ITIL Processes

SERVICE STRATEGY

·   Strategy Management for IT Services

·   Service Portfolio Management

·   Financial Management

·   Business Relationship Management

·   Demand Management for IT Services

SERVICE DESIGN

·   Design Coordination

·   Service Level Management

·   Service Catalog Management

·   Supplier Management

·   Availability Management

·   IT Service Continuity Management

·   Capacity Management

·   Information Security Management

SERVICE TRANSITION

·   Transition Planning & Support

·   Change Management

·   Service Asset Management

·   Configuration Management

·   Release & Deployment Mgmnt

·   Service Validation & Testing

·   Change Evaluation

·   Service Knowledge Management

SERVICE OPERATION

·   Service Desk Function

·   IT Operations Management Function

·   Technical Management Function

·   Applications Management Function

·   Event Management

·   Incident Management

·   Request Fulfillment

·   Problem Management

·   Access Management

CONTINUAL SERVICE IMPROVEMENT

·   Service Measurement & Reporting

·   Service Improvement

Physical Security Controls

• Close security events monitoring
• Computerized access-controlled doors
• Fire detection system for IT offices
• Locked IT storerooms and offices
• Locked offices for personal computer locations
• Restricted access to valuable records, files, facilities and systems
• Safety and fire-proof vaults for IT assets (back-ups, original vendor software)
• Security guards, especially for computer rooms and data centres
• Television and microwave surveillance for sensitive IT areas
• Visitor entry and exit controls
• Waste management for all reports, correspondence, digital media, diskettes, tapes, DVDs, ribbons, special forms, etc. via the use of paper shredders, incinerators, media crunchers, software degaussing and binary zero creation for all destroyed computerized data files.

IT Administrative Controls

• IT administration performance measures
• IT asset controls
• IT budget
• IT office administration controls
• IT personnel management controls
• IT purchasing controls
• IT standards, policies and procedures
• Monitoring and review controls

IT Governance Framework - Why ?

• Aligning the IT strategy to corporate strategy within the framework of the Enterprise Architecture of the organization
• IT standards, policies, procedures, practices and methods for the safe, efficient, effective and cost-beneficial running of all ITC systems and infrastructural components
• Managing human and other resources
• Performance management
• Quality management

IT Organizational Controls

• IT department functional description controls
• IT governance and control frameworks
• IT organization controls
• IT organization performance measures.
• IT vision, mission and values statements
• Monitoring and review controls

Super Fraud - Crazy Eddie on Masterminds

Still relevant.

COSO Update - Key Links

Current COSO

http://www.coso.org/documents/coso_framework_body_v6.pdf

 Presentation on COSO changes

http://www.coso.org/documents/cosoicifoutreachdeck_05%2018%2012.pdf

Direct link to download proposed COSO draft (zipped files, checkout coso_illustrative_tool.pdf--super)

http://ic.coso.org/download.aspx

Coming COSO Update - 17 Principles

1. Demonstrates Commitment to Integrity and Ethical Values—The organization demonstrates a commitment to integrity and ethical values.

2. Exercises Oversight Responsibility—The board of directors demonstrates independence from management and exercises oversight for the development and performance of internal control.

3. Establishes Structure, Authority, and Responsibility—Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

4. Demonstrates Commitment to Competence—The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

5. Enforces Accountability—The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

6. Specifies Suitable Objectives—The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

7. Identifies and Analyzes Risk—The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

8. Assess Fraud Risk—The organization considers the potential for fraud in assessing risks to the achievement of objectives.

9. Identifies and Analyzes Significant Change—The organization identifies and assesses changes that could significantly impact the system of internal control.

10. Selects and Develops Control Activities—The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

11. Selects and Develops General Controls over Technology—The organization selects and develops general control activities over technology to support the achievement of objectives.

12. Deploys through Policies and Procedures—The organization deploys control activities through policies that establish what is expected and procedures that put the policies into action.

13. Uses Relevant Information—The organization obtains or generates and uses relevant, quality information to support the functioning of other components of internal control.

14. Communicates Internally—The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of other components of internal control.

15. Communicates Externally—The organization communicates with external parties regarding matters affecting the functioning of other

components of internal control.

16. Conducts Ongoing and/or Separate Evaluations—The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

17. Evaluates and Communicates Deficiencies—The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Get Really Free Stuff

Couchsurfing.org  for free lodging

LibriVox.org  free books on tape, mp3

Volition.com get free recording software to read books

TheFreeSite.com

 freechannel.net.

MyKidsEatFree.com

OpenOffice.org.

Lear languages free at BBC

AnnualCreditReport.com

Free phone from Skype or Google voice

Also check out FREEE STUFF category on Craigslist, and don’t limit  yourself only to your town

Glad to See You Visiting Again: Welcome.

Four Rules for Every Meeting

FOCUS Turn off cell phones, laptops, iPads, and point your brain toward the meeting's goals.

PARTICIPATE  Share your input, question others, bring up ideas and comments, get involved.

MOVE  Decisions need to be made to make the meeting productive

CLOSE Get done what you set out so that everyone has the feeling of accomplishment.

YOUR EYES  Always turn toward whoever is speaking.  Most people look at others only when they disagree and are building a rebuttal.

Must Define When Developing Recommendation

• Assumptions and constraints for the solution
• Business objectives of the proposed solution based on the identified problem or business
• Definition of the expected effort to create the expected deliverable
• Description of the deliverable  this may be products, services, environment, profits, problems solved, and other outcomes

 Note  A constraint is anything that limits your option. Time and cost limits are examples of constraints.

When Creating Effective Survey

• Confirm the survey length (ten questions or fewer is ideal).
• Determine how respondents will receive, complete, and return the survey; consider paper-based, telephone-based, or web-based surveys.
• Determine the acceptable level of response rate and what incentives might be offered to help reach the response rate.
• Determine the need for pre- and post-survey interviews to formulate the survey and to review its findings.
• Determine which types of questions, closed or open, are most appropriate for the survey type.
• Document the survey purpose and which stakeholders should participate.
• Refine the survey questions so they're clear, easy to answer, and don't put the participant in a defensive stance.
• Test the survey and make any modifications to the survey if necessary.
• Write the most appropriate survey questions in consideration of the participants' backgrounds, values, and interest in the survey purpose.

Do Before Your Workshop

- Communicate requirements workshop to the key stakeholders

- Complete interviews of stakeholders to help facilitate the workshop

- Create an agenda for the workshop

- Document what the business problem or opportunity is

- Schedule a scribe or recorder to do the minutes and conversations for future reference

Why Brainstorm?

• Encourages stakeholder participation
• Explores solutions to business opportunities
• Explores solutions to problems within the project
• Fosters team building
• Helps determine constraints on the project team, the project, or the organization and how they might be removed
• Promotes diverse thinking for multiple options for a solution
• Reveals options that are available for the current issue

Risk Management Principles

  1. Risk management creates and protects value

  2. Risk management is an integral part of all organizational processes

  3. Risk management is part of decision making

  4. Risk management explicitly addresses uncertainty

  5. Risk management is systematic, structured, and timely

  6. Risk management is based on the best available information

  7. Risk management is tailored

  8. Risk management takes human and cultural factors into account

  9. Risk management is transparent and inclusive

10. Risk management is dynamic, iterative, and responsive to change

11. Risk management facilitates continual improvement of the organization

Key Risk Documents To Review

• Risk Management Policy
• Risk Management Process and Strategy
• Risk Identification and Assessment Tools and Templates
• Risk Management Training Program and Materials
• Risk Tolerance documentation, including likelihood, consequence, and overall risk level criteria
• Risk Registers
• Risk Reports

Risk Management Policy

• Accountabilities and responsibilities for managing risk
• Commitment to the periodic review and verification of the risk management policy and framework, and its continual improvement
• Links between this policy and the strategies and objectives
• The risk appetite
• The rationale for managing risk
• Processes and methods to be used for managing risk
• Resources available to assist those accountable or responsible for managing risk
• The way in which risk management performance will be measured and reported

Risk Framework Documentation

• Objectives and rationale for managing risk
• The overall appetite/tolerance for risks
• The strategic objectives and the strategies deployed to achieve these objectives
• Key risks associated with these strategies within a one to three year time frame
• The high-level approach to managing these risks
• A plan for progressive enhancement of risk management practices and competencies and initiatives

Why Document Risk Framework and Steps Performed

• Demonstrate to stakeholders that the process has been conducted properly
• Provide evidence of a systematic approach to risk identification and analysis
• Enable decisions or processes to be reviewed
• Provide a record of risks and to develop the organization’s knowledge database
• Provide decision makers with a risk management plan for approval and subsequent implementation
• Provide an accountability mechanism and tool
• Facilitate ongoing monitoring, review and continuous improvement
• Provide an audit trail
• Share and communicating information