COBIT 5的启动流程.pdf

发布时间：2022-06-22 发布人：admin 分类：说明书资料大小：2.30M 资料格式：pdf 举报版权申诉

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第1页.png

第1页 / 共230页

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第2页.png

第2页 / 共230页

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第3页.png

第3页 / 共230页

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第4页.png

第4页 / 共230页

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第5页.png

第5页 / 共230页

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第6页.png

第6页 / 共230页

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第7页.png

第7页 / 共230页

1321ef17-78e1-4ec2-ae96-4a51505123b5.pdf-第8页.png

第8页 / 共230页

List of Figures

Chapter 1. Introduction

Chapter 2. The Goals Cascade and Metrics for Enterprise Goals and IT-related Goals

COBIT 5 Goals Cascade

Step 1. Stakeholder Drivers Influence Stakeholder Needs

Step 2. Stakeholder Needs Cascade to Enterprise Goals

Step 3. Enterprise Goals Cascade to IT-related Goals

Step 4. IT-related Goals Cascade to Enabler Goals

Using the COBIT 5 Goals Cascade

Benefits of the COBIT 5 Goals Cascade

Using the COBIT 5 Goals Cascade Carefully

Using the COBIT 5 Goals Cascade in Practice

Metrics

Enterprise Goal Metrics

IT-related Goal Metrics

Chapter 3. The COBIT 5 Process Model

Enabler Performance Management

Chapter 4. The COBIT 5 Process Reference Model

Governance and Management Processes

Model

Chapter 5. COBIT 5 Process Reference Guide Contents

Inputs and Outputs

Generic Guidance for Processes

Evaluate, Direct and Monitor (EDM)

Align, Plan and Organise (APO)

Build, Acquire and Implement (BAI)

Deliver, Service and Support (DSS)

Monitor, Evaluate and Assess (MEA)

Appendix A. Mapping Between COBIT 5 and Legacy ISACA Frameworks

Appendix B. Detailed Mapping Enterprise Goals—IT-related Goals

Appendix C. Detailed Mapping IT-related Goals—IT-related Processes

Enabling Processes Personal Copy of: Mr. Chen Jia

: ENABLING PROCESSES ISACA® With 95,000 constituents in 160 countries, ISACA (www.isaca.org) is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the non-profit, independent ISACA hosts international conferences, publishes the ISACA® Journal, and develops international IS auditing and control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor® (CISA®), Certified Information Security Manager® (CISM®), Certified in the Governance of Enterprise IT® (CGEIT®) and Certified in Risk and Information Systems ControlTM (CRISCTM) designations. ISACA continually updates COBIT®, which helps IT professionals and enterprise leaders fulfil their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business. Disclaimer ISACA has designed this publication, COBIT® 5: Enabling Processes (the ‘Work’), primarily as an educational resource for governance of enterprise IT (GEIT), assurance, risk and security professionals. ISACA makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of all proper information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, readers should apply their own professional judgement to the specific GEIT, assurance, risk and security circumstances presented by the particular systems or information technology environment. Copyright © 2012 ISACA. All rights reserved. For usage guidelines, see www.isaca.org/COBITuse. ISACA 3701 Algonquin Road, Suite 1010 Rolling Meadows, IL 60008 USA Phone: +1.847.253.1545 Fax: +1.847.253.1443 Email: info@isaca.org Web site: www.isaca.org Feedback: www.isaca.org/cobit Participate in the ISACA Knowledge Center: www.isaca.org/knowledge-center Follow ISACA on Twitter: https://twitter.com/ISACANews Join the COBIT conversation on Twitter: #COBIT Join ISACA on LinkedIn: ISACA (Official), http://linkd.in/ISACAOfficial Like ISACA on Facebook: www.facebook.com/ISACAHQ COBIT® 5: Enabling Processes ISBN 978-1-60420-241-0 Printed in the United States of America 2 Personal Copy of: Mr. Chen Jia

ACKNOWLEDGEMENTS ACKNOWLEDGEMENTS ISACA wishes to recognise: COBIT 5 Task Force (2009-2011) John W. Lainhart, IV, CISA, CISM, CGEIT, IBM Global Business Services, USA, Co-chair Derek J. Oliver, Ph.D., CISA, CISM, CRISC, CITP, DBA, FBCS, FISM, MInstISP, Ravenswood Consultants Ltd., UK, Co-chair Pippa G. Andrews, CISA, ACA, CIA, KPMG, Australia Elisabeth Judit Antonsson, CISM, Nordea Bank, Sweden Steven A. Babb, CGEIT, CRISC, Betfair, UK Steven De Haes, Ph.D., University of Antwerp Management School, Belgium Peter Harrison, CGEIT, FCPA, IBM Australia Ltd., Australia Jimmy Heschl, CISA, CISM, CGEIT, ITIL Expert, bwin.party digital entertainment plc, Austria Robert D. Johnson, CISA, CISM, CGEIT, CRISC, CISSP, Bank of America, USA Erik H.J.M. Pols, CISA, CISM, Shell International-ITCI, The Netherlands Vernon Richard Poole, CISM, CGEIT, Sapphire, UK Abdul Rafeq, CISA, CGEIT, CIA, FCA, A. Rafeq and Associates, India Development Team Floris Ampe, CISA, CGEIT, CIA, ISO 27000, PwC, Belgium Gert du Preez, CGEIT, PwC, Canada Stefanie Grijp, PwC, Belgium Gary Hardy, CGEIT, IT Winners, South Africa Bart Peeters, PwC, Belgium Dirk Steuperaert, CISA, CGEIT, CRISC, IT In Balance BVBA, Belgium Workshop Participants Gary Baker, CGEIT, CA, Canada Brian Barnier, CGEIT, CRISC, ValueBridge Advisors, USA Johannes Hendrik Botha, MBCS-CITP, FSM, getITright Skills Development, South Africa Ken Buechler, CGEIT, CRISC, PMP, Great-West Life, Canada Don Caniglia, CISA, CISM, CGEIT, FLMI, USA Mark Chaplin, UK Roger Debreceny, Ph.D., CGEIT, FCPA, University of Hawaii at Manoa, USA Mike Donahue, CISA, CISM, CGEIT, CFE, CGFM, CICA, Towson University, USA Urs Fischer, CISA, CRISC, CPA (Swiss), Fischer IT GRC Consulting & Training, Switzerland Bob Frelinger, CISA, CGEIT, Oracle Corporation, USA James Golden, CISM, CGEIT, CRISC, CISSP, IBM, USA Meenu Gupta, CISA, CISM, CBP, CIPP, CISSP, Mittal Technologies, USA Gary Langham, CISA, CISM, CGEIT, CISSP, CPFA, Australia Nicole Lanza, CGEIT, IBM, USA Philip Le Grand, PRINCE2, Ideagen Plc, UK Debra Mallette, CISA, CGEIT, CSSBB, Kaiser Permanente IT, USA Stuart MacGregor, Real IRM Solutions (Pty) Ltd., South Africa Christian Nissen, CISM, CGEIT, FSM, CFN People, Denmark Jamie Pasfield, ITIL V3, MSP, PRINCE2, Pfizer, UK Eddy J. Schuermans, CGEIT, ESRAS bvba, Belgium Michael Semrau, RWE Germany, Germany Max Shanahan, CISA, CGEIT, FCPA, Max Shanahan & Associates, Australia Alan Simmonds, TOGAF9, TCSA, PreterLex, UK Cathie Skoog, CISM, CGEIT, CRISC, IBM, USA Dejan Slokar, CISA, CGEIT, CISSP, Deloitte & Touche LLP, Canada Roger Southgate, CISA, CISM, UK Nicky Tiesenga, CISA, CISM, CGEIT, CRISC, IBM, USA Wim Van Grembergen, Ph.D., University of Antwerp Management School, Belgium Greet Volders, CGEIT, Voquals N.V., Belgium Christopher Wilken, CISA, CGEIT, PwC, USA Tim M. Wright, CISA, CRISC, CBCI, GSEC, QSA, Kingston Smith Consulting LLP, UK Personal Copy of: Mr. Chen Jia 3

: ENABLING PROCESSES ACKNOWLEDGEMENTS (CONT.) Expert Reviewers Mark Adler, CISA, CISM, CGEIT, CRISC, Commercial Metals Company, USA Wole Akpose, Ph.D., CGEIT, CISSP, Morgan State University, USA Krzysztof Baczkiewicz, CSAM, CSOX, Eracent, Poland Roland Bah, CISA, MTN Cameroon, Cameroon Dave Barnett, CISSP, CSSLP, USA Max Blecher, CGEIT, Virtual Alliance, South Africa Ricardo Bria, CISA, CGEIT, CRISC, Meycor GRC, Argentina Dirk Bruyndonckx, CISA, CISM, CGEIT, CRISC, MCA, KPMG Advisory, Belgium Donna Cardall, UK Debra Chiplin, Investors Group, Canada Sara Cosentino, CA, Great-West Life, Canada Kamal N. Dave, CISA, CISM, CGEIT, Hewlett Packard, USA Philip de Picker, CISA, MCA, National Bank of Belgium, Belgium Abe Deleon, CISA, IBM, USA Stephen Doyle, CISA, CGEIT, Department of Human Services, Australia Heidi L. Erchinger, CISA, CRISC, CISSP, System Security Solutions, Inc., USA Rafael Fabius, CISA, CRISC, Uruguay Urs Fischer, CISA, CRISC, CPA (Swiss), Fischer IT GRC Consulting & Training, Switzerland Bob Frelinger, CISA, CGEIT, Oracle Corporation, USA Yalcin Gerek, CISA, CGEIT, CRISC, ITIL Expert, ITIL V3 Trainer, PRINCE2, ISO/IEC 20000 Consultant, Turkey Edson Gin, CISA, CISM, CFE, CIPP, SSCP, USA James Golden, CISM, CGEIT, CRISC, CISSP, IBM, USA Marcelo Hector Gonzalez, CISA, CRISC, Banco Central Republic Argentina, Argentina Erik Guldentops, University of Antwerp Management School, Belgium Meenu Gupta, CISA, CISM, CBP, CIPP, CISSP, Mittal Technologies, USA Angelica Haverblad, CGEIT, CRISC, ITIL, Verizon Business, Sweden Kim Haverblad, CISM, CRISC, PCI QSA, Verizon Business, Sweden J. Winston Hayden, CISA, CISM, CGEIT, CRISC, South Africa Eduardo Hernandez, ITIL V3, HEME Consultores, Mexico Jorge Hidalgo, CISA, CISM, CGEIT, ATC, Lic. Sistemas, Argentina Michelle Hoben, Media 24, South Africa Linda Horosko, Great-West Life, Canada Mike Hughes, CISA, CGEIT, CRISC, 123 Consultants, UK Grant Irvine, Great-West Life, Canada Monica Jain, CGEIT, CSQA, CSSBB, Southern California Edison, USA John E. Jasinski, CISA, CGEIT, SSBB, ITIL Expert, USA Masatoshi Kajimoto, CISA, CRISC, Japan Joanna Karczewska, CISA, Poland Kamal Khan, CISA, CISSP, CITP, Saudi Aramco, Saudi Arabia Eddy Khoo S. K., Prudential Services Asia, Malaysia Marty King, CISA, CGEIT, CPA, Blue Cross Blue Shield NC, USA Alan S. Koch, ITIL Expert, PMP, ASK Process Inc., USA Gary Langham, CISA, CISM, CGEIT, CISSP, CPFA, Australia Jason D. Lannen, CISA, CISM, TurnKey IT Solutions, LLC, USA Nicole Lanza, CGEIT, IBM, USA Philip Le Grand, PRINCE2, Ideagen Plc, UK Kenny Lee, CISA, CISM, CISSP, Bank of America, USA Brian Lind, CISA, CISM, CRISC, Topdanmark Forsikring A/S, Denmark Bjarne Lonberg, CISSP, ITIL, A.P. Moller - Maersk, Denmark Stuart MacGregor, Real IRM Solutions (Pty) Ltd., South Africa Debra Mallette, CISA, CGEIT, CSSBB, Kaiser Permanente IT, USA Charles Mansour, CISA, Charles Mansour Audit & Risk Service, UK Cindy Marcello, CISA, CPA, FLMI, Great-West Life & Annuity, USA Nancy McCuaig, CISSP, Great-West Life, Canada John A. Mitchell, Ph.D., CISA, CGEIT, CEng, CFE, CITP, FBCS, FCIIA, QiCA, LHS Business Control, UK Makoto Miyazaki, CISA, CPA, Bank of Tokyo-Mitsubishi, UFJ Ltd., Japan 4 Personal Copy of: Mr. Chen Jia

ACKNOWLEDGEMENTS ACKNOWLEDGEMENTS (CONT.) Expert Reviewers (cont.) Lucio Augusto Molina Focazzio, CISA, CISM, CRISC, ITIL, Independent Consultant, Colombia Christian Nissen, CISM, CGEIT, FSM, ITIL Expert, CFN People, Denmark Tony Noblett, CISA, CISM, CGEIT, CISSP, USA Ernest Pages, CISA, CGEIT, MCSE, ITIL, Sciens Consulting LLC, USA Jamie Pasfield, ITIL V3, MSP, PRINCE2, Pfizer, UK Tom Patterson, CISA, CGEIT, CRISC, CPA, IBM, USA Robert Payne, CGEIT, MBL, MCSSA, PrM, Lode Star Strategy Consulting, South Africa Andy Piper, CISA, CISM, CRISC, PRINCE2, ITIL, Barclays Bank Plc, UK Andre Pitkowski, CGEIT, CRISC, OCTAVE, ISO27000LA, ISO31000LA, APIT Consultoria de Informatica Ltd., Brazil Geert Poels, Ghent University, Belgium Dirk Reimers, Hewlett-Packard, Germany Steve Reznik, CISA, ADP, Inc., USA Robert Riley, CISSP, University of Notre Dame, USA Martin Rosenberg, Ph.D., Cloud Governance Ltd., UK Claus Rosenquist, CISA, CISSP, Nets Holding, Denmark Jeffrey Roth, CISA, CGEIT, CISSP, L-3 Communications, USA Cheryl Santor, CISSP, CNA, CNE, Metropolitan Water District, USA Eddy J. Schuermans, CGEIT, ESRAS bvba, Belgium Michael Semrau, RWE Germany, Germany Max Shanahan, CISA, CGEIT, FCPA, Max Shanahan & Associates, Australia Alan Simmonds, TOGAF9, TCSA, PreterLex, UK Dejan Slokar, CISA, CGEIT, CISSP, Deloitte & Touche LLP, Canada Jennifer Smith, CISA, CIA, Salt River Pima Maricopa Indian Community, USA Marcel Sorouni, CISA, CISM, CISSP, ITIL, CCNA, MCDBA, MCSE, Bupa Australia, Australia Roger Southgate, CISA, CISM, UK Mark Stacey, CISA, FCA, BG Group Plc, UK Karen Stafford Gustin, MLIS, London Life Insurance Company, Canada Delton Sylvester, Silver Star IT Governance Consulting, South Africa Katalin Szenes, CISA, CISM, CGEIT, CISSP, University Obuda, Hungary Halina Tabacek, CGEIT, Oracle Americas, USA Nancy Thompson, CISA, CISM, CGEIT, IBM, USA Kazuhiro Uehara, CISA, CGEIT, CIA, Hitachi Consulting Co., Ltd., Japan Johan van Grieken, CISA, CGEIT, CRISC, Deloitte, Belgium Flip van Schalkwyk, Centre for e-Innovation, Western Cape Government, South Africa Jinu Varghese, CISA, CISSP, ITIL, OCA, Ernst & Young, Canada Andre Viviers, MCSE, IT Project+, Media 24, South Africa Greet Volders, CGEIT, Voquals N.V., Belgium David Williams, CISA, Westpac, New Zealand Tim M. Wright, CISA, CRISC, CBCI, GSEC, QSA, Kingston Smith Consulting LLP, UK Amanda Xu, PMP, Southern California Edison, USA Tichaona Zororo, CISA, CISM, CGEIT, Standard Bank, South Africa ISACA Board of Directors Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA, International President Christos K. Dimitriadis, Ph.D., CISA, CISM, CRISC, INTRALOT S.A., Greece, Vice President Gregory T. Grocholski, CISA, The Dow Chemical Co., USA, Vice President Tony Hayes, CGEIT, AFCHSE, CHE, FACS, FCPA, FIIA, Queensland Government, Australia, Vice President Niraj Kapasi, CISA, Kapasi Bangad Tech Consulting Pvt. Ltd., India, Vice President Jeff Spivey, CRISC, CPP, PSP, Security Risk Management, Inc., USA, Vice President Jo Stewart-Rattray, CISA, CISM, CGEIT, CRISC, CSEPS, RSM Bird Cameron, Australia, Vice President Emil D’Angelo, CISA, CISM, Bank of Tokyo-Mitsubishi UFJ Ltd. (retired), USA, Past International President Lynn C. Lawton, CISA, CRISC, FBCS CITP, FCA, FIIA, KPMG Ltd., Russian Federation, Past International President Allan Neville Boardman, CISA, CISM, CGEIT, CRISC, CA (SA), CISSP, Morgan Stanley, UK, Director Marc Vael, Ph.D., CISA, CISM, CGEIT, CISSP, Valuendo, Belgium, Director Personal Copy of: Mr. Chen Jia 5

: ENABLING PROCESSES ACKNOWLEDGEMENTS (CONT.) Knowledge Board Marc Vael, Ph.D., CISA, CISM, CGEIT, CISSP, Valuendo, Belgium, Chairman Michael A. Berardi Jr., CISA, CGEIT, Bank of America, USA John Ho Chi, CISA, CISM, CRISC, CBCP, CFE, Ernst & Young LLP, Singapore Phillip J. Lageschulte, CGEIT, CPA, KPMG LLP, USA Jon Singleton, CISA, FCA, Auditor General of Manitoba (retired), Canada Patrick Stachtchenko, CISA, CGEIT, Stachtchenko & Associates SAS, France Framework Committee (2009-2012) Patrick Stachtchenko, CISA, CGEIT, Stachtchenko & Associates SAS, France, Chairman Georges Ataya, CISA, CISM, CGEIT, CRISC, CISSP, Solvay Brussels School of Economics and Management, Belgium, Past Vice President Steven A. Babb, CGEIT, CRISC, Betfair, UK Sushil Chatterji, CGEIT, Edutech Enterprises, Singapore Sergio Fleginsky, CISA, Akzo Nobel, Uruguay John W. Lainhart, IV, CISA, CISM, CGEIT, CRISC, IBM Global Business Services, USA Mario C. Micallef, CGEIT, CPAA, FIA, Malta Anthony P. Noble, CISA, CCP, Viacom, USA Derek J. Oliver, Ph.D., CISA, CISM, CRISC, CITP, DBA, FBCS, FISM, Ravenswood Consultants Ltd., UK Robert G. Parker, CISA, CA, CMC, FCA, Deloitte & Touche LLP (retired), Canada Rolf M. von Roessing, CISA, CISM, CGEIT, CISSP, FBCI, Forfa, AG, Germany Jo Stewart-Rattray, CISA, CISM, CGEIT, CRISC, CSEPS, RSM Bird Cameron, Australia Robert E. Stroud, CGEIT, CA Inc., USA ISACA and IT Governance Institute® (ITGI®) Affiliates and Sponsors American Institute of Certified Public Accountants Commonwealth Association for Corporate Governance Inc. FIDA Inform Information Security Forum Institute of Management Accountants Inc. ISACA chapters ITGI France ITGI Japan Norwich University Solvay Brussels School of Economics and Management Strategic Technology Management Institute (STMI) of the National University of Singapore University of Antwerp Management School Enterprise GRC Solutions Inc. Hewlett-Packard IBM Symantec Corp. 6 Personal Copy of: Mr. Chen Jia

TABLE OF CONTENTS TABLE OF CONTENTS List of Figures .......................................................................................................................................................................... 9 Chapter 1. Introduction ............................................................................................................................................................... 11 Chapter 2. The Goals Cascade and Metrics for Enterprise Goals and IT-related Goals ................................................ 13 COBIT 5 Goals Cascade ............................................................................................................................................................ 13 Step 1. Stakeholder Drivers Inﬂuence Stakeholder Needs .............................................................................................13 Step 2. Stakeholder Needs Cascade to Enterprise Goals ...............................................................................................13 Step 3. Enterprise Goals Cascade to IT-related Goals ...................................................................................................15 Step 4. IT-related Goals Cascade to Enabler Goals........................................................................................................15 Using the COBIT 5 Goals Cascade ........................................................................................................................................... 15 Beneﬁts of the COBIT 5 Goals Cascade ........................................................................................................................15 Using the COBIT 5 Goals Cascade Carefully ...............................................................................................................16 Using the COBIT 5 Goals Cascade in Practice .............................................................................................................16 Metrics .......................................................................................................................................................................................... 16 Enterprise Goal Metrics .................................................................................................................................................16 IT-related Goal Metrics ..................................................................................................................................................17 Chapter 3. The COBIT 5 Process Model .................................................................................................................................. 19 Enabler Performance Management .......................................................................................................................................... 21 Chapter 4. The COBIT 5 Process Reference Model ............................................................................................................... 23 Governance and Management Processes .................................................................................................................................. 23 Model ............................................................................................................................................................................................ 23 Chapter 5. COBIT 5 Process Reference Guide Contents ...................................................................................................... 25 Inputs and Outputs ...................................................................................................................................................................... 25 Generic Guidance for Processes ................................................................................................................................................ 27 Evaluate, Direct and Monitor (EDM) ................................................................................................................................29 Align, Plan and Organise (APO) ........................................................................................................................................49 Build, Acquire and Implement (BAI) ...............................................................................................................................117 Deliver, Service and Support (DSS) .................................................................................................................................171 Monitor, Evaluate and Assess (MEA) ..............................................................................................................................201 Appendix A. Mapping Between COBIT 5 and Legacy ISACA Frameworks ................................................................... 217 Appendix B. Detailed Mapping Enterprise Goals—IT-related Goals ............................................................................... 225 Appendix C. Detailed Mapping IT-related Goals—IT-related Processes ......................................................................... 227 Personal Copy of: Mr. Chen Jia 7

: ENABLING PROCESSES Page intentionally left blank 8 Personal Copy of: Mr. Chen Jia

分享到：

赞收藏

资料库

COBIT 5的启动流程.pdf

相关推荐

考试认证

热门标签

最新资料