applicable. N b) Control limits of variation are established for normal process performance. N c) Measurement data are analysed for special causes of variation. N d) Corrective actions are taken to address special causes of variation. N e) Control limits are re-established (as necessary) following corrective action. N As a result of full achievement of this attribute: N
a) Pprocess improvement objectives for the process are defined that support the relevant business goals.
N
b) Appropriate data are analysed to identify common causes of variations in process performance.
N
c) Appropriate data are analysed to identify opportunities for best practice and innovation. N d) Improvement opportunities derived from new
o Level 5
Optimizing.
PA 5.1 Process innovation - A measure of the extent to which changes to the process are identified from analysis of common causes of variation in performance, and from investigations of innovative approaches to the definition and deployment of the process.
X
PA 4.2 Process Control - A measure of the extent to which the process is quantitatively managed to produce a process that is stable, capable and predictable within defined
limits. X
Level 4 Predictable
PA 4.1 Process Measurement - A measure of the extent to which measurement results are used to ensure that performance of the process supports the achievement of relevant process performance objectives in support of defined business goals.
X
~ PA 3.2 Process Deployment - A measure of the extent to which the standard process is effectively deployed as a defined process to achieve its process outcomes.
X
Level 3 Established
PA 3.1 Process Definition - A measure of the extent to which a standard process is maintained to support the deployment of the defined process.
X
PA 2.2 Work Product Management - A measure of the extent to which the work products produced by the process are appropriately managed. The work products (or outputs from the process) are defined and controlled.
X
Level 1 Performed
Level 2 Managed
PA 2.1 Performance Management - A measure of the extent to which the performance of the process is managed.
X
Provide a consistent management approach to enable the enterprise governance requirements to be met, covering management processes, organisational structures, roles and responsibilities, reliable and repeatable activities, and skills and competencies.
Define the Management Framework for IT
Overall rating for the process
