1 | P a g e

COBIT 5 Mapping Exercise for

Establishing Enterprise IT Strategy By Christopher Oparaugo, CISM, CGEIT, CRISC

COBIT Focus | 5 December 2016

In recent years, (as demonstrated in my previous article titled “ISO/IEC 27001 Process Mapping to COBIT 4.1 to

Derive a Balanced Scorecard for IT Governance”),1 the balanced scorecard (BSC)

2, 3, 4 has been applied to

enterprise IT and the first real-life IT security governance application has been developed based on mapping the

control objectives from the International Organization for Standardization (ISO)/International Electrotechnical

Commission’s (IEC) ISO/IEC 27001:2013 standard to COBIT®

4.1 process and IT governance focus areas.5 As a

further exercise, the relationships and similarities between ISO/IEC 27001:2013, COBIT 4.1 and COBIT®

5 can be

explored to provide data values, insights and results that will help in strategic management discussions.

What is driving the need for this mapping exercise?

The need to integrate IT governance with overall business governance

The need for effective deployment, governance and management of enterprise IT

The exercise will help in establishing enterprise IT strategy through control objective linkages

Key performance indicators (KPIs) can be derived for individuals or business unit

This article explains how an exercise in instituting controls can be used to establish IT strategy, which is shown in

the resultant enterprise and IT goals BSC values and outcomes applied in COBIT 5. In so doing, it showcases the

IT/business governance and alignment processes as derived from mapping ISO/IEC 27001 and COBIT 4.1 controls

and processes further to COBIT 5 governance and management processes.

Brief Understanding of ISO/IEC 27001:2013 An executive brief from ISO/IEC 27001:2013 sheds more light on the essence of having controls in an enterprise IT

organization.6 Organizations of all types and sizes collect, process, store and transmit information in many forms.

This information is valuable to an organization’s business and operations. In today’s interconnected and mobile

world, information is processed using systems and networks that employ state-of-the-art technology. It is vital to

protect this information against both deliberate and accidental threats and vulnerabilities. ISO/IEC 27001 helps

organizations keep their information assets and those of their customers secure. Effective information security

assures management and other stakeholders that the organization’s assets are safe, thereby acting as a business

enabler.

“The information security management system preserves the confidentiality, integrity and availability of information

by applying a risk management process, which reassures interested parties that risk factors are adequately

managed. It is important for the information security management system to be part of, and integrated with, the

DISCUSS THIS ARTICLE

2 | P a g e

organization’s processes and overall management structure and for information security to be considered in the

design of processes, information systems and controls.”7 The information security risk assessment and treatment

process in this international standard aligns with the principles and generic guidelines provided in ISO 31000.8

What Is the Essence of Having Controls? Enterprise security is no longer solely the realm of the IT department. Within the Internet of Things (IoT) and in the

world, “data is recognized as a core business asset, valuable to companies and cybercriminals alike. Therefore, the

enterprise risk caused by cyber security threats to data requires a holistic approach”9 to security; oversight of

security compliance and controls must be a senior management, C-suite and boardroom responsibility because

security oversight is risk management oversight and, therefore, a corporation’s business oversight.

“Risk management aims to identify the risk a company faces and ways of mitigating it to a bearable level

determined by the company’s risk appetite.”10

It is recognized that risk exists due to the confluence of assets,

threats and vulnerabilities. Accordingly, employing mitigating controls that reduce one or all of these factors

reduces the overall risk exposure of the organization.

“As data risk encompasses the risk of financial losses; business disruption; the loss or compromise of assets and

information; the failure to meet legal, regulatory or contractual requirements; and reputational damage, effective

oversight of IT security is essential to enterprise or corporate oversight of risk management. The need for

information security requires a number of policies and procedures to be created and put in place. These policies, in

turn, require a number of security-related standards and practices to be implemented. However, if the enterprise’s

and personnel’s culture and ethics are not appropriate, enforcing information security processes (the policy

controls) and procedures will not be effective.”11

An exercise in instituting controls can be used to establish IT

strategy, which will be shown in the resultant enterprise and IT goals BSC values and outcomes applied to COBIT 5

governance and management processes.

The resultant summation from the control questions is shown in figure 1 and figure 2 for control domains and

security control areas. With these values from the exercise, low values can be potential areas of security breaches

(i.e., backup, redundancies) leading to business continuity issues. Data security is no longer a cost of doing business,

but a core component of remaining in business. Resources must, therefore, be appropriately allocated to meet

these risk factors. Budgeting must enable the company to deploy, train and develop the right people and processes

and employ technology to truly address the company’s security needs.12

Figure 1—Resulting ISO/IEC 27001:2013 Compliance Data by Domain

3 | P a g e

Source: Christopher Oparaugo. Reprinted with permission

Figure 2—Resulting ISO/IEC 27001:2013 Compliance Data by Controls and Domains

Security Control Domains Status (%)

A.5 Information Security Policies 90.50

A.6 Organization of Information Security 86.43

A.7 Human resource security 88.19

A.8 Asset management 83.29

A.9 Access control 85.71

A.10 Cryptography 82.33

A.11 Physical and Environmental Security 82.26

A.12 Operations Security 82.74

A.13 Communications Security 81.72

A.14 System Acquisition, Development and Maintenance 81.48

A.15 Supplier Relationships 83.40

A.16 Information Security incident management 80.20

A.17 Information Security aspects of Business Continuity Management 80.69

A.18 Compliance 82.47

4 | P a g e

Source: Christopher Oparaugo. Reprinted with permission.

Understanding COBIT 5 in Relation to Governance and Strategy COBIT 5 provides the next generation of ISACA’s guidance on the enterprise governance and management of IT. It

Control Domains Security Control Areas Status (%)

A.5 Information Security Policies Management direction for information security 90.50

Internal Organization 87.72

Mobile devices and teleworking 85.14

Prior to employment 86.25

During employment 90.00

Termination and change of employment 88.33

Responsibility for assets 83.75

Information classification 81.39

Media handling 84.72

Business requirements of access control 86.25

User access management 88.26

User responsibilities 85.00

System and application access control 83.33

A.10 Cryptography Cryptographic controls 82.33

Secure areas 83.38

Equipment 81.15

Operational procedures and responsibilities 85.21

Protection from malware 82.50

Backup 76.67

Logging and monitoring 81.87

Control of operational software 80.00

Technical Vulnerability Management 89.59

Information Systems Audit considerations 83.34

Network Security Management 83.24

Information transfer 80.21

Security requirements of information systems 81.20

Security in development and support processes 83.24

Test data 80.00

Information security in supplier relationships 83.89

Supplier service delivery management 82.92

A.16 Information Security incident

management

Management of information security incidents and

improvements80.20

Information Security Continuity 81.39

Redundancies 80.00

Compliance with Legal and Contractual requirements 81.33

Information Security reviews 83.61

A.17 Information Security aspects of Business

Continuity Management

A.18 Compliance

A.7 Human resource security

A.8 Asset management

A.6 Organization of Information Security

A.9 Access control

A.14 System Acquisition, Development and

Maintenance

A.12 Operations Security

A.13 Communications Security

A.15 Supplier Relationships

A.11 Physical and Environmental Security

5 | P a g e

builds on more than 15 years of practical usage and application of COBIT®

by many enterprises and users from the

business, IT, risk, security and assurance communities.13 COBIT has evolved from an auditing framework to controls,

from being a control framework to an IT governance framework that can be mapped to other international

standards, and now to a governance for enterprise IT (GEIT) framework, showing a management strategy for

enterprise IT.

Key Concepts Information is a key resource for all enterprises, and from the time that information is created to the moment that it

is destroyed, technology plays a significant role. IT is increasingly advanced and has become pervasive in

enterprises and in social, public and business environments.14

“As a result, today, more than ever, enterprises and their executives strive to:

Maintain high-quality information to support business decisions

Generate business value from IT-enabled investments, i.e., achieve strategic goals and realize business benefits

through effective and innovative use of IT

Achieve operational excellence through the reliable and efficient application of technology

Maintain IT-related risk at an acceptable level

Optimize the cost of IT services and technology

Comply with ever-increasing relevant laws, regulations, contractual agreements and policies”15

COBIT 5 is not prescriptive, but it advocates that organizations implement governance and management processes

such that the key areas are covered, as shown in figure 3.

Figure 3—Separating Governance From Management

Source: ISACA, COBIT

® 5, USA, 2012

COBIT 5 provides a comprehensive framework that helps enterprises achieve their goals and deliver value through

effective governance and management of enterprise IT. Successful enterprises have recognized that the board of

directors (BoD) needs to embrace IT just like any other significant part of doing business. Corporate boards and

business management (in both the enterprise and IT functions) must collaborate and work together so that IT is

included within the governance and management functions.

6 | P a g e

In addition, 2 core components of GEIT (controls and compliance) must be overseen at the highest levels of

management to confirm that they are customized for the enterprise standards and are not applied generically:

Controls—The organization’s systems, procedures and processes for protecting data

Compliance—An organization’s program for ensuring adherence to and enforcement of enterprise security

policies and relevant external privacy and data protection laws and regulations. Department’s policies,

standards and procedures are often disconnected from operational practices, and technology infrastructures

that are not tailored specifically to the company operations become worthless effort and ineffective.16

The COBIT 5 framework makes a clear distinction between governance and management. These 2 disciplines

encompass different types of activities, require different organizational structures and serve different purposes.

The COBIT 5 view on this key distinction between governance and management is:

Governance—Governance ensures that stakeholder needs, conditions and options are evaluated to determine

balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision

making; and monitoring performance and compliance against agreed-on direction and objectives. In most

enterprises, governance is the responsibility of the BoD under the leadership of the chairperson.

Management—Management plans, builds, runs and monitors activities in alignment with the direction set by

the governance body to achieve enterprise objectives. In most enterprises, it is the responsibility of the

executive management, under the leadership of the chief executive officer (CEO).17

This article presents a mapping between the requirements of ISO/IEC 27001:2005 and ISO/IEC 27001:2013 using a

previous article’s (“ISO 27001 Process Mapping to COBIT 4.1 to Derive a Balanced Scorecard for IT

Governance,”) control data values and a target value for differentiation. It has been designed for guidance

purposes and discussion.

Further, this article extends the mapping from COBIT 4.1 processes to COBIT 5 processes using input control data

from ISO/IEC 27001:2013 as designed to bring out the BSC dimensions for a strategic guide and measurement

system.

Adopting the Lean Management theory’s 5 Whys approach, the process of continually asking questions until you

get to the root cause,18 enabled the validation of the assessment results to get closer to a problem or low value

until the real issue is understood. The 5 Whys method helps managers eliminate waste and aids executives in

figuring out which projects or controls to pursue and which to address to find solutions to underperforming areas

in a controlled environment to aid enforcement of the policy. Productivity and strategy mean different things to

different people, but, at their core, the meaning is how effective an organization’s decisions are in delivering

subsequent results.

COBIT 5 addresses the governance and management of information and related technology from an

enterprisewide, end-to-end perspective (figure 4).19

Figure 4—Covering the Enterprise End-to-end

7 | P a g e

Source: ISACA, COBIT®

5, USA, 2012

The questions help stakeholders understand whether the set objectives were achieved based on the results and

backward reviews of the elements contributing to these results. These results also show IT governance pain points

to be addressed. In addition to these activities, COBIT 5 suggests accountabilities and responsibilities for enterprise

roles and governance/management structures (responsible, accountable, consulted and informed [RACI] charts) for

each process and Capability Maturity Model Integration (CMMI) scores help stakeholders see the picture and values

of control activities.

These resultant data from the exercise were further employed as COBIT information criteria for primary and

secondary grouping. The resultant values of the ISO/IEC 27001:2013 mapping to COBIT 4.1 processes are linked

with the defined IT governance areas.

The value inputs of 0% to 100% from the ISO/IEC 27001:2013 control objectives security control questions are

mapped to COBIT 4.1 domains and processes, and further mapping is done from COBIT 4.1 to COBIT 5 related

processes. These are linked to the IT focus areas as exercise results showing the values from the data mapping

outputs, illustrated in figure 5.

Figure 5—Results Showing Mapping of ISO/IEC 27001:2013 Data to COBIT Processes

8 | P a g e

Source (table): ISACA, Mapping COBIT 4.1 to ISO /IEC 27001, USA, 2005

Source (numeric values): Christopher Oparaugo. Reprinted with permission.

The results in figure 6 are a comparison of COBIT 4.1 domain results from the previous mapping of ISO/IEC

27001:2005 to ISO/IEC 27001:2013 data that was then mapped to COBIT 4.1

COBIT 4.1 Domains and Processes

Risk

Rank

Strategic

Alignment

Value

Delivery

Resource

Mgt

Risk

Mgt

Performance

Management

ISO

27001:2013

Status

(%)

1 Plan and Organise Mapping

PO1 Define a Strategic IT Plan H P S S 88.33 88%

PO2 Define the Information Architecture L P S P S 80.69 81%

PO3 Determine Technological Direction M S S P S 84.33 84%

PO4 Define the IT Processes, Organisation and Relationships L S P P 85.25 85%

PO5 Manage the IT Investment M S P S S 86.33 86%

PO6 Communicate Management Aims and Direction M P P 84.40 84%

PO7 Manage IT Human Resources L P P S S 89.20 89%

PO8 Manage Quality M P S S 81.67 82%

PO9 Assess and Manage IT Risks H P P 83.03 83%

PO10 Manage Projects H P S S S S 90.00 90%

85%

2 Acquire and Implement

AI1 Identify Automated Solutions M P P S S 83.82 84%

AI2 Acquire and Maintain Application Software M P P S 82.22 82%

AI3 Acquire and Maintain Technology Infrastructure L P 84.37 84%

AI4 Enable Operation and Use L S P S S 83.61 84%

AI5 Procure IT Resources. M S P 80.83 81%

AI6 Manage Changes. H P S 86.50 87%

AI7 Install and Accredit Solutions and Changes M S P S S S 85.00 85%

84%

3 Deliver and Support

DS1 Define and Manage Service Levels M P P P P 82.92 83%

DS2 Manage Third-party Services L P S P S 81.95 82%

DS3 Manage Performance and Capacity L S S P S S 80.00 80%

DS4 Ensure Continuous Service M S P S P S 84.00 84%

DS5 Ensure Systems Security H P 84.48 84%

DS6 Identify and Allocate Costs L S P S 90.00 90%

DS7 Educate and Train Users M S P S 83.33 83%

DS8 Manage Service Desk and Incidents M S P S 80.32 80%

DS9 Manage the Configuration M P S 81.39 81%

DS10 Manage Problems M P S 80.00 80%

DS11 Manage Data H P P P 80.22 80%

DS12 Manage the Physical Environment L S P 82.17 82%

DS13 Manage Operations L P 82.25 82%

83%

4 Monitor and Evaluate

ME1 Monitor and Evaluate IT Performance. H P 80.28 80%

ME2 Monitor and Evaluate Internal Control. M P P 84.10 84%

ME3 Ensure Regulatory Compliance. H P P 84.21 84%

ME4 Provide IT Governance. H P P P P P 86.99 87%

84%

COBIT4.1 Domains and Processes

ScoreFuture

State

PERCENTAG

E

COMPLIANC

E

Plan and Organise 85% 90% 95%

Acquire and Implement 84% 90% 93%

Deliver and Support 83% 90% 92%

Monitor and Evaluate 84% 90% 93%

84% 90% 93%

IT GOVERNANCE FOCUS AREAS

9 | P a g e

The new target exercise (having different data input values for comparison) represents values directly from the

mapping of ISO/IEC 27001:2013 to COBIT 4.1.

The previous results were Plan and Organize (55%), Acquire and Implement (64%), Deliver and Support (55%), and

Monitor and Evaluate (64%). There is a remarkable increase in the values generated through this realignment from

ISO 27001:2005 to ISO 27001:2013.

Figure 6—Comparing Sample Results Showing Mapping of ISO/IEC 27001:2005 From the Previous

Article’s Exercise and New ISO/IEC 27001:2013 Data to COBIT 4.1 Control Objectives

Using the scores from previous exercises of ISO 27001:2005 now mapped to ISO 27001:2013 producing the mapped

results for COBIT 4.1 domains, showing compliance to future state.

New target exercise scores for ISO 27001:2013 are mapped to COBIT 4.1 domains and processes, showing

compliance to future state.

Source: Christopher Oparaugo. Reprinted with permission.

Having done this comparison, the focus is now to determine a relationship and understanding of how these scores

and values map to COBIT 5.

The COBIT 5 process reference model divides the governance and management processes of enterprise IT into 2

main process domains:

Governance—Contains 1 domain with 5 governance processes; Evaluate, Direct and Monitor (EDM) consisting

of 5 processes in COBIT 5.

Management—The management principles of COBIT 5, having evolved from the Plan, Do, Check and Act

(PDCA) maxim, follows the functional responsibility areas of plan, build, run and monitor (PBRM) creating a new,

elaborate set of 4 domains, and provides end-to-end coverage of IT. These domains are an evolution of the

COBIT 4.1 domain and process structure as shown below:

o Align, Plan and Organize (APO) consisting of 13 processes

10 | P a g e

o Build, Acquire and Implement (BAI) consisting of 10 processes

o Deliver, Service and Support (DSS) consisting of 6 processes

o Monitor, Evaluate and Assess (MEA) consisting of 3 processes

Useful COBIT 5 Governance and Management Interactions “Principles, policies and frameworks—The vehicle by which governance decisions are institutionalized within the

enterprise. For that reason, they are an interaction between governance decisions (direction setting) and

management (execution of decisions).

Services, infrastructure and applications—Services are required and are supported by applications and

infrastructure to provide the governance body with adequate information and to support the governance activities

of evaluating, setting direction and monitoring.

Processes—In the illustrative COBIT 5 process model (COBIT®

5: Enabling Processes), a distinction is made

between governance and management processes, including specific sets of practices and activities for each. The

process model also includes RACI charts, describing the responsibilities of different organizational structures and

roles within the enterprise.

Enablers—Factors that individually and collectively influence whether something will work—in this case,

governance and management over enterprise IT. Enablers are driven by the goals cascade, i.e., higher-level IT-

related goals define what the different enablers should achieve.”20

To achieve success in enterprise governance and

management, the COBIT 5 enablers must be interconnected and interrelated to deliver on the enterprise and IT

goals. This will help the organization develop a 360-degree vision of cyber security.

These resultant data from the exercise are further employed as COBIT information criteria for primary and

secondary grouping. The resultant values of the ISO/IEC 27001:2013 mapping into COBIT 5 processes are linked

with the defined IT BSC dimension information and related technology goals. Exercise results showing the values

from the data mapping outputs are shown in figure 7.

Figure 7—Results Showing Mapping Data Values of COBIT 4.1 Control Objectives (Using Input Data

From ISO/IEC 27001:2013) to COBIT 5 Governance and Management Practices

11 | P a g e

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17

1 Evaluate, Direct and Monitor

EDM01Ensure Governance Framework

Setting and MaintenanceP S P S S S P S S S S S S S S S

85.66 86%

EDM02 Ensure Benefits Delivery P S P P P S S S S S S S P 87.66 88%

EDM03 Ensure Risk Optimisation S S S P P S S P S S P S S 84.81 85%

EDM04 Ensure Resource Optimisation S S S S S S S P P S P S 86.99 87%

EDM05 Ensure Stakeholder Transparency S S P P P S S S S - 0%

69%

2 Align, Plan and Organise

APO01Manage the IT Management

FrameworkP P S S S P S P S S S P P P

84.48 84%

APO02 Manage Strategy P S S S P S S S S S S S S P 86.33 86%

APO03 Manage Enterprise Architecture P S S S S S S P S P S S S 82.51 83%

APO04 Manage Innovation S S P P P P S S P 84.33 84%

APO05 Manage Portfolio P S S P S S S S S P S 87.33 87%

APO06 Manage Budget and Costs S S S P P S S S S 88.17 88%

APO07 Manage Human Resources P S S S S S S P P S P P 85.93 86%

APO08 Manage Relationships P S S S S P S S P S S S P - 0%

APO09 Manage Service Agreements S S S S P S S S S S P S 82.92 83%

APO10 Manage Suppliers S P S S P S P S S S S S S 81.39 81%

APO11 Manage Quality S S S P P S S S P S S S S 83.46 83%

APO12 Manage Risk P P P S S S P P S S S S 83.03 83%

APO13 Manage Security P P P S S P P 84.48 84%

78%

3 Build, Acquire and Implement

BAI01 Manage Programmes and Projects P S P P S S S S P S S 90.00 90%

BAI02 Manage Requirements Definition P S S S S P S S S S P S S S 83.82 84%

BAI03Manage Solutions Identification and

BuildS S S P S S S S S S

82.48 82%

BAI04 Manage Availability and Capacity S S P S S P S P S 80.00 80%

BAI05Manage Organisational Change

EnablementS S S S P S S S P P

84.31 84%

BAI06 Manage Changes S P S P S S P S S S S S S 86.50 87%

BAI07Manage Change Acceptance and

Transitioning S S S P S P S S S S85.00

85%

BAI08 Manage Knowledge S S S S P S S S S P 83.61 84%

BAI09 Manage Assets S S P S S S P S S 82.25 82%

BAI10 Manage Configuration P S S S S S P P S 81.39 81%

84%

4 Deliver, Service and Support

DSS01 Manage Operations S P S P S S S P S S S S 81.62 82%

DSS02Manage Service Requests and

IncidentsP P S S S S S

82.64 83%

DSS03 Manage Problems S P S P S S P S P S S 80.00 80%

DSS04 Manage Continuity S S P S P S S S S S P S S S 82.11 82%

DSS05 Manage Security Services S P P S S P S S S S 82.28 82%

DSS06 Manage Business Process Controls S P P S S S S S S S S 80.22 80%

81%

5 Monitor, Evaluate and Assess

MEA01

Monitor, Evaluate and Assess

Performance and Conformance S S S P S S P S S S P S S P S S 80.28 80%

MEA02

Monitor, Evaluate and Assess the System

of Internal Control P P S S S S S P S 85.54 86%

MEA03Monitor, Evaluate and Assess Compliance

With External Requirements P P S S S S S 84.21 84%

83%

77 84 43 83 87 73 74 85 84 84 83 56 86 82 84 86 75

COBIT4.1

Mapping

Status

(%)

IT

co

mp

lian

ce w

ith

in

tern

al p

olicie

s

Co

mp

ete

nt

an

d m

oti

vate

d b

usin

ess a

nd

IT

pers

on

nel

Kn

ow

led

ge, exp

ert

ise a

nd

in

itia

tives f

or

bu

sin

ess in

no

vati

on

Financial Customer Internal

Learning

and

Growth

Op

tim

isati

on

of

IT a

ssets

, re

so

urc

es a

nd

cap

ab

ilit

ies

En

ab

lem

en

t an

d s

up

po

rt o

f b

usin

ess

pro

cesses b

y in

teg

rati

ng

ap

plicati

on

s a

nd

tech

no

log

y in

to b

usin

ess p

rocesses

Delivery

of

pro

gra

mm

es d

eliveri

ng

ben

efi

ts,

on

tim

e, o

n b

ud

get,

an

d m

eeti

ng

req

uir

em

en

ts a

nd

qu

ality

sta

nd

ard

s

Availab

ilit

y o

f re

liab

le a

nd

usefu

l in

form

ati

on

for

decis

ion

makin

g

IT BSC Dimension Information and Related

Technology Goal

COBIT 5 Domains and Processes

Alig

nm

en

t o

f IT

an

d b

usin

ess s

trate

gy

IT

co

mp

lian

ce a

nd

su

pp

ort

fo

r b

usin

ess

co

mp

lian

ce w

ith

exte

rnal la

ws a

nd

reg

ula

tio

ns

Co

mm

itm

en

t o

f execu

tive m

an

ag

em

en

t fo

r

makin

g IT

-rela

ted

decis

ion

s

Man

ag

ed

IT

-Rela

ted

Bu

sin

ess R

isk

COBIT 5 Process

IT BSC Dimension Information and Related Technology Goal

Realised

ben

efi

ts f

rom

IT

-en

ab

led

investm

en

ts a

nd

serv

ices p

ort

folio

Tra

nsp

are

ncy o

f IT

co

sts

, b

en

efi

ts a

nd

ris

k

Delivery

of

IT s

erv

ices in

lin

e w

ith

bu

sin

ess

req

uir

em

en

ts

Ad

eq

uate

use o

f ap

plicati

on

s, in

form

ati

on

an

d t

ech

no

log

y s

olu

tio

ns

IT

Ag

ilit

y

Secu

rity

of

info

rmati

on

, p

rocessin

g

infr

astr

uctu

re a

nd

ap

plicati

on

s

12 | P a g e

Source (table): ISACA, COBIT®

5, USA, 2012

Source (numerical data values): Christopher Oparaugo. Reprinted with permission.

The mapped data values of COBIT 4.1 control objectives (using input data from ISO/IEC 27001:2013) to COBIT 5

governance and management practices shows how an IT-related goal is supported by a COBIT 5 IT-related process.

This mapping is expressed using the following scale:

"P" stands for primary, indicating there is an important relationship, i.e., the COBIT 5 process is a primary

support for the achievement of an IT-related goal.

“S" stands for secondary, indicating there is still a strong, but less important, relationship, i.e., the COBIT 5

process is a secondary support for the IT-related goal.21

The compared results in figure 8 show that Evaluate, Direct and Monitor (EDM) (the governance area for enterprise

IT) was lowest in all the cases as the bulk of the alignment was related to COBIT 4.1 in the other 4 domains of COBIT

5 governance and management practices (i.e., core enterprise IT management area).

Figure 8—Comparing Sample Results of ISO/IEC 27001:2005, ISO/IEC 27001:2013, COBIT 4.1 and

COBIT 5 Mappings

Legend:

In the columns, all 17 generic IT-related goals, grouped in IT BSC dimensions

In the rows, all 37 COBIT 5 processes, grouped by domain

13 | P a g e

Source: Christopher Oparaugo. Reprinted with permission.

These results confirm that the bedrock of GEIT under COBIT 5 is in the BAI domain, which has taken on many

elements of the COBIT 4.1 domains of Plan and Organize (PO), Acquire and Implement (AI) and Deliver and Support

(DS).

Using the Balanced Scorecard as a Strategic Management System “The BSC revolutionized conventional thinking about performance metrics. When the concept was first introduced

in 1992, companies were busy transforming themselves to compete in the world of information; their ability to

exploit intangible assets was becoming more developed than their ability to manage physical assets.

The authors of the BSC describe how it addresses a serious deficiency in traditional management systems: the

inability to link a company’s long-term strategy with its short-term financial goals. The scorecard lets managers

introduce 4 new processes (in the 3rd

-generation edition) that help companies make that important link.”22

“The first process—translating the vision—helps managers build a consensus concerning a company’s strategy and

express it in terms that can guide action at the local level. The second—communicating and linking—calls for

communicating a strategy at all levels of the organization and linking it with unit and individual goals. The third—

business planning—enables companies to integrate their business plans with their financial plans. The fourth—

feedback and learning—gives companies the capacity for strategic learning, which consists of gathering feedback,

testing the hypotheses on which a strategy is based and making necessary adjustments.”23

“In addition, while traditional measures report on what happened last period without indicating how managers can

improve performance in the next, the scorecard functions as the cornerstone of a company’s current and future

success.”24

“The information from the 4 perspectives provides balance between external measures such as operating income

and internal measures such as new product development and innovation. This balanced set of measures both

reveals the trade-offs that managers have already made among performance measures and encourages them to

achieve their goals in the future without making trade-offs among key success factors.“25

The assumptions made for using the primary (P) values related to the COBIT 5 processes and IT-related goals are

based on information from COBIT 5:

The COBIT 5 process is a primary support for the achievement of an IT-related goal.

It is primary when there is an important relationship between the COBIT 5 process and IT-related goals.

Achieving IT-related goals requires the successful application and use of a number of enablers.26

There is relationship to the 3 main governance objectives—benefits realization, risk optimization and resource

optimization.27

This understanding from the BSC perspective and a focus on the primary values shows the COBIT 5 governance and

management practices that are a primary (P) support for the achievement of an IT-related goal. Applying these

criteria and assumptions for IT-related goal 01, Alignment of IT and business strategy, which has 10 P values, the

average cumulative score is 77%. The P values and the related COBIT 5 score entries for each of the 17 generic IT-

related goals are added to get a cumulative average score for the particular IT-related goal as represented in figure

9. (See scores related to the 10 P values for IT-related goal 01, Alignment of IT and business strategy in figure 7

assigned to the COBIT 5 processes column COBIT 4.1 Mapping. The average of these [85.66+ 87.66+…+90.00+83.82]

scores is 77.37, approximated to 77 %.)

14 | P a g e

Figure 9—Results Showing Mapping COBIT 5 Data Values From IT-related Goals to Enterprise Goals

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

1 Alignment of IT and business strategy P P S P S P P S P S P S S 77.37 77%

2

IT compliance and support for business

compliance with external laws and

regulations

S P P 83.63 84%

3 Commitment of executive management for

making IT-related decisions P S S S S S P S S 42.83 43%

4 Managed IT-related business risk P S P S P S S S 83.27 83%

5 Realised benefits from IT-enabled

investments and services portfolio P P S S S S P S S 86.82 87%

6 Transparency of IT costs, benefits and risk S S P S P P 72.91 73%

74%

7 Delivery of IT services in line with

business requirements P P S S P S P S P S S S S 73.73 74%

8 Adequate use of applications, information

and technology solutions S S S S S S S P S P S S 85.04 85%

79%9 IT Agility S P S S P P S S S P 83.89 84%

10 Security of information, processing

infrastructure and applications P P P P 84.22 84%

11 Optimisation of IT assets, resources and

capabilities P S S P S P S S S 82.71 83%

12

Enablement and support of business

processes by integrating applications and

technology into business processes

S P S S S S P S S S S 56.27 56%

13 Delivery of programmes delivering

benefits, on time, on budget, and meeting

requirements and quality standards

P S S S S S P 85.68 86%

14 Availability of reliable and useful

information for decision making S S S S P P S 82.09 82%

15 IT compliance with internal policies S S P 83.78 84%

80%

16 Competent and motivated business and IT

personnel S S P S S P P S 85.80 86%

17 Knowledge, expertise and initiatives for

business innovation S P S P S S S S P 74.58 75%

Enterprise Goals by BSC 74.86 75.44 84.43 83.93 72.91 75.55 83.19 77.39 79.73 79.63 75.26 80.82 68.63 85.42 83.88 85.80 79.23 80%

Enterprise Goals Status (%) 75% 75% 84% 84% 73% 76% 83% 77% 80% 80% 75% 81% 69% 85% 84% 86% 79%

78% 79% 79% 83%

Man

ag

ed

bu

sin

ess r

isk

(safeg

uard

ing

of a

ssets)

COBIT5 -

IT Goals

Scores

Skille

d a

nd

mo

tiv

ated

peo

ple

Internal

Learning

and

Growth

Bu

sin

ess s

ervic

e c

on

tin

uit

y a

nd

availab

ilit

y

Ag

ile r

esp

on

ses t

o a

ch

an

gin

g

bu

sin

ess e

nvir

on

men

t

In

fo

rm

atio

n-b

ased

strateg

ic

decis

ion

makin

g

Op

tim

isatio

n o

f s

ervic

e d

elivery

co

sts

Op

tim

isatio

n o

f b

usin

ess p

ro

cess

fu

nctio

nality

Op

tim

isatio

n o

f b

usin

ess p

ro

cess

co

sts

IT BSC Dimension Information and Related

Technology Goal

Op

eratio

nal an

d s

taff p

ro

du

ctiv

ity

Co

mp

lian

ce w

ith

in

tern

al p

olicie

s

Fin

an

cia

l tran

sp

aren

cy

Cu

sto

mer-o

rie

nted

servic

e c

ult

ure

BSC Dimension Mapping COBIT 5 Enterprise Goals to IT-related Goals

Average COBIT 5

Related Process

scores with Primary

support to the IT-

related goal

Pro

du

ct a

nd

bu

sin

ess in

no

vatio

n

cu

ltu

re

Financial Customer

Status

(%) C

om

plian

ce w

ith

extern

al la

ws a

nd

reg

ula

tio

ns

Man

ag

ed

bu

sin

ess c

han

ge

pro

gram

mes

Stakeh

old

er v

alu

e o

f b

usin

ess

investm

en

ts

Po

rtfo

lio

of c

om

petit

ive p

ro

du

cts

an

d s

ervic

es

Fin

an

cia

lC

usto

mer

Inte

rn

al

Learn

ing

an

d

Gro

wth

15 | P a g e

Source (table): ISACA, COBIT®

5, USA, 2012

Source (numeric data values): Christopher Oparaugo. Reprinted with permission.

Having completed these exercises and reviewed the outcomes, it is important to distil the values by making

assumptions in using the legend’s primary values of the BSC related to the enterprise goals mapping to COBIT 5 and

IT-related goals based on the information from ISACA COBIT 5 framework as follows:

The IT-related goal is a primary support for the enterprise goal.

It is primary when there is an important relationship between enterprise and IT-related goals.

Achieving IT-related goals and enterprise goals requires the successful application and use of a number of

enablers.

There is relationship to the 3 main governance objectives—benefits realization, risk optimization and resource

optimization.28

With this understanding from a BSC perspective and focusing on the “P” values that show that the COBIT 5

governance and management practices are a primary support for the achievement of an IT-related goal. Applying

these criteria and assumptions, for IT-related goal 01—Alignment of IT and business strategy—that has 10 P values,

the result is an average score of 77% (from figure 7 data). For the enterprise goal 1 of Stakeholder value of business

investments which has 6 P values, the result is an average score of 75%. This is achieved by calculating the

cumulative average of the IT-related goals (column COBIT 5 - IT Goals Score) aligned/mapped to the enterprise goals

with P values/fields.

The P values and the related enterprise goals score entries for each of all 17 generic IT-related goals are added to

get a cumulatively average score for the particular enterprise related/mapped goal.

The BSC can serve as the fulcrum, defining and communicating priorities to managers, employees, investors and

even customers. The scorecard is a strategic measurement system, not a measure of strategy that is reviewed every

month or modified for weekly meetings. The 6 IT scorecard implementation cycles can be reviewed in line with the

outcome of the exercises and effected.

The aim or objectives of the BSC should be:

Improvement/alignment of processes and removal of enterprise operation bottlenecks

Increased financial usage/return on investment/capital employed

Greater customer satisfaction and loyalty

Motivated/educated employees

Enhanced information systems/employees understanding the business

Successful realization of the strategic plan/vision

Monitored activities and progress visibility

Instituting controls enable the enterprise to build effective governance and management results that optimize

information and technology investment and use for the benefit of stakeholders through an on-the-ground

assessment based on controls using a BSC approach. These results also show IT governance pain points to be

addressed. In addition to these activities, COBIT 5 suggests accountabilities and responsibilities for enterprise roles

Legend:

The purpose of this mapped table in Figure 9 is to demonstrate how enterprise goals are supported by or translate into IT-related goals

showing the values for compliance purposes.

For that reason, the table contains the following information:

• In the columns, all 17 generic enterprise goals defined in COBIT 5, grouped by BSC dimension

• In the rows, all 17 IT-related goals, grouped in IT BSC dimensions

• A mapping of how each enterprise goal is supported by IT-related goals. This mapping is expressed using the following scale: “P” stands for

primary, indicating there is an important relationship, i.e., the IT-related goal is a primary support for the enterprise goal. “S” stands for

secondary, indicating there is still a strong, but less important, relationship, i.e., the IT-related goal is a secondary support for the enterprise

goal.

16 | P a g e

and governance/management structures.29

The final outcome on these exercises is shown in figure 10. If there were great deviations or skewed results, further

reviews and employing the 5 Whys would be called into play to determine the elements from the ISO 27001 control

questions that impacted these outcomes negatively and caused the deviations. Keep in mind that for a BSC to be

established, all the criteria (the aim/objectives) should be met based on these 4 perspectives:

Financial

Customer

Internal

Learning and growth

This article highlights the importance of proper mapping to process and domains for both ISO and COBIT to achieve

these results.

Figure 10—Results Showing Mapped COBIT 5 Data Values to Achieve IT-related Goals, BSC and

Enterprise Goals BSC

Source: Christopher Oparaugo. Reprinted with permission.

Conclusion IT governance is not an isolated discipline. It is an integral part of overall enterprise governance that drives the

business in these days of IoT. This helps successful business enterprises understand the IT risk and exploit the

benefits of IT, and find ways to deal with aligning IT strategy with the business strategy, incorporating IT strategy

and goals into the fabrics of enterprise businesses and insisting that an IT control framework be adopted and

implemented.30

This understanding and discipline cuts across government and public and private business entities

for effective deployment, governance and management of the enterprise IT.

Having gone through these exercises of mapping ISO/IEC 27001:2005 controls to ISO/IEC 27001:2013 controls and

getting the results from COBIT 4.1 data mapped to COBIT 5, it can be deduced that when these controls are

properly mapped, the end results shows an evenly distributed BSC for APO, BAI, DSS and MEA (the core

operation/enterprise IT management areas in COBIT 5), while EDM is more of a governance area and has a lower

IT Goals BSC Mapping to COBIT 5 Score

Financial Perspective 74%

Customer Perspective 79%

Internal Perspective 80%

Learning and Growth Perspective 80%

78%

Enterprise Goals BSC Mapping to

COBIT 5 and IT GoalsScore

Financial Perspective 78%

Customer Perspective 79%

Internal Perspective 79%

Learning and Growth Perspective 83%

80%

17 | P a g e

score in all outcomes.

Enterprises that understand the risk and exploit the benefits of IT and cascade IT strategy and goals down to the

enterprise business will insist that IT control framework be adopted and implemented, as IT governance is not an

isolated discipline in an organization.

The need to integrate IT governance with overall business governance is similar to the need for IT to be an integral

part of the business. Organizations recognize that risk exists due to the confluence of assets, threats and

vulnerabilities and, accordingly, employing mitigating controls that reduce one or all of these factors will reduce the

overall risk exposure of the organization.

Enterprise security is no longer a concern for only the IT department. Today’s IoT world means that data are a core

business asset, valuable to companies and cybercriminals or Internet hackers alike.

Christopher Oparaugo, CISM, CGEIT, CRISC Is the chief technology officer at KATEC Consulting Ltd. He has also worked in various positions in the

telecommunication and banking industries in West Africa. Prior to joining KATEC Consulting Ltd, he was an

information security consultant with IBM Global Business Services. Oparaugo has contributed to the ISACA®

Certified Information Security Manager®

, Certified in the Governance of Enterprise IT®

and Certified in Risk and

Information Systems Control™ examinations. He has also participated in ISACA certification projects and has been

part of the ISACA Test Enhancement Committee since 2005, setting exam questions and reviewing exam manuals.

Endnotes 1 Oparaugo, C.; “ISO 27001 Process Mapping to COBIT 4.1 to Derive a Balanced Scorecard for IT Governance ,” COBIT Focus, 14 December, 2015, figure 10 2 Kaplan, R.; D. Norton; “Using the Balanced Scorecard as a Strategic Management System ,” Harvard Business Review,

January-February 1996, p. 75-85 3 Van Grembergen, W.; ”The Balanced Scorecard and IT Governance,” Information Systems Control Journal, vol. 2, 2000 4 Op cit, Oparaugo 5 Ibid. 6 International Organization for Standardization, ISO/IEC 27001—Information Security Management 7 Op cit, Oparaugo 8 Op cit, ISO/IEC 27001 9 IT Governance.com 10 Ibid. 11 Ibid. 12 Ibid. 13 ISACA, COBIT

® 5, USA, 2012

14 Ibid. 15 Ibid. 16 Op cit, IT Governance.com 17 Op cit, COBIT 5 18 Gold, C.; “Total Quality Management in Information Services—IS Measures: A Balancing Act,” Ernst & Young Center for Information Technology

and Strategy, research note, 1992 19 Op cit, COBIT 5 20 Ibid. 21 Ibid.

22 Lawrie, G.J.G.; I. Cobbold; J. Marshall; “Corporate Performance Management System in a Devolved UK

Governmental Organisation: A Case Study,” International Journal of Productivity and Performance Management, vol. 53, no. 4, 2004,

p. 353–370

18 | P a g e

23 Op cit, Kaplan and Norton

24 Ibid. 25 Ibid. 26 Op cit, COBIT 5

27 Vendang Software

28 Ibid. 29 Ibid. 30 Op cit, Oparaugo