COBIT：企业IT治理与管理业务框架

需积分: 10 201 浏览量更新于2024-07-18 收藏 1.66MB PDF 举报

"COBIT（Control Objectives for Information and Related Technology）是ISACA（Information Systems Audit and Control Association）推出的一个业务框架，旨在为企业信息技术（IT）的治理和管理提供指导。COBIT 5是该框架的最新版本，它强调了在160多个国家拥有超过95,000名成员的ISACA在全球信息系统的保证、安全、企业治理和IT相关风险与合规性方面的专业知识。ISACA还提供认证服务，如CISA（Certified Information Systems Auditor）、CISM（Certified Information Security Manager）、CGEIT（Certified in the Governance of Enterprise IT）和CRISC（Certified in Risk and Information Systems Control），以提升和验证IT专业人员的技能和知识。" COBIT 5框架的核心目标是帮助组织确保对IT的治理和管理，从而增强对信息系统的信任并从中获取价值。该框架涵盖了五个关键领域： 1. **达成业务目标**：COBIT 5强调IT应与企业的战略目标保持一致，通过IT活动实现业务目标，并确保IT投资与业务收益相匹配。 2. **优化资源**：有效地管理和利用IT资源，包括人员、流程、技术和信息，以提高效率和效果。 3. **构建可信的系统**：通过建立和维护一套控制标准，确保信息系统的安全性、可靠性和完整性，从而赢得利益相关者的信任。 4. **管理风险**：识别、评估和管理与IT相关的风险，确保组织能够适应不断变化的环境，同时保持合规性。 5. **实现治理要求**：提供一个结构化的框架，以满足监管要求、行业标准和最佳实践，确保IT治理的透明度和问责制。 COBIT 5包含了一系列的过程和管理实践，这些实践覆盖了从需求定义到交付和使用整个IT生命周期的各个阶段。每个过程都定义了明确的输入、输出、关键绩效指标（KPIs）和控制目标，以支持度量、监控和改进。此外，COBIT 5还引入了“整合框架”的概念，它与其他治理框架（如Val IT、Risk IT和ITIL）相结合，提供了一个全面的IT治理解决方案。这种整合性使得COBIT不仅限于审计和控制，还可以支持决策制定、风险管理和持续改进。在实施COBIT 5时，组织应考虑其特定的业务需求、文化、规模和复杂性，以定制适合自己的IT治理和管理体系。通过采用COBIT，企业可以更好地管理IT风险，提高IT效率，确保合规，并最终推动业务的成功。

Overview of This Publication

The COBIT 5 framework contains seven more chapters:

• Chapter 2 elaborates on Principle 1, Meeting Stakeholder Needs. It introduces the COBIT 5 goals cascade. The

enterprise goals for IT are used to formalise and structure the stakeholder needs. Enterprise goals can be linked to

IT-related goals, and these IT-related goals can be achieved through the optimal use and execution of all enablers,

including processes. This set of connecting goals is called the COBIT 5 goals cascade. The chapter also provides

examples of typical governance and management questions that stakeholders may have about enterprise IT.

• Chapter 3 elaborates on Principle 2, Covering the Enterprise End-to-end. It explains how COBIT 5 integrates

governance of enterprise IT into enterprise governance by covering all functions and processes within the enterprise.

• Chapter 4 elaborates on Principle 3, Applying a Single Integrated Framework, and describes briefly the COBIT 5

architecture that achieves the integration.

• Chapter 5 elaborates on Principle 4, Enabling a Holistic Approach. Governance of enterprise IT is systemic and

supported by a set of enablers. In this chapter, enablers are introduced and a common way of looking at enablers is

presented: the generic enabler model.

• Chapter 6 elaborates on Principle 5, Separating Governance From Management, and discusses the difference

between management and governance, and how they interrelate. The high-level COBIT 5 process reference model is

included as an example.

• Chapter 7 contains an introduction to Implementation Guidance. It describes how the appropriate environment can

be created, the enablers required, typical pain points and trigger events for implementation, and the implementation

and continual improvement life cycle. This chapter is based on the publication titled COBIT

5 Implementation, where

full details on how to implement governance of enterprise IT based on COBIT 5 can be found.

• Chapter 8 elaborates on The COBIT 5 Process Capability Model in the COBIT Assessment Programme approach

(www.isaca.org/cobit-assessment-programme) scheme, how it differs from COBIT 4.1 process maturity assessments,

and how users can migrate to the new approach.

The appendices contain reference information, mappings and more detailed information on specific subjects:

• Appendix A. References used during COBIT 5 development are listed.

• Appendix B. Detailed Mapping Enterprise Goals—IT-related Goals describes how enterprise goals typically are

supported by one or more IT-related goals.

• Appendix C. Detailed Mapping IT-related Goals—IT-related Processes describes how COBIT processes support

the achievement of IT-related goals.

• Appendix D. Stakeholder Needs and Enterprise Goals describes how typical stakeholder needs relate to COBIT 5

enterprise goals.

• Appendix E. Mapping of COBIT 5 With the Most Relevant Related Standards and Frameworks

• Appendix F. Comparison Between the COBIT 5 Information Model and the COBIT 4.1 Information Criteria

• Appendix G. Detailed Description of the COBIT 5 Enablers builds on chapter 5 and includes more details on the

different enablers, including a detailed enabler model describing specific components, and is illustrated with a number

of examples.

• Appendix H. Glossary

Personal Copy of: Oo2 Formations

Chapter 2

rinCiple 1: Meeting Stakeholder needS

chApter 2

principle 1: meeting stAkeholder needs

Introduction

Enterprises exist to create value for their stakeholders. Consequently, any enterprise—commercial or not—will have value

creation as a governance objective. Value creation means realising benefits at an optimal resource cost while optimising

risk. (See figure 3.) Benefits can take many forms, e.g., financial for commercial enterprises or public service for

government entities.

Figure 3—The Governance Objective: Value Creation

Enterprises have many stakeholders, and ‘creating value’ means different—and sometimes conflicting—things to each of

them. Governance is about negotiating and deciding amongst different stakeholders’ value interests. By consequence, the

governance system should consider all stakeholders when making benefit, risk and resource assessment decisions. For

each decision, the following questions can and should be asked: For whom are the benefits? Who bears the risk? What

resources are required?

COBIT 5 Goals Cascade

Every enterprise operates in a different context; this context is determined by external factors (the market, the industry,

geopolitics, etc.) and internal factors (the culture, organisation, risk appetite, etc.), and requires a customised governance

and management system.

Stakeholder needs have to be transformed into an enterprise’s actionable strategy. The COBIT 5 goals cascade is the

mechanism to translate stakeholder needs into specific, actionable and customised enterprise goals, IT-related goals and

enabler goals. This translation allows setting specific goals at every level and in every area of the enterprise in support of

the overall goals and stakeholder requirements, and thus effectively supports alignment between enterprise needs and IT

solutions and services.

The COBIT 5 goals cascade is shown in figure 4.

Step 1. Stakeholder Drivers Influence Stakeholder Needs

Stakeholder needs are influenced by a number of drivers, e.g., strategy changes, a changing business and regulatory

environment, and new technologies.

Step 2. Stakeholder Needs Cascade to Enterprise Goals

Stakeholder needs can be related to a set of generic enterprise goals. These enterprise goals have been developed using the

balanced scorecard (BSC)

dimensions, and they represent a list of commonly used goals that an enterprise may define

for itself. Although this list is not exhaustive, most enterprise-specific goals can be mapped easily onto one or more of the

generic enterprise goals. A table of stakeholder needs and enterprise goals is presented in appendix D.

Benefits

Realisation

Resource

Optimisation

Risk

Optimisation

Governance Objective: Value Creation

Drive

Stakeholder

Needs

Kaplan, Robert S.; David P. Norton; The Balanced Scorecard: Translating Strategy Into Action, Harvard University Press, USA, 1996

Personal Copy of: Oo2 Formations

Figure 4—COBIT 5 Goals Cascade Overview

COBIT 5 defines 17 generic goals, as shown in figure 5, which includes the following information:

• The BSC dimension under which the enterprise goal fits

• Enterprise goals

• The relationship to the three main governance objectives—benefits realisation, risk optimisation and resource

optimisation. (‘P’ stands for primary relationship and ‘S’ for secondary relationship, i.e., a less strong relationship.)

Step 3. Enterprise Goals Cascade to IT-related Goals

Achievement of enterprise goals requires a number of IT-related outcomes,

which are represented by the IT-related goals.

IT-related stands for information and related technology, and the IT-related goals are structured along the dimensions of the

IT balanced scorecard (IT BSC). COBIT 5 defines 17 IT-related goals, listed in figure 6.

The mapping table between IT-related goals and enterprise goals is included in appendix B, and it shows how each

enterprise goal is supported by a number of IT-related goals.

Step 4. IT-related Goals Cascade to Enabler Goals

Achieving IT-related goals requires the successful application and use of a number of enablers. The enabler concept is

explained in detail in chapter 5. Enablers include processes, organisational structures and information, and for each enabler

a set of specific relevant goals can be defined in support of the IT-related goals.

Processes are one of the enablers, and appendix C contains a mapping between IT-related goals and the relevant COBIT 5

processes, which then contain related process goals.

Benefits

Realisation

Stakeholder Drivers

(Environment, Technology Evolution, …)

Enterprise Goals

IT-related Goals

Enabler Goals

Influence

Cascade to

Appendix B

Appendix C

Figure 5

Figure 6

Resource

Optimisation

Risk

Optimisation

Stakeholder Needs

Cascade to Appendix D

IT-related outcomes obviously are not the only intermediate benefit required to achieve enterprise goals. All other functional areas in an organisation,

such as finance and marketing, also contribute to the achievement of enterprise goals, but within the context of COBIT 5 only IT-related activities and goals

are considered.

Personal Copy of: Oo2 Formations

Chapter 2

rinCiple 1: Meeting Stakeholder needS

Figure 5—COBIT 5 Enterprise Goals

BSC Dimension Enterprise Goal

Relation to Governance Objectives

Benefits

Realisation

Risk

Optimisation

Resource

Optimisation

Financial 1. Stakeholder value of business investments

P S

2. Portfolio of competitive products and services

P P S

3. Managed business risk (safeguarding of assets)

P S

4. Compliance with external laws and regulations

5. Financial transparency

P S S

Customer 6. Customer-oriented service culture

P S

7. Business service continuity and availability

8. Agile responses to a changing business environment

P S

9. Information-based strategic decision making

P P P

10. Optimisation of service delivery costs

P P

Internal 11. Optimisation of business process functionality

P P

12. Optimisation of business process costs

P P

13. Managed business change programmes

P P S

14. Operational and staff productivity

P P

15. Compliance with internal policies

Learning and Growth 16. Skilled and motivated people

S P P

17. Product and business innovation culture

Figure 6—IT-related Goals

IT BSC Dimension Information and Related Technology Goal

Financial 01 Alignment of IT and business strategy

02 IT compliance and support for business compliance with external laws and regulations

03 Commitment of executive management for making IT-related decisions

04 Managed IT-related business risk

05 Realised benefits from IT-enabled investments and services portfolio

06 Transparency of IT costs, benefits and risk

Customer 07 Delivery of IT services in line with business requirements

08 Adequate use of applications, information and technology solutions

Internal 09 IT agility

10 Security of information, processing infrastructure and applications

11 Optimisation of IT assets, resources and capabilities

12 Enablement and support of business processes by integrating applications and technology into business processes

13 Delivery of programmes delivering benefits, on time, on budget, and meeting requirements and quality standards

14 Availability of reliable and useful information for decision making

15 IT compliance with internal policies

Learning and Growth 16 Competent and motivated business and IT personnel

17 Knowledge, expertise and initiatives for business innovation

Personal Copy of: Oo2 Formations

剩余93页未读，继续阅读

weixin_43899518

粉丝: 0
资源: 4

COBIT：企业IT治理与管理业务框架

商业分析知识体系指南 v3 [A_Guide_to_the_Business_Analysis_Body_of_Knowledge v3]

CBAP - Babok V3

BABOK-V3.0.pdf

COBIT 5与其他标准对比分析：企业IT治理的关键

【java毕业设计】小型企业办公自动化系统的设计和开发源码（ssm+vue+mysql+说明文档+LW）.zip

基于JAVA+SpringBoot+Vue+MySQL的智慧草莓基地管理系统 源码+数据库+论文(高分毕业设计).zip

基于Django的校园考试宝系统 期末项目：智慧校园考试宝 技术：基于Django框架，使用前后端分离，前端使用Vue,后端 使用Django+Python 亮点：考虑到课上所学知识不能及时掌握

Apache RocketMQ go 客户端.zip

豆瓣小组话题帖LDA主题模型构建python源码+详细注释.zip

JAVASSM超市进销存管理系统源码数据库 MySQL源码类型 WebForm

最新资源

基于JAVA+SpringBoot+Vue+MySQL的智慧草莓基地管理系统源码+数据库+论文(高分毕业设计).zip

基于Django的校园考试宝系统期末项目：智慧校园考试宝技术：基于Django框架，使用前后端分离，前端使用Vue,后端使用Django+Python 亮点：考虑到课上所学知识不能及时掌握