CANSU ALKAN: Mart 2016

The Interactions in Between ITIL, Cobit and ISO27001

ISO/IEC 27001, ITIL, and COBIT are the three most important best-practice IT-related frameworks.

ISO/IEC 27001 is the international Code of Best Practice for Information Security from the International Standards Organization in Geneva.

ITIL is the IT Infrastructure Library, created by the United Kingdom's Office of Government Commerce, and CobiT is Control Objectives for Information and Related Technology, from the IT Governance Institute, in the United States.

ISO 17799, ITIL, and COBIT are all best-practice IT approaches to regulatory and corporate governance compliance. The challenge is to craft an integrated framework that encompasses all three standards. The Joint Framework established by the IT Governance Institute and the British Office of Government Commerce forms one of the two most comprehensive frameworks.

Aligning COBIT, ITIL and ISO 17799 for Business Benefit was published in 2005 and serves to formalize the relationship between these three best-practice frameworks. The recommendation is that COBIT should be used to provide "an overall control framework based on the (generic) IT-process model" at the governance level. ITIL describes how service management aspects should be handled.

ITIL and ISO 27001 are mapped to high-level COBIT process and control objectives.
ISO 27001 defines what must be done in terms of information security controls.
Appendix I maps CobiT controls to ITIL processes and ISO 27001 controls.
Appendix II maps ITIL processes to COBIT control objectives.
ITIL, COBIT, and ISO 27001(17799) projects are enabled to be cross-linked/integrated.

ITIL (Information Technology Infrastructure Library)

The Information Technology Infrastructure Library (ITIL) is growing in popularity among financial institutions seeking to improve service quality and to align IT with larger business objectives. It is an IT management approach that bridges tools and standards with business processes .It was developed in England in the 1980s for the Central Computer and Telecommunications Agency (CCTA), and is a set of documents focused on best-practice processes for IT service management. ITIL is technology neutral and focuses on processes. Unlike ISO 17799, ITIL security management describes "how" security measures can be implemented.

ITIL provide consistent and comprehensive best practices for IT service management and delivery.

ITIL provides the foundation for quality IT service management. It gives comprehensive best practices of how to plan, design and implement effective service management capabilities, and describes detailed approaches, functions, roles and processes upon which organizations may base their own practices.

ITIL Core Concepts

Services

Services are a means of delivering value to customers without requiring the customer to own specific costs and risks.

Service Management

Service Management is a set of specialized capabilities for delivering value to customers in the form of services. ITIL® is a framework for IT Service Management.

ITIL as a Good Practice Framework

Good practices are best practices which have gained wide acceptance and adoption. In short, Good Practices have withstood the test of time. Good Practices may come from a number of sources including:

· Standards

· Public frameworks

· Academic research

· Proprietary knowledge

The Service Lifecycle

The core of ITIL® is structured around a Service Lifecycle which consists of the five phases shown in the illustration below. Each lifecycle phase is discussed in more detail later in this study guide. The Service Lifecycle organizes activity around services as the services move from concept through the live environment and into retirement. The ITIL® ‘core’ documentation consists of five volumes representing each of the phases of the Service Lifecycle

Service Strategy provides guidance to perceive services as strategic assets more than just organisation capabilities. This stage is essential for developing policies, guidelines, and processes of service management across the ITIL lifecycle;

Service Design provides guidance to design and develop service, and also service management practices. It also includes design principles for converting business objectives into services. However, those principles are not only applied to new services, but include also maintaining or increasing services.

Service Transition provides guidance for developing and improving of the transition capability of new and changed services into operational ones. This stage ensures that the requirements of service strategy, encoded in service design, are well implemented in the service operation.

Service Operation includes the knowledge of day-to-day operation of service management. It provides guidance to achieve effective and efficient service delivery and to ensure the value retained by the customers and the service provider.

Continual Service Improvement provides instrumental guidance to maintain and create values for customers by means of better design, transition, and operation of services

ITIL Process Description

Configuration management: Creation and maintenance of a database of all IT configuration items, their relationship with other items, and their proper state.
Incident management: Receiving, recording, and classifying user reports of malfunctions, primarily received through the help desk.
Problem management: Analysis of incidents to uncover patterns of repetition that might indicate a common root cause. Positive conclusion results in a request for change (RFC), and the cycle repeats.
Change management: Response to and action on requests for change. The process includes solution evaluation and design, risk analysis, prioritization, approvals, and feasibility testing.
Release management: Sequence of events for rolling out a change to the user environment in order to minimize disruption, prevent errors and loss of data, and maintain proper documentation.

Terms and Definitions Associated with ITIL

SLM (service-NN level management): The monitoring of required service levels.
SLA (service-level agreement): Specific targets identified by SLM for each unit within the IT organization.
SLC (service-level contract) : Specific targets identified by SLM for each unit within an external IT supplier.
OLA (operation-level agreement) : Specific targets for the service being supplied by internal service providers (network services, LAN services, and so on).
- UC (underpinning contract) : Specific targets for the service being supplied by an external service provider (such as GE Capital, Decision One).
- Service catalogue: A collection of all the services being provided and the customers of each.
- SLR (service-level requirements) : SLM will ask each IT customer what his or her requirements are. This will be embedded into the SLA.
- SIP (service improvement program) : After the review of an SLA, service improvements may be necessary. A service improvement plan will be designed and acted on.
- CI (configuration item) : Anything within IT that is decided to be within scope and can be changed should be considered a CI. This could be hardware, software, an SLM, a job description, and so on.
- CMDB (configuration management database) : The CMDB holds all details, and relationship information of all CIs, associated with the IT infrastructure.
- SCOPE (scope) : The activities of configuration management include identification, control, status accounting, and auditing.
Control Mapping-ITIL
ITIL addresses the domain control requirements of
- Change management
- Business continuity and availability
- Operational monitoring
- Records management
- Operational controls
The standard concedes as out of its scope the control areas of

Trusted access
Audit and risk management
Operational transparency
Segregation of duties

COBIT

COBIT is a globally accepted set of tools that executives and IT professionals can use to ensure that IT operations are aligned with business goals and objectives. It was initially created by the Information Systems Audit and Control Foundation (ISACF) in 1996 as part of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) evaluation framework. The IT Governance Institute (ITGI), which founded by ISACA in 1998, released the third edition of COBIT in 2000; the fourth edition was released in 2005, and was revised as 4.1 edition in 2007. Released in 2012, COBIT 5 is the newest framework.

Core Concepts

The underpinning concept of the COBIT framework is that IT should be controlled by concentrating on information that is needed to support the business objectives and requirements. The required information is the result of combined application of IT-related resources and IT processes. The three components, namely information criteria, IT resources and IT processes form the three main dimensions of COBIT conceptual framework (see figure 1):

Information Criteria

Information delivered to the core business processes has to fulfill certain criteria ,categorized as follows:
Quality requirements:

Effectiveness: The relevance and pertinence of information to the business process as well as the timely, correct, consistent, and usable delivery. Efficiency: The provision of information through the optimum (most productive and economical) use of resources.

Security requirements:

Confidentiality: The protection of sensitive information from unauthorized disclosure.
Integrity: The accuracy and completeness of information, as well as its validity, in accordance with business values and expectations.
Availability: Information being available when required by the business process now and in the future. It also concerns the safeguarding of necessary resources and associated capabilities.

Fiduciary requirements:

Compliance: Deals with following those laws, regulations, and contractual arrangements to which the business process is subject (i.e., externally imposed business criteria).
Reliability: Relates to the provision of appropriate information for management to operate the entity and for management to exercise its financial and compliance-reporting responsibilities.

Five essential IT resources:

• People

• Applications

• Technology

• Facilities

• Data

IT processes:

Each of COBIT‘s IT processes has a process description and a number of control objectives. COBIT classifies generic IT processes into main domains.

The control objectives are identified by a two-character domain reference (such as PO, AI, DS and ME) plus a process number and a control objective number.

COBIT 4.1 has 34 high level processes that cover 222 control objectives categorized in four domains, which are mapped and aligned with traditional IT development concept of Plan, Build, Run and Monitor:

• Plan and Organise (PO): provides the guidance for service delivery;

• Acquire and Implement (AI): provides the solution by considering the some guidance/policies;

• Deliver and Support (DS): makes the service available for the users;

• Monitor and Evaluate (ME): monitors all the services and evaluates their effectiveness.

COBIT presents IT activities in a hierarchical structure from the highest domain level to IT processes and to the lowest level of IT activities

Common COBIT Tools

COBIT contains a set of tools and resources that organizations can use for IT governance and control. Common tools used in COBIT are:

• Performance Goals and Metrics: enabling IT performance to be measured;

• Maturity Model: assisting in benchmarking and decision-making for process improvements;

• RACI Chart: identifying who are Responsible, Accountable, Consulted, or Informed for specific IT process.

Focuses of COBIT

Aiming to bridge the gap between business control models and IT control models, COBIT is designed for management, senior IT professionals and auditors. It helps management balance risk and control in IT investments; provides guidelines for better IT service and performance management; and assists auditors identifying IT risks and establishing adequate IT controls. COBIT is a comprehensive IT governance framework for management to operate at high level; it is not a pure technology standard for IT management. COBIT contributes to enterprise needs by ensuring that:

• IT is aligned with the business;

• IT enables the business and maximizes its benefits;

• IT resources are used responsibly

• IT risks are managed appropriately.

Control Mapping-COBIT

COBIT addresses the domain control requirements of

Trusted access
Business continuity and availability
Operational monitoring
Records management
Operational controls

The standard concedes as out of its scope the control areas of

Change management
Audit and risk management
Operational transparency
Segregation of duties

ISO 27001

ISO 27001 on requirements for Information Security Management Systems (ISMS). It is an international standard that is prepared to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an Information Security Management System (ISMS). It emphases on:

• Understand the security requirements of an organisation’s information systems, and the need to establish policy and objective for information security

• Implement and operate controls to manage security risks
Monitor and review the performance and effectiveness of the controls

• Improve the control based on objective measurement.

Principally, ISMS adopts the Plan-Do-Check-Action model for managing Information Security. This standard concentrates on security risks as the main drivers in defining security controls.

However, sometimes an organisation might also be required to control some process because some regulations (e.g., SoX) prescribe to do so. This standard has specified WHAT-to-do to establish security requirements, to operate them in terms of controls, to monitor-review the controls, and finally to maintain-improve their performance. Moreover, the standard has also specified a format to document all of these processes.

Figure 1 shows inputs and outputs of the ISO process and the content of this process. This system, called a Plan-DoCheck-Act (PDCA) cycle, also forms the basis of ISO 27001 ISMS standard

Control Mapping-ISO 27001 adresses

ISO/IEC 27001:2005adresses the domain control requirements of

· Trusted Access

· Business continuity and availability

· Operational monitoring

· Records management

· Audit and risk management

· Operational controls

The standard concedes as out of its scope the control areas of

· Change management

· Operational transparency

· Segregation of duties

Comparison between COBIT, ITIL and ISO 27001

COBIT

Cobit is stand for Control Objective over Information and Related Technology. Cobit issued by ISACA (Information System Control Standard) a non profit organization for IT Governance. The Cobit main function is to help the company, mapping their IT process to ISACA best practices standard. Cobit usually choosen by the company who performing information system audit, whether related to financial audit or general IT audit.

ITIL

Itil is stand for Information Technology Library. ITIL issued by OGC, is a set of framework for managing IT Service Level. Although ITIL is quite similar with COBIT in many ways, but the basic difference is Cobit set the standard by seeing the process based and risk, and in the other hand ITIL set the standard from basic IT service.

ISO 27001

ISO 27001 is much more different between COBIT and ITIL, because ISO27001 is a security standard, so it has smaller but deeper domain compare to COBIT and ITIL.

AREA	COBIT	ITIL	ISO27001
Function	Mapping IT Process	Mapping IT Service Level Management	Information Security Framework
Area	4 Process and 34 Domain	9 Process	10 Domain
Issuer	ISACA	OGC	ISO Board
Implementation	Information System Audit	Manage Service Level	Compliance to security standard
Consultant	Accounting Firm, IT Consulting Firm	IT Consulting firm	IT Consulting firm, Security Firm, Network Consultant