Mapping COBIT®, ITIL® & ISO27002 v3

LINKING COBIT®, IT ITIL IL® & ISO27001/2 P res resent ented ed by by:: Marianne Coop “ITIL ® is a Registered Trade Mark of the Office Office of Governmen Governmentt Commerce Commerce in the United Kingdom and and other countries” countries”

 Assumptions / Misconceptions: COBIT is only for IT Auditors ITIL is only for “Techies”  ISO27001/2 is only for IT Security boffs These are mutually exclusive Only one of can be primary “governance” for an organisation Linking COBIT, ITIL & ISO27001/2

 Aim of this session

Linking COBIT, ITIL & ISO27001/2

Why These Three?

What

• COBIT • ISO 27001 How • ITIL • ISO 27001 Guidance

• ISO 27002

Linking COBIT, ITIL & ISO27001/2

Common Ground: Business Strategy

COBIT

IT Management

ITIL

Success £

ISO27001/2

Effective Efficient

Linking COBIT, ITIL & ISO27001/2

Brief bit about COBIT 4.1: Common IT control framework. Generic set of IT processes. Globally accepted. Monitoring & managing IT activities. Maturity Model.

Linking COBIT, ITIL & ISO27001/2

COBIT Lifecycle:

Linking COBIT, ITIL & ISO27001/2

COBIT Framework (Simpler picture): Business Objectives Governance Objectives

Information Criteria Monitor & Evaluate

Plan & Organise IT Resources

Develop & Support

Acquire & Implement Linking COBIT, ITIL & ISO27001/2

Brief bit about ITIL V3 : For IT Service Managers. Not dictate business processes. Strives for continuous improvement. Guidance to demonstrate compliance to: ISO/IEC 20000:2005 standard COBIT Control Objectives

Linking COBIT, ITIL & ISO27001/2

ITIL Framework :

Linking COBIT, ITIL & ISO27001/2

Brief bit about ISO27001/2: ISO 27001 defines requirements for an ISMS (Information Security Management System).

ISO 27002 provides guidance for an ISMS. Certified as compliant to ISO 27001. It is a best practice that can be adopted without being certified.

Linking COBIT, ITIL & ISO27001/2

ISO27001/2 ISMS Processes: Plan

Establish ISMS

Maintain & improve ISMS

Implement & operate ISMS

Monitor & review ISMS Check Linking COBIT, ITIL & ISO27001/2

IT Service Management Pyramid:

Mapping COBIT, ITIL & ISO27001/2

How they link together: Business Objectives Plan & Organise Service Strategy Establish ISMS

Acquire & Implement Service Design

Develop & Support

Service  Transition

Implement & operate ISMS

Service Operation

Monitor & review ISMS

Monitor & Evaluate Continual Improvement Maintain & improve ISMS

IT Resources Mapping COBIT, ITIL & ISO27001/2

ITGI’s Products Support Adoption of ISO/IEC 38500:

Mapping COBIT, ITIL & ISO27001/2

How they link together:

Mapping COBIT, ITIL & ISO27001/2

Links to further reading: ISACA’s COBIT Pages: COBIT Home page www.isaca.org/Know ledge-Center/COBIT/Pages/Overview.aspx

COBIT Download Page www.isaca.org/Knowledge-Center/cobit/Pages/Downloads.aspx

Enabling Adoption of ISO 3850 www.is aca.org/Knowledge-Center/Research/ResearchDeliv erables/Pages/ITGI-Enables-ISO-IEC-38500-2008-Adopti on-.aspx

COBIT Downloads:  A good overview: Excerpt and Executive Summary  All of COBIT 4.1: COBIT 4.1 pdf  http://www.isaca.org/Knowledge-Center/cobit/Documents/CobiT_4.1.pdf 

COBIT Mapping: www.is aca.org/Knowl edge-Center/Research/ResearchDeliverables/Pages/Aligni ng-COBIT-4-1-ITIL-V3-and-ISO-IEC-27002-for-Busi nessB enefit.aspx

Mapping COBIT, ITIL & ISO27001/2

Links to further reading: ITIL: Official ITIL® Website http://www.itil-officialsite.com/home/home.asp

Overview: An Introductory Overview of ITIL V3.pdf  http://www.best-management-practice.com/gempdf/itSMF_An_Introductory_Overview_of_ITIL_V3.pdf 

Service Management - ITIL® Version 3 Publications http ://www.best-management-practice.com/Publicati ons-Lib rary/IT-Service-Management-ITIL/?DI=603118#GEMS6415420

ISO: ISO Online http://www.27001-online.com/index.htm

Offi cial Site: BSI http://www.bsigroup.co.uk/

Mapping COBIT, ITIL & ISO27001/2

 Thank you  And Enjoy

Mapping COBIT, ITIL & ISO27001/2