| 0 Non-existent | The organisation does not have assurance
processes in place. Security policies are not
implemented. Service level agreements have not been
developed and processes are not measured. Management
has not instituted any assurance or certification programs.
|
| 1 (Initial/Ad Hoc) | The organisation manages IT processes
independently. Certification and assurance processes are
in place on an exception basis. Certification and
assurance are driven by events such as regulatory
changes or requirements or customer demand. The
assurance process is conducted reactively by task forces
or by technical specialists who do not have specific
assurance skills.
|
| 2 (Repeatable but Intuitive) | Information services
function management has implemented processes for
managing assurance activities. Assurance requirements
are still linked to business needs and requirements and
are driven by the information system services function.
Risk management, as part of information services
function management, drives certification and assurance
programs. The information services function performs
risk assessments to identify system level risks. Senior
management supports and has committed to independent
assurance. Methods and techniques are developed for
certification and assurance and are being benchmarked to
develop best practices. The process for selecting internal
or external resources is being formalised.
|
| 3 (Defined Process) | The organisation has defined and
institutionalised the processes for IT assurance activities
and the criteria for using internal and external resources
based on the level of expertise, sensitivity and
independence required. Assurance processes include
legal and regulatory requirements, certification needs,
general organisational effectiveness and identification of
best practices. Assurance requirements have been
developed for IT processes. Management conducts
participative reviews of all assurance activities. Management outside of the information services function
has proactive involvement in assurance and certification
reviews. A knowledge base of certification and
assurance best practices has been developed. Key IT
processes have been certified.
|
| 4 (Managed and Measurable) | Management has
implemented assurance processes for ensuring that
critical IT processes are identified and have specific
assurance plans. IT processes are reviewed in the
context of the business process they support. Assurance
processes are quantitatively managed and controlled.
Management uses what is learned from assurance and
certification processes to improve other processes, based
on what was learned. The knowledge base is utilised to
ensure that best practices are used in new processes and
to benchmark other processes. A formal process is in
place to ensure the competence of the assurance function
by continually evaluating the balance between internallyand
externally-available knowledge and skills.
Cost/benefit criteria for conducting internal and externalbased
assessments are defined.
|
| 5 Optimized | Management has implemented measures to
ensure that all critical business processes have assurance
processes over the IT infrastructures that support them.
The organisation has a continuous improvement program
for the assurance and certification processes that reflects
industry best practices. Management has developed the
ability to quickly integrate the results of assurance and
certification activities into organisation-wide processes.
The effectiveness of third-party service providers and
relationships with business partners are routinely
evaluated. There is a formally-defined strategy,
supported by senior management, for developing
compliance with national and international standards and
for obtaining certifications that are seen as providing
recognition and a competitive advantage.
|
![[To top of Page]](../../../images/up.gif){kind=small}
