CobiT, ITIL V3与ISO/IEC 27002业务效益整合研究

需积分: 5 18 浏览量更新于2024-07-17 收藏 882KB PDF 举报

本文档是一份由IT Governance Institute（ITGI）和Office of Government Commerce（OGC）联合发布的管理简报，标题为"Aligning COBIT 4.1, ITIL V3 and ISO/IEC 27002 for Business Benefit"。这份研究主要探讨了如何将三个重要的IT管理和安全标准——COBIT 4.1、ITIL V3和ISO/IEC 27002——有效地结合起来，以实现商业利益。首先，COBIT 4.1是信息技术控制框架，它提供了一套全面的指导原则和控制目标，帮助组织实现信息技术治理，确保IT活动与企业的战略目标相一致，同时降低风险并提升效率。其核心目的是通过定义和实施一套可操作的控制措施，确保IT资源的有效管理。 ITIL V3（信息技术基础设施库）则关注服务管理的最佳实践，涵盖服务战略、设计、转换、运营和持续改进等五个阶段。它强调的是服务导向，提升IT服务质量，从而提高业务流程的效率和响应能力。 ISO/IEC 27002，作为信息安全管理体系（ISMS）的标准，侧重于信息安全风险管理，提供了一套信息安全控制措施，帮助企业保护信息资产，防止数据泄露和安全威胁。三者结合的主要好处在于：通过整合COBIT的控制框架和企业目标，ITIL的服务管理实践可以确保这些控制措施的有效执行，同时ISO/IEC 27002的引入强化了信息安全保障。这种协同作用有助于提升组织的整体IT治理水平，降低运营成本，提高合规性，并增强客户信任，最终推动商业价值的实现。文档还指出，OGC作为政府机构，致力于与公共部门合作，推广这些最佳实践，以提高公共服务的效率和质量。这份研究对于任何寻求在复杂多变的IT环境中提升组织治理效能和信息安全的企业来说，提供了宝贵的参考和实践指导。这篇管理简报的核心知识点包括：如何通过将COBIT 4.1的控制框架与ITIL V3的服务管理理念及ISO/IEC 27002的信息安全管理相结合，来驱动商业价值的提升，并强调了政府机构在推广这些标准应用中的角色。这对于企业和组织优化IT治理、确保信息安全以及提升服务质量具有重要的实践指导意义。

Aligning Co b i T

4.1, ITIL

V3 and ISO/IEC 27002 for Business Benefit

There is also an introductory volume

that describes the rationale for the life cycle model and covers the key principles

in each life cycle stage. There are other supporting publications and further titles in preparation.

OGC’s official publisher is The Stationery Office (TSO), which makes ITIL publications available as books, e-books

and PDFs, or via online subscription. TSO also manages a library of supporting and complementary publications and

a best practice web site for ITIL and other OGC best practice products (www.best-management-practice.com).

The ITIL qualification scheme (www.itil-officialsite.com/home/home.asp) offers certification for individuals, ranging

from a foundation-level appreciation of ITIL terms and concepts to an advanced professional diploma. OGC’s official

accreditor is APM Group, which licences a number of examination institutes to provide examinations and manage

and accredit training organisations.

Since 1991, ITIL has been championed and supported by itSMF (www.itsmfi.org), a vendor and user group that

now has chapters in more than 40 countries worldwide. It is a not-for-profit organisation and a prominent player in

the ongoing development and promotion of IT service management best practice, standards and qualifications. The

itSMF provides an accessible network of industry experts, information sources and events to help members address

IT service management issues and achieve the delivery of high-quality, consistent IT services internally and externally

through the adoption of best practices. Globally, the itSMF now boasts more than 6,000 member companies, blue

chip and public sector alike, covering in excess of 70,000 individuals.

Figure 3—ITIL Core Topics

Service

Strategy (SS)

Service

Design (SD)

Service

Transition (ST)

Service

Operation (SO)

Continual Service

Improvement (CSI)

• Service management

• Service life cycle

• Service assets and value

creation

• Service provider types

and structures

• Strategy, markets

and offerings

• Financial management

• Service portfolio

management

• Demand management

• Organisational design,

culture and development

• Sourcing strategy

• Service automation and

interfaces

• Strategy tools

• Challenges and risks

• Balanced design

• Requirements, drivers,

activities and constraints

• Service-oriented

architecture

• Business service

management

• SD models

• Service catalogue

management

• Service level management

• Capacity and availability

• IT service continuity

• Information security

• Supplier management

• Data and information

management

• Application management

• Roles and tools

• Business impact analysis

• Challenges and risks

• SD package

• Service acceptance criteria

• Documentation

• Environmental issues

• Process maturity framework

• Goals, principles, policies,

context, roles and models

• Planning and support

• Change management

• Service asset and

configuration management

• Release and deployment

• Service validation

and testing

• Evaluation

• Knowledge management

• Managing communication

and commitment

• Stakeholder management

• Configuration management

system

• Staged introduction

• Challenges and risks

• Asset types

• Balance in SO

• Operational health

• Communication

• Documentation

• Events, incidents and

problems

• Request fulfilment

• Access management

• Monitoring and control

• Infrastructure and service

management

• Facilities and data centre

management

• Information and physical

security

• Service desk

• Technical, IT operations and

application management

• Roles, responsibilities and

organisational structures

• Technology support to SO

• Managing change, projects

and risk

• Challenges

• Complementary guidance

• Goals, methods and

techniques

• Organisational change

• Ownership

• Drivers

• Service level management

• Service measurement

• Knowledge management

• Benchmarks

• Models, standards

and quality

• CSI seven-step

improvement process

• Return on investment (ROI)

and business issues

• Roles

• Authority matrix (RACI)

• Support tools

• Implementation

• Governance

• Communications

• Challenges and risks

• Innovation, correction

and improvement

• Best practices supporting

CSI

OGC, ‘The Introduction to the ITIL Service Lifecycle Book’, The Stationery Ofce, UK, 2007, www.best-management-practice.com/Portfolio-Library/IT-Service-

Management-ITIL/ITIL-Version-3/The-Introduction-to-the-ITIL-Service-Lifecycle/?trackid=002094&DI=582435

Aligning Co b i T

4.1, ITIL

V3 and ISO/IEC 27002 for Business Benefit

ISO/IEC 27002

The international standard was published by ISO (www.iso.org/iso/home.htm) and the IEC, which established a

joint technical committee, ISO/IEC JTC 1. The historic source for the standard was BS 7799-1, of which essential

parts were taken in the development of ISO/IEC 17799:2005 Information Technology—Code of Practice for

Information Security Management. It was developed and published by the British Standards Institution (BSI),

labeled as BS 7799-1:1999. The original British Standard was issued in two parts:

• BS 7799 Part 1: Information Technology—Code of Practice for Information Security Management

• BS 7799 Part 2: Information Security Management Systems—Specification With Guidance for Use

The standard was published in 2000 in its first edition, which was updated in June 2005. It can be classified as

current best practice in the subject area of information security management systems. The original BS 7799 was

revised and reissued in September 2002. ISO/IEC 27002 is often used as a generic term to describe what are actually

two different documents:

• ISO/IEC 17799 (now renamed ISO 27002, www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.

htm?csnumber=50297)—A set of security controls (a code of practice)

• ISO/IEC 27001 (www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=42103, formerly

BS7799-2)—A standard ‘specification’ for an information security management system (ISMS)

The goal of ISO/IEC 27002:2005 is to provide information to parties responsible for implementing information

security within an organisation. It can be seen as a best practice for developing and maintaining security standards

and management practices within an organisation to improve reliability on information security in interorganisational

relationships. It defines 133 security controls strategies, under 11 major headings. The standard stresses the

importance of risk management and makes it clear that it is not necessary to implement every stated guideline, only

those that are relevant.

The guiding principles in ISO/IEC 27002:2005 are the initial points for implementing information security. They

rely on either legal requirements or generally accepted best practices.

Measures based on legal requirements include:

• Protection and non-disclosure of personal data

• Protection of internal information

• Protection of intellectual property rights

Best practices mentioned in the standard include:

• Information security policy

• Assignment of responsibility for information security

• Problem escalation

• Business continuity management

When implementing a system for information security management, several critical success factors should be considered:

• The security policy, its objectives and activities should reflect the business objectives.

• The implementation should consider cultural aspects of the organisation.

• Open support from and engagement of senior management should be required.

• Thorough knowledge of security requirements, risk assessment and risk management should be required.

• Effective marketing of security should target all personnel, including members of management.

Aligning Co b i T

4.1, ITIL

V3 and ISO/IEC 27002 for Business Benefit

6. How Best to Implement Co b i T, ITIL and ISO/IEC 27002

There is no doubt that effective management policies and procedures help ensure that IT is managed as a routine part of

everyday activities. Adoption of standards and best practices enables quick implementation of good procedures and avoids

lengthy delays in creating new approaches when reinventing wheels and agreeing on approaches.

However, the best practices adopted have to be consistent with a risk management and control framework,

appropriate for the organisation, and integrated with other methods and practices that are being used. Standards and

best practices are not a panacea; their effectiveness depends on how they have been implemented and kept up to date.

They are most useful when applied as a set of principles and as a starting point for tailoring specific procedures.

To ensure policies ad procedures are effectively utilised, change enablement is required so management and staff

understand what to do, how to do it and why it is important.

For best practices to be effective, the use of a common language and a standardised approach oriented toward real

business requirements is best, as it ensures that everyone follows the same set of objectives, issues and priorities.

Tailoring

Every enterprise needs to tailor the use of standards and practices, such as those examined in this document, to suit

its individual requirements. All three guidance documents can play a very useful part—C

o b i T and ISO/IEC 27002

helping to define what should be done and ITIL providing the how for service management aspects. Typical uses for

these standards and practices are:

• To support governance by:

– Providing a management policy and control framework

– Enabling process ownership, clear responsibility and accountability for IT activities

– Aligning IT objectives with business objectives, setting priorities and allocating resources

– Ensuring return on investments and optimising costs

– Making sure that significant risks have been identified and are transparent to management, responsibility for

risk management has been assigned and embedded in the organisation, and assurance has been provided to

management that effective controls are in place

– Ensuring that resources have been organised efficiently and sufficient capability (technical infrastructure, process

and skills) exists to execute the IT strategy

– Making sure that critical IT activities can be monitored and measured, so problems can be identified and

corrective action can be taken

• To define requirements in service and project definitions, internally and with service providers, for example:

– Setting clear, business-related IT objectives and metrics

– Defining services and projects in end-user terms

– Creating service level agreements and contracts that can be monitored by customers

– Making sure customer requirements have been cascaded down appropriately into technical IT operational

requirements

– Considering services and project portfolios collectively so that relative priorities can be set and resources can be

allocated on an equitable and achievable basis

• To verify provider capability or demonstrate competence to the market by:

– Independent third-party assessments and audits

– Contractual commitments

– Attestations and certifications

Aligning Co b i T

4.1, ITIL

V3 and ISO/IEC 27002 for Business Benefit

• To facilitate continuous improvement by:

– Maturity assessments

– Gap analyses

– Benchmarking

– Improvement planning

– Avoidance of re-inventing already proven good approaches

• As a framework for audit/assessment and an external view through:

– Objective and mutually understood criteria

– Benchmarking to justify weaknesses and gaps in control

– Increasing the depth and value of recommendations by following generally accepted preferred approaches

Prioritising

To avoid costly and unfocused implementations of standards and best practices, enterprises need to prioritise where and

how to use standards and practices. The enterprise needs an effective action plan that suits its particular circumstances

and needs. First, it is important for the board to take ownership of IT governance and set the direction that management

should follow. The board should:

• Make sure IT is on the board agenda

• Challenge management’s activities with regard to IT to make sure that IT issues are uncovered

• Guide management by helping align IT initiatives with real business needs and ensure that management appreciates

the potential impact on the business of IT-related risks

• Insist that IT performance be measured and reported to the board

• Establish an IT steering group or IT governing council with responsibility for communicating IT issues between the

board and management

• Insist that there be a management framework for IT governance based on a common approach (e.g., C

o b i T) and a

best practice framework for IT service management and security based on a global, de facto standard (e.g., ITIL and

ISO/IEC 27002)

Planning

With this mandate and direction in place, management then can initiate and put into action an implementation

approach. To help management decide where to begin and to ensure that the implementation process delivers

positive results where they are needed most, the following steps are suggested, based on ITGI’s IT Governance

Implementation Guide:

1. Set up an organisational framework (ideally as part of an overall IT governance initiative) with clear responsibilities

and objectives and participation from all interested parties who will take implementation forward and own it as

an initiative.

2. Align IT strategy with business goals. In which current business objectives does IT have a significant contribution?

Obtain a good understanding of the business environment, risk appetite and business strategy as they relate to IT.

o b i T’s management guidelines (specifically the goals and metrics) help define IT objectives. Used in conjunction

with ITIL, services and service level agreements (SLAs) can be defined in end-user terms.

3. Understand and define the risks. Given the business objectives, what are the risks relating to IT’s ability to deliver

against these objectives? Consider:

– Previous history and patterns of performance

– Current IT organisational factors

– Complexity and size/scope of the existing or planned IT environment

– Inherent vulnerability of the current and planned IT environment

– Nature of the IT initiatives being considered, e.g., new systems projects, outsourcing considerations, architectural

changes

剩余130页未读，继续阅读

monkeywang007

粉丝: 1
资源: 1

CobiT, ITIL V3与ISO/IEC 27002业务效益整合研究

Aligning_COBIT,ITILV3,ISO27002.pdf

Aligning optical setups_opticalalignment_optics_physics_

Aligning text in TEdit_in_delphi7_

self-aligning-gallery

Aligning-Time-Series

Top Aligning Label(iPhone源代码)

Microservice Architecture Aligning Principles Practices And Culture 2016

a tiwana platform ecosystems aligning architecture governance an

Bottlenecks Aligning UX Design with User Psychology epub

Microservice Architecture ALIGNING PRINCIPLES, PRACTICES, AND CULTURE

最新资源