Foundational IT Governance Framework

8/10/2019 Foundational IT Governance Framework

1/107

!"#$%&'"$&( *+ ,"-./$&$0.1 !"#$%&'"$&( !/&2.3"/4 5"/ ,"-./$6$7 8$9./:/6;. *+

!"#$%&" ()*+ %,& -./!0! 012.3 4 5)#+&6*)78

"#$%$& '()$*+*,-$ ./ 01%$*&2&3$ "#*2#$4,-#

56"6 67$- 8$-$2*39 :$$*

;,392$< 5$ .&>1*72?1& 6--(*2&3$

@14ABC @@:


2/107

*+,


3/107

17.$%&

OPQRPSQ TI1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J

*+ ,"-./$&$0. @.A$.%

I1(&D2?1&2< )$*+*,-$ ./ 01%$*&2&3$

U

V92# ,- :WX./ P :WX./ YZU :WX./ Y WE[$3?%$-

U

:WX./ Y I*27$F1*J

U :WX./ Y X$&$\#-

:WX./ Y ]*,&3,+


4/107

*+ ,"-./$&$0. @.A$.%

OPQRPSQ OI1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J

,"-./$&$0. )&-(*$- #92# $$*+*,-$ 1E[$3?%$- 2*$ 239,$%$D EA .-&(#&'$7

-#2J$911*72&3$C 317+


5/107

*+ ,"-./$&$0. @.A$.%

*$9.7/&'"$ "5 ,"-./$&$0. E B&$&7.2.$9 =,-?&3?1& E$#F$$& 01%$*&2&3$ M ;2&24$7$ 1a$&

7,-(&D$*-#11D

8F.0'-. 6$9.7/&'"$ "5 9G.;. 93" .(.2.$9; 6; 0/6'0&( >1*-(33$-->(< ./ 01%$*&2&3$ ,& 2&A $$*+*,-$ 1* 1*42&,`2?1&

./ 01%$*&2&3$ ,- HI+ *$-+1&-,E1* J/.$%./6$7K ./

,&>*2-#*(3#(*$

./ 01%$*&2&3$ *= *$-+1&-,E1* J"-./;67G9 "5 9G.2&$&7.2.$9 :/"0.;;.;K #92# *$&D$* ./ ,&>*2-#*(3#(*$

OPQRPSQ YI1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J


6/107

*+,


7/107

17.$%&

./ 01%$*&2&3$ =$\&$D

!"#$%&'"$&( 8$9./:/6;. *+ ,"-./$&$0.

U

V92# ,- :WX./ P :WX./ YZU :WX./ Y WE[$3?%$-

U

:WX./ Y I*27$F1*J

U :WX./ Y X$&$\#-

:WX./ Y ]*,&3,+


8/107

3,9: $)&:&;%#


9/107

PG&9 6; QIR*+S :1*1< WE[$3?%$- >1* .&>1*72?1& 2&D 8$


10/107

PG&9 6; QIR*+ TS

:WX./ Y ,- 2 I1(&D2?1&2< $$*+*,-$ ./ 01%$*&2&3$ >*27$F1*JC +*1%,D,&4

2 E2-,- #1 $g$3?%$ 4(,D2&3$,& 2 &1&^#$39&,32(*#9$* -(++1*#$D EA :WX./ Y 31%$*24$ 1> 2


11/107

QIR*+ T IDM.0'-.;

Provide a renewed and authoritative full-spectrum framework for the

governance and management of enterprise IT.

Building on the current widely recognized and accepted COBIT

framework, link together and reinforce all other major ISACA

frameworks and guidance.

Connect to and align with other major frameworks and standards

(ISO 38500, ITIL, EA, NIST etc).

Incorporate familiar components such as a Domain/Process model,

Governance/Management Best Practices, RACI charts, and processinput/output linkages.

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J SS


12/107

+G. QIR*+ T !/&2.3"/4

B&M"/ U:%&9. 5/"2 -./;6"$ VWX

!6/;9 8Y:";#/. @/&Z /.(.&;. [i(&$ QdC QhSS

e/9$ I*27$F1*Jf K =*2a

e]*13$-- 8$>$*$&3$ 0(,D$f K =*2a

@"0#2.$9; /.(.&;.% "$ 1:/6( X\C ]\X]

:WX./ Y I*27$F1*J

:WX./ Y )&2E


13/107

+G. QIR*+ T !/&2.3"/4

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J ST


14/107

+G. QIR*+ T !/&2.3"/4

1 7"-./$&$0. E 2&$&7.2.$9 5/&2.3"/4

"#2*#- F,#9 ;9&4.G"(%./ %/6-./; &$% $..%;*$1* 2


15/107

+G. QIR*+ T !/&2.3"/4

Framework components

PrinciplesArchitecture Goals Cascade Enablers

COBIT Process Assessment Model (PAM) Implementation Guidance

Includes familiar ITG Framework elements

Domain / Process Model

Governance / Management Best Practices Granular Practice Activities Process Inputs / Outputs RACI charts

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J SY


16/107

QIR*+ T R.$.A9;

.&31*+1*2?&4 2& 1+$*2?1&2< 71D$*27$F1*J >1*H

.$4*2?&4 X$-# ]*23?3$-

:177(&,32?&4 F,#9 "#2J$911*72&3$

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Sb


17/107

QIR*+ T R.$.A9;

8$9./:/6;.[36%. R.$.A9;

R.$.A9; /.&(6_&'"$ #9*1(49 )$*+*,-$ ./ 01%$*&2&3$

R#;6$.;;[#;./ ;&';5&0'"$F,#9 ./ $&424$7$ 2&D -$*%,3$-

*+ ;..$ &; & 4.L .$&D(./

Q"2:(6&$0.F,#9 *$


18/107

QIR*+ T R.$.A9;

`.L R#;6$.;; R.$.A9; 8$%[9"[.$%$$*+*,-$ 41%$*&2&3$ 2&D 72&24$7$ 1> ./

+/&$;:&/.$0L,& D$3,-,1& 72J,&4

`.L *+ R.$.A9;

176(69L1> ./ #1 *$-+1&D #1 E(-,&$-- &$$D-

1(67$2.$91> ./ #2-J-P23?%,?$- F,#9 E(-,&$-- &$$D-

I:'26_&'"$1>H

./ 2--$#- M *$-1(*3$-

./^*$1*72&3$ 1> ./

OPQRPSQ SdI1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J


19/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J SR

./ 01%$*&2&3$ =$\&$D

I1(&D2?1&2< )$*+*,-$ ./ 01%$*&2&3$

U

V92# ,- :WX./ P :WX./ YZU :WX./ Y WE[$3?%$-

U

:WX./ Y I*27$F1*J

U :WX./ Y X$&$\#-

QIR*+ T


20/107

*+ ,"-./$&$0.


21/107

QIR*+ T


22/107

QIR*+ T


23/107

=9&4.G"(%./ H..%; &/. 6$d#.$0.% DLN6 &(7E$* 1> D*,%$*-H

"#*2#$4A :92&4$- :92&4,&4 X(-,&$-- L;,--,1&N M 8$4(


24/107

,"&(; Q&;0&%.N ]*1%,D$- #9$


25/107

,"&(; Q&;0&%.

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J QY

=(6%. b]

=(6%. b\

=(6%. Ve

=(6%. bV

=(6%.; Vf > Vg


26/107


27/107

=9&4.G"(%./ H..%;

B&6$9&6$ I#/ !"0#;!: :&)C9D& $)*C9"&): %* *>) :%#7&,*@"&): 6& +>:%

)&+&+=&) %,#% A;%&)$)9:& E*#@: #)& # $)*FG (*)

/%#7&,*@"&) H&&":a"3 %".; *+ ,"-./$&$0. ;./-. "#/ 0#;9"2./;S

5)*+ # :%#7&,*@"&): $*9;% *( C9&6 9% 9: C#@>#=@& %*

>;"&):%#;" ,*6 %,&9) ;&&": )&@#%& %* A;%&)$)9:& I .3J

)&@#%&" E*#@:

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Qc

=9 4 G (% H %


28/107

=9&4.G"(%./ H..%;

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Qd


29/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J QR

8$9./:/6;. ,"&(; E B.9/60;

8$9./:/6;. ,"&(; LScN

8$9./:/6;. ,"&(; =&2:(. B.9/60; LYON


30/107

8$9./:/6;. ,"&(;SG "#2J$91$4(2*D,&4 1> 2--$#-NOG :17+


31/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J TS

8$9./:/6;. ,"&(; =&2:(. B.9/60;

=9 4 G (% H % 9 8 9 6 , (


32/107

=9&4.G"(%./ H..%; 9" 8$9./:/6;. ,"&(;

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J TQ


33/107

*+ ?.(&9.% ,"&(; E B.9/60;

*+ ?.(&9.% ,"&(; LScN

*+ ?.(&9.% ,"&(; =&2:(. B.9/60; LYRN

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J TT

*+ ?.(&9.% ,"&(;


34/107

*+ ?.(&9.% ,"&(;SG 6 ./ 2&D E(-,&$-- -#*2#$4A

QG ./ 317+1* E(-,&$-- 317+


35/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J TY

*+ ?.(&9.% ,"&(; =&2:(. B.9/60;


36/107

QIR*+ T


37/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Tc

QIR*+ T


38/107

QIR*+ T


39/107

QIR*+ T


40/107

QIR*+ T


41/107

QIR*+ T


42/107

QIR*+ T 1*72&3$

TbG

;)6hQH ;1&,#1*C )%2


43/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J OT


44/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J OO


45/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J OY


46/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Ob

8$9./:/6;. ,"&(; ?.(&'"$ 9" ,"-./$&$0. IDM.0'-.;

8$9./:/6;. ,"&(; 9" *+ ?.(&9.% ,"&(;


47/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Oc

8$9./:/6;. ,"&(; 9" *+ ?.(&9.% ,"&(;

*+ ?.(&9.% ,"&(; 9" QIR*+ T


48/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Od

*+ ?.(&9.% ,"&(; 9" QIR*+ T


49/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J OR

*+ ?.(&9.% ,"&(; 9" QIR*+ T


50/107


51/107

!/&2.3"/4; 1(67$2.$9

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J YS

QIR*+ T 1/0G69.09#/.


52/107

QIR*+ T 1/0G69.09#/.

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J YQ

8$&D(./;N

o


53/107


54/107

QIR*+ T 8$&D(./;

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J YO

,.$./60 8$&D(./ B"%.(


55/107

,.$./60 8$&D(./ B"%.(

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J YY

6 41%$*&2&3$ -A-#$7 ,- 2 317+


56/107

8$&D(./ @62.$;6"$;

=9&4.G"(%./;i- :2& E$ ,$*&2< 1* $B#$*&2< #1 #9$ 1*42&,`2?1&C 2&D 92%$ #9$,* 1F&

,$*$-#- 2&D &$$D-C F9,39 32& E$ 31&q,3?&4- "#2J$91


57/107

^65. QL0(. i

]92-$- 31&-,-# 1>H

]


58/107

/1 72&24$ +$*>1*72&3$ 1> $&2E1


59/107


60/107


61/107

I/7&$6_&'"$&( =9/#09#/.;

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J bS

6DD,?1&2< ,&>1*72?1& 2%2,


62/107

Q#(9#/. E R.G&-6"/

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J bQ

6DD,?1&2< ,&>1*72?1& 2%2,


63/107

*$5"/2&'"$

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J bT

6DD,?1&2< ,&>1*72?1& 2%2,


64/107

=./-60.;C *$5/&;9/#09#/.C E Q&:&D6(6'.;

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J bO

6DD,?1&2< ,&>1*72?1& 2%2,


65/107

1*72?1& 2%2,


66/107

=46(( Q&9.7"/6.;

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J bb


67/107

:WX./ Y >*27$F1*J 72J$- 2 3 23?%,?$-

8$m(,*$ D,g$*$ 1*42&,`2?1&2< -#*(3#(*$-

"$*%$ D,g$*$ +(*+1-$-

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J bc


68/107

,"-./$&$0. E B&$&7.2.$9


69/107

,"-./$&$0. )&-(*$- #92# $$*+*,-$ 1E[$3?%$- 2*$ 239,$%$D EA .-&(#&'$7

-#2J$911*72&3$C 317+


70/107

*+ ,"-./$&$0.

*$9.7/&'"$ "5 ,"-./$&$0. E B&$&7.2.$9 =,-?&3?1& E$#F$$& 01%$*&2&3$ M ;2&24$7$ 1a$&

7,-(&D$*-#11D

8F.0'-. 6$9.7/&'"$ "5 9G.;. 93" .(.2.$9; 6; 0/6'0&( >1*

-(33$-->(< 41%$*&2&3$ 1> 2&A ./ $$*+*,-$ 1* 1*42&,`2?1&

./ 01%$*&2&3$ ,- HI+ *$-+1&-,E1* J/.$%./6$7K ./

,&>*2-#*(3#(*$

./ 01%$*&2&3$ *= *$-+1&-,E1* J"-./;67G9 "5 2&$&7.2.$9:/"0.;;.;K #92# *$&D$* ./ ,&>*2-#*(3#(*$

OPQRPSQ chI1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J


71/107

?"(.;C 10'-6'.;C E ?.(&'"$;G6:;

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J cS


72/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J cQ

=8


73/107


74/107

17.$%&


75/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J cY

./ 01%$*&2&3$ =$\&$D

I1(&D2?1&2< )$*+*,-$ ./ 01%$*&2&3$

U

V92# ,- :WX./ P :WX./ YZ

U

:WX./ Y WE[$3?%$-

U

:WX./ Y I*27$F1*J

U :WX./ Y X$&$\#-

:WX./ Y ]*,&3,+


76/107


77/107

=6Y


78/107

: L

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J cd


79/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J cR

Q"22"$(L

?.0"7$6_.% B&9#/69L

^.-.(;

QIR*+ T *=Ik*8Q

XTT\V[D&;.%

Q&:&D6(69L .-.(;

B.&$6$7 "5 9G. QIR*+ T *=Ik*8Q XTT\V[D&;.%

Q&:&D6(69L .-.(;

YG W+?7,`$D YG W+?7,`$D :1&?&(1(-


80/107


81/107

23,1


82/107

1* 2--$--7$ ,& #9$ u]*13$--

8$>$*$&3$ ;1D$1


83/107


84/107


85/107

: L

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J dY

Q&:&D6(69L ^.-.( X 1;;.;;2.$9N

XW

1;;.;; 9G. :/"0.;; "#90"2.; 2- #9$A 2*$ D13(7$$D ,& #9$D$#2,1* $239

1> #9$ *$72,&,&4 32+2E,


86/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J db


87/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J dc

:

@.;0/6:'"$


88/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J dd

: :


89/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J dR

,.$./60 P"/4


90/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Rh

,.$./60 P"/4


91/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J RS

./ 0 = \ D

17.$%&


92/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J RQ

./ 01%$*&2&3$ =$\&$D

I1(&D2?1&2< )$*+*,-$ ./ 01%$*&2&3$

U

V92# ,- :WX./ P :WX./ YZ

U

:WX./ Y WE[$3?%$-

U

:WX./ Y I*27$F1*J

U :WX./ Y X$&$\#-

:WX./ Y ]*,&3,+$*$&3$-

*2:(.2.$9&'"$ ^65. QL0(.


93/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J RT

*2:(.2.$9&'"$ ,#6%&$0.


94/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J RO

QIR*+ T *2:(.2.$9&'"$ ,#6%.

X2-$D 1& 2 31&?&(2< ,7+*1%$7$ $ 3A3


95/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J RY

`.L 5&09"/; 5"/ ;#00.;;5#( 62:(.2.$9&'"$N +": 2&$&7.2.$9 :/"-6%6$7N

U

=,*$3?1& 2&D 72&D2#$ >1* #9$ ,&,?2?%$

U

k,-,E


96/107

: L ::

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Rb

]*1%,D$- 2 F2A >1* $$*+*,-$- #1 2DD*$-- #9$

317+


97/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Rc

*$6'&9.


98/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Rd

@.A$. ?"&%2&:o]$*>1*7 2 D$#2,


99/107

=.-.$


100/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J Shh

./ 01%$*&2&3$ =$\&$D

I1(&D2?1&2< )$*+*,-$ ./ 01%$*&2&3$

U

V92# ,- :WX./ P :WX./ YZ

U

:WX./ Y WE[$3?%$-

U

:WX./ Y I*27$F1*J

U :WX./ Y X$&$\#-

:WX./ Y ]*,&3,+


101/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J ShS

*+ ,"-./$&$0. @.A$.%U

=,-?&3?1& E$#F$$& 01%$*&2&3$ M ;2&24$7$ 1a$&

7,-(&D$*-#11D

U )g$3?%$ ,$4*2?1& 1> #9$-$ #F1 $1*

-(33$-->(< ./ 01%$*&2&3$ ,& 2&A $$*+*,-$ 1*

1*42&,`2?1&

!"#$%&'"$&( 8$9./:/6;. *+ ,"-./$&$0.s&D$*-#2&D,&4 1> ./0 :1*$ :1&3$+#- ,- *$m(,*$D #1 >(


102/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J ShQ

QIR*+ T


103/107

OPQRPSQ I1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J ShT

*2:(.2.$9&'"$ ,#6%&$0.K

W+?72< %2


104/107

=#22&/L

/9,- 92- +*$-$$D 2& 1%$*%,$F 1> 2 eI1(&D2?1&2*27$F1*J

X2-$D (+1& ."6:6v- I1(&D2?1&2< )$*+*,-$ ./

01%$*&2&3$ I*27$F1*J J&1F& 2- :WX./ Y

/9,- $-#2E1(&D2?1& 1> 317+*$9$&-,%$ ./

01%$*&2&3$

ShOI(&D27$< )$*+*,-$ ./ 01%$*&2&3$OPQRPSQ

?.0"22.$%&'"$;


105/107

?.0"22.$%&'"$;

=$%$*27$F1*J

E2-$D (+1& ,$*&2?1&2< E$-# +*23?3$ >*27$F1*J- M

31&3$+#-G /1 ,&3*27$F1*J- 1(#


106/107

j#.;'"$;S

OPQRPSQ ShbI1(&D2?1&2< ./ 01%$*&2&3$ I*27$F1*J

?.5./.$0.; QIR*+ T


107/107

QIR*+ T

9t+HPPFFFG,-232G1*4P

QIR*+ TN 8$&D(6$7

Foundational IT Governance Framework

Documents