Ещё одна посылка от Водяхо / Cobit-5-EN-Framework-DRAFT

COBIT 5: The Framework Exposure Draft

2.In addition, the process (governance or management) practices can be assessed using the same rating scale, expressing to which extent the base practices are applied.

3.To further refine the assessment, the work products may be taken into consideration as well to determine to which extent a specific assessment attribute has been achieved.

Although defining target capability levels is up to each enterprise to decide, many organisations will have the ambition to have all their processes achieve capability level 1 (otherwise, what would be the point of having these processes?). If this level is not achieved, the reasons for not achieving this level are immediately obvious from the approach explained above, and an improvement plan can be defined:

1.If a required process outcome is not consistently achieved, the process does not meet its objective and needs to be improved.

2.The assessment of the process practices will reveal which practices are lacking or failing, enabling implementation and/or improvement of those practices to take place and allowing all process outcomes to be achieved.

For higher process capability levels, the generic practices are used, taken from ISO/IEC 15504:2. They provide generic descriptions for each of the capability levels.

COBIT 5: The Framework Exposure Draft

Appendix A. References

CONTENT TO BE SUPPLIED AFTER EXPOSURE.

COBIT 5: The Framework Exposure Draft

Appendix B. Detailed Mapping Enterprise Goals—IT related Goals

The COBIT 5 goals cascade is explained in section 3. Figure 27 contains:

•In the columns, all 17 generic enterprise goals defined in COBIT 5, grouped by BSC dimension

•In the rows, all 18 IT related goals, also grouped in IT BSC dimensions

•A mapping on how each enterprise goal is supported by IT related goals. This mapping is expressed using the following scale:

-‘P’ stands for primary, when there is an important relationship, i.e., the IT related goal is a primary support for the enterprise goal.

-‘S’ stands for secondary, when there is still a strong, but less important, relationship, i.e., the IT related goal is a secondary support for the enterprise goal.

EX A M P L E 10

The mapping table suggests that one would normally expect that:

•Enterprise goal 7. Business service continuity and availability will:

-Primarily depend on the achievement of the IT related goals:

4. Managed IT related business risks

10. Security of information and processing infrastructure and applications

14. Availability of reliable and useful information

-Also depend, but to a lesser degree, on the achievement of the IT related goals:

1. Alignment of IT and business strategy

7. Delivery of IT services in line with business requirements

8. Adequate use of applications, information and technology solutions

•Using the table in the opposite direction, achieving the IT related goal 9. IT agility will contribute to the achievement of several enterprise goals:

-Primarily, the enterprise goals:

3. Portfolio of competitive products and services (this is #2 in fig 12)

8. Agile responses to a changing business environment

11. Optimisation of business process functionality

17. Product and business innovation culture

-To a lesser degree, the enterprise goals:

6. Customer oriented service culture

13. Managed business change programmes

14. Operational and staff productivity

16. Skilled and motivated people

The table was created based on the following inputs:

•Research by the University of Antwerp Management School (UAMS) IT Alignment and Governance Research Institute

•Additional reviews and expert opinions obtained during the development and review process of COBIT 5

When using this table, please keep in mind the remarks made in section 3 on how to use the COBIT 5 goals cascade.

COBIT 5: The Framework Exposure Draft

Figure 27—Mapping COBIT 5 Enterprise Goals to IT related Goals

COBIT 5: The Framework Exposure Draft

Appendix C. Detailed Mapping IT related Goals—IT related Processes

Figure 28 contains:

•In the columns, all 18 generic IT related goals defined in section 3, grouped in IT BSC dimensions

•In the rows, all 36 COBIT 5 processes, grouped by domain

•A mapping on how each IT related goal is supported by a COBIT 5 IT related process. This mapping is expressed using the following scale:

-‘P’ stands for primary, when there is an important relationship, i.e., the COBIT 5 process is a primary support for the achievement of an IT related goal.

-‘S’ stands for secondary, when there is still a strong, but less important, relationship, i.e., the COBIT 5 process is a secondary support for the IT related goal.

EX A M P L E 11

The process DSS7 Manage security will contribute:

•Primarily, to the achievement of the IT related goals:

-2. IT compliance and support for business compliance with external laws and regulations

-4. Managed IT related business risks

-10. Security of information and processing infrastructure and applications

•To a lesser degree, to the achievement of the IT related goals:

-1. Alignment of IT and business strategy

-7. Delivery of IT services in line with business requirements

-8. Adequate use of applications, information and technology solutions

-14. Availability of reliable and useful information

-15. IT compliance with internal policies

The table was created based on the following inputs:

•Research by the University of Antwerp Management School (UAMS) IT Alignment and Governance Research Institute

•Additional reviews and expert opinions obtained during the development and review process of COBIT 5

When using this table, please keep in mind the remarks made in section 3 on how to use the COBIT 5 goals cascade.

COBIT 5: The Framework Exposure Draft

Figure 28—Mapping COBIT 5 IT related Goals to COBIT 5 Processes

COBIT 5: The Framework Exposure Draft

Figure 28—Mapping COBIT 5 IT related Goals to COBIT 5 Processes