Ad
More Related Content
What's hot (20)
Similar to Cobit, itil and cmmi - a tutorial (20)
Ad
Recently uploaded (20)
Ad
Cobit, itil and cmmi - a tutorial
- 1. Integrating CMMI® with COBIT® and ITIL® Dr. Bill Curtis Dr. Bill Curtis Chief Process Officer Chief Process Officer © 2005 Agenda 1) The IT Space 3 2) CMMI and COBIT 7 3) CMMI and ITIL C C 27 M M T ITIL B O ® CMM and CMMI are registered with the US Patent and Trademark Office ® COBIT is a registered trademark of ISACA ® ITIL is a registered trademark of the UK Office of Government Commerce 2 1
- 2. Section 1: The IT Space IT Strategy Data and Operations Center Application Development Service Desk IT-Enabled Services 3 The Standards Standard Parent Org. Industry Sponsor Group 4 2
- 3. Gartner’s Review of Models 5 Application Management Application Management CMMI Domain Plan Define Application Development Design Build Service Management Deploy Operate Support Optimize Source: ITIL: Application Management (2002, p.7) 6 3
- 4. Section 2: COBIT COBIT: • Control OBjectives for Information and related Technology • 3rd edition—July 2000 Sponsorship: • Open standard of IT Governance Institute • Published by ISACA – The Information Systems Audit and Control Association & Foundation • Certified Information Systems Auditor certification – 23,000+ auditors Focus: • IT Governance - How does executive management fulfill its responsibilities with respect to IT? • Audit of IT operations 7 Source: COBIT Management Guidelines (2000) Approach to Using COBIT Manage IT-related business risks: • base use on business objectives in the COBIT Framework • select IT processes and controls appropriate for the organization from the COBIT Control Objectives • operate from the organization business plan • assess procedures and results with COBIT Audit Guidelines • assess status of the organization, identify critical success factors, measure performance with the COBIT Management Guidelines To develop a sound set of processes: • choose Control Objectives that fit the business objectives • identify industry models that provide guidance for supporting processes (CMMI, People CMM, ITIL, …) 8 4
- 5. COBIT Architecture 34 Information Technology control objectives: • 11 planning and organization • 6 acquisition and implementation • 13 delivery and support • 4 monitoring 318 detailed control objectives & audit guidelines: • 3-30 detailed control objectives per process Each IT process is supported by: • 8-10 Critical Success Factors • 5-7 Key Goal Indicators • 6-8 Key Performance Indicators 9 Source: COBIT Management Guidelines (2000) Evaluating COBIT Processes Critical Success Factors: • Management’s key issues to control and actions to take • Focused on implementing and controlling the right processes Key Goal Indicators: • Indicators of whether an IT process has achieved its goals • Focused on monitoring achievement of goals Key Performance Indicators: • Measures of how well an IT process is performing • Focused on monitoring performance to predict goal achievement 10 Source: COBIT Management Guidelines (2000) 5
- 6. Architectural Comparison COBIT CMMI Control objectives Process Areas Detailed control objectives Practices Critical success factors Key goal indicators Key performance indicators Practice level goals Measures in Directing Implementation Measures in Directing Implementation Architectural comparison is suggestive of relationships, but the mapping between these elements is not exact. Font sizes indicate relative scope of the element between models. 11 COBIT’s Maturity Model Level 5 Optimised Processes refined to level of best practice Automation integrates workflow Level 4 Managed Process compliance monitored & measured Constant improvement, some automation Level 3 Defined Standard, documented procedures based on existing practice with no process assurance Level 2 Repeatable Similar procedures followed by people performing the same task, but no training Level 1 Initial Ad hoc processes developed case by case Recognition of issues to be addressed Level 0 Complete lack of recognizable processes No recognition of issues to be addressed Non-existent Non12 Source: COBIT Management Guidelines (2000) 6
- 7. Prescriptive Models that assign a specific set of process areas to each maturity level and require that for an organization to be rated at a specific level, all process areas at that level and all lower levels must be implemented. Each process area usually contains a collection of practices for implementing that process. Models that provide a simple scale for assigning a level of maturity to a single process based on a generalized characterization of its behavior or results without requiring that any specific attributes be implemented. Processes are appraised independently and can be rated at different levels Models that provide a simple scale for appraising the attributes of an organization and assign it to a level of maturity based on a generalized characterization of its behavior or results without requiring that specific processes be implemented Single process Level to Which Best Practices Are Characterized Models that assign a specific set of process attributes to each maturity level and require that for a process to be rated at a specific level, all the attributes at that level and all lower levels must be implemented for that process. Processes are appraised independently and can be rated at different levels Descriptive Maturity Model Types Organizational Focus of the Transformation 13 Prescriptive Descriptive Level to Which Best Practices Are Characterized Maturity Model Types CMMI Continuous CMMI People Staged CMM COBIT ITIL Maturity Model ITIL Org. Growth Single process 14 Crosby Quality Maturity Grid Organizational Focus of the Transformation 7
- 8. COBIT Maturity Evaluations Maturity comparisons for each IT process: 15 Company status Industry status Industry guidelines Op tim ise d Ma na ge d De fi n ed tia l Ini No n-e xis t AI7 Re pe ata ble Status of organization’s current process Status of best in class industry process Status of current industry standard guidelines Strategic objective for organizational improvement en t • • • • Company objective Source: COBIT Management Guidelines (2000) COBIT-MM vs. CMMs Not mapped to CMM’s view of maturity: • Level 2 uses local procedures • Level 3 compliance is not left to individuals • Level 4 measurement focused on compliance not stability or predictability • Weak focus on continual improvement • COBIT-MM is evolving and will include an assessment method COBIT uses the continuous approach • Process focus, not organizational focus • No roadmap for implementation Confuses process maturity and auditability 16 8
- 9. Planning & Organization—1 COBIT Process Maturity Framework PO1—Define a strategic IT plan—align IT opportunities with business requirements and ensure accomplishment Level 3 issue PO2—Define the information architecture—optimize the organization and integration of information systems Level 3 issue PO3—Determine technological direction—exploit current and emerging technology to achieve business strategy Level 3 issue PO4—Define the IT organization and relationships—deliver the right IT services CMMI—no clear referent CMMI—no clear referent CMMI—no clear referent CMMI L3—OEI Level 3 issue Source: COBIT Management Guidelines (2000) 17 Planning & Organization—2 COBIT Process Maturity Framework PO5—Manage the IT investment—ensure funding and control of financial resources Level 3 issue PO6—Communicate management aims and directions—ensure user awareness of directions Level 2 issue PO7—Manage human resources—sustain a motivated, competent workforce & ensure individual contributions PO8—Ensure compliance with external requirements— meet legal, regulatory, and contractual obligations 18 CMMI—no clear referent CMMI GP2.1—Policy People CMM CMMI—OT Level 3 issue CMMI L2—REQM, PPQA CMMI L3—RD, VAL Source: COBIT Management Guidelines (2000) 9
- 10. Planning & Organization—3 COBIT Process Maturity Framework PO9—Assess risks—support management decisions and reduce threats PO10—Manage projects—set priorities and deliver on time and within budget CMMI L2—REQM, PP, PMC CMMI L3—IPM, RSKM PO11—Manage quality—meet IT customer requirements 19 CMMI L2—PP CMMI L3—RSKM CMMI L2—REQM CMMI L3—RD, TS, VER, VAL Source: COBIT Management Guidelines (2000) Acquisition & Implementation—1 COBIT Process Maturity Framework AI1—Identify automated solutions—ensure effective, efficient approach to satisfy user requirements AI2—Acquire and maintain application software— provide automated functions to support business processes CMMI L2—SAM CMMI L3—RD, TS, VA, IPM, ISM AI3—Acquire and maintain technology infrastructure— provide appropriate platforms to support business applications CMMI L2—CM CMMI L3—RD, TS AI4—Develop and maintain procedures—ensure proper use of applications and technical solutions deployed 20 CMMI L2—REQM, SAM CMMI L3—RD, TS, RM, DAR, ISM CMMI L3—RD, TS Source: COBIT Management Guidelines (2000) 10
- 11. Acquisition & Implementation—2 COBIT Process Maturity Framework AI5—Install and accredit systems—confirm that solution is fit for intended purpose AI6—Manage changes—minimize disruption, unauthorized changes, and errors 21 CMMI L3—VER, VAL CMMI L2—REQM, CM Source: COBIT Management Guidelines (2000) Delivery and Support—1 COBIT Process Maturity Framework DS1—Define and manage service levels—establish a common understanding of the level of service required DS2—Manage third party services—ensure that third party responsibilities are defined and met CMMI L2—SAM CMMI L3—ISM DS3—Manage performance and capacity—ensure that adequate capacity is available and used to best effect CMMI L3—RD, TS DS4—Ensure continuous service—make IT services available and minimize business impact in case of disruption 22 CMMI L2—REQM, PP, PMC CMMI L3—IPM CMMI—no clear referent Level 2&3 issue Source: COBIT Management Guidelines (2000) 11
- 12. Delivery and Support—2 COBIT Process Maturity Framework DS5—Ensure system security— safeguard information against unauthorized use, disclosure, modification, damage, or loss Level 2&3 issue DS6—Identify and allocate costs—ensure awareness of costs attributable to IT services Level 3 issue CMMI—no clear referent CMMI—no clear referent DS7—Educate and train users— ensure users make effective use of technology and are aware of responsibilities DS8—Assist and advise customers—ensure problems experienced by users are resolved 23 People CMM CMMI L3—OT CMMI—no clear referent Level 3 issue Source: COBIT Management Guidelines (2000) Delivery and Support—3 COBIT DS9—Manage the configuration—prevent unauthorized alteration, verify existence, provide change mgt. DS10—Manage problems and incidents—ensure problems and incidents are resolved and causes investigated Process Maturity Framework CMMI L2—CM CMMI—no clear referent Level 3 issue DS11—Manage data—ensure data remains complete, accurate, and valid during input, update, and storage DS12—Manage facilities—provide physical environment that protects people and equipment against hazards 24 CMMI L2—PP, PMC People CMM—WE Source: COBIT Management Guidelines (2000) 12
- 13. Delivery and Support—4 COBIT DS13—Manage operations— ensure IT support functions are performed regularly in an orderly fashion 25 Process Maturity Framework CMMI—no clear referent Level 3 issue Source: COBIT Management Guidelines (2000) Monitoring—1 COBIT Process Maturity Framework M1—Monitor the processes— ensure achievement of performance objectives set for IT processes M2—Assess internal control adequacy—ensure achievement of internal control objectives for IT processes CMMI L2—PMC CMMI L3—IPM M3—Obtain independent assurance—increase confidence and trust among IT, customers, and suppliers CMMI L2—PPQA M4—Provide for an independent audit—ensure proper use of applications and technical solutions deployed 26 CMMI L2—PMC CMMI L2—PPQA Source: COBIT Management Guidelines (2000) 13
- 14. CMMI-COBIT Coverage COBIT Planning and Organization Acquisition and Implementation CMMI CMMI provides light support for achieving organization-wide objectives, but better support for objectives with greater project focus such as requirements, risks, quality, and project mgt. CMMI provides excellent coverage for achieving acquisition and implementation objectives Delivery and Support CMMI’s management processes can be translated to support the management of service levels, third parties, capacity, problems, and data; however continuous operation and user support services are not well covered in CMMI Monitoring CMMI provides for monitoring functions at the project level, but does not involve audit controls at the organizational level 27 CMMI-COBIT Summary CMMI and COBIT have different objectives: • COBIT focuses on governance of all IT functions • CMMI focuses on improving application development processes CMMI and COBIT are complementary: • Use COBIT to appraise overall management of IT • Use CMMI to appraise the maturity of application development Use CMMI to guide the implementation of control processes for: • acquisition and implementation processes • project management processes • some delivery and support processes 28 14
- 15. Section 3: ITIL ITIL—Information Technology Infrastructure Library • • • • Guide for cost-effective use of UK public sector IT resources Requirements for IT service management Collection of best practices in IT Vendor independent Supporting organizations: • • • • © UK Office of Government Commerce Published by The Stationary Office (London) itSMF—IT Service Management Forum—intro book EXIN, ISEB—professional certifications in ITIL 29 ITIL & BS 15000 BS 15000-1 Specification BS 15000-2 Code of Practice Aspiration Guidance PD 0005 ITIL Internal Processes and Procedures 30 Overview How-to As-is Source: PD 0015 (2000) 15
- 16. ITIL Publication Framework Planning to Implement Service Management T h e B u s i n e s s 31 Service Management Service Support The Business Perspective ICT Infrastructure Management Service Delivery Security Management Application Management T h e T e c h n o l o g y Source: ITIL: Planning to Implement Service Management (2002, p.4) ITIL Topic Areas—1 Service Delivery: • • • • • Service level management Financial management for IT services Capacity management IT service continuity management Availability management Service Support: 32 • • • • • • Service desk Incident management Problem management Change management Release management Configuration management 16
- 17. ITIL Topic Areas—2 ICT Infrastructure Management: • • • • Design and planning Deployment Operations Technical support Applications Management: • • • • • Managing business value Aligning delivery strategy with business drivers Application management lifecycle Organizing roles and functions Control methods and techniques 33 ITIL Topic Areas—3 Planning to Implement Service Mgt Security Management Software Asset Management The Business Perspective 34 17
- 18. ITIL-Related Models HP ITSM Reference Model IBM IT Process Model ITIL Microsoft MOF Etc., etc., etc. 35 The ITIL Processes ITIL Process CMMI PA Configuration Management Configuration Management Change Management Configuration Management Release Management Configuration Management Incident Management Problem Management Verification, Causal Analysis & Res. Service Desk Service Level Management Capacity Management Financial Mgt. for IT Services Customer Relationship Management ICT Infrastructure Management Application Management RM, TS, PI, VE, VA, ISM Security Management Environmental Infrastructure 36 Project Management PP, PMC, SAM, ISM, SAM Source: ITIL: Service Support (2002, p.11-16) 18
- 19. Application Mgt. Lifecycle Application development Requirements Requirements CMMI domain Optimize Optimize Operate Operate Design Design Build Build Deploy Deploy Service management 37 Source: ITIL: Application Management (2002, p.7) ITIL-AM: Requirements ITIL Application Management CMMI Functional requirements RM-Manage requirements: • Obtain understanding of requirements Non-functional requirements • Obtain commitment to requirements Usability requirements • Manage requirements changes Change cases • Maintain bi-directional traceability • Identify inconsistencies between project work and Testing requirements requirements Requirements management checklist RD-Develop customer requirements Organization of the requirements team • Elicit needs • Develop the customer requirements RD-Develop product requirements • Establish product & product-component reqts. • Allocate product-component reqts. • Identify interface requirements RD-Analyze and validate requirements • Establish operational concepts & scenarios • Establish definition of required functionality • Analyze requirements • Analyze requirements to achieve balance • Validate reqts with comprehensive models 38 Source: ITIL: Application Management (2002), CMMI (2003) 19
- 20. ITIL-AM: Design ITIL Application Management Design for non-functional requirements/manageability Risk-driven scheduling Managing tradeoffs Application-independent design guidelines and application frameworks Design management checklist Problems with design guidelines Testing the requirements Organization of the design team CMMI TS-Select product component solutions •Develop detailed alternatives and selection criteria •Evolve operational concepts & scenarios •Select product component solutions TS-Develop the design •Design the product or product component solution •Establish a technical data package •Design interfaces using criteria •Perform make, buy, or reuse analyses TS-Implement the product design •Implement the design •Develop product support documentation 39 Source: ITIL: Application Management (2002) ), CMMI (2003) ITIL-AM: Build—1 ITIL Application Management Consistent coding conventions Application-independent building guidelines Operability testing Build management checklist Organization of the build team CMMI PI-Prepare for product integration •Determine integration sequence •Establish the integration environment •Establish integration procedures and criteria PI-Ensure interface compatibility •Review interface description for completeness •Manage interfaces PI-Assemble product deliver product •confirm readiness for integration •Assemble product components •Evaluate assembled components •Package and deliver the product or component 40 Source: ITIL: Application Management (2002) ), CMMI (2003) 20
- 21. ITIL-AM: Build—2 ITIL Application Management Consistent coding conventions Application-independent building guidelines Operability testing Build management checklist Organization of the build team CMMI VE-Prepare for verification •Select work products for verification •Establish the verification environment •Establish verification procedures and criteria VE-Perform peer reviews •Prepare for peer reviews •Conduct peer reviews •Analyze peer review data VE-Analyze selected work products •Perform verification •Analyze verification results and identify corrective action 41 Source: ITIL: Application Management (2002) ), CMMI (2003) ITIL-AM: Deploy ITIL Application Management CMMI Planning the deployment Approving the deployment Distributing applications Pilot deployments Deployment management checklists Organization of the deployment team 42 Source: ITIL: Application Management (2002) 21
- 22. ITIL-AM: Operate ITIL Application Management CMMI Day-to-day maintenance activities to maintain service levels Application state Benefits of an application Operations management checklist Organization of the operations team 43 Source: ITIL: Application Management (2002) ITIL-AM: Optimize ITIL Application Management CMMI Application review process Optimization management checklist Organization of the optimization team 44 Source: ITIL: Application Management (2002) 22
- 23. Service Delivery Processes Availability Management Service Level Management Requirements Targets, Achievements Capacity Management Financial Management Alerts & exceptions, Changes 45 Continuity Management Source: ITIL: Planning to Implement Service Management (2002, p.7) ITIL-SD: Service Level Mgt. ITIL Service Delivery Planning service delivery CMMI PP Service catalogue Service level requirements Service level agreement PP SG 3 Operational level agreements PP SG 3 Monitor and report service delivery PMC Service improvement program 46 REQM, RD OPF, OID Source: ITIL: Service Delivery (2001) 23
- 24. ITIL-SD: Financial Mgt. ITIL Service Delivery CMMI Budgeting IT accounting system IT charging system Planning IT financial mgt Implementing IT financial mgt Financial operation and reporting Managing variances 47 Source: ITIL: Service Delivery (2001) ITIL-SD: Capacity Mgt. ITIL Service Delivery CMMI Business capacity management Service capacity management Resource capacity management Monitoring PMC SG1 Analysis OPP Tuning OPP, OID Implementation Demand management Modeling QPM Application sizing Capacity planning 48 Source: ITIL: Service Delivery (2001) 24
- 25. ITIL-SD: Continuity Mgt.—1 ITIL Service Delivery CMMI Initiate business continuity mgt. Business impact analysis Risk assessment RSKM Business continuity strategy Org. and implementation planning PP Implement standby arrangements Develop recovery plans Implement risk reduction measures RSKM Develop procedures OPD, TS Initial testing 49 PP VER Source: ITIL: Service Delivery (2001) ITIL-SD: Continuity Mgt.—2 ITIL Service Delivery CMMI Education and awareness OT Review and audit VER, PPQA Tuning Change management Training OT Assurance 50 CM VAL, PPQA Source: ITIL: Service Delivery (2001) 25
- 26. ITIL-SD: Availability Mgt. ITIL Service Delivery CMMI Availability requirements Failure impact analysis CAR Availability targets REQM Availability measures and reporting MA Monitoring and trend analysis PMC SG1 Availability problem detection PMC SG2 Availability problem prevention PMC SG2 Availability planning 51 REQM, RD PP Source: ITIL: Service Delivery (2001) Service Support Processes Incident Management Incidents Problem Management Changes Releases Change Management Release Management Configuration Management Repository 52 Configuration Management Source: ITIL: Planning to Implement Service Management (2002, p.6) 26
- 27. ITIL-SS: Incident Mgt. ITIL Service Support CMMI Incident detection and recording Classification and initial support Investigation and diagnosis Resolution and recovery Incident closure Ownership, monitoring, tracking, and communication 53 Source: ITIL: Service Support (2000) ITIL-SS: Problem Mgt. ITIL Service Support CMMI Problem identification and recording Problem classification CAR SP1.1 Problem investigation and diagnosis VER SP3.2, CAR SP1.2 Error identification and recording VER SP3.2 Error assessment VER SP3.2 Error resolution recording VER SP3.2 Error closure VER SP3.2 Problem/error resolution recording 54 Source: ITIL: Service Support (2000) 27
- 28. ITIL-SS: Configuration Mgt. ITIL Service Support CMMI Configuration management planning CM GP2.2 Configuration identification CM SP1.1 Control of configuration items CM SP1.2, SP2.2 Configuration status accounting CM SP3.1 Configuration verification and audit CM SP3.2 CMDB backups, archives, and housekeeping CM SP1.2 Configuration management service 55 Source: ITIL: Service Support (2000) ITIL-SS: Change Mgt.—1 ITIL Service Support CMMI Planning the implementing of operational processes Change logging and filtering CM SP2.1 Allocation of priorities CM SP2.1 Change categorization CM SP2.1 Change Advisory Board meetings CM SP2.2 Impact and resource assessment CM SP2.1 Change approval CM SP2.2 Change scheduling CM SP2.2 Change building, testing, and implementation 56 CM GP2.2 CM SP2.2 Source: ITIL: Service Support (2000) 28
- 29. ITIL-SS: Change Mgt.—2 ITIL Service Support CMMI Urgent change scheduling Urgent change building, testing, and implementation CM SP2.2 Change review CM SP2.2 Reviewing the change management process for efficiency & effectiveness CM GP2.8, GP2.9, P2.10 Roles and responsibilities 57 CM SP2.2 CM GP2.4 Source: ITIL: Service Support (2000) ITIL-SS: Release Mgt. ITIL Service Support Release planning CMMI CM GP2.2 Designing, building, and configuring a CM SP1.3 release Release acceptance VE SP3.1 Rollout planning CM GP2.2 Communication, preparation, and training Distribution and installation 58 Source: ITIL: Service Support (2000) 29
- 30. ICT Infrastructure Mgt. Design and planning Deployment Operation Technical support 59 Source: ITIL: ICT Infrastructure Management (2002, p.9) ITIL-ICT: Design & Planning ITIL ICT Infrastructure Mgt. CMMI Strategic management Review current position Define desired state Design and implement a plan Review progress of the plan Source: ITIL: ICT Infrastructure Management (2002) 60 30
- 31. ITIL-ICT: Deployment ITIL ICT Infrastructure Mgt. CMMI Design phase TS Working environments IPM Build phase TS Acceptance testing VER Rollout phase Handover 61 Source: ITIL: ICT Infrastructure Management (2002) ITIL-ICT: Operation ITIL ICT Infrastructure Mgt. CMMI Manage ICT infrastructure events Operational control and management Workload, output, resilience testing management, & schedules Storage mgt., backup, &recovery ICT operational security Manage support operating processes Proactive operational mgt. processes 62 Source: ITIL: ICT Infrastructure Management (2002) 31
- 32. ITIL-ICT: Technical Support ITIL ICT Infrastructure Mgt. CMMI Research and development Supplier management Document management 63 SAM, ISM PP SG 2 Source: ITIL: ICT Infrastructure Management (2002) BS 15000 Processes Service Delivery Processes Capacity Management Service Level Management Service Continuity and Availability Management Service Reporting Control Processes Information Security Management Budgeting and Accounting for IT Services Configuration Management Release Process Release Management Change Management Resolution Processes Relationship Processes Incident Management Problem Management 64 Business Relationship Management Supplier Management Source: BS 15000-2: Service Management (2003) 32
- 33. Maturity of IT Organizations Organization Growth Model Influence on the business high Value chain Business focus Stage 5 Stage 4 Customer focus Stage 3 Product/Service Stage 2 Technology Stage 1 low 65 Source: ITIL: Planning to Implement Service Management (2002, p.27) ITIL’s Maturity Model Level Characterization 1 Little process management activity. Loosely defined processes and procedures, totally reactive, irregular unplanned activities 2 Process activities are uncoordinated, without direction, focused on process effectiveness. Defined processes and procedures, largely reactive 3 Documented process with process owner, but no formal recognition of its role in IT. Clearly defined and occasionally proactive 4 Process fully accepted in IT, with targets based on business goals. Proactive and integrated with other IT service management processes 5 Process has strategic objectives that are institutionalized, self-contained improvements creating a pre-emptive capability. Initial Repeatable Defined Managed Optimized 66 Source: ITIL: Planning to Implement Service Management (2002, p.187-190) 33
- 34. IT-Business Alignment Business objectives should be reflected in all levels of IT. Key Business Drivers Business Function SLAs Service Level Requirements IT Service OLAs Operational Level Requirements IT System Process Requirements Strategic Alignment Objectives Model (SOAM) 67 IT Processes Skill Requirements IT People Technology Requirements Technology Application Characteristics Applications Data Characteristics Data Infrastructure Characteristics Infrastructure Source: ITIL: Application Management (2002, p.14) Rethinking Issues by Level Project level configuration management issues in CMMI space may become organizational issues in IT CM CMMI Content System components, documentation, tools, environment, etc. Service components Control Under local control Not under local control Level Level 2 - project Level 2 – local unit Level 3 – service-wide New issue (project) IT (system components, service processes, forms, training, etc.) (different functional units) Transaction integrity 68 34
- 35. Using ITIL and CMMI ITIL and CMMI best apply to different parts of the IT organization: • Use CMMI in application development • Use CMMI in ICT Infrastructure projects • Use ITIL in IT operations and services The problem—service level application activities: • Option 1—treat each modification/enhancement as a project— CMMI (may require translation) • Option 2—treat the service level agreement as a project—CMMI (requires translation) • Option 3—treat the service level agreement as a service—ITIL 69 Summary CMMI, COBIT, and ITIL (BS 15000) provide complementary models for different IT functions: • Use CMMI and ITIL to implement practices that support COBIT control objectives • Apply CMMI or ITIL to appropriate parts of the IT organization • Select appraisal/certification methods based on appropriateness of fit to the IT processes to be assessed Draw from all standards when designing and implementing processes to ensure a more complete and robust implementation 70 35
- 36. Relevant Websites www.itgi.org www.isaca.org IT Governance Institute Information Systems Audit and Control Assoc. www.itil.co.uk www.itsmf.com UK Office of Government Commerce IT Service Management Forum www.sei.cmu.edu Software Engineering Institute National Defense Industrial Assoc. www.ndia.org 71 Dr. Bill Curtis Bill Curtis is the Chief Process Officer of Borland Software Corp. Prior to its acquisition by Borland, he was the Co-founder and Chief Scientist of TeraQuest in Austin, Texas. He is a former Director of the Software Process Program in the Software Engineering Institute at Carnegie Mellon University. He is a co-author of the Capability Maturity Model for Software, and is the principal architect of the People CMM. Prior to joining the SEI, Dr. Curtis directed research on advanced user interface technologies and the software design process at MCC, developed a global software productivity and quality measurement system at ITT’s Programming Technology Center, evaluated software development methods in GE Space Division, and taught statistics at the University of Washington. P.O. Box 126079 9108 Benview Court Fort Worth, Texas 76126-0079 1-817-228-2994 [email protected] 72 36