1 Chapter 2 Reference Models, Standards & Frameworks

2 Learning Objectives  IT Governance frameworks  Related industry standards, guideline  Maturity model, reference  การเลือกใช้งาน framework

3 ข้อจำกัดของ model, standard, framework  ส่วนใหญ่ ไม่ครบวงจร  ไม่มี How to Process Template Checklist Tools  Too flexible / too rigid

4 Integrated IT Governance Framework  Philosophy  Key issue  Legal  Maturity  Culture

5 Maturity model

6 เนื้อหาสำคัญและจำเป็นใน Framework / Model (from chapter1) 1.Business plan 2.IT plan ที่สัมพันธ์กับ ข้อ 1, investment port folio 3. การนำ IT plan ไปปฏิบัติ, ความเสี่ยง, ภัย 4. ประสิทธิภาพ ตัวควบคุม ตัววัด 5.Vendor & Outsourcing 6.IT People, process improvement

7 International Standards & Frameworks: Focus Areas  IT Governance – General  Project management  System/Software development  Quality/Security  IT Operations & Infrastructure More….

8 International Standards & Frameworks: Focus Areas cont.  Human Resources  Performance measurement  Regulatory Compliance  Outsourcing & Vendor management  Voice of Customer

9 IT Governance -General  ModelName CObit  Author ITGI/ Well & Ross / U of Holland v  Use A framework which links IT process Decision maker  Certification: CISA/ CISM

10 IT Governance –General cont.  Model name COSO internal control framework  Author COSO Comittee of Sponsoring Organsations of Tredway Comission, AICPA, AAA  Use Reliability of financial statement

COSO  Consists of 5 components Control environment Risk assessment Control activities Information & communications Monitoring 11

12 Project Management  Model IT Investment Management (ITIM)  Author General Account Office (GAO) of US Government  Use Evaluate select & prioritize IT investment

ITIM Maturity stages 13

14 Project Management cont.  Model PMBOK – Project Mamangement Book of Knowledge OPM3 Organizational PM Maturity Model  Author Project Management Institute PMI, 2004  Use 9 Knowledge & 5 Processes areas of PM Tool for self assessment PM maturity  Certification PMP Project Management Professional

OPM3 Framework 15

16 Project Management cont.  Model PMMM – PM Maturity Model blends PMBOK with CMMI  Author Crawford 2002  Use Map CMMI to PMBOK to provide PM maturity roadmap

17 Project Management cont.  Model PRINCE2  Author Central Computer and Telecommunications Agency (CCTA) or Office of Government Commerce (OGC)  Use UK Government application development

18 System / Software Development  Model Capability Maturity Model Integration (CMMI)  Author SEI / Carnegie Melon University 2002, 2005  Use 5 stage maturity acquisition / system & software development  Certification Organization: Level of maturity

19 Quality /Security cont.  Model ISO 9001  Author Motorola & GE ( ร่วมกันศึกษา )  Use Quality management policy

20 8 Quality principle ISO  Customer  Leadership  People  Process approach  System approach (inter-process)  Continuous Improvement  Decision on facts  Supplier management

21 Quality /Security  Model Six sigma, Lean, Baldridge Quality Award  Author Motorola & GE  Use Reduce error & defect  Certification: black belt

22 Quality /Security cont.  Model ISO ISO27001 implementation guideline for  Author ISO 2005  Use IT security model  Certification organizational level

23 ISO &  Plan-Do-Check-Act (PDCA model) Plan Do: implement / operated /maintained Check: monitored/measured/ audited/reviewed Act: improved  11 security policy domains

24 IT Operation & Infrastructure  Model ISO  Author ITSMF IT Service Management Forum V  Use 10 processes of IT service management

25 ISO  Key Process 1.Service Level Management SLM 2.Service delivery 3.Relationship management (supplier) 4.Resolution management (Problem) 5.Control & release (Config & change)

26 IT Operation & Infrastructure  Model ITIL IT Infrastructure Library v2 v3  Author CCTA, APMG Accrediting Professional Management group 2007  Use 10 processes of IT service management

27 Human Resource  Model P-CMM people capability maturity model  Author SEI software engineering institute, Carnegie Mellon University  Use Advancing people & competencies

28 Performance management  Model Balance Scored Card, Critical success Factor  Author Kaplan & Norton, Cattuci, Rockhart  Use วัดผลของความสำเร็จด้วย กลยุทธ์

29 Outsourcing & Vendor Management  Model OPBOK, eSCM (eSourcing Capability Model)  Author Carnegie Mellon University  Use How to outsource IT & how to manage vendor  Certification: COP Certify Outsourcing Personal

30 Outsourcing & Vendor Management  eSCM eSCM –SP for service provider eSCM – CL for customer  OPBOK Outsourcing Processional Body of Knowledge

31 Customer  Model VOC Voice of Customer  Author Kano  Use Customer requirement

32 Regularity Compliance กฎหมาย  Model Sarbanes-Oxley Act SOX 2002  Author US Congress  Use For Board & executive responsibility

33 Regularity Compliance กฎหมาย cont. Sarbanes-Oxley Act of 2002  Public Company Accounting Reform and Investor Protection Act of 2002  SOX or Sarbox  Senator Paul Sarbanes (D-MD) and Representative Michael G. OxleyPaul SarbanesDMDMichael G. Oxley  SOX Section 404: Assessment of internal control

34 Regularity Compliance กฎหมาย cont. AS 8000 / AS 8015  Model AS8000 for enterprise governance AS8015 for ICT governance  Author Standard Australia 2003

35 Regularity Compliance กฎหมาย cont.  Model FDA, FDIC, HIPPA, SEC  Author US government agency  Use Selected industry

ค้นคว้าต่อ chapter The Carnegie Mellon Software Engineering Institute (SEI) สมาคมผู้ควบคุมและตรวจสอบระบบ สารสนเทศ - ภาคพื้นกรุงเทพฯ The American Institute of Certified Public Accountants (AICPA) The American Accounting Association The General Accounting Office (GAO), created by the Budget and Accounting Act Project management Institute The Office of Government Commerce (OGC) is the most widely accepted approach to IT service management Professor Noriaki Kano