Combining ITIL, COBIT, and ISO/IEC 27002 in Order to Design a
Comperhensive IT Framework in Organization
1.
Introduction
Management is an attempt to direct and
control a group of one or more people or entities for the purpose of
coordinating and harmonizing them towards accomplishing a special goal . At present
Management encompasses several dimension like human resources ,financial
resource and technological resource. One new area of management is information
technology management (or IT management). It is a combination of two branches
of study, information technology and management.
‘Information Technology’ has several definition from different
perspective :
From the first perspective , IT system are application and
infrastructure which are components of a larger product. They enable or are
embedded in processes and service.
From the second perspective , IT is an organization with its
own set of capabilities and resource. IT organization can be one of various
types such as business function , shared service units and enterprise –level
core units.
From the third perspective , IT is a category of service
utilized by business . They are typically IT application and infrastructure
that are package and offered as service by internal IT organization of external
service providers. In this perspective IT cost are treated as business
expenses.
From the fourth perspective , IT is a category of business
assets that provide a stream of benefit for their owner , including but not
limited to revenue , income and profit. In this perspective IT cost are treated
as investment.
All definition emphasize the importance of IT in the
organization . therefore it is crucial to manage and implement IT in the
organizations. There are several standards , tools , frameworks, and best
practice to manage and maintain IT service. The most applicable and widely used
such standards are ISO/IEC 27002 in information security. Hence it is better to
combine them to make a comprehensive IT framework in the organization . Based
on previous studies the best combination should be between laying ITIL , COBIT
and ISO/IEC 17799 together . But ITIL de-facto standard and ISO/IEC 17799
standard recently has been refreshed and changed.
2.
ITIL
ITIL (Information Technology Infrastructure
Library) is a de-facto standard which introduced and distributed by Office of
Government Commerce (OGC) in UK and includes all IT parts of organization. At
present ITIL is the most widely accepted approach to IT service Management in
the world. It has an iterative, multidimensional and lifecycle form structure.
ITIL has an integrated approach as required by the ISO/IEC 20000 standard with
following guidance.
·
Service Strategy
The service strategy
provides guidance on how to design , develop and implement service management
form organizational capability perspective and strategic asset. It provides
guidance on the principles underpinning the practice of service management
which are useful for developing service management policies, guidelines and
processes across the ITIL service lifecycle . service strategy guidance is
applicable in the context of other parts of ITIL lifecycle. Service strategy
covers these parts of IT system : the development of markets , internal and
external , service assets, service catalogue and implementation of strategy
through the service lifecycle.
Service strategy includes
these processes :
§ Financial
Management
§ Service
Portfolio Management
§ Demand
Management
·
Service Design
It is guidance for the
design and development of service and service management processes. It covers
design principles and method for converting strategic objective into portfolios
of service and service assets. The scope of Service Design is includes the
changes and improvements necessary to increase or maintain value to costumer
over the lifecycle of service, the continuity of service, achievements of
service levels and conformance to standards and regulations. It guides
organization on how to develop design capabilities for service management.
Service Design includes these processes:
§ Service
Catalogue Management
§ Service
Level Management
§ Capacity
Management
§ Availability
Management
§ IT
Service Continuity Management
§ Information
Security Management Supplier Management , Application Management
§ Data
and Information Management Business Service Management
·
Service Transition
It is guidance for the development and improvement
of capabilities for transitioning new and changed service into operations.
Service Transition provides guidance on how the requirements of service
strategy encoded in Service Design are effectively realized in Service
Operation while controlling the risk of failure and disruption . This part of
ITIL framework combines practices in release management , program management
and risk management and place them in the practical context of service
management.
Service Transition
processes are:
§ Change
Management
§ Service
asset and Configuration Management
§ Release
and deployment Management
§ Knowledge
Management
§ Stakeholder
Management
§ Transition
Planning
§ Support
and Service Evaluation
·
Service Operation
Service Operation tries
to embody practice in the management of Service Operation. It includes guidance
on achieving effectiveness and efficiency in the delivery and support of
service so as to ensure value for the customer and the service provider.
Strategic objectives are ultimately realized through Service Operation ,
therefore making it a critical capability.
It process are:
§ Event
Management
§ Incident
Management
§ Request
Management
§ Problem
Management
§ Access
Management
·
Continual Service Improvement
This is including of
instrumental guidance in creating and maintaining value for customers through
better design , introduction and operation of service. It combines principles ,
practice and methods from quality management, Change Management and capability improvement. Organization learn to
realize incremental and large-scale improvements in service quality , operational
efficiency and business continuity.
Its processes are:
§ The
7-Step Improving Process
§ Service
Level Management
3. COBIT
The control Objectives for Information and
related Technology (COBIT) is a set of best practice (framework) for
information technology management created by the Information System Audit and
Control Association (ISACA), and the IT Governance Institute (ITGI) in 1992 .
COBIT was released and used primarily by the IT community. Later Management
Guidelines were added , and COBIT became the internationally accepted
framework for IT governance and control.
COBIT
provides managers , auditors, and IT users with a set of generally accepted
measures , indicators, processes and best practice to assist them in maximizing
the benefits derived through the use of information technology and developing
appropriate IT governance and control in a company.
In its
latest edition, COBIT has 34 high level objective that cover 215 control
objective categorized in four domains: Plan and Organize , Acquire and
Implement, Deliver and Support, and Monitor and Evaluate.
The COBIT
mission is to research , develop, publicize and promote an authoritative , up
to date, international set of generally accepted information technology control
objective for day-to-day use by business managers and auditors. Managers,
auditors ,and users benefit from the development of COBIT because it helps them
understand their IT system and decide the level of security and control that is
necessary to protect their companies assets through the development of an IT
governance model. COBIT covers four domains:
·
Plan and Organize
The Planning and
Organization domain covers the use of technology and how best it can be used in
a company to help achieve the company’s goals and objective. It also highlights
the organizational and infrastructural form IT is to take in order to achieve
the optimal results and to generate the most benefits from the use of IT. Here
is list of the high level control objective for the planning and Organization
domain.
§ Define
a Strategic IT Plan
§ Define
The Information Architecture
§ Determine
Technological Direction
§ Define
the IT Processes, Organization and Relationships
§ Manage
the IT Investment
§ Communicated
Management Aims and Direction
§ Manage
IT Human Resource
§ Manage
Quality
§ Assess
and Manage IT Risk
§ Manage
Projects
·
Acquire and Implement
The aim is to identify
its IT requirements acquiring the technology and to implement it within the
company’s current business processes.
This domain also
addresses the development of a maintenance plan that a company should adopt in
order to prolong the life of an IT system and its components. Here is list of
the high level control objective for the Acquisition and Implementation domain.
§ Identify
Automated Solution
§ Acquire
and Maintain Application Software
§ Acquire
and Maintain Technology Infrastructure
§ Enable
Operation and use
§ Procure
IT Resource
§ Manage
Changes
§ Install
and Accredit Solution And Changes
·
Delivery and Support
This domain tries to
manage delivery service which include:
§ Define
and Manage Service Levels
§ Manage
Third-party Service
§ Manage
Performance and Capacity
§ Ensure
Continuous Service
§ Ensure
System Security
§ Identify
and Allocated Costs
§ Educated
and Train Users
§ Manage
Service Desk and Incidents
§ Manage
the configuration
§ Manage
Problems
§ Manage
Data
§ Manage
the Physical Environment
§ Manage
Operation
·
Monitor and Evaluate
The Monitoring and
Evaluation domain deals with a company’s strategy in assessing the needs of the
company and whether or not the current IT system still meets the objectives for
which it was designed and the controls necessary to comply with regulatory
requirements. Monitoring also covers the issue of an independent assessment of
the effectiveness of IT system in its ability to meet business objective and
the company’s control process by internal and external auditors . The following
table list the high levels control objective for the Monitoring domain
§ Monitor
and Evaluate IT Processes
§ Monitor
and Evaluate Internal Control
§ Ensure
Regulatory Compliance
§ Provide
IT Governance
4.
ISO/IEC
27002
This is an information security management
system (ISMS) standard which is the code of practice for Information Security
Management. It list security control objectives and recommended range of a
specific security controls .
Organizations that implement an ISMS in accordance with the
best practice advice in ISO/IEC 27002 are likely simultaneously to meet the
requirements of ISO/IEC 27002, but certification is entirely optional (unless
mandated by the organization’s stakeholder).
5.
ITIL
related to COBIT
The strength within ITIL is the way
processes are described with difference activities and flowcharts to use for
target implementation . Cost/Benefit and Implementation issues are also
described. There are also guidelines for reviews and Critical Success Factors,
but these issues are better described in
COBIT, First of all COBIT is defined by the IT-audit community as a framework
highly suitable for authority. COBIT is also stronger when it come to management
issues where “Management Guidelines” provides the implementer with a reference
where Critical Success Factors are describe together with Key Goal Indicators
,Key Performance Indicators and
Capability Maturity Models (CMM).
When ITIL is benchmarked with COBIT , it has been found that they
correspond with each other to a high degree ,especially, when the
processes of COBIT are ITIL based as in
its latest version . In spite of different words used for the same issues but
they cover the same problem. It is only for incident Management in ITIL that
there is not any equivalent in COBIT. This however ,does not mean that it is
not covered at all. Instead it may be covered in the other part of the framework
or with a different approach. As shown in table therefore it is better to
borrow concepts/process, Activities, Cost/Benefits and planning to
Implementation from ITIL standard and audits from COBIT to design a
comprehensive framework.
6.
ITIL
related to ISO/IEC 27002
As
already mentioned, ISO/IEC 27002 is used for information security and not just
IT issues, With such broad objective it is apparent that ISO/IEC 27002 does not
correspond with ITIL as much as ITIL does with COBIT . ISO/IEC 27002 main
straight is in its application for ensuring overall security at all levels
within an organization.
Problem
Management and Configuration Management in ITIL have not any equivalent in ISO
27002. Configuration Management has a huge impact on the IT environment and it
should be handled in a secure manner. In addition in ISO/IEC 27002 security is
characterized as the preservation of confidentially , integrity and
Availability. In ITIL Availability is about quality aspect such as reliability,
maintainability , serviceability & resilience. Another important finding in
the benchmark it that financial issues are not handled at all in ISO/IEC27002
,instead it is about only risk management, i.e. the implementer should mitigate
risks to avoid costs. ITIL on the other hand , is about financing and cost
allocation for the delivery of IT-services.
Therefore
it is better to borrow Information Security process from ISO/IEC 270002 in
designing a comprehensive framework.
7.
Conclusion
In every
organization today, IT service must be delivered in a cost efficient manner,
mitigating security risk and complying with legal requirements. The equation is
difficult to handle and in some cases it seems like an impossible mission . To be able to survive in
this environment a combination of ITIL, COBIT and ISO/IEC 27002 can be value able
for organization targets , Implementers should use ITIL to define strategies ,
plans and processes, use COBIT for metrics, benchmarks and audits and use
ISO/IEC 27002 to address security issues to mitigate the risk as below in Table
2.
|
ITIL
|
COBIT
|
ISO/IEC
27002
|
|
Concepts/process
|
Critical Success
Factors
|
Information Security
|
|
Activities
|
Metric (CSF,KPI)
|
|
|
Cost/Benefits
|
Benchmarking (CMM)
|
|
|
Planning for
Implementation
|
|
|
|
|
Audit
|
|
8.
Referensi
[1] wikipedia,
Management, HBusiness and Economics WikiProjectH., 3 July 2007,
Hhttp://en.wikipedia.org/wiki/ManagemenHt.
[2] Sharon Taylor,
S.Lacy, I.Macfarlane, ITIL:Service Transition,TSO publications.Norwith,UK,2007
[3] wikipedia,
ISO-IEC-27002:,HISO standardsH, November 2007 ,
http://www.bsiglobal.com/en/Assessment-and-certificationservices/management-systems/Standards-and-Schemes
[4] Wikipedia,
COBIT:2005,Quality Management, 24 November 2007,
Hhttp://en.wikipedia.org/wiki/COBITH.
[5] Wikipedia, ISO/IEC
20000:2005, ISO/IEC standards,October 2007,
Hhttp://en.wikipedia.org/wiki/ISO_20000H.
[6] Wikipedia,ITIL v3,
HInformation technology managementH , 24 November 20, Hhttp://en.wikipedia.org/wiki/ITIL_v3H.
[7] John Wallhoff,
Combining ITIL with COBIT and 17799, 15 October
2007,Hwww.scillani.comH\COBIT\Scillani%20Article%
20Combining%20ITIL%20with%20Cobit%20and%20 17799.
[8] ITIL forum(2007), Information Technology
Infrastructure Library ver 3, From Wikipedia, the free encyclopedia
[9] Jan van Bon,M.Pieper,A.Veen,T.Verheijen,Best
Practices: Introduction to ITIL,TSO Publications,Norwich,June 2007.
[10] Sharon Taylor,
M.Iqbal, M.Nieves, ITIL:Service Strategy,TSO publications.Norwith,UK,2007
[11]Sharon Taylor, V.
Lioyd,C.Rudd, ITIL:Service Design,TSO publications.Norwith,UK,2007 [12]Sharon
Taylor,S. Lacy,I.Macfarlane, ITIL:Service Transition,TSO
publications.Norwith,UK,2007
[13]Sharon Taylor, D.
Cannon,D.Wheeldon, ITIL:Service Strategy,TSO publications.Norwith,UK,2007
[14] Sharon Taylor,
G.Case,G.Spalding, ITIL:Continual Service Improvement,TSO
publications.Norwith,UK,2007
[15] Eric Lachapelle,
White Paper : “Control Objectives for Information and related Technology
“,Veridion Inc.,Montreal, Canada,2 October2007,
Hwww.veridion.netH\ITIL+COBIT\cobit_en_wp.pdf,2007.
[16] David Kohrell, CobiT
and IT Governance - Elements for building in securityfrom the top, down and
thebottom, up,23 October 2007, www.tapuniversity.com
[17] Introduction To ISO 27002 (ISO27002), 27
November 2007,http://www.27000.org/iso-27002.htm
[18] Peter Hill, K. Turbitt, Combine ITIL and
COBIT to MeetBusiness Challenges , 9 November 2007,
www.bmc.com,\COBIT\BMC_BPWP_ITIL_COBIT_ 06.pdf Referensi
[1] wikipedia,
Management, HBusiness and Economics WikiProjectH., 3 July 2007,
Hhttp://en.wikipedia.org/wiki/ManagemenHt.
[2] Sharon Taylor,
S.Lacy, I.Macfarlane, ITIL:Service Transition,TSO publications.Norwith,UK,2007
[3] wikipedia,
ISO-IEC-27002:,HISO standardsH, November 2007 ,
http://www.bsiglobal.com/en/Assessment-and-certificationservices/management-systems/Standards-and-Schemes
[4] Wikipedia,
COBIT:2005,Quality Management, 24 November 2007,
Hhttp://en.wikipedia.org/wiki/COBITH.
[5] Wikipedia, ISO/IEC
20000:2005, ISO/IEC standards,October 2007,
Hhttp://en.wikipedia.org/wiki/ISO_20000H.
[6] Wikipedia,ITIL v3,
HInformation technology managementH , 24 November 20, Hhttp://en.wikipedia.org/wiki/ITIL_v3H.
[7] John Wallhoff,
Combining ITIL with COBIT and 17799, 15 October
2007,Hwww.scillani.comH\COBIT\Scillani%20Article%
20Combining%20ITIL%20with%20Cobit%20and%20 17799.
[8] ITIL forum(2007), Information Technology
Infrastructure Library ver 3, From Wikipedia, the free encyclopedia
[9] Jan van Bon,M.Pieper,A.Veen,T.Verheijen,Best
Practices: Introduction to ITIL,TSO Publications,Norwich,June 2007.
[10] Sharon Taylor,
M.Iqbal, M.Nieves, ITIL:Service Strategy,TSO publications.Norwith,UK,2007
[11]Sharon Taylor, V.
Lioyd,C.Rudd, ITIL:Service Design,TSO publications.Norwith,UK,2007 [12]Sharon
Taylor,S. Lacy,I.Macfarlane, ITIL:Service Transition,TSO
publications.Norwith,UK,2007
[13]Sharon Taylor, D.
Cannon,D.Wheeldon, ITIL:Service Strategy,TSO publications.Norwith,UK,2007
[14] Sharon Taylor,
G.Case,G.Spalding, ITIL:Continual Service Improvement,TSO
publications.Norwith,UK,2007
[15] Eric Lachapelle,
White Paper : “Control Objectives for Information and related Technology
“,Veridion Inc.,Montreal, Canada,2 October2007,
Hwww.veridion.netH\ITIL+COBIT\cobit_en_wp.pdf,2007.
[16] David Kohrell, CobiT
and IT Governance - Elements for building in securityfrom the top, down and
thebottom, up,23 October 2007, www.tapuniversity.com
[17] Introduction To ISO 27002 (ISO27002), 27
November 2007,http://www.27000.org/iso-27002.htm
