The Interactions in Between ITIL, Cobit and ISO27001

 

COBIT aims to research, develo, publish and promote an authoritative, up-to-date, international set of generally accepted information technology control objectives for day-to-day use by business managers, IT professionals and assurance professionals.

Provides a comprehensive framework that assist enterprises to achieve their goals and deliver value through effective governance and management of enterprise IT.

Helps enterprise to create optimal value from IT by maintaining a balance between realizing benefits and optimizing risk leveles and resource use.

COBIT is a high-level IT governance and management framework. It is designed to be employed not only by users and auditors, but also, and more important, as comprehensive guidance for management and business process owners.

It focuses on the broader decisions in IT management and does not well into technical details. It is a framework of best practices in managing resources, infrastructure, processes, responsibilities, controls.

The COBIT framework provides a tool for the business process owner that facilitates the discharge of this responsibility. The framework starts from a simple and pragmatic premise: To provide the information that the organisation needs to achieve its objectives, IT resources need to be managed by a set of naturally grouped processes.

The framework continues with a set of 34 high-level control objectives, one for each of the IT processes, grouped into four domains: Plan and Organise, Acquire and Implement, Deliver and Support, and Monitor. This structure covers all aspects of information and the technology that supports it. By addressing these 34 high-level control objectives, the business process owner can ensure that an adequate control system is provided for the IT environment.It is a good solution when managers are looking for a framework which serves as an integrated solution within itself, rather than having to be implemented along with other IT governance frameworks.

IT governance guidance is also provided in the COBIT framework. IT governance provides the structure that links IT processes, IT resources and information to enterprise strategies and objectives. IT governance integrates optimal ways of planning and organising, acquiring and implementing, delivering and supporting, and monitoring and evaluating IT performance. IT governance enables the enterprise to take full advantage of its information, thereby maximising benefits, capitalising on opportunities and gaining competitive advantage.

However, its biggest short-coming is that it does not give “how- to” guidelines to accomplish the control objectives. This is not preferred when the trust in on correct implementation of security controls.

COBIT aims to research, develo, publish and promote an authoritative, up-to-date, international set of generally accepted information technology control objectives for day-to-day use by business managers, IT professionals and assurance professionals.

Provides a comprehensive framework that assist enterprises to achieve their goals and deliver value through effective governance and management of enterprise IT.

Helps enterprise to create optimal value from IT by maintaining a balance between realizing benefits and optimizing risk leveles and resource use.

ITIL is quite similar with COBIT in many ways, but the basic difference is Cobit set the standard by seeing the process based and risk, and in the other hand ITIL set the standard from basic IT service.

ITIL is a widely accepted approach to IT Service Management(ITSM),which has been adopted by individuals and organisations across the World.ITIL provides a cohesive set of best practice, drawn from the public and private sectors internationally.

Because ITSM is driven both by technology and the huge range of organizational environments in which it operates, it is constantly evolving.

Provides a consistent, and coherent framework of best practices for ITSM and related processes, which promotes a quality approach for achieving business effectiveness and efficiency in the use of Information Systems.

Organisations are increasingly dependent upon IT to satisfy their corporate aims and meet their business needs. This growing dependency necessitates quality IT services at a level matched to business needs and user requirements as they emerge.

IT service management is concerned with delivering and supporting IT services that are appropriate to the business requirements of the organisation. ITIL provides a comprehensive, consistent and coherent set of best practices for IT service management and related processes, promoting a quality approach for achieving business effectiveness and efficiency in the use of IS.

The core operational processes of IT service management are described within the two ITIL publications: Service Support and Service Delivery.

ITIL Service Lifecycle Governance and Operational Elements

TIL defines service management as “a set of specialized organizational capabilities for providing value to customers in the form of services.  The capabilities take the form of functions and processes that are used to manage services over their Lifecycle.

ITIL contains a set of five publications, the ITIL Core, which provide structure, stability, and strength to an IT organization’s service management capabilities.  The structure of the core is in the form of an iterative life cycle

 Combination of ITIL and COBIT

COBIT and ITIL provide an integrated, top-to-bottom approach to IT governance and service management from a “business perspective”.

When used together, the power of both approaches is amplified, with a greater likelihood of management support and direction, and a more cost-effective use of implementation resources.

ISO27001 is much more different between COBIT and ITIL, because ISO27001 is a security standard, so it has smaller but deeper domain compare to COBIT and ITIL.

ISO 27000 series is a family of IS management standards. It is the set of standards in this family that focuses on Information Systems Management.

ISO 27001 defines methods and practices of implementing information security in organizations with detailed steps on how these implemented. They aim to provide reliable and secure communication and data exchange in organizations. Also, it stresses on a risk approach to accomplishing its objectives.

This standard dives deep into ways to implement its sub- objectives. This puts managers who are looking for clarifications on implementation, at an advantage. However, it fails to achieve the goal of integrating into a larger system. It is standalone in its nature, and does not work as a complete ISM solution.

AREA	COBIT	ITIL	ISO27001
Function	Mapping IT Process	Mapping IT Service Level Management	Information Security Framework
Area	4 Process and 34 Domain	9 Process	10 Domain
Issuer	ISACA	OGC	ISO Board
Implementation	Information System Audit	Manage Service Level	Compliance to security standard
Consultant	Accounting Firm, IT Consulting Firm	IT Consulting firm	IT Consulting firm, Security Firm, Network Consultant
Focus	Business orientation and IT governance in its entirety	Value creation made possible by technology.	Implementation of security controls, stress on risk management approach
Scope	Complete IT governance of organization, including security planning. It is an integrated solution.	Satisfy their corporate aims and meet their business needs.	Standalone guidance for security.
Structure	34 IT processes grouped in 4 domains: Plan and organize, Acquire and Implement, Deliver and support, Monitor		11 sections with 36 objectives which are further divided into sub- objectives
Organizational model	All stakeholders	All stakeholders	Management, IS departments

What should be implemented first?

Most of company start to implemented Cobit first because its cover general information system. And after that they usually choose between ITIL or ISO27001.

Another consideration is about budget and authoritive. Cobit implementation usually run from internal audit budget and ITIL or ISO27001 usually performed using IT departement budget. This consideration usually makes what kind of standard to implemented first become depend on management policy.

What is the easiest standard?

From the implementatation view, ITIL is the easiest standard to be implemented. Because, ITIL could be implemented partially and still not have impact on performance. Example, if IT departement lack of budget and he could choose to implement IT Service Delivery layer only, and the next year he will try to implement IT Release Management or IT Problem Management.

However COBIT and ISO27001 is quite difficult to be implemented partially, since it should see a process in bigger view first before they could implemented partially.

How to choose the right vendor?

Many vendor said that he could help your company to implement these standard effectively, in fact there is no one solution for all. Usually the COBIT vendor come from Publci Accounting Firm. This type of vendor is best choice for COBIT since they also work for COBIT implementation derivative such as COBIT for Sarbanes Oxley.