IT控制成熟度调查.pptVIP

Goal Establish an actual reference benchmark and a self-assessment tool Based on COBIT process maturity levels For comparison to experts’ reference benchmark Give answers to questions: What are the others doing? Where do we stand? Methodology Survey created by ISACA Web-based pilot survey posted in December 2001 (BenchmarkMe) Pilot-tested by experts Final survey posted in March 2002 E-mail invitation and reminder sent by ISACA Survey closed beginning of June 2002 Results 253 responses After thorough clean-up: 168 responses Different sectors Different locations different sizes * ??This survey provide benchmark material to compare the enterprise state of practice relative to COBIT process maturity.? COBIT Control Maturity Surveys IT Control Maturity Survey IT Control Maturity Survey PO1 Define a strategic IT plan PO3 Determine the technological direction PO5 Manage the IT investment PO9 Assess risks PO10 Manage projects AI1 Identify solutions AI2 Acquire and maintain applications s/w AI5 Install and accredit systems AI6 Manage changes DS1 Define service levels DS4 Ensure continuous service DS5 Ensure system security DS10 Manage problems and incidents DS11 Manage data M1 Monitor the processes The Most Important IT Processes 34 15 7 Survey IT Control Maturity Survey 0 Nonexistent. Complete lack of any recognisable processes. Organisation has not even recognised that there is an issue to be addressed. 1 Initial. There is evidence that the organisation has recognised that the issues exist and need to be addressed. There are, however, no standardised processes but instead there are ad hoc approaches that tend to be applied on an individual or case-by-case basis. The overall approach to management is chaotic. 2 Repeatable. Processes have developed to the stage where similar procedures are followed by different people undertaking the same task. There is no formal training or communication of standard procedures and responsibility is left to the i