According to its authors, COBIT is an "overarching framework" for IT governance that is "aligned with other relevant standards and frameworks at a high level" [ISACA, 2012].
COBIT describes seven categories of "enablers" for the governance and management of enterprise IT:
Principles, policies and frameworks
Processes
Organizational structures
Culture, ethics and behavior
Information
Services, infrastructure and applications
People, skills and competencies.
COBIT's "enabling processes" are defined in the COBIT Process Reference Model. For each process in the reference model, COBIT specifies a number of dimensions such as a set of goals, metrics, inputs, outputs, management practices and activities. The COBIT product set also includes a process capability model which can be used to assess the maturity of an organization's IT-related processes, as well as an implementation guide.
Because of its complete set of goals and metrics for IT processes, many organizations use COBIT to improve governance of their information technology operations.
Using YaSM and COBIT® in combination
COBIT is less helpful for designing the service management processes of an organization. Although COBIT defines a process model complete with suggested process activities, its authors concede that "the activities may not be at a sufficient level of detail for implementation, and further guidance may need to be obtained from specific relevant standards and good practice such as ITIL®, ..." [ISACA, 2012].
This is where YaSM comes into the picture. YaSM and ITIL[2] are well aligned but YaSM is somewhat easier to implement, so using YaSM and COBIT in combination is quite conceivable when setting up a set of service management processes, including a suitable governance framework. We expect, however, that a number of enhancements to the YaSM processes will be needed, depending on which particular sets of COBIT goals an organization intends to fulfill. The ITIL® publications and other service management guidance may also be consulted if additional advice is needed for specific topics.
Note:YaSM is an independent framework and is not endorsed by the authors of COBIT.
COBIT® enabling processes and how they relate to YaSM processes
The following tables highlight which YaSM processes are related to specific COBIT® enabling processes, to illustrate that YaSM and COBIT share many basic principles. Please note that the aim is not to provide a detailed and scientifically correct cross-reference between the two service management frameworks.
These COBIT processes cannot be related directly to specific YaSM processes.
The YaSM process for setting up the service management system (SMS) is responsible for defining, maintaining, reviewing and improving a set of suitable service management processes and policies. This includes the processes and policies related to governance.
The strategic process ensures at the strategic level that the service provider's objectives and those of the customers are aligned, that best use is made of available resources, and that enterprise risk is identified and managed.
The defined strategic objectives are typically achieved by executing suitable strategic initiatives.
The YaSM process for setting up the SMS is in charge of defining and maintaining a set of suitable service management processes and policies. This includes aspects such as communicating the service provider's objectives, establishing responsibilities, tracking compliance with the defined policies and processes, and continually improving the processes.
This COBIT process cannot be related directly to specific YaSM processes.
A number of YaSM processes maintain information which is generally under-stood to be part of the enterprise architecture, for example:
The process for setting up the SMS maintains a model of the organization's processes.
The configuration management process maintains a configuration model, which typically includes information about applications and their interrelationships.
The strategic process contains activities to produce a roadmap for the future development of the technical infrastructure.
YaSM's strategic process gathers information about the latest available technologies and assesses how these may be applied to offer innovative services or to improve service economics.
This is supported by customer relation-ship management, which provides inputs related to the customers' needs and plans for the future, as well as by supplier management, which contributes information on new or enhanced services offered by external service suppliers.
The strategic process decides which strategic initiatives ("programs") are to be executed and allocates the required funds, in cooperation with financial management. Once the programs have been initiated, the strategy manager will monitor their progress and take corrective action if required.
The financial management process tracks the budget against actual expenses and reviews the investments to verify if the expected benefits have been realized.
The portfolio of services is maintained by the service portfolio management process.
The portfolio of assets is maintained by the configuration management process.
YaSM's human resources management process is tasked with developing the skills required to provide the service provider's range of services.
The required staffing levels for new services or processes are determined during the service design stage.
Once services and processes are implemented, tracking of human resources usage and planning of staffing levels is done as part of service and process operation.
The service portfolio process identifies the services, maintains the service portfolio and publishes service catalogues, as appropriate.
The customer relationship process is in charge of signing service agreements with the customers; the properties of those services are defined in service definitions, which are prepared in the service design stage.
Service operation is responsible for monitoring service levels and producing corresponding reports.
Service improvement will conduct periodic service reviews, which typically include reviews of the service agreements.
This COBIT process cannot be related directly to specific YaSM processes.
YaSM is particularly concerned with managing service quality. This is achieved through defining the required service quality levels during the service design stage, measuring the achieved service levels during service operation, and continually improving the services as required.
Risks affecting the service provider's business model as a whole are assessed during strategic reviews. This may lead to the definition and implementation of suitable responses to the identified strategic risks.
A number of other YaSM processes are tasked with managing risks of particular types, for example security risks or risks associated with disaster events.
Both YaSM and COBIT stipulate that service availability and capacity must be managed, but YaSM does not contain specific capacity and availability management processes. Rather, service capacity and availability is treated as an aspect of services to be managed through the service lifecycle processes.
This COBIT process cannot be related directly to specific YaSM processes.
If significant organizational changes are required, YaSM suggests implementing such changes by way of defining and executing strategic initiatives. Communicating the vision and empowering the implementation team is thus the responsibility of the strategic process.
The actual implementation of the organizational changes may be performed, for example, by the process responsible for setting up and maintaining the SMS.
YaSM's service design process will define the approach for developing new or significantly changed services, including any required supporting infrastructure. Project management is responsible for the detailed planning of service development projects.
The actual implementation of new services is performed by the service build process.
BAI08 Manage Know-ledge
-/-
The YaSM model does not include a specific knowledge management process.
YaSM takes the view that knowledge is managed and knowledge management principles are used in several service management processes. For example, the incident resolution process manages knowledge on how to deal with certain types of service incidents.
This COBIT process cannot be related directly to specific YaSM processes.
IT assets are identified and recorded by the configuration management process.
The availability of critical assets is ensured by appropriately designing the supporting service infrastructure and adequate operational procedures.
The deployment and reallocation of assets is the responsibility of the service build and operation processes, depending on the types of assets.
The financial process provides insight into the costs for service provisioning; this allows other processes to assess if costs can be reduced by making better use of assets.
Licenses are managed by the supplier management process, supported by the configuration management process.
YaSM's security process is responsible for defining the organization's approach to ensuring security as well as for implementing, operating and reviewing appropriate security controls and mechanisms.
Some activities associated with ensuring security are also performed by other processes; for example, service operation is tasked with monitoring the infrastructure, which includes monitoring for security-related events.
Controls and standards to ensure the security of information assets are defined under the responsibility of YaSM's security process.
The enforcement of the defined controls is often achieved through suitably defined service management processes or workflows, as well as appropriate configuration of applications or document management systems. The configuration of the applications and systems may be carried out when service components are being built, or as part of service operation.
Domain: Monitor, Evaluate and Assess (MEA)
COBIT® enabling processes
Related YaSM processes
Notes
MEA01 Monitor, Evaluate and Assess Performance and Conformance
Process performance management and monitoring of conformance to the defined processes is the responsibility of YaSM's process for maintaining the SMS. This includes, in particular, the definition of process goals and metrics, collection of data and initiation of corrective action if required.
MEA02 Monitor, Evaluate and Assess the System of Internal Control
This COBIT process cannot be related directly to specific YaSM processes.
The system of internal control is effectively defined by specifying a number of suitable processes and policies. This means the YaSM process for maintaining the SMS is predominantly in charge of monitoring and assessing the system of internal control.
MEA03 Monitor, Evaluate and Assess Compliance with External Requirements
YaSM's process for ensuring compliance is responsible for identifying and monitoring compliance requirements, as well as for devising suitable controls and mechanisms for fulfilling those requirements.
The implementation of the defined controls may be achieved in a number of ways, for example through
Stipulations in service agreements and service definitions
Mandated activities in the defined service management processes
Mandated operational activities
Technical mechanisms.
References
[ISACA, 2012]. - Information Systems Audit and Control Association (ISACA): COBIT 5: Enabling Processes. - Rolling Meadows, IL, USA, 2012.
External links
[COBIT browsing page]. -- ISACA International ("ISACA"): https://cobitonline.isaca.org/. -- The COBIT 5 resource center for governance and management of enterprise IT. - ISACA; Rolling Meadows, IL 60008, USA.
Notes
[1] COBIT® is a registered trademark of ISACA (Information Systems Audit and Control Association).
[2] ITIL® is a registered trade mark of AXELOS Limited.
Is based on: The YaSM Process Map. - Document: "YaSM and COBIT®".
By: Stefan Kempter and Andrea Kempter , IT Process Maps.
and Andrea Kempter 
