2 0 0 5 G L O B A L E V E N T S

North America CACS Information Security Benefits of ISACA Membership

Las Vegas, Nevada, USA Management Conference www.isaca.org/membership
24-28 April 2005 Las Vegas, Nevada, USA ISACA and ITGI are not-for-profit organizations. The COBIT products are priced to achieve maximum
www.isaca.org/naCACS 19-21 September 2005 usage, while providing income to support further research. Many publications are complimentary
www.isaca.org/infosecurity downloads available in PDF format through the ISACA and IT Governance Institute web sites.
Oceania CACS
Perth, Australia International Conference To sustain the COBIT initiatives, ISACA and ITGI receive sponsorship from corporate organizations, and
Dates TBD Oslo, Norway ISACA members provide their expertise and support in all regions of the world.
www.isaca.org/oceaniaCACS 19-22 June 2005
www.isaca.org/international ISACA members enjoy significant discounts on all COBIT products, and also enjoy interaction with a
Latin America CACS community of more than 35,000 professionals in more than 100 countries around the world. COBIT
Panama users are encouraged to join in this collaborative effort, helping to grow the COBIT family while
benefiting from the networking and services that ISACA and ITGI offer.
September/October 2005
www.isaca.org/latinCACS Sarbanes-Oxley Events
For more information about ISACA membership, visit the ISACA web site at
www.isaca.org/sarbanes-oxley www.isaca.org/membership, e-mail [email protected], or call +1.847.253.1545, ext. 475.
Asia-Pacific CACS
Kuala Lumpur, Malaysia Training Weeks
www.isaca.org/asiaCACS New Orleans, Louisiana, USA
28 February-4 March 2005
C OBIT
®

AND RELATED
Network Security Conference
Las Vegas, Nevada, USA
19-21 September 2005
www.isaca.org/nsc

Network Security Conference

Europe
www.isaca.org/nsceurope
Frankfurt, Germany
7-11 March 2005

Baltimore, Maryland, USA

6-10 June 2005

Vancouver, British Columbia, Canada

PRODUCTS
Guidance
<
Materials for
IT Governance
12-16 September 2005
COBIT User Conventions
4-5 November 2004 Chicago, Illinois, USA
Rosemont, Illinois, USA (Chicago Area) October 2005

21-22 February 2005 Phoenix, Arizona, USA

Cape Town, South Africa 5-9 December 2005

www.isaca.org/trainingweek 3701 Algonquin Road

GOVERN
11-12 April 2005
Brussels, Belguim
Suite 1010 DIRECT
Rolling Meadows, IL 60008 USA
www.isaca.org/CobitUserConvention
CONTROL
www.isaca.org
Phone: +1.847.253.1545
IMPLEMENT
3701 Algonquin Road, Suite 1010 Fax: +1.847.253.1443 MEASURE
Rolling Meadows, Illinois 60008 USA E-mail: [email protected]
Telephone: +1.847.253.1545 EVALUATE
Fax: +1.847.253.1443
E-mail: [email protected]
www.itgi.org REPORT
Phone: +1.847.590.7491
Web site: www.isaca.org
Fax: +1.847.253.1443
E-mail: [email protected]
▲
The IT Governance Institute® was CONTROL EVALUATE
established in 1998 to clarify and
provide guidance on current and future
GOVERN IMPLEMENT REPORT
issues pertaining to IT governance, DIRECT MEASURE
security and assurance. The institute
undertakes original research, convenes
symposia and hosts a web site Audit Guidelines A variety of subscription levels are available, framework, giving you a generic action plan Board Briefing on IT Governance, IT Control Objectives for Sarbanes-Oxley
The Advantages of COBIT

▲
(www.itgi.org) dedicated to Management needs assurance that the desired each allowing different amounts and types of that you can tailor and adapt to suit your 2nd Edition www.isaca.org/sox
offering a variety of IT governance- COBIT provides significant advantages to those IT goals and objectives are being met and that access and functionality. particular organization. Newly expanded and updated, the Board This document issued by the ITGI reflects the
who recognize the need for internal control key controls are being addressed. COBIT Audit Briefing is a comprehensive description of IT latest thinking on this increasingly global topic.
related resources. over their information and the systems that Guidelines outlines and suggests which COBIT QuickstartTM IT Governance Implementation governance concepts, useful as a reference Based on COBIT control objectives, the authors
manage it, including: assessment activities should perform for each www.isaca.org/quickstart Using a COBIT Training Course booklet or as a tool for educating top have designed this publication as an
The ITGI’s leading research publication • It is increasingly accepted internationally, of the 34 high-level IT control objectives, COBIT Quickstart is specifically designed to ISACA has developed a two-day course to help management, and comes complete with educational resource primarily for IT control
is Control Objectives for Information based on the professional and practical providing helpful guidance on who to interview, assist in rapid and easy adoption of the most experienced COBIT users to implement the COBIT checklists and tools to help management professionals, but CIOs, IT management and
experiences of experts worldwide. what questions to ask, and how to evaluate essential elements of COBIT. Quickstart is a resources for IT governance. Aligned with the IT initiate and sustain an effective IT governance
and related Technology (COBIT®). COBIT is • It is 100 percent compliant with often lacking in most organizations and Control Practices control, assess compliance and finally summarized version of the COBIT resources, Governance Implementation Guide and program. Guidance is also provided on the
assurance professionals will find the information
welcomed by IT and senior business Control Practices helps those responsible for vitally important and beneficial as well.
fast becoming the most popular and ISO17799, COSO I and COSO II, and maps substantiate the risk of the controls not being focusing on the most crucial IT processes, facilitated by an experienced COBIT expert, roles and responsibilities for IT governance,
management alike. The process model is justifying and designing the specific controls
internationally accepted set of guidance onto many other related standards.
organized into four domains: Plan and needed to address IT project and operational
met. It provides invaluable guidance for the control objectives and metrics, all presented in the workshop takes the participant through highlighting the parts played by the CEO, COBIT User Conventions
materials for IT governance. The success • COBIT is a way to bridge the communication audit team and a structured audit approach easy-to-follow format to help users gain the the implementation road map, includes five business executives, CIO, IT steering www.isaca.org/cobituserconvention
gap between IT functions, the business and Organize, Acquire and Implement, Deliver and risks, and improve IT performance. By providing linked to a framework that IT people can benefits of COBIT quickly. Quickstart was case studies, and covers project scoping, committee, technology council, and IT
of COBIT has resulted in the creation of Support, and Monitor and Evaluate. guidance on why controls are needed and These unique educational events are
auditors, by providing a common approach, understand. This approach facilitates a shared designed as a baseline for many SMEs, but maturity assessments, improvement planning architecture review board. exclusively designed for users of COBIT. The two
a growing family of publications and understandable by all. what the best practices are for meeting identification of control priorities and is also suitable for large organizations as a and metrics.
The Framework explains how these IT specific control objectives, Control Practices day events feature case studies and facilitated
products designed to assist in the • COBIT is management-oriented, actionable
processes deliver the information that the helps ensure that solutions put forward are
improvements. useful tool to accelerate adoption of Specific attention is given to the IT strategy discussion groups that address how COBIT is
implementation of effective IT and easy to use. governance best practices. The classroom environment provides committee, which plays a key role but needs to employed from both a governance and
• COBIT provides strong support for IT audit, business needs to achieve its objectives. This likely to be more completely and successfully COBIT Online® opportunities to share experiences with other broaden its scope. In addition to providing
governance throughout your enterprise. delivery is controlled through 34 high-level implemented. Control Practices expands the assurance perspective. The facilitators join
reduces the cost of audit risk assessment, www.isaca.org/cobitonline Quickstart will help you to rapidly understand users and learn practical tips and concepts. counsel on strategy when advising the board a number of COBIT users to present
and enables a higher quality of audit and control objectives, one for each IT process, capabilities of COBIT by providing an additional Whether you are a current user of COBIT or you the important issues and management The course provides 15 continuing professional on its IT governance responsibilities, it needs to
contained in the four domains. The Framework level of practical detail. implementaton strategies, lead discussions,
The COBIT set of guidance materials related opinion.
identifies which of the seven information
are planning to adopt COBIT as the preferred priorities. It can be followed by nontechnical education hours. For information about ISACA focus on IT value, risks and performance. The answer questions and provide COBIT updates.
provides a reference framework and • COBIT avoids reinventing wheels, and framework for IT governance, COBIT provides people or managers who want principles, not conferences where implementation training will briefing provides high-level guidance on how to
shortens the time required to implement criteria (effectiveness, efficiency, confidentiality, Management Guidelines easy and rapid access to all the COBIT detail, and is a springboard to the more be offered, visit the ISACA web site at set up an effective committee. Purchasing COBIT and Related

▲
common language for management, effective practices. integrity, availability, compliance and reliability), COBIT Management Guidelines provides tools to resources. With COBIT Online, you can browse comprehensive full COBIT guidance should that www.isaca.org/conferences.
IS and business leaders, and IS audit, • COBIT is a flexible and adaptable approach as well as which IT resources (people, help IT managers improve IT performance, and and search the best practices, download subsequently be indicated. For information Information Security Governance: Guidance
Products
applications, technology, facilities and data), link IT objectives to business objectives. For more information about COBIT, visit the
control and security practitioners, to suit every organization’s unique cultures,
are important for the IT processes to fully
customized guidance, perform benchmarking about purchasing COBIT Quickstart, visit the IT Governance Executive Summary for Boards of Directors and Executive ISACA web site at www.isaca.org/cobit.
across the entire information systems size and specific requirements. and more. ISACA web site at www.isaca.org/quickstart. The IT Governance Executive Summary Management COBIT products are available for purchase
• COBIT is complete, objective and continually support the business objectives. A key feature Management Guidelines contains maturity provides a synopsis for top executives, giving a With increased networking and a growing
life cycle. of the Framework is the linkage between IT models, providing a very effective technique for online through the ISACA Bookstore at
IT Governance Institute

▲
evolving, and is maintained by a reputable Set up as an online service and available to clear and forthright explanation of why IT realization of how valuable information assets www.isaca.org/bookstore. Certain products,
processes and business requirements. assessing IT capability, benchmarking and
not-for-profit organization.
identifiying gaps in control over IT processes.
anyone with an Internet connection, COBIT Publications and Products governance is important, what boards and are, information security is recognized as one designated by , are available as
Online makes COBIT more accessible and The ITGI publishes products on IT governance, management should do about it, and how best of the most important issues to address for all complimentary PDF downloads from the
Control Objectives Management can map where the organization
▲

COBIT Components user-friendly than any other IT best practices. including: practices can improve the performance of IT in IT users. However, the subject of IT security is Resource Center of the IT Governance Institute
www.isaca.org/cobit Increasingly, organizations are recognizing that is today, where it stands in relation to the best Furthermore, using MyCOBIT, you can construct the future. often presented in high-tech terms, and
control of IT is critical for ensuring that value is in class in its industry and to international web site, www.itgi.org.
and download your own version of COBIT for IT Governance Implementation Guide managers find it difficult to understand the
Executive Summary delivered, risks are managed, regulatory standards, and where the organization wants use on the desktop in Word® or Access® COBIT Security Baseline issues and feel confident about how their
One of the primary goals of using best practice
COBIT Executive Summary explains COBIT key requirements are met, and that investments in to be. formats as assessment forms, rich text Word This publication helps an organization focus on organizations are managing security-related
is to avoid reinventing the wheel. However, this
concepts and principles. Aimed at those new IT deliver a reasonable return. COBIT’s Control documents or as a database. the essential steps to take by extracting the risks. Information Security Governance
is possible only if implementation is effective
to COBIT or for senior management wishing to Objectives component provides more than 300 The guidelines also provide critical success most important security-related objectives from helps overcome these barriers by
and efficient. The IT Governance
obtain an overview, it succinctly describes what generic control statements that define what factors, which define the most important COBIT Online will grow and develop based on the COBIT framework. It then presents key explaining information security in business
Implementation Guide provides a road map
COBIT is, what it consists of, and how to use it. needs to be managed in each IT process to management-oriented implementation user feedback provided through several control objectives and suggested minimum terms and comes complete with tools and
and process guidance on how to implement IT
address these business requirements. They help guidelines to achieve control within the IT mechanisms, enabling the knowledge base to control steps for each, cross-referenced to the techniques to help managers uncover
governance using the COBIT resources.
Framework to delineate a clear policy, foster good practices processes; key goal indicators, which define evolve quickly after expert review of the COBIT processes and detailed COBIT control security-related problems.
Complete with a tool kit of useful templates,
COBIT Framework is the basis of the COBIT for IT controls, and encourage process measures that tell management—after the comments provided. It will incorporate a objectives. A mapping to related control
presentations and articles, the guide is an
approach and the foundation for all the other ownership. They also provide the reference fact—whether an IT process has achieved its community section and discussion area to objectives in ISO17799 is included as well.
invaluable aid to exploiting the real benefits of
COBIT elements. Providing a fundamental set of point for linking best practices to business business requirements; and key performance help users exchange experiences and learn COBIT’s principles while also addressing many
principles when it was launched in 1994, the requirements. Constructed by harmonizing more indicators, which are lead indicators that from each other. of the organizational and process changes that
Framework has remained a popular vehicle for than 40 different control guidance sources, define measures of how well the IT process is
are needed. The guide will help you to adopt
organizing IT activities into a process model COBIT can be integrated with other respected performing in enabling the goal to be reached. Users of COBIT Online will benefit from and instill a COBIT-based governance
whether in-house or outsourced, something standards and practices that focus on specific accessing the very latest version of the
areas such as ISO17799, ISO9000, ITIL, CMM guidance material without waiting for the next
and the PMF. hard copy releases, sharing experiences with
other users, and creating their own customized
COBIT environment.
▲
The IT Governance Institute® was CONTROL EVALUATE
established in 1998 to clarify and
provide guidance on current and future
GOVERN IMPLEMENT REPORT
issues pertaining to IT governance, DIRECT MEASURE
security and assurance. The institute
undertakes original research, convenes
symposia and hosts a web site Audit Guidelines A variety of subscription levels are available, framework, giving you a generic action plan Board Briefing on IT Governance, IT Control Objectives for Sarbanes-Oxley
The Advantages of COBIT

▲
(www.itgi.org) dedicated to Management needs assurance that the desired each allowing different amounts and types of that you can tailor and adapt to suit your 2nd Edition www.isaca.org/sox
offering a variety of IT governance- COBIT provides significant advantages to those IT goals and objectives are being met and that access and functionality. particular organization. Newly expanded and updated, the Board This document issued by the ITGI reflects the
who recognize the need for internal control key controls are being addressed. COBIT Audit Briefing is a comprehensive description of IT latest thinking on this increasingly global topic.
related resources. over their information and the systems that Guidelines outlines and suggests which COBIT QuickstartTM IT Governance Implementation governance concepts, useful as a reference Based on COBIT control objectives, the authors
manage it, including: assessment activities should perform for each www.isaca.org/quickstart Using a COBIT Training Course booklet or as a tool for educating top have designed this publication as an
The ITGI’s leading research publication • It is increasingly accepted internationally, of the 34 high-level IT control objectives, COBIT Quickstart is specifically designed to ISACA has developed a two-day course to help management, and comes complete with educational resource primarily for IT control
is Control Objectives for Information based on the professional and practical providing helpful guidance on who to interview, assist in rapid and easy adoption of the most experienced COBIT users to implement the COBIT checklists and tools to help management professionals, but CIOs, IT management and
experiences of experts worldwide. what questions to ask, and how to evaluate essential elements of COBIT. Quickstart is a resources for IT governance. Aligned with the IT initiate and sustain an effective IT governance
and related Technology (COBIT®). COBIT is • It is 100 percent compliant with often lacking in most organizations and Control Practices control, assess compliance and finally summarized version of the COBIT resources, Governance Implementation Guide and program. Guidance is also provided on the
assurance professionals will find the information
welcomed by IT and senior business Control Practices helps those responsible for vitally important and beneficial as well.
fast becoming the most popular and ISO17799, COSO I and COSO II, and maps substantiate the risk of the controls not being focusing on the most crucial IT processes, facilitated by an experienced COBIT expert, roles and responsibilities for IT governance,
management alike. The process model is justifying and designing the specific controls
internationally accepted set of guidance onto many other related standards.
organized into four domains: Plan and needed to address IT project and operational
met. It provides invaluable guidance for the control objectives and metrics, all presented in the workshop takes the participant through highlighting the parts played by the CEO, COBIT User Conventions
materials for IT governance. The success • COBIT is a way to bridge the communication audit team and a structured audit approach easy-to-follow format to help users gain the the implementation road map, includes five business executives, CIO, IT steering www.isaca.org/cobituserconvention
gap between IT functions, the business and Organize, Acquire and Implement, Deliver and risks, and improve IT performance. By providing linked to a framework that IT people can benefits of COBIT quickly. Quickstart was case studies, and covers project scoping, committee, technology council, and IT
of COBIT has resulted in the creation of Support, and Monitor and Evaluate. guidance on why controls are needed and These unique educational events are
auditors, by providing a common approach, understand. This approach facilitates a shared designed as a baseline for many SMEs, but maturity assessments, improvement planning architecture review board. exclusively designed for users of COBIT. The two
a growing family of publications and understandable by all. what the best practices are for meeting identification of control priorities and is also suitable for large organizations as a and metrics.
The Framework explains how these IT specific control objectives, Control Practices day events feature case studies and facilitated
products designed to assist in the • COBIT is management-oriented, actionable
processes deliver the information that the helps ensure that solutions put forward are
improvements. useful tool to accelerate adoption of Specific attention is given to the IT strategy discussion groups that address how COBIT is
implementation of effective IT and easy to use. governance best practices. The classroom environment provides committee, which plays a key role but needs to employed from both a governance and
• COBIT provides strong support for IT audit, business needs to achieve its objectives. This likely to be more completely and successfully COBIT Online® opportunities to share experiences with other broaden its scope. In addition to providing
governance throughout your enterprise. delivery is controlled through 34 high-level implemented. Control Practices expands the assurance perspective. The facilitators join
reduces the cost of audit risk assessment, www.isaca.org/cobitonline Quickstart will help you to rapidly understand users and learn practical tips and concepts. counsel on strategy when advising the board a number of COBIT users to present
and enables a higher quality of audit and control objectives, one for each IT process, capabilities of COBIT by providing an additional Whether you are a current user of COBIT or you the important issues and management The course provides 15 continuing professional on its IT governance responsibilities, it needs to
contained in the four domains. The Framework level of practical detail. implementaton strategies, lead discussions,
The COBIT set of guidance materials related opinion.
identifies which of the seven information
are planning to adopt COBIT as the preferred priorities. It can be followed by nontechnical education hours. For information about ISACA focus on IT value, risks and performance. The answer questions and provide COBIT updates.
provides a reference framework and • COBIT avoids reinventing wheels, and framework for IT governance, COBIT provides people or managers who want principles, not conferences where implementation training will briefing provides high-level guidance on how to
shortens the time required to implement criteria (effectiveness, efficiency, confidentiality, Management Guidelines easy and rapid access to all the COBIT detail, and is a springboard to the more be offered, visit the ISACA web site at set up an effective committee. Purchasing COBIT and Related

▲
common language for management, effective practices. integrity, availability, compliance and reliability), COBIT Management Guidelines provides tools to resources. With COBIT Online, you can browse comprehensive full COBIT guidance should that www.isaca.org/conferences.
IS and business leaders, and IS audit, • COBIT is a flexible and adaptable approach as well as which IT resources (people, help IT managers improve IT performance, and and search the best practices, download subsequently be indicated. For information Information Security Governance: Guidance
Products
applications, technology, facilities and data), link IT objectives to business objectives. For more information about COBIT, visit the
control and security practitioners, to suit every organization’s unique cultures,
are important for the IT processes to fully
customized guidance, perform benchmarking about purchasing COBIT Quickstart, visit the IT Governance Executive Summary for Boards of Directors and Executive ISACA web site at www.isaca.org/cobit.
across the entire information systems size and specific requirements. and more. ISACA web site at www.isaca.org/quickstart. The IT Governance Executive Summary Management COBIT products are available for purchase
• COBIT is complete, objective and continually support the business objectives. A key feature Management Guidelines contains maturity provides a synopsis for top executives, giving a With increased networking and a growing
life cycle. of the Framework is the linkage between IT models, providing a very effective technique for online through the ISACA Bookstore at
IT Governance Institute

▲
evolving, and is maintained by a reputable Set up as an online service and available to clear and forthright explanation of why IT realization of how valuable information assets www.isaca.org/bookstore. Certain products,
processes and business requirements. assessing IT capability, benchmarking and
not-for-profit organization.
identifiying gaps in control over IT processes.
anyone with an Internet connection, COBIT Publications and Products governance is important, what boards and are, information security is recognized as one designated by , are available as
Online makes COBIT more accessible and The ITGI publishes products on IT governance, management should do about it, and how best of the most important issues to address for all complimentary PDF downloads from the
Control Objectives Management can map where the organization
▲

COBIT Components user-friendly than any other IT best practices. including: practices can improve the performance of IT in IT users. However, the subject of IT security is Resource Center of the IT Governance Institute
www.isaca.org/cobit Increasingly, organizations are recognizing that is today, where it stands in relation to the best Furthermore, using MyCOBIT, you can construct the future. often presented in high-tech terms, and
control of IT is critical for ensuring that value is in class in its industry and to international web site, www.itgi.org.
and download your own version of COBIT for IT Governance Implementation Guide managers find it difficult to understand the
Executive Summary delivered, risks are managed, regulatory standards, and where the organization wants use on the desktop in Word® or Access® COBIT Security Baseline issues and feel confident about how their
One of the primary goals of using best practice
COBIT Executive Summary explains COBIT key requirements are met, and that investments in to be. formats as assessment forms, rich text Word This publication helps an organization focus on organizations are managing security-related
is to avoid reinventing the wheel. However, this
concepts and principles. Aimed at those new IT deliver a reasonable return. COBIT’s Control documents or as a database. the essential steps to take by extracting the risks. Information Security Governance
is possible only if implementation is effective
to COBIT or for senior management wishing to Objectives component provides more than 300 The guidelines also provide critical success most important security-related objectives from helps overcome these barriers by
and efficient. The IT Governance
obtain an overview, it succinctly describes what generic control statements that define what factors, which define the most important COBIT Online will grow and develop based on the COBIT framework. It then presents key explaining information security in business
Implementation Guide provides a road map
COBIT is, what it consists of, and how to use it. needs to be managed in each IT process to management-oriented implementation user feedback provided through several control objectives and suggested minimum terms and comes complete with tools and
and process guidance on how to implement IT
address these business requirements. They help guidelines to achieve control within the IT mechanisms, enabling the knowledge base to control steps for each, cross-referenced to the techniques to help managers uncover
governance using the COBIT resources.
Framework to delineate a clear policy, foster good practices processes; key goal indicators, which define evolve quickly after expert review of the COBIT processes and detailed COBIT control security-related problems.
Complete with a tool kit of useful templates,
COBIT Framework is the basis of the COBIT for IT controls, and encourage process measures that tell management—after the comments provided. It will incorporate a objectives. A mapping to related control
presentations and articles, the guide is an
approach and the foundation for all the other ownership. They also provide the reference fact—whether an IT process has achieved its community section and discussion area to objectives in ISO17799 is included as well.
invaluable aid to exploiting the real benefits of
COBIT elements. Providing a fundamental set of point for linking best practices to business business requirements; and key performance help users exchange experiences and learn COBIT’s principles while also addressing many
principles when it was launched in 1994, the requirements. Constructed by harmonizing more indicators, which are lead indicators that from each other. of the organizational and process changes that
Framework has remained a popular vehicle for than 40 different control guidance sources, define measures of how well the IT process is
are needed. The guide will help you to adopt
organizing IT activities into a process model COBIT can be integrated with other respected performing in enabling the goal to be reached. Users of COBIT Online will benefit from and instill a COBIT-based governance
whether in-house or outsourced, something standards and practices that focus on specific accessing the very latest version of the
areas such as ISO17799, ISO9000, ITIL, CMM guidance material without waiting for the next
and the PMF. hard copy releases, sharing experiences with
other users, and creating their own customized
COBIT environment.
▲
The IT Governance Institute® was CONTROL EVALUATE
established in 1998 to clarify and
provide guidance on current and future
GOVERN IMPLEMENT REPORT
issues pertaining to IT governance, DIRECT MEASURE
security and assurance. The institute
undertakes original research, convenes
symposia and hosts a web site Audit Guidelines A variety of subscription levels are available, framework, giving you a generic action plan Board Briefing on IT Governance, IT Control Objectives for Sarbanes-Oxley
The Advantages of COBIT

▲
(www.itgi.org) dedicated to Management needs assurance that the desired each allowing different amounts and types of that you can tailor and adapt to suit your 2nd Edition www.isaca.org/sox
offering a variety of IT governance- COBIT provides significant advantages to those IT goals and objectives are being met and that access and functionality. particular organization. Newly expanded and updated, the Board This document issued by the ITGI reflects the
who recognize the need for internal control key controls are being addressed. COBIT Audit Briefing is a comprehensive description of IT latest thinking on this increasingly global topic.
related resources. over their information and the systems that Guidelines outlines and suggests which COBIT QuickstartTM IT Governance Implementation governance concepts, useful as a reference Based on COBIT control objectives, the authors
manage it, including: assessment activities should perform for each www.isaca.org/quickstart Using a COBIT Training Course booklet or as a tool for educating top have designed this publication as an
The ITGI’s leading research publication • It is increasingly accepted internationally, of the 34 high-level IT control objectives, COBIT Quickstart is specifically designed to ISACA has developed a two-day course to help management, and comes complete with educational resource primarily for IT control
is Control Objectives for Information based on the professional and practical providing helpful guidance on who to interview, assist in rapid and easy adoption of the most experienced COBIT users to implement the COBIT checklists and tools to help management professionals, but CIOs, IT management and
experiences of experts worldwide. what questions to ask, and how to evaluate essential elements of COBIT. Quickstart is a resources for IT governance. Aligned with the IT initiate and sustain an effective IT governance
and related Technology (COBIT®). COBIT is • It is 100 percent compliant with often lacking in most organizations and Control Practices control, assess compliance and finally summarized version of the COBIT resources, Governance Implementation Guide and program. Guidance is also provided on the
assurance professionals will find the information
welcomed by IT and senior business Control Practices helps those responsible for vitally important and beneficial as well.
fast becoming the most popular and ISO17799, COSO I and COSO II, and maps substantiate the risk of the controls not being focusing on the most crucial IT processes, facilitated by an experienced COBIT expert, roles and responsibilities for IT governance,
management alike. The process model is justifying and designing the specific controls
internationally accepted set of guidance onto many other related standards.
organized into four domains: Plan and needed to address IT project and operational
met. It provides invaluable guidance for the control objectives and metrics, all presented in the workshop takes the participant through highlighting the parts played by the CEO, COBIT User Conventions
materials for IT governance. The success • COBIT is a way to bridge the communication audit team and a structured audit approach easy-to-follow format to help users gain the the implementation road map, includes five business executives, CIO, IT steering www.isaca.org/cobituserconvention
gap between IT functions, the business and Organize, Acquire and Implement, Deliver and risks, and improve IT performance. By providing linked to a framework that IT people can benefits of COBIT quickly. Quickstart was case studies, and covers project scoping, committee, technology council, and IT
of COBIT has resulted in the creation of Support, and Monitor and Evaluate. guidance on why controls are needed and These unique educational events are
auditors, by providing a common approach, understand. This approach facilitates a shared designed as a baseline for many SMEs, but maturity assessments, improvement planning architecture review board. exclusively designed for users of COBIT. The two
a growing family of publications and understandable by all. what the best practices are for meeting identification of control priorities and is also suitable for large organizations as a and metrics.
The Framework explains how these IT specific control objectives, Control Practices day events feature case studies and facilitated
products designed to assist in the • COBIT is management-oriented, actionable
processes deliver the information that the helps ensure that solutions put forward are
improvements. useful tool to accelerate adoption of Specific attention is given to the IT strategy discussion groups that address how COBIT is
implementation of effective IT and easy to use. governance best practices. The classroom environment provides committee, which plays a key role but needs to employed from both a governance and
• COBIT provides strong support for IT audit, business needs to achieve its objectives. This likely to be more completely and successfully COBIT Online® opportunities to share experiences with other broaden its scope. In addition to providing
governance throughout your enterprise. delivery is controlled through 34 high-level implemented. Control Practices expands the assurance perspective. The facilitators join
reduces the cost of audit risk assessment, www.isaca.org/cobitonline Quickstart will help you to rapidly understand users and learn practical tips and concepts. counsel on strategy when advising the board a number of COBIT users to present
and enables a higher quality of audit and control objectives, one for each IT process, capabilities of COBIT by providing an additional Whether you are a current user of COBIT or you the important issues and management The course provides 15 continuing professional on its IT governance responsibilities, it needs to
contained in the four domains. The Framework level of practical detail. implementaton strategies, lead discussions,
The COBIT set of guidance materials related opinion.
identifies which of the seven information
are planning to adopt COBIT as the preferred priorities. It can be followed by nontechnical education hours. For information about ISACA focus on IT value, risks and performance. The answer questions and provide COBIT updates.
provides a reference framework and • COBIT avoids reinventing wheels, and framework for IT governance, COBIT provides people or managers who want principles, not conferences where implementation training will briefing provides high-level guidance on how to
shortens the time required to implement criteria (effectiveness, efficiency, confidentiality, Management Guidelines easy and rapid access to all the COBIT detail, and is a springboard to the more be offered, visit the ISACA web site at set up an effective committee. Purchasing COBIT and Related

▲
common language for management, effective practices. integrity, availability, compliance and reliability), COBIT Management Guidelines provides tools to resources. With COBIT Online, you can browse comprehensive full COBIT guidance should that www.isaca.org/conferences.
IS and business leaders, and IS audit, • COBIT is a flexible and adaptable approach as well as which IT resources (people, help IT managers improve IT performance, and and search the best practices, download subsequently be indicated. For information Information Security Governance: Guidance
Products
applications, technology, facilities and data), link IT objectives to business objectives. For more information about COBIT, visit the
control and security practitioners, to suit every organization’s unique cultures,
are important for the IT processes to fully
customized guidance, perform benchmarking about purchasing COBIT Quickstart, visit the IT Governance Executive Summary for Boards of Directors and Executive ISACA web site at www.isaca.org/cobit.
across the entire information systems size and specific requirements. and more. ISACA web site at www.isaca.org/quickstart. The IT Governance Executive Summary Management COBIT products are available for purchase
• COBIT is complete, objective and continually support the business objectives. A key feature Management Guidelines contains maturity provides a synopsis for top executives, giving a With increased networking and a growing
life cycle. of the Framework is the linkage between IT models, providing a very effective technique for online through the ISACA Bookstore at
IT Governance Institute

▲
evolving, and is maintained by a reputable Set up as an online service and available to clear and forthright explanation of why IT realization of how valuable information assets www.isaca.org/bookstore. Certain products,
processes and business requirements. assessing IT capability, benchmarking and
not-for-profit organization.
identifiying gaps in control over IT processes.
anyone with an Internet connection, COBIT Publications and Products governance is important, what boards and are, information security is recognized as one designated by , are available as
Online makes COBIT more accessible and The ITGI publishes products on IT governance, management should do about it, and how best of the most important issues to address for all complimentary PDF downloads from the
Control Objectives Management can map where the organization
▲

COBIT Components user-friendly than any other IT best practices. including: practices can improve the performance of IT in IT users. However, the subject of IT security is Resource Center of the IT Governance Institute
www.isaca.org/cobit Increasingly, organizations are recognizing that is today, where it stands in relation to the best Furthermore, using MyCOBIT, you can construct the future. often presented in high-tech terms, and
control of IT is critical for ensuring that value is in class in its industry and to international web site, www.itgi.org.
and download your own version of COBIT for IT Governance Implementation Guide managers find it difficult to understand the
Executive Summary delivered, risks are managed, regulatory standards, and where the organization wants use on the desktop in Word® or Access® COBIT Security Baseline issues and feel confident about how their
One of the primary goals of using best practice
COBIT Executive Summary explains COBIT key requirements are met, and that investments in to be. formats as assessment forms, rich text Word This publication helps an organization focus on organizations are managing security-related
is to avoid reinventing the wheel. However, this
concepts and principles. Aimed at those new IT deliver a reasonable return. COBIT’s Control documents or as a database. the essential steps to take by extracting the risks. Information Security Governance
is possible only if implementation is effective
to COBIT or for senior management wishing to Objectives component provides more than 300 The guidelines also provide critical success most important security-related objectives from helps overcome these barriers by
and efficient. The IT Governance
obtain an overview, it succinctly describes what generic control statements that define what factors, which define the most important COBIT Online will grow and develop based on the COBIT framework. It then presents key explaining information security in business
Implementation Guide provides a road map
COBIT is, what it consists of, and how to use it. needs to be managed in each IT process to management-oriented implementation user feedback provided through several control objectives and suggested minimum terms and comes complete with tools and
and process guidance on how to implement IT
address these business requirements. They help guidelines to achieve control within the IT mechanisms, enabling the knowledge base to control steps for each, cross-referenced to the techniques to help managers uncover
governance using the COBIT resources.
Framework to delineate a clear policy, foster good practices processes; key goal indicators, which define evolve quickly after expert review of the COBIT processes and detailed COBIT control security-related problems.
Complete with a tool kit of useful templates,
COBIT Framework is the basis of the COBIT for IT controls, and encourage process measures that tell management—after the comments provided. It will incorporate a objectives. A mapping to related control
presentations and articles, the guide is an
approach and the foundation for all the other ownership. They also provide the reference fact—whether an IT process has achieved its community section and discussion area to objectives in ISO17799 is included as well.
invaluable aid to exploiting the real benefits of
COBIT elements. Providing a fundamental set of point for linking best practices to business business requirements; and key performance help users exchange experiences and learn COBIT’s principles while also addressing many
principles when it was launched in 1994, the requirements. Constructed by harmonizing more indicators, which are lead indicators that from each other. of the organizational and process changes that
Framework has remained a popular vehicle for than 40 different control guidance sources, define measures of how well the IT process is
are needed. The guide will help you to adopt
organizing IT activities into a process model COBIT can be integrated with other respected performing in enabling the goal to be reached. Users of COBIT Online will benefit from and instill a COBIT-based governance
whether in-house or outsourced, something standards and practices that focus on specific accessing the very latest version of the
areas such as ISO17799, ISO9000, ITIL, CMM guidance material without waiting for the next
and the PMF. hard copy releases, sharing experiences with
other users, and creating their own customized
COBIT environment.
2 0 0 5 G L O B A L E V E N T S
North America CACS Information Security Benefits of ISACA Membership
Las Vegas, Nevada, USA Management Conference www.isaca.org/membership
24-28 April 2005 Las Vegas, Nevada, USA ISACA and ITGI are not-for-profit organizations. The COBIT products are priced to achieve maximum
www.isaca.org/naCACS 19-21 September 2005 usage, while providing income to support further research. Many publications are complimentary
www.isaca.org/infosecurity downloads available in PDF format through the ISACA and IT Governance Institute web sites.
Oceania CACS
Perth, Australia International Conference To sustain the COBIT initiatives, ISACA and ITGI receive sponsorship from corporate organizations, and
Dates TBD Oslo, Norway ISACA members provide their expertise and support in all regions of the world.
www.isaca.org/oceaniaCACS 19-22 June 2005
www.isaca.org/international ISACA members enjoy significant discounts on all COBIT products, and also enjoy interaction with a
Latin America CACS community of more than 35,000 professionals in more than 100 countries around the world. COBIT
Panama users are encouraged to join in this collaborative effort, helping to grow the COBIT family while
benefiting from the networking and services that ISACA and ITGI offer.
September/October 2005
www.isaca.org/latinCACS Sarbanes-Oxley Events
For more information about ISACA membership, visit the ISACA web site at
www.isaca.org/sarbanes-oxley www.isaca.org/membership, e-mail [email protected], or call +1.847.253.1545, ext. 475.
Asia-Pacific CACS
Kuala Lumpur, Malaysia Training Weeks
www.isaca.org/asiaCACS New Orleans, Louisiana, USA
28 February-4 March 2005
C OBIT
®

AND RELATED
Network Security Conference
Las Vegas, Nevada, USA
19-21 September 2005
www.isaca.org/nsc

Network Security Conference

Europe
www.isaca.org/nsceurope
Frankfurt, Germany
7-11 March 2005

Baltimore, Maryland, USA

6-10 June 2005

Vancouver, British Columbia, Canada

PRODUCTS
Guidance
<
Materials for
IT Governance
12-16 September 2005
COBIT User Conventions
4-5 November 2004 Chicago, Illinois, USA
Rosemont, Illinois, USA (Chicago Area) October 2005

21-22 February 2005 Phoenix, Arizona, USA

Cape Town, South Africa 5-9 December 2005

www.isaca.org/trainingweek 3701 Algonquin Road

GOVERN
11-12 April 2005
Brussels, Belguim
Suite 1010 DIRECT
Rolling Meadows, IL 60008 USA
www.isaca.org/CobitUserConvention
CONTROL
www.isaca.org
Phone: +1.847.253.1545
IMPLEMENT
3701 Algonquin Road, Suite 1010 Fax: +1.847.253.1443 MEASURE
Rolling Meadows, Illinois 60008 USA E-mail: [email protected]
Telephone: +1.847.253.1545 EVALUATE
Fax: +1.847.253.1443
E-mail: [email protected]
www.itgi.org REPORT
Phone: +1.847.590.7491
Web site: www.isaca.org
Fax: +1.847.253.1443
E-mail: [email protected]
2 0 0 5 G L O B A L E V E N T S
North America CACS Information Security Benefits of ISACA Membership
Las Vegas, Nevada, USA Management Conference www.isaca.org/membership
24-28 April 2005 Las Vegas, Nevada, USA ISACA and ITGI are not-for-profit organizations. The COBIT products are priced to achieve maximum
www.isaca.org/naCACS 19-21 September 2005 usage, while providing income to support further research. Many publications are complimentary
www.isaca.org/infosecurity downloads available in PDF format through the ISACA and IT Governance Institute web sites.
Oceania CACS
Perth, Australia International Conference To sustain the COBIT initiatives, ISACA and ITGI receive sponsorship from corporate organizations, and
Dates TBD Oslo, Norway ISACA members provide their expertise and support in all regions of the world.
www.isaca.org/oceaniaCACS 19-22 June 2005
www.isaca.org/international ISACA members enjoy significant discounts on all COBIT products, and also enjoy interaction with a
Latin America CACS community of more than 35,000 professionals in more than 100 countries around the world. COBIT
Panama users are encouraged to join in this collaborative effort, helping to grow the COBIT family while
benefiting from the networking and services that ISACA and ITGI offer.
September/October 2005
www.isaca.org/latinCACS Sarbanes-Oxley Events
For more information about ISACA membership, visit the ISACA web site at
www.isaca.org/sarbanes-oxley www.isaca.org/membership, e-mail [email protected], or call +1.847.253.1545, ext. 475.
Asia-Pacific CACS
Kuala Lumpur, Malaysia Training Weeks
www.isaca.org/asiaCACS New Orleans, Louisiana, USA
28 February-4 March 2005
C OBIT
®

AND RELATED
Network Security Conference
Las Vegas, Nevada, USA
19-21 September 2005
www.isaca.org/nsc

Network Security Conference

Europe
www.isaca.org/nsceurope
Frankfurt, Germany
7-11 March 2005

Baltimore, Maryland, USA

6-10 June 2005

Vancouver, British Columbia, Canada

PRODUCTS
Guidance
<
Materials for
IT Governance
12-16 September 2005
COBIT User Conventions
4-5 November 2004 Chicago, Illinois, USA
Rosemont, Illinois, USA (Chicago Area) October 2005

21-22 February 2005 Phoenix, Arizona, USA

Cape Town, South Africa 5-9 December 2005

www.isaca.org/trainingweek 3701 Algonquin Road

GOVERN
11-12 April 2005
Brussels, Belguim
Suite 1010 DIRECT
Rolling Meadows, IL 60008 USA
www.isaca.org/CobitUserConvention
CONTROL
www.isaca.org
Phone: +1.847.253.1545
IMPLEMENT
3701 Algonquin Road, Suite 1010 Fax: +1.847.253.1443 MEASURE
Rolling Meadows, Illinois 60008 USA E-mail: [email protected]
Telephone: +1.847.253.1545 EVALUATE
Fax: +1.847.253.1443
E-mail: [email protected]
www.itgi.org REPORT
Phone: +1.847.590.7491
Web site: www.isaca.org
Fax: +1.847.253.1443
E-mail: [email protected]