搜索
COBIT®3rdEditionManagementGuidelinesJuly2000ReleasedbytheCOBITSteeringCommitteeandtheITGovernanceInstituteTMTheCOBITMission:Toresearch,develop,publiciseandpromoteanauthoritative,up-to-date,internationalsetofgenerallyacceptedinformationtechnologycontrolobjectivesforday-to-dayusebybusinessmanagersandauditors.AMERICANSAMOAARGENTINAARMENIAAUSTRALIAAUSTRIABAHAMASBAHRAINBANGLADESHBARBADOSBELGIUMBERMUDABOLIVIABOTSWANABRAZILBRITISHVIRGINISLANDSCANADACAYMANISLANDSCHILECHINACOLOMBIACOSTARICACROATIACURACAOCYPRUSCZECHREPUBLICDENMARKDOMINICANREPUBLICECUADOREGYPTELSALVADORESTONIAFAEROEISLANDSFIJIFINLANDFRANCEGERMANYGHANAGREECEGUAMGUATEMALAHONDURASHONGKONGHUNGARYICELANDINDIAINDONESIAIRANIRELANDISRAELITALYIVORYCOASTJAMAICAJAPANJORDANKAZAKHSTANKENYAKOREAKUWAITLATVIALEBANONLIECHTENSTEINLITHUANIALUXEMBURGMALAYSIAMALTAMALAWIMAURITIUSMEXICONAMIBIANEPALNETHERLANDSNEWGUINEANEWZEALANDNICARAGUANIGERIANORWAYOMANPAKISTANPANAMAPARAGUAYPERUPHILIPPINESPOLANDPORTUGALQATARRUSSIASAUDIARABIASCOTLANDSEYCHELLESSINGAPORESLOVAKREPUBLICSLOVENIASOUTHAFRICASPAINSRILANKAST.KITTSST.LUCIASWEDENSWITZERLANDTAIWANTANZANIATASMANIATHAILANDTRINIDAD&TOBAGOTUNISIATURKEYUGANDAUNITEDARABEMIRATESUNITEDKINGDOMUNITEDSTATESURUGUAYVENEZUELAVIETNAMWALESYUGOSLAVIAZAMBIAZIMBABWETheInformationSystemsAuditandControlAssociationisaleadingglobalprofessionalorganisationrepresentingindividualsinmorethan100countriesandcomprisingalllevelsofIT—executive,management,middlemanagementandpractitioner.TheAssociationisuniquelypositionedtofulfilltheroleofacentral,harmonisingsourceofITcontrolpracticestandardsfortheworldover.Itsstrategicallianceswithothergroupsinthefinancial,accounting,auditingandITprofessionsareensuringanunparalleledlevelofintegrationandcommitmentbybusinessprocessowners.AssociationProgrammesandServicesTheAssociation’sservicesandprogrammeshaveearneddistinctionbyestablishingthehighestlevelsofexcellenceincertification,standards,professionaleducationandtechnicalpublishing.•Itscertificationprogramme(theCertifiedInformationSystemsAuditorTM)istheonlyglobaldesignationthroughouttheITauditandcontrolcommunity.•ItsstandardsactivitiesestablishthequalitybaselinebywhichotherITauditandcontrolactivitiesaremeasured.•Itsprofessionaleducationprogrammeofferstechnicalandmanagementconferencesonfivecontinents,aswellasseminarsworldwidetohelpprofessionalseverywherereceivehigh-qualitycontinuingeducation.•Itstechnicalpublishingareaprovidesreferencesandprofessionaldevelopmentmaterialstoaugmentitsdistinguishedselectionofprogrammesandservices.TheInformationSystemsAuditandControlAssociationwasformedin1969tomeettheunique,diverseandhightechnologyneedsoftheburgeoningITfield.Inanindustryinwhichprogressismeasuredinnano-seconds,ISACAhasmovedwithagilityandspeedtobridgetheneedsoftheinternationalbusinesscommunityandtheITcontrolsprofession.ForMoreInformationToreceiveadditionalinformation,youmaytelephone(+1.847.253.1545),sendane-mail(research@isaca.org)orvisitthesewebsites:www.ITgovernance.orgwww.isaca.orgINFORMATIONSYSTEMSAUDITANDCONTROLASSOCIATIONASingleInternationalSourceforInformationTechnologyControlsAcknowledgments4ExecutiveSummary5-9FrameworkMaturityModels...............................................10-13CriticalSuccessFactors...................................14-16KeyGoalIndicators.........................................17-19KeyPerformanceIndicators..............................20-21Conclusion..............................................................22MangementGuidelinesPlanningandOrganisation................................23-45AcquisitionandImplementation.......................47-59DeliveryandSupport........................................61-87Monitoring.........................................................89-97AppendixIHowtoUse......................................................99-101AppendixIITheCOBITFramework..................................103-112AppendixIIICOBITandtheBalancedBusinessScorecard....................................................113-114AppendixIVGenericProcessMangementGuideline........115-117AppendixVITGovernanceManagementGuideline........119-122TABLEOFCONTENTSDisclaimerTheInformationSystemsAuditandControlFoundation,ITGovernanceInstituteandthesponsorsofCOBIT:ControlObjectivesforInformationandrelatedTechnologyhavedesignedandcreatedthepublicationsentitledExecutiveSummary,Framework,ControlObjectives,ManagementGuidelines,AuditGuidelinesandImplementationToolSet(collectively,the“Works”)primarilyasaneducationalresourceforcontrolsprofessionals.TheInformationSystemsAuditandControlFoundation,ITGovernanceInstituteandthesponsorsmakenoclaimthatuseofanyoftheWorkswillassureasuccessfuloutcome.TheWorksshouldnotbeconsideredinclusiveofanyproperproceduresandtestsorexclusiveofotherproceduresandteststhatarereasonablydirectedtoobtainingthesameresults.Indeterminingtheproprietyofanyspecificprocedureortest,thecontrolsprofessionalshouldapplyhisorherownprofessionaljudgmenttothespecificcontrolcircumstancespresentedbytheparticularsystemsorITenvironment.DisclosureandCopyrightNoticeCopyright©1996,1998,