Enabling Processes

Recommendations

Info

Build, Acquire and Implement 136 : ENABLING PROCESSES BAI03 Process Practices, Inputs/Outputs and Activities (cont.) BAI03.02 Activities �� 2. Design the application processing steps, including specification of transaction types and business processing rules, automated controls, data �� 3. Classify data inputs and outputs according to enterprise architecture standards. Specify the source data collection design, documenting the data inputs (regardless of source) and validation for processing transactions as well as the methods for validation. Design the identified outputs, including data sources. �� 5. Design data storage, location, retrieval and recoverability. 6. Design appropriate redundancy, recovery and backup. 7. Design the interface between the user and the system application so that it is easy to use and self-documenting. �� and time sensitivity of the information. 9. Proactively evaluate for design weaknesses (e.g., inconsistencies, lack of clarity, potential flaws) throughout the life cycle, identifying improvements when required. 10. Provide an ability to audit transactions and identify root causes of processing errors. Management Practice Inputs Outputs BAI03.03 Develop solution components. From Description Description To Develop solution components progressively BAI02.02 Feasibility study report Documented solution BAI04.03 in accordance with detailed designs following components BAI05.05 development methods and documentation standards, BAI02.04 Sponsor approvals of BAI08.03 quality assurance (QA) requirements, and approval requirements and BAI08.04 standards. Ensure that all control requirements in proposed solutions the business processes, supporting IT applications and infrastructure services, services and technology �� Activities 1. Develop business processes, supporting services, applications and infrastructure, and information repositories based on agreed-on specifications and business, functional and technical requirements. 2. When third-party providers are involved with the solution development, ensure that maintenance, support, development standards and licencing are addressed and adhered to in contractual obligations. 3. Track change requests and design, performance and quality reviews, ensuring active participation of all impacted stakeholders. 4. Document all solution components according to defined standards and maintain version control over all developed components and associated documentation. 5. Assess the impact of solution customisation and configuration on the performance and efficiency of acquired solutions and on inter-operability with existing applications, operating systems and other infrastructure. Adapt business processes as required to leverage the application capability. 6. Ensure that responsibilities for using high security or restricted access infrastructure components are clearly defined and understood by those who develop and integrate infrastructure components. Their use should be monitored and evaluated. Management Practice Inputs Outputs BAI03.04 Procure solution components. From Description Description To Procure solution components based on the acquisition BAI02.04 Sponsor approvals Approved acquisition plan APO10.03 plan in accordance with requirements and detailed of requirements and designs, architecture principles and standards, and proposed solutions �� procedures, QA requirements, and approval standards. Updates to asset inventory BAI09.01 Ensure that all legal and contractual requirements are identified and addressed by the supplier. Activities 1. Create and maintain a plan for the acquisition of solution components, considering future flexibility for capacity additions, transition costs, risk and �� 2. Review and approve all acquisition plans, considering risk, costs, benefits and technical conformance with enterprise architecture standards. 3. Assess and document the degree to which acquired solutions require adaptation of business process to leverage the benefits of the acquired solution. 4. Follow required approvals at key decision points during the procurement processes. 5. Record receipt of all infrastructure and software acquisitions in an asset inventory. Personal Copy of: Mr. Dong Hong Wang
CHAPTER 5 COBIT 5 PROCESS REFERENCE GUIDE CONTENTS BAI03 Process Practices, Inputs/Outputs and Activities (cont.) Management Practice Inputs Outputs BAI03.05 Build solutions. From Description Description To Install and configure solutions and integrate with business process activities. Implement control, security and auditability measures during configuration, and during integration of hardware and infrastructural software, to protect resources and ensure availability and data integrity. Update the services catalogue to reflect the new solutions. Integrated and configured solution components BAI06.01 Activities 1. Integrate and configure business and IT solution components and information repositories in line with detailed specifications and quality requirements. Consider the role of users, business stakeholders and the process owner in the configuration of business processes. 2. Complete and update business process and operational manuals, where necessary, to account for any customisation or special conditions unique to the implementation. 3. Consider all relevant information control requirements in solution component integration and configuration, including implementation of business controls, where appropriate, into automated application controls such that processing is accurate, complete, timely, authorised and auditable. 4. Implement audit trails during configuration and integration of hardware and infrastructural software to protect resources and ensure availability and integrity. �� specifications) require a high-level reassessment of the solution and associated functionality. 6. Ensure the interoperability of solution components with supporting tests, preferably automated. 7. Configure acquired application software to meet business processing requirements. 8. Define service catalogues for relevant internal and external target groups based on business requirements. Management Practice Inputs Outputs BAI03.06 Perform quality assurance (QA). From Description Description To Develop, resource and execute a QA plan aligned with the QMS to obtain the quality specified in the �� APO11.01 Results of QMS effectiveness reviews QA plan APO11.04 policies and procedures. BAI01.09 Quality management plan Activities Quality review results, exceptions and corrections APO11.04 1. Define a QA plan and practices including, e.g., specification of quality criteria, validation and verification processes, definition of how quality will be reviewed, necessary qualifications of quality reviewers, and roles and responsibilities for the achievement of quality. �� management procedures and acceptance criteria. 3. Employ code inspection, test-driven development practices, automated testing, continuous integration, walk-throughs and testing of applications as appropriate. Report on outcomes of the monitoring process and testing to the application software development team and IT management. 4. Monitor all quality exceptions and address all corrective actions. Maintain a record of all reviews, results, exceptions and corrections. Repeat quality reviews, where appropriate, based on the amount of rework and corrective action. Management Practice Inputs Outputs BAI03.07 Prepare for solution testing. From Description Description To Establish a test plan and required environments to test the individual and integrated solution components, Test plan BAI07.03 including the business processes and supporting services, applications and infrastructure. Activities Test procedures BAI07.03 1. Create an integrated test plan and practices commensurate with the enterprise environment and strategic technology plans that will enable the creation of suitable testing and simulation environments to help verify that the solution will operate successfully in the live environment and deliver the intended results and that controls are adequate. 2. Create a test environment that supports the full scope of the solution and reflects, as closely as possible, real-world conditions, including the business processes and procedures, range of users, transaction types, and deployment conditions. 3. Create test procedures that align with the plan and practices and allow evaluation of the operation of the solution in real-world conditions. Ensure that the test procedures evaluate the adequacy of the controls, based on enterprisewide standards that define roles, responsibilities and testing criteria, �� Personal Copy of: Mr. Dong Hong Wang 137 Build, Acquire and Implement
Page 1 and 2:
Enabling Processes Personal Copy of
Page 3 and 4:
ACKNOWLEDGEMENTS ISACA wishes to re
Page 5 and 6:
ACKNOWLEDGEMENTS (CONT.) ACKNOWLEDG
Page 7 and 8:
TABLE OF CONTENTS TABLE OF CONTENTS
Page 9 and 10:
LIST OF FIGURES LIST OF FIGURES Fig
Page 11 and 12:
CHAPTER 1 INTRODUCTION CHAPTER 1 IN
Page 13 and 14:
CHAPTER 2. THE GOALS CASCADE AND ME
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
CHAPTER 3 THE COBIT 5 PROCESS MODEL
Page 21 and 22:
Enabler Performance Management CHAP
Page 23 and 24:
CHAPTER 4 THE COBIT 5 PROCESS REFER
Page 25 and 26:
CHAPTER 5 COBIT 5 PROCESS REFERENCE
Page 27 and 28:
Generic Guidance for Processes CHAP
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
EDM02 Process Practices, Inputs/Out
Page 39 and 40:
Page 41 and 42:
EDM03 Process Practices, Inputs/Out
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
APO01 Process Practices, Inputs/Out
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
APO04 Manage Innovation (cont.) CHA
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86: CHAPTER 5 COBIT 5 PROCESS REFERENCE
Page 87 and 88: APO07 Process Practices, Inputs/Out
Page 113 and 114: APO13 Manage Security Process Descr
Page 123 and 124: BAI01 Process Practices, Inputs/Out
Page 135: CHAPTER 5 COBIT 5 PROCESS REFERENCE
Page 179 and 180: DSS02 Process Practices, Inputs/Out
Page 187 and 188:
Page 189 and 190:
Page 191 and 192:
Page 193 and 194:
Page 195 and 196:
DSS05 Process Practices, Inputs/Out
Page 197 and 198:
Page 199 and 200:
Page 201 and 202:
Page 203 and 204:
Page 205 and 206:
MEA01 Process Practices, Inputs/Out
Page 207 and 208:
Page 209 and 210:
Page 211 and 212:
Page 213 and 214:
Page 215 and 216:
Page 217 and 218:
APPENDIX A MAPPING BETWEEN COBIT 5
Page 219 and 220:
Page 221 and 222:
Page 223 and 224:
Page 225 and 226:
APPENDIX B DETAILED MAPPING ENTERPR
Page 227 and 228:
APPENDIX C DETAILED MAPPING IT-RELA
Page 229 and 230:
Deliver, Service and Support Monito
show all

Enabling Processes

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?