COBIT - ITIL mapping for Business Process Continuity Management

Headnote

Abstract. Business Continuity Management (BCM) covers risk analysis and management so that the organization can ensure a provision of service at all times. BCM aims to reduce risks and develops plans for restoring business activities if they are interrupted by a disaster.CobIT and ITIL are two specific IT best practices and standards that are becoming widely adopted around the world to better manage the quality and reliability of IT in business. CobiT can be used at the highest level of IT governance, providing an overall control framework based on an IT process model. There is also a need for detailed, standardised practitioner processes. Specific practices and standards, such as ITIL, cover specific areas and can be mapped to the CobiT framework.The purpose of the paper is to analyze and describe these standards, especially their mapping for improved performance, value transparency and increased control over BCM activities. So, ITIL processes may be used to achieve and demonstrate compliance with CobiT control objectives for BCM process.

Keywords. Business Continuity Management (BCM), IT Service Continuity Management (ITSCM), CobIT, ITIL, Mapping Best Practices.

1 Introduction

Business Continuity Management (BCM) covers risk analysis and management so that the organization can ensure a provision of service at all times. BCM aims to reduce risks and develops plans for restoring business activities if they are interrupted by a disaster. IT Service Continuity Management (ITSCM) is part of the overall BCM process and depends on the information provided by the BCM process. Successful implementation of ITSCM requires the understanding and support of the whole organization, especially the essential support of senior business managers and directors.

Every enterprise needs to tailor the use of standards and practices to suit its individual requirements. Users need more guidance on how to integrate the leading global frameworks and other practices and standards. In response to this question, this paper analyses and describes the mapping of CobiT and ITIL for successful implementation, improved performance and increased control over BCM/ITSCM process and their activities. So, ITIL processes may be used to achieve and demonstrate compliance with CobiT control objectives for BCM process.

CobiT does not include process steps and tasks because, although it is oriented towards IT processes, it is a control and management framework rather than a process framework. CobiT focuses on what an enterprise needs to do, not how it needs to do it. ITIL is based on defining best practice processes for IT service management and support, rather than on defining a control framework. It focuses on how an enterprise needs to do for service management aspects [7].

2 ITSCM process model

The objective of ITSCM is to support the overall Business Continuity Management (BCM) by ensuring that necessary IT infrastructure and IT service can be restored after a disaster (incident) within optimal time limits and costs. A disaster is much more serious than an incident. It is a business interruption and it can include fire, burglary, water damage, vandalism and violence, hardware failure, Internet, terrorist attacks, etc. Today, the businesses are increasingly dependent on IT services and it is very important to analyze how to realize business continuity.

Businesses with an ITSCM process have the following benefits[4]:

a) they can manage the recovery of their systems;

b) they lose less service avalilability time and offer better continuity to the users;

c) they minimize the interruption to their business activities.

ITSCM process model (based on BCM) model and its main stages (activities) is shown on Fig.1.

ITSCM/BCM activities will be decribed in chapter related to CobIT and ITIL mapping the BCM process. ITSCM process has several important objectives through presented stages.

* assessing the risk and impact of the interruption of IT services following disaster;

* identifying services critical to the business that require additional prevention measures;

* developing, testing and maintaining a recovery plans;

* defining the approach to be used to restore the IT services;

* defining periods within which services have to restored;

* taking measures to prevent, detect, prepare for the effects of disasters or to reduce their impact.

3 CobIT

CobiT (Control Objectives for Information and related Technology), published by ITGI, is a globally accepted framework for IT governance. IT governance addresses these main areas of IT activity as follows[2]:

* Strategic alignment, with a focus on aligning IT with the business solutions;

* Value delivery, concentrating on optimising costs and proving the value of IT;

* Risk management, addressing the safeguarding of IT assets (including project investments), disaster recovery and continuity of operations;

* Resource management, optimising knowledge and IT infrastructure;

* Performance measurement, tracking project delivery and monitoring IT services.

CobiT enables business executives to better understand how to direct and manage the enterprise's use of IT and the standard of good practice to be expected from IT providers. CobiT provides the tools to direct and control IT-related activities [1].

The CobIT framework includes the folowing components:

* Framework - explains how CobiT organises IT governance management and control objectives and good practices by IT domains and processes, and links them to business requirements; IT processes are grouped into four domains: Plan and Organise, Acquire and Implement, Deliver and Support, and Monitor and Evaluate.

* Process descriptions for each of 34 IT processes;

* Control objectives-provide generic best practice management objectives for IT processes;

* Management guidelines-offer tools to help assign responsibility and measure performance

* Maturity models-assess the maturity level for each of 34 IT processes as well as the whole IT organization. This assessment is the basis of benchmarking in relation to other IT organizations, aimed at improving the IT organization in question.

The enterprise requires IT management framework as its main support in order to achieve the IT business value. Fig. 2 shows the management of IT organization using the CobIT method. Fig.3 shows the CobIT framework [3].

4 ITIL

Except CobiT there is another useful and supportive mechanism for planning and management of IT processes, as well as the BCM process.

ITIL (Information Technology Infrastructure Library) standard, published by the UK government, ensures a consistent best practice concept for setting up the IT service management processes built into the IT organization. Some of ITIL benefits for customer/user are:

* The IT services are described better in more detail;

* The quality, availability, reliability and cost of the services are managed better;

* The provision of IT services becomes more customer-focused.

Some of ITIL benefits for IT organization are:

* The IT organization develops a clearer structure, more focused to the corporate objectives;

* The IT organization has better control of the IT infrastructure and services;

* The ITIL best practices support the introduction of quality management system (example ISO 9000; Six Sigma; etc);

* ITIL provides the quality internal communication and communication with suppliers.

Potential problems with using ITIL are:

* The implementation can take a log time and require significant effort and costs;

* A successful implementation requires the involvement of personnel at all levels in the organization;

* Improvement in the provision of services and cost reductions are insufficiently visible;

* Insufficient investment in adequate education and support tools.

IT service management is concerned with planning, sourcing, designing, implementing, operating, supporting and improving IT services that are appropriate to business needs. IT Service Management provides the strategic alignment between the business company and IT organization (function), shown on Fig.4 [5].

In new context of ITIL (ITIL V3), the key processes have been updated, but more significantly. ITIL now describes IT service management functions, activities and organisational structure; strategic and sourcing concerns; and integration with the business. In ITIL V3, the most significant development has been the move from a process-based framework to a more comprehensive structure reflecting the life cycle of IT services. The processes and functions within the life cycle of IT services are shown on Fig.5 [6].

5 CobIT - ITIL mapping for BCM

IT best practices need to be aligned to business requirements and integrated with one another and with internal procedures. According to Gartner many of the CobiT processes , especially those in the Delivery and Support (DS) domain, map well onto one or more ITIL processes [8]. CobiT can be used at the highest level, providing an overall control framework based on an IT process model that should suit every organisation generically. Specific practices and standards such as ITIL cover particular areas and can be mapped to the CobiT framework. In the paper, this mapping is analyzed within the BCM/ITSCM process.

As mentioned, ITSCM process (based on BCM) is very important process for the company and its planning and management require significant efforts and resources. The purpose of the paper is to analyze and describe CobIT and ITIL mapping for improved performance, value transparency and increased control over BCM activities.ITIL processes may be used to achieve and demonstrate compliance with CobiT control objectives for BCM process.

To better understand mapping amongst ITIL and CobIT over the BCM process, each of the 10 CobiT control objectives for DS4 (Ensure Continuous Service) and relevant key areas within control objectives, has been mapped to specific ITIL activities/processes. Focus was on ITIL ITSCM process and its 4 stages of activities (shown on Fig.1), as well as other relevant ITIL processes (availability management; capacity management, change management, etc.). This mapping is shown on Fig.6.

The need for providing continuous IT services requires developing, maintaining and testing IT continuity plans, utilising offsite backup storage and providing periodic continuity plan training. An effective continuous service process minimises the probability and impact of a major IT service interruption on key business functions and processes.

Organisations wishing to adopt IT best practices need an effective management framework that provides an overall consistent approach and is likely to ensure successful business outcomes when using IT to support the enterprise's strategy.

Implementation of best practices is very complex process and requires the detailed planning process. Additional, it should be consistent with the enterprise's risk management and control framework, appropriate for the enterprise, and integrated with other methods and practices that are being used.

6 Conclusion

As business are increasingly dependent on IT services, the objective of IT Service Continuity Management (ITSCM) is to support the overall Business Continuity Management (BCM) by ensuring that required IT infrastrucure (IT services) can be restored within optimal costs and time after a disaster. The risk analysis is very important within this process because once the risk to the business (not just the risk to the IT services), has been identified, investments can be made measures for prevention and recovery plans.

The planning and management of ITSCM/BCM process requires many efforts and support of the whole organization, especially directors and senior business managers. The implementation of this process can include different problems related to resources, commitment, access to recovery facilities, difficult estimating the damage, budgeting, no business manager commitment, delay, IT department that must be guided by the business requirements, lack of BCM awareness.

The paper focuses on two specific practices and standards that are becoming widely adopted around the world:

a) ITIL V3-published by the UK government to provide a best practice framework for IT service management and

b) CobiT 4.1-published by ITGI and positioned as a high-level governance and control framework.

CobiT define what should be done and ITIL providing the how for service management aspects. These practices and standard can be mapped for improved performance, value transparency and increased control over ITSCM/BCM activities and for diminishing above described problems.This was the purpose of the paper.

In general, the use of IT has the potential to enterprise success, provides opportunities to obtain a competitive advantage and offers a means for increasing productivity. Best practices and standards help enable effective governance of IT activities as well as the adequate benchmarking of the whole IT performance and use in the company.

References

References

[1] Haes,D.S.,Grembergen,V.W.: IT Governance Structures, Processes and Relational Mechanisms: Achieving IT/Business Alignment in a Major Belgian Financial Group, Proceedings of the 38th Hawaii International Confernce on System Science,2005.

[2] Haes, S.D. & Grembergen, W.V. (2004). IT Governance ad Its Mechanisms, Information Systems Control Journal, Vol.1, 2004, pp.27-33, ISACA, ISSN: 1526-7407.

[3] ITGI IT Governance Institute, CobiT 4.1, USA, 2007.

[4] OGC Office of Government Commerce, Introduction to ITIL, U.K., 2005.

[5] OGC Office of Government Commerce, Planning to Implement Service Management, U.K., 2002.

[6] OGC Office of Government Commerce, The Official Introduction to the ITIL V3 Service Lifecycle, U.K., 2007.

[7] Salle, M.:IT Service Management and IT Governance: Review, Comparative Analysis and their Impact on Utility Computing, available at: http://www.hpl.hp.com/techreports/ 2004/HPL-2004-98.pdf,Accessed:10th May2009

[8] Combine CobiT and ITIL for Powerful IT Governance, Gartner, Tactical Guidelines, TG- 16-1849, Research Note 10 June 2002.

[9] CobiT Mapping - Overview of International IT Guidance, IT Governance Institute, available at: http://www.itgi.org,Accessed: 25th May 2009.

[10] CobiT Mapping: Mapping of ITIL V3 With CobiT 4.1, available at: http://www.isaca.org, Accessed: 30th May, 2009.