Comparison Between Cobit, ITIL and ISO27001
Association
(ISACA) published “IT Control Objectives for Cloud Computing” to facilitate the
understanding of cloud computing and the associated risks. ISACA is the
organization behind Cobit. Control Objectives for Information and Related
Technology (Cobit) is an IT governance control framework that helps
organizations address the areas of regulatory compliance, risk management and
aligning IT strategy with organizational goals.
1.Cobit History
COBIT is a
globally accepted framework for IT governance based on industry standards and
best practices. Once implemented, executives can ensure IT is aligned
effectively with business goals and better direct the use of IT for business
advantage. COBITprovides a common language for business executives to
communicate goals, objectives and results with audit, IT and other
professionals.
COBIT provides
best practices and tools for monitoring and managing IT activities. The use of
IT is a significant investment that needs to be managed. COBIT helps
executives understand and manage IT investments throughout their life cycle and
provides a method to assess whether IT services and new initiatives are meeting
business requirements and are likely to deliver the benefits expected.
The difference
between enterprises that manage IT well and those that do not, or cannot, is
tremendous. COBIT enables clear policy development and good practice for
IT management. The framework helps increase the value attained from IT. It also
helps organisations manage IT-related risk and ensure compliance, continuity,
security and privacy.
Because COBIT is
a set of proven and internationally accepted tools and techniques,
implementation of COBIT is a sign of a well-run organisation. It helps IT
professionals and enterprise users demonstrate professional competence to
senior management. As with many generic business processes, there are specific
IT industry standards and good practices that enterprises should follow when
using IT. COBIT captures these and provides a framework for implementing
and managing them.
2.Cobit and IT
ITIL is stand for Information Technology Library. ITIL issued by OGC,
is a set of framework for managing IT Service Level. Although ITIL is quite
similar with COBIT in many ways, but the basic difference is Cobit set the
standard by seeing the process based and risk, and in the other hand ITIL set
the standard from basic IT service.
3.ITIL History
ITIL developed at
the end of the 1980’s – when the level of IT service provided to the British
Government was deemed insufficient. The Office of Government Commerce (OGC) -
which was then called The Central Computer and Telecommunications Agency
(CCTA), had the task of developing an efficient IT framework with the use of IT
resources within the British Governments private sector.
In 1990 government
agencies and large companies in Europe quickly adopted the framework. ITIL was
used in government and non-government organisations and was spreading very
quickly. IT evolved and likewise ITIL did - it grew in popularity in the UK,
USA and across the world.
It was in 2000 that
CCTA merged into OGC. In that same year Microsoft also developed their
Microsoft Operations Framework (MOF) using ITIL.
Version 2 of ITIL
was released in 2001. The Service Delivery books and Service Support were
rethought and redeveloped into more usable concise volumes. It became, by far,
the most widely used IT service management system with the best practice
approach.
Version 3 of ITIL
was published in 2007. It adopted more of a lifecycle approach to service
management and had greater emphasis on the IT business integration.
ITIL was updated in 2011. No entirely new
concepts were added.
ITIL 2007 has five volumes, published in May 2007,
and updated in July 2011 as ITIL 2011 for consistency:
ITIL Service Strategy: understands
organizational objectives and customer needs.
ITIL Service Design: turns the service
strategy into a plan for delivering the business objectives.
ITIL Service Transition: develops and
improves capabilities for introducing new services into supported environments.
ITIL Service Operation: manages services in
supported environments.
ITIL Continual Service Improvement: achieves
services incremental and large-scale improvements.
4.ITIL continual
process improvement
ISO 27001 is a
specification for an information security management system (ISMS). An ISMS is
a framework of policies and procedures that includes all legal, physical and
technical controls involved in an organisation's information risk management
processes.
According to its
documentation, ISO 27001 was developed to "provide a model for
establishing, implementing, operating, monitoring, reviewing, maintaining and
improving an information security management system."
ISO 27001 uses a topdown, risk-based approach and is
technology-neutral. The specification defines a six-part planning process:
1. Define a security policy.
2. Define the scope of the ISMS.
3. Conduct a risk assessment.
4. Manage identified risks.
5. Select control objectives and controls to be
implemented.
6. Prepare a
statement of applicability.
The specification
includes details for documentation, management responsibility, internal audits,
continual improvement, and corrective and preventive action. The standard
requires cooperation among all sections of an organisation.
The 27001 standard
does not mandate specific information security controls, but it provides a
checklist of controls that should be considered in the accompanying code of
practice, ISO/IEC 27002:2005. This second standard describes a comprehensive
set of information security control objectives and a set of generally accepted
good practice security controls.
ISO 27002 contains 12 main sections:
1. Risk assessment
2. Security policy
3. Organization of information security
4. Asset management
5. Human resources security
6. Physical and environmental security
7. Communications and operations management
8. Access control
9. Information systems acquisition, development and
maintenance
10. Information security incident management
11. Business continuity management
12. Compliance
5. ISO 27002
Analysis in Relation between ITIL, COBIT
Firstly check out relation
between ITIL and COBIT, TOGAF and ITIL then we will do a general analysis
between ITIL, COBIT, CMMI and TOGAF.
IT organizations are facing
the challenging, but necessary, transition to manage IT based on business
priorities. They are looking to frameworks, such as ITIL and COBIT, to help
them meet the challenge, but there is some confusion about how best to use
them. ITIL and COBIT are complementary and can be used together to facilitate
the transition to Business Service Management. ITIL provides a framework for
best practice processes in ITSM that help IT manage resources from a business
perspective. COBIT provides the framework for setting business goals and
objectives, and measuring the progress of “ITIL-izing” the organization to
meet those goals and objectives.
6.Cobit Itil and IT
ITIL, CMMI, TOGAF and COBIT
have profound influence and reach in the IT industry globally, serving as
defining frameworks for wide sections of IT practice. The frameworks are often
utilized as stringent criteria for awarding contracts and assessing maturity,
risk, and performance. Training ecosystems have arisen, and books, conferences,
and research revolve around them. All essentially serve to define and stabilize
much IT terminology and direct it towards a common description of IT practice.
7.Main Framework
Interactions
ITIL, COBIT also contain an
inestimable amount of valuable and hard won industry insight. Any of them could
be re-engineered to be more consistent with BPM(Business Process Management)
approaches, while retaining their previous value. Doing so would make them both
simpler and more powerful, as well as easier to implement. This in turn could
lead to improved IT performance and success for its practitioners and partners.
8. Schema Of Relationship
9.Comparison
How to Choose The Right Vendor?
Many vendor said that he could help
your company to implement these standard effectively, in fact there is no one
solution for all. Usually the COBIT vendor come from Publci Accounting Firm who
has an IT Audit arm, eg PWC, DTT, KPMG, EY. This type of vendor is best choice for
COBIT since they also work for COBIT implementation derivative such as COBIT
for Sarbanes Oxley.
The other standard ITIL and ISO27001
usually come from General IT Consulting Company, eg. IBM, Accenture. And for
ISO27001 most of IT networking company also could offer this standard
consultation.
REFERENCES
A
Short History of ITIL , http://itsm.fwtk.org/History.htm , 01.03.2016
COBIT,
ITIL and ISO 27001,
http://www.cluteinstitute.com/ojs/index.php/IBER/article/viewFile/7972/8026
,01.03.2016
CobiT Nedir ?,
http://www.cozumpark.com/blogs/cobititil/archive/2010/11/21/cobit-nedir.aspx ,
01.03.2016
A Comparison
of COBIT, ITIL, ISO 27002 and NIST , http://agnosticationater.blogspot.com.tr/2013/12/a-comparison-of-cobit-itil-iso-27002.html
Comparison between COBIT, ITIL and ISO 27001 http://www.docfoc.om/comparison-between-cobit-itil-and-iso-27001
