ZenGRC

Simply Powerful GRC

COBIT

COBIT vs ITIL

· ·

COBIT versus ITIL

Many organizations are looking at the COBIT and ITIL as different IT Framework services and trying to decide which one is best for them. This FAQ briefly discusses the differences between the two and how they can be used either separately or together.

COBIT

COBIT is an IT Governance Framework that is typically used from the top down, or from business goals down to the IT environment. It is more concerned about making sure things are working for the company from a management and shareholder’s perspective. In fact, its first priority is Meeting Shareholder Needs, followed by Covering the Enterprise End-to-End, Applying a Single Integrated Framework, Enabling a Holistic Approach, and Separating Governance from Management.  It works to build, improve, and monitor its implementation and tries to work towards reducing costs and establishing privacy standards.  The end results are going to be that an IT department is working properly and there is accountability back up to the management and governance groups.   

ITIL

ITIL is an IT Framework that builds itself from the bottom up and is concerned about the lifecycle of its IT services.  Its first concerns are with making sure the IT services are in place to run the company, but its priorities are not necessarily making the shareholder’s happy. It’s more about efficiency and effectiveness on the ground level. All its priorities are service based.  Service Strategy, Service Design, Service Transition, Service Operation, Continuous Service Transition. As you can tell from the priorities, it wants to make sure that everything is running, which in the end should make the shareholders happy, but that is not one of its goals.   

COBIT Versus ITIL

You could say that COBIT is more concerned with the WHAT of an organization and how it runs, where ITIL is more concerned with the HOW. Since COBIT is focused on things from a business goal perspective, it makes the rules and helps to govern what kinds of processes should be in place to achieve those goals. And since ITIL is mostly concerned about making IT work, it receives directives from management but then uses its own tools to implement the processes and services.

COBIT AND ITIL?

There are many organizations that use both frameworks in their businesses, however these are typically larger environments or more mature ones. The two work very well together and in some cases, there is overlap.  Change Management is one of those places where both frameworks have solutions, but they can still work together. Allowing COBIT to do the top down approach and ITIL to do the bottom up approach, the two end-up complementing each other.  

If you are a newer or perhaps a smaller company looking for an IT Management Framework, it might be a simpler solution to start with ITIL and then as your company grows, move up to COBIT, using ITIL to handle the IT services and COBIT to handle the IT Governance from the top down.

Guide to COBIT Best Practices

· ·

Established by the Information Systems and Audit Control Association (ISACA), the Control Objectives for Information and Related Technologies (COBIT) framework provides a framework for organizing enterprise IT management. Aligning your security-first information security compliance initiatives to COBIT best practices enables organizations to maintain a continuous risk management program.

COBIT Best Practices

Who is ISACA?

Initially founded in 1969, ISACA creates globally recognized IT certifications and develops auditing control guidances. Boasting its COBIT 5 as the only business framework for IT, ISACA formed an IT Governance Institute (ITGI) that focuses on researching and publishing resources that provide updated guidance and benchmarks for maintaining up-to-date information security controls.

What is COBIT 5?

COBIT 5 provides an IT framework which incorporates ISACA’s proprietary Val IT, Risk IT,  and Information Technology Infrastructure Library (ITIL) with relevant standards produced by the International Organization for Standardization (ISO).
By combining these elements, COBIT 5 offers an overarching cybersecurity program for enterprise IT governance.

Who uses COBIT 5?

COBIT 5 provides any organization a way to evaluate and defend data as part of its business processes. With a goal of enabling commercial, non-profit, and public sector companies, COBIT focuses on providing guidance for providing quality, reliability, and control of information and related technology.

ISACA notes on its COBIT 5 resource page that key users include audit and assurance, compliance, IT operations, governance, and security and risk management executives and consultants.

Why should I choose COBIT 5?

COBIT 5 allows you to align many of your current controls with a variety of other standards and regulatory compliance requirements. For example, organizations that need to comply with the COSO Framework can use COBIT 5 as a way to define and measure IT control effectiveness.

Moreover, COBIT 5 defines five maturity models that help you determine where you are on the road to complete compliance.

  • Level 0: Non-existent

No current process in place

  • Level 1: Initial/Ad Hoc

 No standardized process in place

  • Level 2: Repeatable but Intuitive

Procedures exist but require highly knowledgable individuals and little standardization exists.

  • Level 3: Defined Process

Standardized procedures exist but remain unsophisticated.

  • Level 4: Managed and Measurable

Standardized procedures include key performance indicators and error detection methods

  • Level 5: Optimized

Refined, standardized processes exist and maintain strong practice levels that reduce variances

By measuring your cybersecurity protections against the COBIT 5 maturity models, you can review the work you’ve done and compare it to the work that you need to do.

How to use the COBIT framework five principles to creating best practices

ISACA based COBIT 5 on five fundamental principles. These five guiding principles underlie COBIT 5’s approach to information management and governance. By aligning your IT processes and internal controls based on these high-level principles, you can establish an enterprise approach consistent with your business objectives.

Principle 1: Meet Stakeholder Needs

ISACA recognizes that your enterprise has a variety of stakeholder with different, and sometimes conflicting, needs. For example, your marketing department needs to use social media to build your brand voice. However, social media third party applications provide and often ignored data threat that your IT department needs to mitigate.

Best Practices:

  • Define relevant and tangible goals
  • Define levels of responsibility
  • Identify and communicate enablers’ importance

Principle 2: Cover the Enterprise End-to-End

Information governance and management needs to a part of enterprise IT governance but also needs to include all other information and related technology. All members of your organization need to be aware of the information assets that enable their business objectives.

Best Practices:

  • Define governance enablers
  • Define governance scope
  • Assign roles and activities to the relationships

Principle 3: Apply a Single Integrated Framework

COBIT 5 aligns to a variety of frameworks – risk management and IT related – to enable a unified approach to data management. From the enterprise management perspective, it draws from COSO, COSO ERM, ISO/IEC 9000, and ISO/IEC 31000. As related specifically to IT, COBIT 5 focuses on bringing together ISO/IEC 38500, ITIL, ISO/IEC 27000 series, TOGAF, PMBOK/PRINCE2, and CMMI.

Best Practices:

  • Review the standards related to your organization
  • Engage in the appropriate risk identification
  • Ensure COBIT 5 aligns to overarching enterprise goals

Principle 4: Enable a Holistic Approach

As part of creating a holistic approach to information governance, COBIT focuses on aggregating the factors that individually and collectively influence meeting objectives. Principles, policies, and frameworks tie together the processes, organizational structures, and corporate ethical culture to information, services/infrastructures/applications, and people/skills/competencies.

Best Practices:

  • Outline practices and activities that achieve objectives
  • Define key decision-making entities
  • Define the behaviors, of individuals and the organization, that are most important
  • Establish the policies derived from principles and frameworks to guide day-to-day practices
  • Review all information used by the organization to enable business operations or are part of services provided
  • Incorporate infrastructure, technology, and application that enable business operations and processes
  • Define roles based on individuals’ skills and competencies to complete activities, make decision, and take corrective actions.

Principle 5: Separate Governance from Management

Governance involves evaluating, directing, and monitoring the information management program. Management involves planning, building, running, and monitoring the daily activities.  The Board of Directors is responsible for governance while executive management, led by the CEO, is responsible for management. Although the COBIT framework incorporates five domains and 37 processes, the high level overview provides an outline of steps organizations can take to separate governance and management.

Best Practices for Governance:

  • Create enterprise guiding principles
  • Establish decision model
  • Create authority levels
  • Review enterprise governance communications
  • Receive feedback on governance effectiveness and performance

Best Practices for Management

  • Communicate ground rules
  • Establish IT-related policies
  • Communicate IT objectives
  • Suggest process improvement opportunities
  • Create a communications package
  • Establish quality management standards
  • Establish a process for measuring quality of service goals and metrics
  • Continually review and improve good practices
  • Establish quality review benchmark results
  • Establish monitoring targets
  • Review performance reports
  • Define remedial actions
  • Assign responsibility for remedial actions
  • Establish and review internal control monitoring
  • Review benchmarks and evaluations
  • Create self-assessment plans and criteria
  • Review self-assessment results
  • Locate and review control deficiencies
  • Create and review assurance plans and their results
  • Communicate new compliance requirements

How ZenGRC Enables Enterprise Level Compliance

COBIT 5 uses a language reminiscent of project management to better align business leaders to IT principles. Incorporating terms such as value creation, stakeholders, strategic objectives, and stakeholder management help bridge the gap between the IT department, management, and the Board of Directors.

However, the way in which COBIT 5 focuses on stakeholder communication. Moreover, it’s first principle focuses specifically on the variety of stakeholders involved in the process. Therefore, if you’re looking to be COBIT compliant you need to make an IT investment that helps you manage communications between your stakeholders.

ZenGRC provides task prioritization that help let you track compliance activities that reduce vulnerabilities by scheduling reviews and monitoring their completion dates.
As a single-source-of-information, the platform stores and supports remediation activities to prove your continuous compliance and continuous auditing approach to information security.

By using our intuitive interface, you can easily upload frameworks, objectives, and controls while also managing changes to those controls across a variety of frameworks.

For more information on how ZenGRC can enable your compliance efforts, contact us for a demo.

What Are The Differences Between COBIT & COSO

· ·

woman draw graph

COBIT and COSO share more than pleasant alliteration. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the Control Objectives for Information and Related Technologies (COBIT) both help organizations manage financial reporting controls. Understanding the similarities, differences, and overlaps between the two can help organizations create robust internal control objectives that protect data.

COBIT vs. COSO

What is COSO?

Five major professional associations founded COSO in 1985 to sponsor the National Commission on Fraudulent Financial Reporting. The American Accounting Organization (AAA), American Insitute of Certified Public Accountants (AICPA), Financial Executives International (FEI), Institute of Internal Auditors (IIA), and Institute of Management Accountants (IMA) collaborated to found a joint initiative. COSO’s frameworks and guidance on enterprise risk management, internal control, and fraud deterrence provide thought leadership on governance.

What is COBIT?

Initially founded in 1967 as the Information Systems and Audit Control Association, the IT professional organization now uses only the acronym ISACA. ISACA creates globally-recognized IT certifications and guidance for enterprises that use information systems. A key tool is the COBIT framework, which stands for Control Objectives for Information and Related Technology.

What is the COSO Framework?

The COSO Framework provides an applied risk management approach to internal controls. Relevant to both financial reporting and internal reporting, in its 2017 update, the COSO framework integrates risk considerations into the design and implementation of internal controls and strategic objectives.

Five interrelated components convey the framework’s principles. “Governance and Culture” establishes oversight responsibilities and reinforces the importance of ethical behaviors. “Strategy and Objective Setting” connects organizational goals with bases for identifying, assessing, and responding to risk. The “Performance” component requires prioritization of risks and reporting on effectiveness. “Review and Revision” leverages continuous monitoring and internal audit to strengthen enterprise risk management components as needed. Finally, “Information, Communication, and Reporting” mandates the gathering and sharing of the necessary information with stakeholders throughout the organization.

What is the COBIT 5 Framework?

COBIT is a framework for information technology governance and management in a business setting. Potentially confusing things, COBIT 5 also incorporates five strategic principles. Although the numbers match, the two frameworks’ goals and purposes differ. COBIT emphasizes the elements necessary for IT governance that matches enterprise needs. Understanding these five principles helps overlay COSO and COBIT.

“Meeting Stakeholder Needs” introduces cascading goals to ensure that those receiving benefits and those bearing risks are considered in decision-making. “Covering the Enterprise End-to-End” emphasizes that an ERM approach to IT must incorporate all information, technologies, and processes. “Applying a Single Integrated Framework” maps multiple standards to a single governance and management framework for the enterprise. “Enabling a Holistic Approach” integrates processes, organizational structures, culture, policies, information, infrastructure, and people to manage the interconnectedness of governance across the enterprise. “Separating Governance and Management” uses need evaluation to distinguish between prioritized direction and tracking activities.

What are the differences between COBIT 5 and COSO?

While the two seem similar, they perform different functions for organizations. COSO articulates key concepts that organizations can use to enhance internal controls and deter fraud. COBIT 5 helps organizations achieve objectives—both through and regarding information technology.

Organizations using financial risk reporting models that align with COSO can still use COBIT 5 to help organize their enterprise IT landscape. The two work together, like the variety of documents needed for a new house. The survey lays out the building’s location on the plot of land but doesn’t dictate room placement. COSO allows an organization to frame the structure. However, walking through a framed home only shows an outline of how the building will look. COBIT 5 shows organizations where to put the electrical systems and plumbing. The COBIT framework sets the COSO plan into action, with details that allow organizations to secure the IT environment.

Why do organizations need both COBIT and COSO?

COBIT 5 and COSO work together to create not only a controlled landscape but also a risk and governance model that fosters both compliance and information security.

COSO emphasizes controls related to fiduciary duty. Originally designed to enable Sarbanes-Oxley (SOX) 404 requirements on financial reporting, COSO is limited in its consideration of an organization’s IT environment. In contrast, COBIT 5 explicitly addresses an enterprise’s IT landscape. Therefore, the two complement each other as well, as an organization develops an overarching risk, compliance, and governance program.

For example, trust services organizations governing their compliance under COSO can map its principles to the COBIT 5 processes and determine which key practice goals cover both. The AICPA, for example, provides an excel spreadsheet to help visualize the mapping.

Under COSO, organizations must assess the risk to determine critical environments and ensure mitigation. As part of this process, external financial reporting must reflect the underlying transactions and events.

COBIT 5 aligns with this requirement by offering specific ways to assess IT risks. Elements like COBIT’s PO 8 “Manage Quality” dovetail with the COSO Performance component. Clarifying metrics, COBIT defines its measurements as the percent of stakeholders satisfied with IT quality, IT processes formally-reviewed that meet target goals and objectives, and processes receiving QA reviews.

Thus, the specific definitions of controls within COBIT create strategic alignments to COSO that enable quality compliance and monitoring.

Why use an automated system for mapping COSO and COBIT 5?

The above-referenced AICPA worksheet incorporates 414 rows that engage multiple COBIT 5 alignments within each. Managing the compliance of these controls in conjunction with mapping to COSO can quickly become overwhelming. Mapping other compliance architectures to COBIT 5 then becomes nearly impossible.

With ZenGRC’s seed content, organizations can onboard in as little as six weeks and align their controls to COBIT 5.

Once they have aligned their controls to COBIT 5, they can map those to COSO or any other compliance framework by using ZenGRC’s gap analysis tool. The gap analysis tool in the platform harmonizes controls across multiple standards to ease the burden of compliance across frameworks.

For example, ZenGRC’s compliance dashboard provides color-coded audit readiness markers, offering instant visual insights into organizational gaps. A red, low “Audit Readiness” marker visually represents a danger for entities organizing their compliance programs around a particular standard. If that standard appears under COBIT or COSO, then the organization knows they also need to review associated controls.

Moreover, COBIT requires organizations to engage enterprise-wide stakeholders. Organizing people requires ongoing communication. ZenGRC’s streamlined workflow eases the administrative burden by eliminating emails so that varied stakeholders can communicate more efficiently.

To see how ZenGRC can help organize COBIT and COSO compliance, contact us for a demo today.

Infosec Standards and Regulations: A Primer Sorting Compliance By Hogwarts House

· ·

infosec standards and regulations

Sorting infosec standards and regulations into Hogwarts houses seems sort of silly at first. After all, the idea of anthropomorphizing a written set of rules and guidances isn’t really something serious people do. The Hogwarts Houses, however, come with a set of characteristics that define the students’ personalities. Various online sites have sorted politicians, celebrities, and Game of Thrones characters into their houses. People love categorizing, and the Hogwarts Houses allow people to do this in a pretty finite, fun way. Even though infosec standards and regulations don’t have personalities, the organizations that create them do.

Infosec compliance lacks the strict hierarchy of other compliance areas. Infosec standards and regulations often, though not always, act as guidances and peer suggestions. Increased consumer attention has spun much of this discussion into compliance being a selling point for revenue. With the largely diversified field, however, organizing these infosec standards and regulations into a larger guide can help negotiate the continually shifting compliance landscape.

Categorizing Infosec Standards and Regulations Using Hogwarts Houses

The Gryffindors of Infosec Standards and Regulations

Gryffindor, the house of heroes such as the titular Harry Potter and his two best friends Hermione Granger and Ron Weasley, stands as the house that most values courage, bravery, and determination.
Defining Gryffindors within the world of infosec standards and regulations means looking at those organizations bravely leading the charge of security with a sense of determination to make the world more cybersafe.

NIST
The National Institute of Standards and Technology (NIST) publishes for free its well respected Cybersecurity Framework. Providing guidance instead of punishment, the Cybersecurity Framework and NIST 800-53 help give organizations a way to start organizing their best practices without automatically spending money to get caught up on the basics. With an eye towards protecting cyber security, the NIST website also offers a free reference tool to that represents the Framework Core, a set of industry standards, guidelines, and practices.

Security Policy Framework UK
Similar to NIST, the UK Cabinet Office, National Security and INtelligence, and Government Security Profession published this eleven page document to help guide protection of government assets. It incorporates twenty “Mandatory Requirements” grouped into the seven areas of Governance, Risk Management, & Compliance, Protective Marking & Asset Control, Personnel Security, Information Security & Assurance, Physical Security, Counter-Terrorism, and Business Continuity.

OWASP
The Open Web Application Security Project  began in 2001 as an open international community allowing organizations to conceive, develop, acquire, operate, and maintain trusted applications. Although OWASP presents less compliance and more resource, it deserves a place on this list as an heroic act of industry innovation that provides guidance to members. Looking at peer driven standards, frameworks, and guidances, OWASP stands as an organization whose primary goals overlap with the traditional compliance goals set out by more formalized organizations.

The Slytherins of Infosec Standards and Regulations

Slytherin, often erroneously considered the villainous foil to Gryffindor because it housed the evil Voldemort, focuses on pride, ambition, and cunning making it less about evil and more about potentially hubristic characteristics.

This category falls to those standards and frameworks that are well respected but also require users to pay for the privilege of being compliant. In this sense, the ambition and cunning win out. Often, infosec standards and regulations are considered to be best business practices or something that should protect the industry. In this way, it makes perfect ambitious sense to monetize the experience. 

ISO
The International Organization for Standardization brings to the table some of the most recognized and most often complied with standards. ISO/IEC 27000 compliance complete with all of its related standards leads the charge for those starting their infosec standards and regulations journey. The prescriptive nature of ISO 27000 means that having copies of the standard itself matters to compliance. As a leading expert on information security, ISO has managed to leverage that into an ambitious and ongoing business.

COBIT
Created by the Information Systems Audit and Control Association (ISACA), the Control Objectives for Information Related Technology (COBIT) framework acts as a tool to help bridge the gaps between business needs and technical issues to ensure that controls are appropriately mapped. COBIT importantly serves as a tool for process based modeling. Breaking thirty four specific processes into the four specific domains of Organization, Delivering & Support, Acquiring & Implementation, and Monitoring & Evaluation, the framework offers maturity models to assess changes needed as businesses grow.

COSO
During the 1980’s, the Securities and Exchange Commission created a committee to review fraudulent reporting. Five supporting organizations of auditors and accountants joined in the review leading to the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In 2013, a significant revision added to the original framework. COSO’s Internal Control – Integrated Framework identifies the five interrelated components of control environment, risk assessment, control activities, information & communication, and monitoring. Its Enterprise Risk Management – Integrated Framework developed by PricewaterhouseCoopers added strategic, operations, reporting, and compliance business objective with the eight framework components of internal environment, objective setting, event identification, risk assessment, risk response, control activities, information & management, and monitoring.

The Hufflepuffs of Infosec Standards and Regulations

Hufflepuff, long considered the weakest house due to its students kindness and selflessness, values hard work, patience, loyalty, and fair play.
Industries have adopted their own guidelines to help their hardworking members. Both the healthcare industry and the credit card industry have created infosec standards. This idea of loyalty to their community is the reason that they are the Hufflepuffs of information security compliance. The standards are intended to help the industry members be their best making them more about hard work and fair play than other standards.

HITRUST
The Health Information Trust Alliance (HITRUST) started in 2007 to help protect patient information. The HITRUST model seeks to create baselines across the health industry that can be applied to businesses based on their risk and maturity. Instead of starting with risk and creating controls in response to those risks, HITRUST looked at the healthcare industry and determined that certain risks were more likely for their members. In doing so, the HITRUST model allows HIPAA covered entities to tailor their programs through the Common Security Framework model. HITRUST provides broad access to its common risk and compliance management frameworks hoping to support the members of its community.

PCI-DSS
The Payment Card Industry Security Standards Council (PCI) was organized by American Express, DIscover Financial Services, JCB International, Mastercard, and Visa to help promote information security over electronic payment systems. The PCI Data Security Standard (PCI DSS) has become the standard of compliance for any and all payment processors. In order to comply with PCI DSS, vendors must review their landscape to determine the scope of their risk. Following from that, they map their networks to review where information lives and travels. Because PCI DSS is an industry specific standard trying to aid its members, it offers a lot of information, such as lists of approved assessors, devices, and applications.

The Ravenclaws of Infosec Standards and Regulations

Ravenclaws, the esoteric and scholarly house, most values wit, learning, and wisdom.
The key to Ravenclaws lie in their intense desire to be factually correct. Though many would argue that regulations do not promote wisdom and learning, the rule of law that they provide fits well with the need for Ravenclaws to be in charge of information. Rules of law rely on facts. In the case of the regulations discussed, they intended to punish those without integrity or who did not think about the repercussions of actions. This makes the following the most Ravenclawed of the infosec standards and regulations.

SOX
In 2002, the Sarbanes-Oxley Act (SOX) was enacted in response to a wide array of corporate fraudulent reporting. Although the Securities and Exchange Commission (SEC) had addressed many of the concerns in SOX, corporate greed led to several companies flouting the laws. SOX intended to force ethics upon these kinds of companies by establishing penalties for those who would misreport. In the world of infosec standards and regulations, SOX Section 404 causes the greatest cost. 404 requires that business evaluate their IT environment to determine whether there are financial reporting risks and controls that address them. These risks can be internal or external. Often, they come from the way transactions in the financial statements are authorized, processed, or recorded. Once the risks are identified, 404 requires a review of controls in place. These can be anything from looking at the employee level involved in the reporting structure to looking at the automation and possibility of human error. After reviewing the controls, the organization needs to determine the risk of failure to operate as intended and the risk that failure would lead to a material misstatement in financial reports. Finally, companies are required to report on their conclusions. SOC1 reports are obtained and reviewed for the IT controls performed at third parties, such as payroll processor. A company’s SOX conclusions are published in item 9a of the public company’s SEC 10k annual filing.

GDPR
The European Union’s General Data Protection Regulation (GDPR) has made accountability and governance one of its main directives. The GDPR establishes a single set of rules that apply to all member states. However, it also expands the scope to data controllers that collect information from EU residents or process information (whether it be directly or as cloud service providers) from EU residents, or if the person about whom the data is collected is an EU resident. This means that despite not necessarily being in the EU, an organization that deals with EU resident information in this variety of ways will need to become compliant. The GDPR looks to assess the lawfulness, fairness, & transparency of privacy, limit the purpose of using information, minimize the amount of data involved, ensure information accuracy, limit the amount of storage an organization keeps on a person, and enforce the integrity and confidentiality of the information. All of these are intended to lead to accountability by the processor or controller responsible for the compliance.

HIPAA
The Health Insurance Portability and Accountability of 1996 (HIPAA) required the Secretary of Health and Human Services to enact privacy regulations to protect individually identifiable health information. The HIPAA Security Standards create a regulatory requirement that those businesses falling within its purview create administrative procedures to protect and manage protection of data, physical safeguards over computer systems and buildings preventing intrusion, technical security services that review access to information, and technical security mechanism that prevent unauthorized transmission of information.
 
How do you think we fared sorting the infosec standards and regulations into houses? Do you agree with our assessment? What would you suggest be added?