Enabling Processes

Recommendations

Info

Build, Acquire and Implement BAI07 RACI Chart Key Management PracticeBoard BAI07.01 Establish an implementation plan. BAI07.02 Plan business process, system and data conversion. BAI07.03 Plan acceptance tests. BAI07.04 Establish a test environment. BAI07.05 Perform acceptance tests. BAI07.06 Promote to production and manage releases. BAI07.07 Provide early production support. BAI07.08 Perform a post-implementation review. 154 : ENABLING PROCESSES Chief Executive Officer Chief Financial Officer Chief Operating Officer Business Executives BAI07 Process Practices, Inputs/Outputs and Activities Business Process Owners Strategy Executive Committee �� Chief Risk Officer Chief Information Security Officer Architecture Board Enterprise Risk Committee Head Human Resources Compliance Audit Chief Information Officer C R A C R C C R C R C R R R C C R A C R C C R C R C R R R C A R R I C I R R I R R C A R R I I R R I R R C A R R I I R R I R R C R A I I R R R I I I R A I I R R R I I I R A I C C I R R R C I I Management Practice Inputs Outputs BAI07.01 Establish an implementation plan. Establish an implementation plan that covers system and data conversion, acceptance testing criteria, communication, training, release preparation, promotion to production, early production support, � �� review. Obtain approval from relevant parties. From Description Description To BAI01.09 Quality management plan Approved implementation plan Internal BAI06.01 � �� and schedule � �� for change Head Architect Head Development Head IT Operations Implementation fallback and recovery process Activities 1. Create an implementation plan that reflects the broad implementation strategy, the sequence of implementation steps, resource requirements, inter-dependencies, criteria for management acceptance of the production implementation, installation verification requirements, transition strategy for production support, and update of BCPs. 2. Confirm that all implementation plans are approved by technical and business stakeholders and reviewed by internal audit, as appropriate. 3. Obtain commitment from external solution providers to their involvement in each step of the implementation. 4. Identify and document the fallback and recovery process. 5. Formally review the technical and business risk associated with implementation and ensure that the key risk is considered and addressed in the planning process. Personal Copy of: Mr. Dong Hong Wang Head IT Administration Service Manager Information Security Manager Internal Business Continuity Manager Privacy Officer
CHAPTER 5 COBIT 5 PROCESS REFERENCE GUIDE CONTENTS BAI07 Process Practices, Inputs/Outputs and Activities (cont.) Management Practice Inputs Outputs BAI07.02 Plan business process, system and From Description Description To data conversion. Migration plan DSS06.02 Prepare for business process, IT service data and �� development methods, including audit trails and a recovery plan should the migration fail. Activities 1. Define a business process, IT: service data and infrastructure migration plan. Consider, for example, hardware, networks, operating systems, software, transaction data, master files, backups and archives, interfaces with other systems (both internal and external), possible compliance requirements, business procedures, and system documentation, in the development of the plan. �� conversion plan. 3. Incorporate in the data conversion plan methods for collecting, converting and verifying data to be converted, and identifying and resolving any errors found during conversion. Include comparing the original and converted data for completeness and integrity. 4. Confirm that the data conversion plan does not require changes in data values unless absolutely necessary for business reasons. Document changes made to data values, and secure approval from the business process data owner. 5. Rehearse and test the conversion before attempting a live conversion. 6. Consider the risk of conversion problems, business continuity planning, and fallback procedures in the business process, data and infrastructure �� 7. Co-ordinate and verify the timing and completeness of the conversion cutover so there is a smooth, continuous transition with no loss of transaction data. Where necessary, in the absence of any other alternative, freeze live operations. 8. Plan to back up all systems and data taken at the point prior to conversion. Maintain audit trails to enable the conversion to be retraced and ensure that there is a recovery plan covering rollback of migration and fallback to previous processing should the migration fail. 9. Plan retention of backup and archived data to conform to business needs and regulatory or compliance requirements. Management Practice Inputs Outputs BAI07.03 Plan acceptance tests. From Description Description To Establish a test plan based on enterprisewide standards BAI01.09 Requirements for Approved acceptance BAI01.04 that define roles, responsibilities, and entry and exit independent verification test plan BAI01.08 criteria. Ensure that the plan is approved by relevant of deliverables parties. BAI03.07 � �� BAI03.08 � �� communications � �� audit trails Activities �� consult with appropriate business process owners and IT stakeholders. �� assessment of the risk of system failure and faults on implementation, the plan should include requirements for performance, stress, usability, pilot and security testing. 3. Ensure that the test plan addresses the potential need for internal or external accreditation of outcomes of the test process (e.g., financial regulatory requirements). 4. Ensure that the test plan identifies necessary resources to execute testing and evaluate the results. Examples of resources include construction of test environments and use of staff time for the test group, including potential temporary replacement of test staff in the production or development environments. Ensure that stakeholders are consulted on the resource implications of the test plan. 5. Ensure that the test plan identifies testing phases appropriate to the operational requirements and environment. Examples of such testing phases include unit test, system test, integration test, user acceptance test, performance test, stress test, data conversion test, security test, operational readiness test, and backup and recovery tests. 6. Confirm that the test plan considers test preparation (including site preparation), training requirements, installation or an update of a defined test �� 7. Ensure that the test plan establishes clear criteria for measuring the success of undertaking each testing phase. Consult the business process owners and IT stakeholders in defining the success criteria. Determine that the plan establishes remediation procedures when the success criteria are not met (e.g., in a case of significant failures in a testing phase, the plan provides guidance on whether to proceed to the next phase, stop testing or postpone implementation). 8. Confirm that all test plans are approved by stakeholders, including business process owners and IT, as appropriate. Examples of such stakeholders are �� Personal Copy of: Mr. Dong Hong Wang 155 Build, Acquire and Implement
Page 1 and 2:
Enabling Processes Personal Copy of
Page 3 and 4:
ACKNOWLEDGEMENTS ISACA wishes to re
Page 5 and 6:
ACKNOWLEDGEMENTS (CONT.) ACKNOWLEDG
Page 7 and 8:
TABLE OF CONTENTS TABLE OF CONTENTS
Page 9 and 10:
LIST OF FIGURES LIST OF FIGURES Fig
Page 11 and 12:
CHAPTER 1 INTRODUCTION CHAPTER 1 IN
Page 13 and 14:
CHAPTER 2. THE GOALS CASCADE AND ME
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
CHAPTER 3 THE COBIT 5 PROCESS MODEL
Page 21 and 22:
Enabler Performance Management CHAP
Page 23 and 24:
CHAPTER 4 THE COBIT 5 PROCESS REFER
Page 25 and 26:
CHAPTER 5 COBIT 5 PROCESS REFERENCE
Page 27 and 28:
Generic Guidance for Processes CHAP
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
EDM02 Process Practices, Inputs/Out
Page 39 and 40:
Page 41 and 42:
EDM03 Process Practices, Inputs/Out
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
APO01 Process Practices, Inputs/Out
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
APO04 Manage Innovation (cont.) CHA
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104: APO11 Process Practices, Inputs/Out
Page 107 and 108: CHAPTER 5 COBIT 5 PROCESS REFERENCE
Page 113 and 114: APO13 Manage Security Process Descr
Page 123 and 124: BAI01 Process Practices, Inputs/Out
Page 153: CHAPTER 5 COBIT 5 PROCESS REFERENCE
Page 179 and 180: DSS02 Process Practices, Inputs/Out
Page 195 and 196: DSS05 Process Practices, Inputs/Out
Page 205 and 206:
MEA01 Process Practices, Inputs/Out
Page 207 and 208:
Page 209 and 210:
Page 211 and 212:
Page 213 and 214:
Page 215 and 216:
Page 217 and 218:
APPENDIX A MAPPING BETWEEN COBIT 5
Page 219 and 220:
Page 221 and 222:
Page 223 and 224:
Page 225 and 226:
APPENDIX B DETAILED MAPPING ENTERPR
Page 227 and 228:
APPENDIX C DETAILED MAPPING IT-RELA
Page 229 and 230:
Deliver, Service and Support Monito
show all

Enabling Processes

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?