COBIT 2019 Executive Summary -COBIT 2019
- 1. © 2018 ISACA. All rights reserved. INTRODUCING Executive Summary November 2018
- 2. © 2018 ISACA. All rights reserved. COBIT® 2019 The globally recognized COBIT Framework, which helps ensure effective enterprise governance of information and technology, has been updated with new information and guidance, facilitating easier, tailored implementation— strengthening COBIT’s continuing role as an important driver of innovation and business transformation. This document sets the scene for the upcoming release of COBIT® 2019 guidance.
- 3. © 2018 ISACA. All rights reserved. Remembering John Lainhart • In dedication to John Lainhart, who was there from COBIT day -1 in 1995 until his passing in September 2018. • John was the relentless support behind many COBIT related projects, including COBIT 2019 . • ISACA is extremely grateful for John and his vision, and COBIT 2019 (and its progeny) are his legacy. Picture provided courtesy of Dirk Steuperaert
- 4. © 2018 ISACA. All rights reserved. COBIT 2019 DRIVERS AND BENEFITS
- 5. © 2018 ISACA. All rights reserved. COBIT 2019 UPDATE DRIVERS COBIT 2019 Optimizing I&T Governance Staying relevant in a changed environment Building on COBIT strengths and identifying opportunities Addressing COBIT 5 limitations
- 6. © 2018 ISACA. All rights reserved. COBIT 2019 OPTIMIZING I&T GOVERNANCE Enterprise Governance of I&T Business/IT Alignment Value Creation IT - used to refer to the organizational department with main responsibility for technology – versus I&T – all the information the enterprise generates, processes and uses to achieve its goals, as well as the technology to support that throughout the enterprise. COBIT 2019 Optimizing I&T Governance Staying relevant in a changed environment Building on COBIT strengths and identifying opportunities Addressing COBIT5 imperfections
- 7. © 2018 ISACA. All rights reserved. COBIT 2019 STAYING RELEVANT IN A CHANGED ENVIRONMENT • COBIT 5 was published in 2012, making it almost 7 years old • New technology and business trends in the use of IT (e.g. digitization) have not been incorporated into COBIT, requiring re-alignment • The need for the integration of new insights from practitioners, science and academia in the domain of I&T governance creation • Other standards have evolved, resulting in a different standards/frameworks landscape, requiring a re-alignment • More fluid and frequent updates of COBIT required COBIT 2019 Optimizing I&T Governance Staying relevant in a changed environment Building on COBIT strengths and identifying opportunities Addressing COBIT5 imperfections
- 8. © 2018 ISACA. All rights reserved. COBIT 2019 STAYING RELEVANT IN A CHANGED ENVIRONMENT COBIT 2019 Optimizing I&T Governance Staying relevant in a changed environment Building on COBIT strengths and identifying opportunities Addressing COBIT5 imperfections • US National Institute of Standards and Technology (NIST) standards: –NIST Cybersecurity Framework v1.1 –NIST SP 800 53 Rev 5 –NIST SP 800 37 Rev 2 (Risk Management Framework) • ISO/IEC 20000 • ISO/IEC 27000 family: –ISO/IEC 27001 –ISO/IEC 27002 –ISO/IEC 27004 –ISO/IEC 27005 • ISO/IEC 31000:2018 • ISO/IEC 38500 • ISO/IEC 38502 • A Guide to the Project Management Book of Knowledge: PMBOK® Guide, Sixth Edition, 2017 • The TOGAF® Standard, The Open Group • The Open Group IT4IT™ Reference Architecture, version 2.0 • CIS ® Critical Security Controls, Center for Internet Security • King IV Report on Corporate Governance™, 2016 • Scaled Agile Framework (SAFe®) • Cloud standards and good practices: • Amazon Web Services (AWS®) • Security Considerations for Cloud Computing, ISACA • Controls and Assurance in the Cloud: Using COBIT ® 5, ISACA • Enterprise Risk Management (ERM)— Integrated Framework, Committee of Sponsoring Organizations of the Treadway Commission (COSO), June 2017 • The TBM Taxonomy, The TBM Council • “Options for Transforming the IT Function Using Bimodal IT,” MIS Quarterly Executive (white paper) • ITIL V3 • HITRUST ® Common Security Framework, version 9, September 2017 • Change Management Methodology, Prosci • Skills Framework for the Information Age (SFIA® ) V6 • The Standard of Good Practice for Information Security, Information Security Forum (ISF), 2016 • CMMI V2.0 • The CMMI Cybermaturity Platform, 2018 • The Data Management Maturity Model, CMMI Institute, 2014 The COBIT 2019 development team looked at following standards/frameworks to align COBIT 2019 with:
- 9. © 2018 ISACA. All rights reserved. STRENGTHS • COBIT is a unique overarching IT Governance framework • COBIT process guidance has matured and has reached its best quality level yet • COBIT’s business perspective on IT brings a unique opportunity to further expand its impact OPPORTUNITIES • The current (target) audience for COBIT is still very much IT- and Assurance oriented • There is an opportunity to re-discover or re-launch some of COBIT hidden gems • More prescriptive implementation guidance such as incorporating specific design factors COBIT 2019 BUILDING ON COBIT STRENGTHS AND IDENTIFYING OPPORTUNITIES COBIT 2019 Optimizing I&T Governance Staying relevant in a changed environment Buildng on COBIT strengths and identifying opportunities Addressing COBIT5 imperfections
- 10. © 2018 ISACA. All rights reserved. • COBIT users find it hard to locate relevant contents for their needs • Perceived as complex and challenging to apply in practice • The enabler model is incomplete in terms of development and guidance, and thus often ignored • A challenging process capability model and general lack of support of performance management for other enablers • The perceived reputation of IT Governance itself as an inhibitor of change and (administrative) overhead – not per se a COBIT weakness but an IT Governance problem at large COBIT 2019 ADDRESSING COBIT 5 LIMITATIONS COBIT 2019 Optimizing I&T Governance Staying relevant in a changed environment Building on COBIT strengths and identifying opportunities Addressing COBIT5 limitations
- 11. © 2018 ISACA. All rights reserved. INTRODUCTION ENTERPRISE GOVERNANCE OF INFORMATION & TECHNOLOGY (EGIT) AND THE NATURE OF COBIT
- 12. © 2018 ISACA. All rights reserved. In the light of digital transformation, information and technology (I&T) have become crucial in the support, sustainability and growth of enterprises. • Previously, governing boards and senior management could delegate, ignore or avoid I&T-related decisions • In most sectors and industries, such attitudes are now ill advised • Digitized enterprises are increasingly dependent on I&T for survival and growth • Stakeholder value creation is often driven by a high degree of digitization in new business models, efficient processes, successful innovation, etc. INTRODUCTION ENTERPRISE GOVERNANCE OF INFORMATION AND TECHNOLOGY (EGIT)
- 13. © 2018 ISACA. All rights reserved. Given the centrality of I&T for enterprise risk management and value generation, a specific focus on enterprise governance of information and technology (EGIT) has arisen over the last two decades. EGIT is an integral part of corporate governance • Exercised by the board that oversees the definition and implementation of processes, structures and relational mechanisms • Enables both business and IT people to execute their responsibilities in support of business/IT alignment • Enables creation of business value from I&T-enabled business investments INTRODUCTION ENTERPRISE GOVERNANCE OF INFORMATION AND TECHNOLOGY (EGIT)
- 14. © 2018 ISACA. All rights reserved. Fundamentally, EGIT is concerned with value delivery from digital transformation and the mitigation of business risk that results from digital transformation. More specifically, three main outcomes can be expected after successful adoption of EGIT. INTRODUCTION ENTERPRISE GOVERNANCE OF INFORMATION AND TECHNOLOGY (EGIT) Benefits Realization Risk Optimization Resource Optimization
- 15. © 2018 ISACA. All rights reserved. COBIT is a framework for the governance and management of enterprise information and technology, aimed at the whole enterprise. • Enterprise I&T means all the technology and information processing the enterprise puts in place to achieve its goals, regardless of where this happens in the enterprise • Enterprise I&T is not limited to the IT department of an organization, but certainly includes it INTRODUCTION COBIT AS AN INFORMATION & TECHNOLOGY (I&T) FRAMEWORK
- 16. © 2018 ISACA. All rights reserved. Governance (Board Level) Management (Executive Level) INTRODUCTION GOVERNANCE AND MANAGEMENT DEFINED • Plans, builds, runs and monitors activities, in alignment with the direction set by the governance body, to achieve the enterprise objectives • Ensure stakeholder needs, conditions and options are evaluated to determine enterprise objectives • Ensure direction is set through prioritization and decision making • Ensure performance and compliance are monitored against objectives
- 17. © 2018 ISACA. All rights reserved. INTRODUCTION WHAT IS COBIT AND WHAT IT IS NOT: SETTING THE RIGHT EXPECTATIONS COBIT IS • A framework for the governance and management of enterprise I&T • COBIT defines the components to build and sustain a governance system • COBIT defines the design factors that should be considered by the enterprise to build a best fit governance system • COBIT is flexible and allows guidance on new topics to be added COBIT IS NOT • A full description of the whole IT environment of an enterprise • A framework to organize business processes • An (IT-) technical framework to manage all technology • COBIT does not make or prescribe any IT-related decisions
- 18. © 2018 ISACA. All rights reserved. APPENDIX
- 19. © 2018 ISACA. All rights reserved. ABOUT ISACA Nearing its 50th year, ISACA® (isaca.org) is a global association helping individuals and enterprises achieve the positive potential of technology. Today’s world is powered by technology, and ISACA equips professionals with the knowledge, credentials, education and community to advance their careers and transform their organizations. ISACA leverages the expertise of its 450,000 engaged professionals in information and cyber security, governance, assurance, risk and innovation, as well as its enterprise performance subsidiary, CMMI® Institute, to help advance innovation through technology. ISACA has a presence in 188 countries, including 217 chapters worldwide and offices in both the United States and China.