Evaluating Business Service Continuity and Availability Using COBIT 2019

COBIT^® 2019’s enterprise goal EG06 Business service continuity and availability must be foremost in everyone’s mind today due the ongoing pandemic situation. It is important to identify the critical components that need to be evaluated to assess the preparedness of an organization toward business service continuity and availability.

The COBIT^® goals cascade (figure 1) provides a step-by-step approach for identification of the alignment goals and the governance and management objectives that are related to an enterprise goal. So, the first step is to find the alignment goals, followed by the related governance and management objectives.

The appendices in COBIT^® 2019 Framework: Governance and Management Objectives provide several mapping tables, including the A.1.1 mapping table, which maps enterprise goals to alignment goals. Figure 2 maps enterprise goal EG06 with the alignment goals. The P in the Priority column indicates a primary priority and the S refers to secondary.

The next mapping table to consult is A.1.2, which maps alignment goals with governance and management objectives. Figure 3 shows such a mapping of selected alignment goals with governance and management objectives. Only the objectives with a primary (P) priority are included.

For one enterprise goal (EG06), there are 3 alignment goals and 17 mapped governance and management objectives, even though the selection was restricted to only those objectives with a P priority. This is a large number of identified objectives and it may not be very practical to pursue each one of them. The initial focus could be on only those objectives that are directly mapped against alignment goal AG07. AG07 has a P ranking when mapped with enterprise goals. This results in a reduced list of objectives. Two more objectives may be included in this list due to their relevance to the current pandemic situation; although they are not classified as a P priority under AG07, they are listed under AG05: Align, Plan and Organize (APO) APO09 Managed service agreements and APO10 Managed vendors. Other objectives from the Deliver, Service and Support (DSS) group could be included at a later stage.

Figure 4 illustrates a shortlisted table of objectives.

COBIT 2019 defines 7 components that are collectively responsible for achieving these objectives (figure 5). Failure of a single component could result in failure to achieve the objective; hence, the review process should include all the COBIT components of a governance system.

Among all the components, processes are the most elaborately documented. To review the processes, it is necessary to review all the underlying practices and activities. Figure 6 lists all the practices and number of activities relating to the selected objectives.

As per this selection, 8 governance and management objectives, 42 practices, and 227 activities need to be reviewed. Looking at the volume of work, further prioritization can be done. It may be desirable to focus initially only on APO09 Managed service agreements, APO10 Managed vendors, DSS04 Managed continuity and DSS05 Managed security services. This reduces the work to review of 4 management objectives, 25 practices and 140 activities. The selection of actual number of objectives for review is left to the reviewer. Additional objectives for review could be selected depending on the availability of time and the relative importance of the objective as decided by the reviewer.

COBIT is an umbrella framework of good practices for achieving governance and management objectives. This is the reason a large list of items comes up for review. It is important to exercise judgment to identify and prioritize the work to be done and not follow these lists in a mechanical manner.

Components Under Review

Selection of the right processes, practices and activities is necessary but not sufficient to achieve the governance and management objectives since “Processes, practices, activities” is just one of the 7 components essential for the purposes described here. Inadequacy in implementing any 1 of the 7 components can lead to an inability to achieve the objective. In COBIT^® 5, these were named “enablers;” in COBIT 2019, they are called “components,” thus highlighting their importance, as shown in this list:

• Processes, practices, activities–An effort has been made to reduce the number of processes, practices and activities to be reviewed to a smaller list. However, more objectives should be added to this list based on internal discussions and the availability of resources. Ideally, all the objectives mentioned in figure 6 should be covered. For each process under review, the key metrics achieved for the practices and the capability levels achieved and maintained for various activities should be ascertained and reviewed for adequacy.
• Organizational structure–For each practice listed in figure 7, determine if the responsibility and accountability have been properly identified and are being maintained.

• Information flows and items–The quality of information items, both for inputs and the resultant outputs, should be checked for each practice. There are 3 main criteria and 15 sub-criteria that define information quality, such as objective, relevant and current.
• People, skills and competencies–It is important to check whether the people involved in handling the practices and activities have appropriate skills and competencies and identify gaps, if any.
• Policies and procedures–The policies and procedures pertaining to various practices and activities should be reviewed.
• Culture, ethics and behavior–These intangible components must be checked against stakeholders’ expectations.
• Services, infrastructure and application–These must be adequate if successful implementation and execution of various practices and activities are to take place.

The final step in the evaluation of business service continuity and availability is summing up the findings, including documenting achievement of key metrics for the alignment goals and enterprise goal EG06. Failure in achieving any metrics will be traceable to a specific component.

This review process will identify gaps, if any, and provide direction for further improvements in the business service continuity and availability preparedness of the organization.

Avinash W. Kadam, CISA, CRISC, CISM, CGEIT, CISSP, CSSLP, GCIH, GSEC

Is a freelance cybersecurity mentor currently engaged in training and mentoring aspiring cybersecurity professionals and those who are new to this field. He worked for ISACA^® as an advisor to the ISACA India Task Force for more than 3 years. Prior to this, he was involved in information security training and consulting for more than a decade. His career spans almost 5 decades of IT maintenance, operations, management, consulting and training. He coauthored Securing Sensitive Personal Data and Information Under India’s IT Act Using COBIT^® 5 and RBI Guidelines Mapping With COBIT^®5, both of which are available for download from ISACA. He is an accredited trainer for COBIT 2019.