On the Way to a Minimum Baseline in IT Governance: Using Expert Views for Selective Implementation of COBIT 5

Abstract

Information Technology (IT) nowadays is integral part in most organizations and business models, putting Enterprise Governance of IT (EGIT) in focus of researchers and practitioners. A common approach for the implementation of EGIT in organizations is the use of best-practice frameworks, of which COBIT 5 is a very well-known example. However, recent studiesshow that COBIT 5, with its 37 EGIT processes, is often perceived as complex and organizations do not know where to start. To contribute to this concern, this papers reports on a Delphi study that was conducted to capture data on the perceived ease and effectiveness of specific COBIT 5 processes. Our results as such identify (perceived) effective and easy processes as a starting point for IT governance implementations. Experts view processes in the more strategic and governance area typical as more effective but less easy to implement. The more operational processes are typically experienced as easier to implement but also less effective. The result also reports that, according to experts, the most important process to start an EGIT implementation is the process around managing the IT related strategy.

Defining the Minimum Security Baseline in a Multiple Security Standards Environment by Graph Theory Techniques

“…However, such approaches are ad hoc-based and are not directly linked with existing security standards. MSB verification could be implemented in different ways, starting from the expert review [18], including information security consultant analysis. Authors of [18] conducted an explorative expert study to derive a set of COBIT 5 processes that could serve as a basis for an enterprise governance of IT implementation and discussed how this approach could contribute to complexity reduction.…”

“…MSB verification could be implemented in different ways, starting from the expert review [18], including information security consultant analysis. Authors of [18] conducted an explorative expert study to derive a set of COBIT 5 processes that could serve as a basis for an enterprise governance of IT implementation and discussed how this approach could contribute to complexity reduction. This research was based on an earlier [19] study, which was focused on identifying which practices (structures, processes, and relational mechanisms) an organization could leverage to ensure that IT governance becomes a reality in the organization.…”

“…In other words, the MSB would be a subset of an information security standard and could be represented as a subpart of it. The standard approach for minimum security baseline identification is the use of expert knowledge [18]. Information security specialists review the standard or framework and identify which requirements are mandatory and are a part of the MSB.…”

Identificação de Práticas e Recursos de Gestão do Valor das TI no COBIT 5

“…Ao comparar a lista de processos obtidos neste trabalho, com a lista de processos mais importantes e efetivos do COBIT 5 identificados em Bartens et al, (2015) verifica-se a presença de cinco dos oito processos (EDM01; EDM02; APO02; APO06 e BAI01), o que vem reforçar a importância que deve ser dada desde o primeiro momento à componente de Gestão do Valor na implementação prática do COBIT 5. A Framework VAL IT 2.0 considera as componentes de Projetos, Programas e Portfólio, essenciais para entrega de valor ao negócio.…”

“…Processos X Definição e manutenção do modelo de governança (EDM01) (ISACA, 2012b); (Kumar et al, 2008); (Bartens et al, 2015) X Realização de benefícios (EDM02) X Gestão da estrutura de gestão de TI (APO01) ; (Ward & Daniel, 2006); (Grajek, 2015); X X Critérios e tipos de investimento X X X Feedback de desempenho do programa e portfólio…”