1. MIS 5202 Welcome to IT Governance

2. A look at the semester schedule Dive into the Stars Ambulance case
MIS 5202 IT Governance
Welcome to the course
A look at the syllabus
A look at the semester schedule
Dive into the Stars Ambulance case
Review the definition of IT Governance
Review COBIT 5

3. Weekly Rhythm for Online Class
Weekday
Responsibilities
Wednesday
Discussion posts on the coming week’s topic & case analysis will be posted at 6:00 am
Thursday
Reading and case posts welcome
Friday
Saturday
Quiz for last Tuesday’s topic posted on 6:00 am
Sunday
Quiz for last weeks topic closes on 11:59 pm
Monday
Tuesday
Reading and case posts are welcome before 11:59 pm
Webex’s held on 8/30, 9/6, 9/27,10/11, 11/1, 11/29 & 12/6

5. What is IT Governance?

6. Top Down Governance Layers
Corporate IT
Security

7. IT Security exists where Governance, Risk and Compliance overlap

8. Corporate Governance Top-down management Overall strategic direction
Alignment with business strategy
Asset Value
Culture
Risk tolerance
Legal obligations
Market conditions

9. IT Governance

10. AIM: To establish a stable security governance ….
Develop information security strategy
Management commitment
Roles and responsibilities
Reporting
Identify legal issues and access impact
Establish and maintain security policies
Develop procedures and guidelines
Develop a business case

11. How do you “see” Governance?
Strategic
Board Level
CIO
CISO
Operations
System Admins
Subject Matter Experts
Holistic vs targeted

13. What is the concept of governance?
Governance has been defined to refer to structures and processes that are designed to ensure accountability, transparency, responsiveness, rule of law, stability, equity and inclusiveness, empowerment, and broad-based participation.

14. What does governance framework mean?
Governance frameworks structure and delineate power and the governing or management roles in an organization.
They also set rules, procedures, and other informational guidelines.
In addition, governance frameworks define, guide, and provide for enforcement of these processes.

15. Right Things, Done Right
Good IT Governance =
Right Things, Done Right

16. Its about doing the right thing…
What is IT Governance?
Its about doing the right thing…
Who gets to decide?
Are we working on things that will produce the most value to the organization?
Are we protecting the organization?
and then, doing them right.
Do we conform to all laws and regulations?
Do we use our resources well?
Are we meeting our service objectives?

19. The Star Air Ambulance Case
Case study

20. The Star Air Ambulance Case
Read the case
As groups discuss the answers to these questions:
Identify three or four of the most critical challenges facing the new CIO?
What is the overall issue facing the new CIO?
What questions would you, as CIO, want senior management to answer?
Case Notes: Stars Air Ambulance
ASK CLASS TO CONSIDER THESE QUESTIONS
Identify three or four of the most critical challenges facing the new CIO?
Staffing: People’s jobs were not well defined and expensive consultants were not properly utilized.
Project planning was not done.
Solution: Establish clear job responsibilities and use consultants in a purposeful way. Evaluating whether “consultants” should be used in staffing roles.
Support: Too many projects were considered critical (24).
The “fight fires” mindset resulted in little forethought or planning.
And therefore they were unlikely to ever break new ground and improve efficiency or effectiveness.
Solution: Establish a PMO to prioritize and implement projects.
Distributed activities: Other departments ran their own IT operations.
Central IT didn’t not participate, although they used the company’s infrastructure.
Different development methodologies, but an expectation of support from IT group.
Much of the technology was outdated and expensive security breaches occurred.
Solution: Leverage the PMO. Use the departments for idea generation and include them on projects, but IT should manage development and implementation.
What is the overall problem?
Overall issue – there seems to be no sense of the entire organization.
Everyone operates in a vacuum.
There is no IT Governance
Changes may have unintended consequences (good or bad) that we’d never realize because things are siloed and everyone is in defensive mode.
How would you proceed as the new CIO?
Establish a governance structure with the CEO
Identify who gets to make what decisions
Establish a way to request new work
Encourage functional areas to generate ideas and be involved in projects
Insist that the IT group run all IT projects.
The IT group should help the business look at the whole, not the parts
The IT group must understand the business’ processes
Get control of the operational aspects of the IT function.
Understand and manage (or at least influence) all IT costs.
Establish defined roles and responsibilities.
Understand the staff, get rid of any who can’t perform.
Investigate consultants, and probably fire many of them.
Review all projects and kill all but 4 or 5.
Establish a standard approach to project execution.
Should balance innovative thinking with a standard framework for implementation.
This is a way to control costs, increase stability, while still not stifling good ideas.

21. COBIT 5 Framework

22. Builds on more than 15 years of practical usage
COBIT 5 provides the next generation of ISACA’s guidance on the enterprise governance and management of IT.
Builds on more than 15 years of practical usage
Evolved from an auditing framework to controls
Now to a governance for enterprise IT (GEIT) framework, showing a management strategy for enterprise IT.
Reference document with 27 processes
You will not remember all of them and use COBIT 5 as a reference

23. Theme: Where are we?
Where do we need to be?
Are we making progress?

24. Business Framework for Governance of Enterprise IT

25. What is COBIT 5? Its about best practice framework
It tries to cover IT end-to-end
What you need to be thinking about when running (or auditing) IT
Its not about the technology,
its about the processes used to deliver technology
Its about how to decide what you do
(Right Things)
then how to do them in an efficient, effective and secure manner
(Done Right)
It is critical that you understand the processes it recommends

26. “Enablers” Anything that can help achieve the objectives
Reference document with 27 processes
You will not remember all of them and use COBIT 5 as a reference
We will choose only a few to do a deeper dive into during this class. Will show up in later courses

27. Based on 5 Principles Generic in language
Applicable to organizations of all sizes

28. COBIT 5
Governance Board is Accountable, CEO, CFO, Business Executives, CIO are responsible Add CRiskOfficer if there is one
Management: CEO is accountable, CIO and IT leadership team is responsible, sometime include CFO, Business Exec’s etc
Source:  COBIT® 5, figure 2. © 2012 ISACA® All rights reserved.

29. Cascade for Enterprise Stakeholders needs into actionable goals

32. Two Security Specific COBIT topics
Align, Plan, Organize APO13: Manage Security
Define, operate and monitor systems for IT Management
Five goals
Support IT & Business
Support Management of IT and enterprise risk
Transparency of IT costs and benefits
Ensure security of information infrastructure
Reliable information for decision making

33. DSS05: Operational Processes
Protect Enterprise Information
Maintain acceptable level of risk
Establish and maintain roles and access
Security monitoring

34. 7 Control Objectives Protect against malware
Manage network connectivity and security
Manage endpoint security
Manage user ID and access
Control physical access to IT
Manage sensitive documents
Monitor infrastructure for security events