IT Governance Archives | Cybiant

Governing AI Agents: Controls, Audit Trails and Human-in-the-Loop Design

Cybiant — Mon, 02 Nov 2026 09:09:29 +0000

AI agents are moving from answering questions to taking actions: updating records, issuing refunds, provisioning access, closing tickets. That shift changes the governance question. With classic RPA you governed a script that did the same thing every time. With agents you govern a system that decides what to do, chooses its own tools and can be steered by the content it reads.

This article sets out a practical governance model in three layers: controls that limit what an agent can do, audit trails that record what it did and why, and human-in-the-loop design that places people where their judgement actually counts. It draws on the rules and standards that now apply to agents, including the EU AI Act, Singapore’s Model AI Governance Framework for Agentic AI and the OWASP Top 10 for Agentic Applications, and maps them to the Service Automation Framework (SAF).

Who this is for: automation managers, CIOs and CDOs, risk and compliance leads, and public sector digital teams deploying agents on ServiceNow, UiPath, Microsoft Power Platform or custom stacks.

Why agents need a different governance model

An agent’s risk equals everything it can reach, multiplied by how many steps it can take without a person looking. A bot that follows a fixed script fails in predictable ways. An agent plans, calls tools, holds memory and can be redirected by an email or a document it was asked to summarise. Each step can look reasonable while the chain as a whole is something no one would have approved.

The OWASP Top 10 for Agentic Applications, published on 9 December 2025 and peer reviewed by more than 100 practitioners, is now the common vocabulary for these risks. Each one has a governance answer, not only a security one.

OWASP risk	What goes wrong	Governance control
ASI01 Agent Goal Hijack	Content the agent reads changes its objective	Treat retrieved content as untrusted; fixed task scope
ASI02 Tool Misuse and Exploitation	Legitimate tools chained to an illegitimate end	Tool allowlists; parameter validation at runtime
ASI03 Identity and Privilege Abuse	Borrowed or shared credentials with broad scope	One identity per agent; short-lived, task-scoped credentials
ASI04 Agentic Supply Chain Vulnerabilities	A compromised plugin, connector or MCP server	Approved component register; signed, verified sources
ASI05 Unexpected Code Execution	Natural language becomes running code	Sandboxed execution; outbound network denied by default
ASI06 Memory and Context Poisoning	False “memories” steer later sessions	Validate memory writes; inspectable, flushable memory
ASI07 Insecure Inter-Agent Communication	Spoofed or replayed messages between agents	Mutual authentication; allowlisted delegation paths
ASI08 Cascading Failures	One bad action triggers downstream automation	Circuit breakers; separation of test and production
ASI09 Human-Agent Trust Exploitation	The approver sees the agent’s summary, not the action	Show the raw action at approval; log what was displayed
ASI10 Rogue Agents	An agent keeps acting outside policy and looks normal	Behaviour baselines; named owner; tested kill switch

Risk names from OWASP; the control column is Cybiant’s governance mapping, informed by the OWASP mitigation guidance as summarised by Cycode.

Two items deserve attention from automation leaders in particular. ASI03 is the multiplier: a hijacked agent with read-only scope is an incident report, while the same agent holding a broad token is a breach. ASI09 targets the human approval step itself, which is why “add an approval” is not a complete answer.

The rules and standards that now apply

The frameworks differ in legal force, but they converge on the same four asks: know your agents, limit what they can do, record what they did, and keep a person able to intervene. Design once against that common core and you can map to each framework rather than rebuilding for each.

Framework	Status (October 2026)	What it asks of organisations running agents
EU AI Act, Articles 12, 14 and 19	Law. The Digital Omnibus moved high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) (Gibson Dunn)	Automatic event logging over the system’s lifetime; oversight that lets a person recognise automation bias, override the output and stop the system in a safe state (Article 14); deployers keep logs for at least six months
Singapore Model AI Governance Framework for Agentic AI (IMDA)	Voluntary; launched 22 January 2026. Organisations stay legally accountable for their agents’ actions	Four dimensions: bound risks upfront, make humans meaningfully accountable, apply technical controls across the lifecycle, enable end-user responsibility
NIST AI Agent Standards Initiative	Launched 17 February 2026; guidance in development	Focus on agent security, identity and authorization, including how existing identity standards extend to software agents (Pillsbury)
ISO/IEC 42001	Voluntary, certifiable; published December 2023	An AI management system covering the whole AI lifecycle, whether you build, buy or simply use AI
Malaysia AIGE Guidelines (MOSTI)	Voluntary; launched September 2024	Seven principles, including reliability, safety and control, and accountability (Skrine); the National AI Office signalled further AI security guidance for 2026 (Lex Mundi)

Most internal service agents will not be classed as high-risk under the EU AI Act. Articles 12 and 14 are still the most precise public description of what “governed” looks like, which makes them a sensible design target even where they are not mandatory.

Controls: limit what an agent can do

The strongest control is the one that does not depend on the agent behaving well. Prompts and instructions shape behaviour; permissions, limits and stop mechanisms enforce it. Singapore’s framework puts it as bounding risk by design: restrict access, limit autonomy, keep every action traceable to a human, and threat-model before go-live (Bird & Bird).

Control	Minimum standard	Evidence an auditor will ask for
Agent register	Every agent listed with purpose, owner, systems touched, risk tier and review date	The register, and proof it matches what is running
Agent identity	One identity per agent; no borrowed human logins or shared service accounts; short-lived credentials scoped to the task	Identity records; access reviews on the same cycle as staff
Least agency	Allowlist of tools and actions; hard caps on value, volume and scope (for example, refunds under a set amount, a maximum records per run)	Tool and limit configuration under version control
Untrusted input handling	Emails, documents, tickets and web pages treated as data, never as instructions; memory writes validated	Test results from prompt-injection scenarios
Containment	Sandboxed execution, outbound network denied by default, test and production separated, circuit breakers on abnormal activity	Architecture diagram; circuit breaker trigger history
Stop mechanism	A kill switch that halts the agent in a safe state, not mid-transaction	Results of a scheduled kill-switch drill
Change control	Model, prompt, tool and policy changes versioned, tested and approved like code	Change records linked to test runs
Staged rollout	Start in shadow or low-autonomy mode; widen autonomy by evidence, with alert thresholds	Go-live criteria and the metrics that met them

The stop mechanism is the one most often missing. Article 14(4)(e) of the EU AI Act asks for an interrupt that brings the system to a halt in a safe state (AI Act Service Desk). For an agent halfway through a multi-system update, that means designing rollback or compensation steps, not just a pause button.

Audit trails: record what the agent did and why

An audit trail for an agent must answer one question for any action: what did it read, what did it change, in which system, on whose behalf, and who could have stopped it. Model-level logs of prompts and completions are not enough on their own; regulators and auditors will look for a per-action record (StackOne). The EU AI Act requires logging to be built into high-risk systems for their whole lifetime, not added later (Article 12).

Control	Minimum standard	Evidence an auditor will ask for
Agent register	Every agent listed with purpose, owner, systems touched, risk tier and review date	The register, and proof it matches what is running
Agent identity	One identity per agent; no borrowed human logins or shared service accounts; short-lived credentials scoped to the task	Identity records; access reviews on the same cycle as staff
Least agency	Allowlist of tools and actions; hard caps on value, volume and scope (for example, refunds under a set amount, a maximum records per run)	Tool and limit configuration under version control
Untrusted input handling	Emails, documents, tickets and web pages treated as data, never as instructions; memory writes validated	Test results from prompt-injection scenarios
Containment	Sandboxed execution, outbound network denied by default, test and production separated, circuit breakers on abnormal activity	Architecture diagram; circuit breaker trigger history
Stop mechanism	A kill switch that halts the agent in a safe state, not mid-transaction	Results of a scheduled kill-switch drill
Change control	Model, prompt, tool and policy changes versioned, tested and approved like code	Change records linked to test runs
Staged rollout	Start in shadow or low-autonomy mode; widen autonomy by evidence, with alert thresholds	Go-live criteria and the metrics that met them

Use a standard format. The OpenTelemetry semantic conventions for GenAI agents define spans such as invoke_agent and execute_tool, so one agent run becomes one trace with each tool call as a child step. The conventions are still marked as in development (Microsoft Learn), but adopting them now keeps traces portable across ServiceNow, UiPath, Power Platform and custom agents.

Make logs trustworthy. Write to append-only storage with integrity checks, separate log access from agent access so an agent cannot edit its own history, and set retention by the strictest rule that applies. For high-risk systems under the EU AI Act that is at least six months for automatically generated logs (Prediction Guard).

Protect the people in the logs. Agent traces often contain personal data. Mask or tokenise sensitive fields, and align retention with PDPA, GDPR or sector rules.

Human-in-the-loop design: put people where judgement counts

A human approval on every step does not scale and quickly turns into rubber-stamping. The better question is where a person adds real protection. Two factors decide it: how much harm a wrong action causes, and how hard it is to undo. Singapore’s framework names the same factors, asking organisations to weigh the scope and reversibility of an agent’s actions before setting its autonomy (Bird & Bird).

Checkpoint placement matrix: impact by reversibility. Move an agent between quadrants as the logs earn it more autonomy.

Only actions that are both high impact and hard to undo need approval before the agent acts; everything else can run with review after the fact, a cancel window, or logging and sampling.

Make the approval meaningful

Show the real action. The reviewer should see the exact record, amount and recipient, not the agent’s own summary. OWASP flags agent-written summaries at approval time as a distinct risk (ASI09).
Design against automation bias. The EU AI Act asks that overseers stay aware of the tendency to over-rely on system output, and that they can override it or stop the system (Article 14). Show confidence and uncertainty, and add friction on consequential steps.
Give reviewers real authority. A reviewer who must escalate to override is not exercising oversight. Train them on the agent’s limits and give them time to review.
Measure oversight quality. Track override rates and time per review. A near-zero override rate or reviews taking seconds are signs that oversight has become a formality (Presencis).
Escalate the unexpected. Monitor agent behaviour in real time and route anomalies to a named person, as Singapore’s framework recommends.

Autonomy should be earned. Start an agent in a stricter quadrant, then move it as logs show reliable behaviour, and move it back if incidents or drift appear.

Putting it into practice with the Service Automation Framework

Governance works when it is part of how automated services are designed, not a review bolted on before go-live. The Service Automation Framework, authored by Cybiant and maintained by the Service Automation Framework Alliance, already treats automation as a service with users, a designed interface and managed delivery (Cybiant). Agents fit that structure: the autonomy tier becomes a design decision in the service blueprint, and exception handling becomes part of service delivery rather than an afterthought.

Who owns what

Role	Accountable for
AI or automation governance board	Risk appetite, autonomy tiers, approval of high-impact agents
Agent owner (business)	The outcome the agent delivers, its autonomy level, and sign-off on changes
Automation Centre of Excellence	Build standards, the agent register, change control, monitoring
Identity and security team	Agent identities, credential scope, access reviews, kill-switch drills
Risk and compliance	Mapping to EU AI Act, Singapore MGF, ISO/IEC 42001 and local rules; auditing oversight quality
Human reviewers	Decisions at checkpoints, with training on automation bias

A 90-day starting plan

Days 1 to 30: build the agent register, assign an owner to every agent, and rate each one on impact and reversibility
Days 1 to 30: remove borrowed human credentials and shared service accounts from agents
Days 31 to 60: set autonomy tiers and checkpoints for every agent using the matrix above
Days 31 to 60: switch on per-action tracing in a standard format and route it to append-only storage
Days 61 to 90: run a kill-switch drill and a prompt-injection test on your highest-risk agent
Days 61 to 90: publish the first oversight report: override rates, review times, incidents, and changes made

Automate What Matters

How Cybiant helps

Cybiant authored the Service Automation Framework and can design, build, run and teach governed agentic automation end to end.

Design: an agentic governance assessment that maps your agents to impact and reversibility, sets autonomy tiers, and aligns controls with the EU AI Act, Singapore MGF, ISO/IEC 42001 and Malaysia’s AIGE principles.
Build: agents on UiPath, ServiceNow and Microsoft Power Platform with identity, limits, tracing and approval checkpoints built in from the first release.
Run: managed services that operate the agent register, monitoring, kill-switch drills and oversight reporting.
Teach: SAF certification and training for automation teams and the reviewers who sit at your checkpoints.

talk to cybiant

Sources

OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Project
OWASP Top 10 for Agentic Applications: risks and mitigations, Cycode
EU AI Act, Article 12: Record-keeping, European Commission AI Act Service Desk
EU AI Act, Article 14: Human oversight, European Commission AI Act Service Desk
EU AI Act Omnibus Agreement: postponed high-risk deadlines, Gibson Dunn
EU AI Act compliance audit log, Prediction Guard
The EU AI Act will grade your logs, not your model, StackOne
AI transparency logging infrastructure for EU AI Act compliance, Airia
Singapore introduces new Model AI Governance Framework for Agentic AI, Bird & Bird
AI Agent Standards Initiative, NIST CAISI
NIST AI agent standards, Pillsbury
ISO/IEC 42001 certification, DNV
National Guidelines on AI Governance and Ethics (AIGE), Government of Malaysia
National Guidelines on AI Governance and Ethics launched, Skrine
AI Legislative Guide: Malaysia, Lex Mundi
Semantic conventions for GenAI agent spans, OpenTelemetry
Agent tracing concepts, Microsoft Learn
EU AI Act Article 14 conformity guidance, Presencis
Service Automation Framework, Wikipedia
Intelligent Automation Implementation, Cybiant

The post Governing AI Agents: Controls, Audit Trails and Human-in-the-Loop Design appeared first on Cybiant.

CISA vs. ISACA IT Audit Fundamentals: Which Certification Is Right for You?

Cybiant — Fri, 26 Jun 2026 09:25:30 +0000

If you’re exploring a career in IT audit, you’ve likely come across two ISACA credentials that sound like they cover similar ground. They’re related, but built for different people, at different points in their careers, solving different problems.

This article breaks down what each certification actually is, who it’s for, and how to decide which one, or which order, makes sense for you.

The Short Answer

	IT Audit Fundamentals	CISA
What it is	An entry-level course covering the basics of IT audit	A globally recognized professional certification
Who it’s for	Newcomers to IT audit, risk, or compliance	Experienced IT auditors and audit/risk leaders
Prerequisites	None	None to sit the exam, but 5 years of relevant work experience to earn the certification
Format	3-day instructor-led course	Exam-based certification + structured exam prep training
Outcome	Foundational knowledge and a course completion	A certification recognized as the global standard for IT audit professionals
Best starting point if you…	Are new to audit and need the vocabulary and method	Already work in audit/IT/security and are ready to formalize that experience

If you are unsure which to choose: if you have never been formally trained in IT audit, start with Fundamentals. If you already have IT audit, security, or risk experience and want the credential that proves it, go straight to CISA.

ISACA® IT Audit Fundamentals

Foundation

ISACA IT Audit Fundamentals is a foundational training course designed to introduce the core concepts, vocabulary, and methodology of IT audit. It is built for people who touch audit, risk, or compliance in their role but have never had structured training in how IT audit actually works.

What it covers

Risk-based audit planning
Control evaluation and testing
Evidence gathering and documentation
Audit reporting and communication

What it is not: It is not a certification in the way CISA is. It is a structured, instructor-led course that builds the baseline knowledge most audit careers are built on — there is no separate exam to sit afterward, and no work-experience requirement.

Who takes it

IT professionals moving into audit, risk, or compliance for the first time
Junior auditors who learned the job through on-the-job training rather than formal training
Risk, compliance, or security staff whose roles increasingly overlap with audit
Anyone preparing the ground before attempting CISA

Format: 3-day instructor-led

Certified Information Systems Auditor® (CISA)

Senior Professional

CISA (Certified Information Systems Auditor) is ISACA’s flagship credential, and one of the most recognized certifications in the IT audit, risk, and governance profession globally. It is the certification job postings for senior audit, risk, and compliance roles often name explicitly.

What it validates

The ability to assess IT and business process vulnerabilities
Governance and management of enterprise IT
Acquisition, development, and implementation of information systems
Protection of information assets
Reporting on audit findings to stakeholders and leadership

The certification requirements

Earning CISA requires two separate things:

Passing the CISA exam — a rigorous exam covering the five domains above
Meeting ISACA’s professional experience requirement — a minimum of 5 years of relevant work experience in IS/IT audit, control, security, or assurance (some substitutions and waivers apply for specific education or certifications)

This is the key structural difference from Fundamentals: you can complete a Fundamentals course in a week, but you cannot fast-track your way to CISA — the experience requirement exists precisely because CISA is meant to certify people who have already done the work, not people who have only studied it.

Who pursues it

Experienced IT auditors formalizing their credentials
Risk, security, or compliance professionals targeting audit leadership roles
Consultants who need a credential clients and regulators recognize
Professionals targeting CISO, Head of Internal Audit, or Director of Risk-type roles

Format: 4-day instructor-led + exam preparation

The Real Difference: Depth, Not Just Difficulty

It is tempting to think of these as “beginner” and “advanced” versions of the same thing. That is only half right. The more important difference is what each one is certifying.

IT Audit Fundamentals certifies that you understand how IT audit works. It is knowledge-based. You leave the course able to speak the language of audit and apply its core methods.
CISA certifies that you have already done IT audit work, at a professional standard, for years. It is experience-based, with the exam serving as a rigorous test of whether your practical knowledge matches the global standard ISACA has defined.

This is why a motivated newcomer can complete Fundamentals in a long weekend but cannot shortcut their way into a CISA designation no matter how well they study — the credential is partly a function of time and practice, not just test performance.

Can You Go Straight to CISA?

Yes — if you already meet the experience requirement. There is no rule that says you must complete Fundamentals first. Many experienced IT auditors, security professionals, and risk managers go directly into CISA exam preparation because they already have the years of hands-on practice the certification requires.

Fundamentals exists for the other case: professionals who have the adjacent experience (IT operations, security, compliance, general business) but have not had formal exposure to audit methodology, and want to build that foundation, whether or not they intend to pursue CISA afterward.

A Common, Deliberate Pathway

For professionals building toward a long-term audit career:

ISACA IT Audit Fundamentals → gain qualifying work experience → CISA

This sequencing means you enter your audit experience years already speaking the right language and using the right methodology, rather than learning audit fundamentals informally on the job, while the clock on your CISA-qualifying experience is already running.

Which One Should You Choose?

1

Have I had formal training in IT audit methodology before?
If no → start with IT Audit Fundamentals.
2

Do I already have 5+ years of relevant audit, security, risk, or assurance experience?
If yes → go straight to CISA exam preparation.
3

Am I trying to move into audit from an adjacent IT or risk role?

Build the foundation with Fundamentals first, then work toward CISA once you’ve accumulated qualifying experience.

There’s no wrong choice here, only a mismatch between where you currently are and which course assumes you already are. Fundamentals assumes no audit background. CISA assumes a meaningful one.

Free Download

Train with Cybiant

Both certifications are delivered as accredited, instructor-led programs taught by certified trainers — connected to real governance and audit implementation work, not generic exam-cram courses.

IT Audit Fundamentals →

CISA →

The post CISA vs. ISACA IT Audit Fundamentals: Which Certification Is Right for You? appeared first on Cybiant.

Criticality of IT/OT Data Convergence For Industrial Automation

Cybiant — Fri, 16 Dec 2022 06:50:56 +0000

Criticality of IT/OT Data Convergence For Industrial Automation | Automation Days Asia 2022

By Bryan Lee

Manufacturing, utilities, and oil & gas organizations are undergoing significant digital transformations, fueled by the Industrial Internet of Things (IIoT) and advanced digital solutions. A key enabler of this transformation is the convergence of data from Operational Technology (OT) and Information Technology (IT). Historically, IT and OT have operated in separate domains, with IT focusing on data management and communication while OT managed industrial control systems. However, bringing these two areas together allows for more streamlined operations, data-driven insights, and improved automation capabilities.

In this session, Bryan Lee will highlight the critical importance of IT/OT data convergence for enhancing industrial automation. By integrating IT’s data processing capabilities with OT’s real-time control systems, organizations can optimize production workflows, improve asset utilization, and increase overall efficiency. This convergence enables industries to harness real-time data for predictive maintenance, process optimization, and smarter decision-making. The result is a more responsive and resilient industrial environment, where operations can be adjusted dynamically based on data insights.

Gain practical knowledge on how IT/OT integration can drive success in industries such as manufacturing, utilities, and oil & gas. Bryan will explore the benefits of this convergence, such as reducing operational costs, minimizing downtime, and enhancing safety. The session will also address common challenges, including security concerns and the complexities of merging legacy OT systems with modern IT infrastructures, offering strategies to navigate these hurdles and maximize the potential of digital transformation in industrial settings.

About Speaker

Bryan Lee is an enthusiast in helping manufacturer moving their business into IR4.0. Bryan works as a Sales Vice President at Matrix Invent Sdn Bhd.

To find out more about what is Automation Days Asia 2022, visit here. If you want to know more about training and certification, don’t hesitate to drop us a message in the chatbox! Subscribe to our newsletter here.

The post Criticality of IT/OT Data Convergence For Industrial Automation appeared first on Cybiant.

IT Governance Roles and Responsibilities

Celine Chow — Thu, 08 Sep 2022 08:55:24 +0000

IT Governance Roles and Responsibilities

Having an effective IT governance framework in place will help you to safeguard your organisation against an information security breach. At the same time, your IT governance framework would lead to more opportunities for your business.

By ensuring that your IT structures are accurately integrated with your business and in synchronization with your overall business goals, an organisation will be in an advantageous position to drive through changes and improvements. Establishing an IT governance framework is critical for the success of both IT projects and the larger scale projects that need support from across the whole organisation.

IT Governance department is the department that carries the role of describing and managing the business application processes and policies throughout the organisation. IT Governance department is usually managed by a team or individual based on the organisation size.

IT governance also works to align your IT and business vision. The primary objective of IT governance roles and responsibilities is to ensure the policies and strategies that are designed are applied in a way that helps the business to meet the objectives.

The IT governance roles include:

Implementation of guidelines and strategies:

Guideline act as a direction for the businesses to follow. Therefore, a well-planned strategy for every department within an organisation are crucial steps to take in.

Adherence to processes:

The IT governance department plays a major role to ensure adherence to these processes as per guidelines. If misuse or improper usage of policies, the team should take corrective actions immediately to fix the non-compliance.

Resolving identified issues:

The governance team also takes care of all issues related to the policies and processes and actions of addressing the issues is required in this role. The governance team usually get a helping hand from the IT Service Management team who focuses on incidents and approves change requests.

The Governance responsibilities:

Governance is applied by regulating influence to guide and control the actions and affairs of management and the rest of the organisation. The person or team who carries the responsibility for governance is accountable for the performance and conformance of the company. The basics of the IT governance team in any organisation should include the design, implementation and on-going compliance with these five responsibilities:

1. Determine the objectives for IT

The objectives explain the purpose of IT and define how the organisation will fulfil the purpose. The objectives often included IT vision or mission statements and implementation by using a strategic IT plan.

2. Design and implement the IT governance framework

The framework design blueprint should include the objectives for IT, policies, governance principles, IT Governance roles with responsibilities and processes. The framework must be aligned with the organization’s governance responsibilities and support the achievement of the organisation’s goals and objectives that aim to achieve. A framework that builds is recommended to utilise the industry standards and best practice frameworks such as COBIT as reference guides. The framework should be reviewed regularly and updated whenever required.

3. Define the ethics of the IT organization

Organisation ethics are usually based on morals and values. The rules or standards set shall shape how IT staff at all levels conduct performance within the organisation and set expectations of behaviours from each of them.

4. Create the culture of the IT organization

Create a culture that motivates IT staff to interact with people that is outside the IT domain. IT Governance success is depending on the team who takes responsibility seriously. Cultural change has to be led and nurtured by the top of IT to make it happen. An effective governance culture is the heart of the IT governance system where the people are willing to be governed and support the IT governance.

5. Ensure compliance

Ensuring compliance is an ongoing governance responsibility. It designs to ensure that IT continually meets any regulatory, statutory and legal obligations to support the organisation’s objectives while working within the defined ethical and cultural frameworks.

Figure 1: The Key IT Governance Roles and Responsibility by LinkedIn: Sherif Galal

This is an ongoing governance responsibility. It aims to ensure that IT continually meets any regulatory, statutory, and legal obligations to support the organization’s objectives while working within the defined ethical and cultural framework, and follows the IT governance framework. Compliance also includes checking that the IT governance roles and responsibilities are still relevant.

For more articles, visit our Cybiant’s Knowledge Centre. Learn more about topics that are required for digital transformation and other information technology related subjects!

The post IT Governance Roles and Responsibilities appeared first on Cybiant.

Types of IT Governance

Celine Chow — Tue, 14 Jun 2022 06:32:13 +0000

Types of IT Governance

“IT governance is the responsibility of executives and the board of directors, and consists of leadership, organizational structures, and processes that ensure that the enterprise’s IT sustains and extends the organization’s strategies and objectives.”

Decent IT Governance implementation requires set of best practice frameworks based on major elements:

Effective
Structure

Effective
Process

Effective
Communication

The efficiency of IT Governance would be enabling the organisation to achieve its goals and objectives. The efficiency of IT Governance’s focus includes the effectiveness of:

Evaluation

Selection

Prioritization

During the decision-making process, action involves are:

Funding of
competing IT Investments

Oversee
the
implementation

Handpicked measurable business advantage

Governance process enforcement is spoken by IT group management and it acts as a guideline for leaders to manage their IT investment, projects and resources while basic elements are in place and ensuring the success

The IT Governance Institute (a division of ISACA) breaks down IT governance into five domains:

Value Delivery
Strategic Alignment
Performance Management
Resource Management
Risk management

1. Value Delivery

Governance allows leadership to actively commit to improving the management and control of IT activities in the agency. Governance provides federal managers with the framework to manage all IT initiatives and demands, through a single point where they are prioritized and fulfilled. It allows standardizing technology platforms and helps managers make informed decisions on IT initiatives.

Effective governance is about accountability. This enables leaders to enforce the responsibilities that relate to IT program management.

2. Strategic Alignment

Governance works together with IT portfolio management to align IT investments with business objectives, enabling leaders to improve responsiveness to challenges and also to manage current and future IT investments. It provides transparency to enterprise IT investments and ensures investment is spent in accordance with the business’s mission. Governance allows leaders to actively commit to improve the management style and controlling IT activities within the business. This initiative also ensures a culture of openness and collaboration among the business, geographical and functional units of the enterprise.

3. Performance Management

Enterprises that effectively monitor the activities of IT would ensure the activities are in line with the business goals that are set by using KPI or key measurement metrics. Performance metrics are used as a tool to evaluate the effectiveness and efficiency of business processes against the business goal. Besides, the performance metrics also help businesses to allocate and manage resources. The results shown from the performance metrics will also influence the leaders’ decisions that are related to the activities such as budgeting, priorities, and resources.

KPI and metrics are crucial tools for management to have a complete overview of the whole business performance and this is usually involving a huge investment in IT. Due to that, business owners usually will confirm that the IT investment is strategically aligned with the business goals and they are managed effectively to help the achievement of the common business goals. This includes ensuring the stakeholders expectations are met, and management uses IT governance process that is defined by global standards. The popular best practice framework includes ISO 38500 and COBIT.

4. Resource Management

Proper management of critical resources (IT resources and IT infrastructures) enables control in planning and organizing IT initiatives. This gives leaders the ability to ensure appropriate IT support is available at enterprise level for current and future IT investments. The governance practices for resource allocation are following:

IT resource allocation in correlation with business priorities.
Implement effective controls towards IT infrastructure that identifies resource fulfilment at optimum level.
Sustain investment in staff development, education and training.

5. Risk Management

Proactive risk management ensures that IT managers and leaders are aware of the risk associated with the IT initiatives and provides the root cause to implement risk mitigation strategies. Risk management is a continuous process which starts by assessing the level of exposure of the organisation and identifying the main incident risks. Identifies risks should be minimised using a control procedure and the lasting risk should be adjusted at a minimal level.

To learn more about IT Governance, feel free to reach us at info@cybiant.com or drop us a message in the chatbox or subscribe to Cybiant Newsletter.

The post Types of IT Governance appeared first on Cybiant.

What is COBIT?

Celine Chow — Mon, 22 Nov 2021 02:05:09 +0000

What is COBIT?

COBIT was known as – Control Objectives for Information and Related Technologies in the past and it is known as a best practice framework founded by ISACA for IT Management and IT Governance. Before the release of framework, people talked about COBIT as “control objective for IT” or Control Objective for Information and Related Technology.

COBIT draw a clear distinction between governance and management ever since they involve different activities which require different organisational structure that serve both different purposes. The governance ensures stakeholder needs, conditions and options are assessed to ensure balanced and it is aligned on enterprise objectives. Path is set based on prioritization and decision making. In the meantime, management plans, builds, runs and observe activities that are in alignment with the path that established by governance body to achieve enterprise level objectives.

COBIT can be used as business framework to implement enterprise governance of IT for deploying new and existing platforms and technologies. Organisation may conduct a systematic approach for using COBIT 2019 components as a benchmark, tailored them as required to build an operative governance system with define focus.

There are 7 steps organisation can consider when selecting and customising COBIT 2019:

Step 1: Identify Stakeholder Needs
Step 2: Identify Enterprise Goals and Alignment Goals
Step 3: Identify the Governance and Management Objectives
Step 4: Select and Customize Goals and Metrics for Enterprise and Alignment Goals
Step 5: Select and Customize the Components of the Governance and Management
Step 6: Prepare Customized COBIT Contents and Integrate Them into Enterprise Practices
Step 7: Implement Performance and Monitoring Measures to Confirm Results and Take Remedial Action

Step 1: Identify Stakeholder Needs

The implementation of an appropriate business continuity strategy supported by relevant policies and procedures ensure minimum business disruption by ensuring maximum flexibility of business operations.

Step 2: Identify Enterprise Goals and Alignment Goals

According to stakeholder needs, Organisational Goals and relevant alignment goals must be identified. In COBIT^® 2019 Framework: Governance and Management Objectives, it guides organisation by helping with mapping Organisation Goals to Alignment Goals. This can be use as reference to identify the relevant alignment goals.

Step 3: Identify the Governance and Management Objectives

By using the COBIT 2019 framework guide, organisation be able to select the relevant governance and management objectives. From the template, organisation would be able to have an overview of the primary governance and objectives that applicable. With the overview, organisation may decide based on priority with either implement or improve processes that relating to managed continuity.

Step 4: Select and Customize Goals and Metrics for Enterprise and Alignment Goals

From COBIT core model, sample list of goals and metrics is listed to assist organisation in getting started. Organisation may select the most relevant goals and metrics from the ready list. The goals and metrics also can be tailored and integrated as is or can be used as Key Goal Indicators (KGIs), Key Performance Indicators (KPIs) or Key Risk Indicators (KRIs) or areas as described by organisation’s reporting and monitoring system.

Step 5: Select and Customize the Components of the Governance and Management

In COBIT^® 2019 Framework: Introduction and Methodology, the COBIT governance and management components giving guidance and best practices for each component which allows organisation to select and tailor as required. The organisation may select any or all the governance and management practices relevant to its circumstances and tailor each practice further if required. You may also decide to whether to use it as practice level or activities level.

Step 6: Prepare Customized COBIT Contents and Integrate Them into Enterprise Practices

The relevant components that extracted from COBIT could be tailor further by adding guidance from appropriate regulations that applicable. It should be then be interpreted and reorganized in detailed policies and procedures, standards and guideline that are integrated towards proper documentation for organisation. Furthermore, relevant KGIs and KPIs would be required for each of the KGAs in order to monitor and measure the performance of the established standards. Next would be job responsibilities are then required to be updated and selected staff would need to be trained to perform based on the updated standards and procedures, consequently integrating the COBIT 2019 content into the day-to-day work of the business operations.

Step 7: Implement Performance and Monitoring Measures to Confirm Results and Take Remedial Action

The governing body should be informed with the changes required and benefits of the changes. To implement new approach, approval must be granted and it should be based on criticality, deliverables and milestones. Necessary budget and implementing changes within the organisation also required approval and decision based on relevant performance measurement metrics for all KGAs operation by using relevant KGIs and KPIs. These should be reported and monitored on regular basis to ensure compliance and value delivery.

COBIT 2019 provide rich source of guidance that can be used for implementation that not only on controls but also a governance system. The key differentiator of a governance system is the involvement of top management in leading and controlling the use of business IT to achieve objectives using appropriate decision-making mechanism as a guidance that is equip with responsible and accountable matrix with a monitoring system. COBIT 2019 content can be identified and selected as required using the mapping tables of business goals, alignment goals, and governance and management objectives, and how content from each of the 7 components of the governance and management system can be identified, selected and customized to address business needs.

If you are interested to know more about COBIT, please subscribe to our newsletter by clicking here or contact us at info@cybiant.com.

The post What is COBIT? appeared first on Cybiant.

Difference of COBIT 5 and COBIT 2019

Adam Chin — Thu, 19 Aug 2021 00:33:08 +0000

Difference of COBIT 5 and COBIT 2019

INTRODUCTION

COBIT is an Enterprise governance of I&T. It has evolved over time to provide a clear distinction between governance and management. The COBIT components aim to build and sustain a governance system. The design factors should be taken into consideration by the Enterprise in order to build a best fit governance system.

COBIT was first introduced in 1996 and COBIT 5 was released on 2012 while the latest version of COBIT, the COBIT 2019 was published in 2018.

1: Change in Governance Principles

Governance System Principles

COBIT 5 is formed of 5 main principle systems while COBIT 2019 launched an additional principle system to the latest release, so the COBIT 2019 contains 6 Principles to the governance framework.

COBIT 5 Principles	COBIT 2019 Principles
Meeting Stakeholder needs	Provide Stakeholder Value
Covering the Enterprise end-to-end	Holistic Approach
Applying a single Integrated Framework	Dynamic Governance System
Enabling a Holistic Approach	Governance Distinct from Management
Separating a Governance from Management	Tailored to Enterprise Needs
	End-to End Governance System

Source: ISACA®, COBIT® 2019 Framework: Introduction and Methodology, figure 3.5, USA, 2018, and COBIT® 5 figure 2, USA, 2012.

Governance Framework Principles

Apart from that, the 3 three Governance Framework Principles are introduced in COBIT 2019:

Source: ISACA, COBIT® 2019 Implementation Guide, figure 2.2, USA, 2018.

Based of Conceptual Model

Identifies key components and relationship between the components to maximise consistency and allow automation.

Open and Flexible

Openness and flexibility allow the addition of new content and the ability to address new issues in a flexible way which also contributes to integrity and consistency.

Align to Major Standards

The model should be aligned to major standards, frameworks and regulations.

2: Change in Processes

More changes are made towards the processes of the framework to address the governance and management objectives.

COBIT 5 Processes	COBIT 2019 Processes
37 Processes	40 processes
Terminology used: “Manage”	Terminology used: “Managed”
Terminology in APO10: Supplier	Terminology in APO10: Vendor
	Align, Plan and Organize (APO) added 1 process: APO14 Managed Data
	Build, Acquire and Implement (BAI) process added: BAI11 Managed Projects BAI06 and BAI07 indicate the changes being managed, accepted and transitioned are IT changes
Evaluate and Assess (MEA) Monitor, Evaluate and Assess	Evaluate and Assess (MEA) process added: MEA04 Managed Assurance emphasize the use of “managed”

Overview of Governance and Management Objectives may refer to as follows:

Source: ISACA, COBIT 2019 Framework: Introduction and Methodology, USA, 2018, figure 4.2.

Source: ISACA COBIT 5 Figure 16.

3: Change in Performance Management and Design Factors

COBIT 5	COBIT 2019
Between 0-5 scale based on ISO/IEC 33000	CMMI Performance Management Scheme
Enablers available and Design Factors not available	Design Factors introduced and removed Enablers

In COBIT 2019, 11 Design Factors introduced are about the factors that influence the design of the enterprise governance system.

Source: ISACA, COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution, figure 2.4, USA, 2018.

In order to facilitate application, a governance system design workflow was adopted. The workflow details can refer to ISACA’s COBIT® 2019 Design Guide and Toolkit: Designing an Information and Technology Governance Solution:

Source: ISACA, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution, USA, 2018, figure 4.1.

SUMMARY

COBIT 5 Processes	COBIT 2019 Processes
5 Governance Principles	6 Governance Principles
37 Processes	40 Processes
“Manage” Terminology used for management processes	“Managed” Terminology use for management processes
“Ensure” Terminology used for governance processes	“Ensured” Terminology use for governance processes
Governance framework principles are not available	Governance framework principles added
Measure performance using 0-5 scale based on ISO/IEC 33000	CMMI performance management scheme introduced to measure performance
Design Factors not included	Design Factors introduced

ISACA’s tool kit can be used to design an enterprise governance system by inserting appropriate values in the corresponding fields. COBIT 2019 also includes new technology and business trends in enterprise I&T. The framework is also capable of integrating with other international standards, guidelines, regulations and best practices that is inimitable for your organisation to provide an effective EGIT framework.

For more information about COBIT 2019 please contact us via our chat or info@cybiant.com.

The post Difference of COBIT 5 and COBIT 2019 appeared first on Cybiant.

What is IT Governance?

Cybiant — Tue, 18 May 2021 06:06:21 +0000

Introduction to IT Governance

IT Governance is an architectural framework that functions as a structure to ensure the organisation’s IT Strategy is aligned with its business strategy. With a best practice framework, an organisation can generate measurable results between strategies and goals. This includes a holistic view of stakeholder’s interest as well as the staff needs and the processes required in every stage of work. IT Governance is also known as the bridge that integrates overall business governance. This integration often involves not just the governance but also the risk and compliance factor through organizing activities in processes with clearly defined process outcomes that can be linked to the organisation’s strategic objectives.

IT Governance Goals and Objectives

The primary goals for IT Governance are to:

assure that the use of information and technology generate business value,
oversee management’s performance and
mitigate the risks associated with using information and technology.

Every organisation implements IT governance infrastructures to ensure they meet the internal and external requirements with best practice in place and control. This would usually differ for every organisation based on regions as a different region would be under different regulations from the local authorities. The difference usually involved the protection of confidential information, financial accountability, data retention and disaster recovery.

IT Governance frameworks are widely used in both public and private sectors. The official IT governance will be on the radar of any organisation in any industry in order to comply with regulations requirements from financial to technological accountability.

The most common initiative for an organisation to kick start with IT Governance is to start with a framework that has been created by the industry experts for years and that has been used by most organisations globally.

Overview of the different IT Governance Frameworks

The most commonly used frameworks are:

COBIT: Published by ISACA, COBIT is a comprehensive framework of “globally accepted practices, analytical tools and models” designed for governance and management of enterprise IT. With its roots in IT auditing, ISACA expanded COBIT’s scope over the years to fully support IT governance. The latest version is COBIT 2019, which is widely used by organizations focused on risk management and mitigation.
ITIL: Formerly an acronym for Information Technology Infrastructure Library, ITIL focuses on IT service management. It aims to ensure that IT services support the core processes of the business. ITIL comprises five sets of management best practices for service strategy, design, transition (such as change management), operation and continual service improvement.
COSO: This model for evaluating internal controls is from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). COSO’s focus is less IT-specific than the other frameworks, concentrating more on business aspects like enterprise risk management (ERM) and fraud deterrence.
CMMI: The Capability Maturity Model Integration method, developed by the Software Engineering Institute, is an approach to performance improvement. CMMI uses a scale of 1 to 5 to gauge an organization’s performance, quality and profitability maturity level. According to Calatayud, “allowing for mixed-mode and objective measurements to be inserted is critical in measuring risks that are qualitative in nature.”
FAIR: Factor Analysis of Information Risk (FAIR) is a relatively new model that helps organizations quantify risk. The focus is on cybersecurity and operational risk, with the goal of making more well-informed decisions. Although it’s newer than other frameworks mentioned here, Calatayud points out that it is already gained a lot of traction with Fortune 500 companies.

When reviewing the framework that best suits your organisation, understand your corporate culture would be the key to a decision. The consideration includes the framework or model that fits well for your organisation and resonate with your stakeholders. To keep the programs, to achieve a significant result an organisation should always keep the communication open between parties involved. Also, always measure and monitor the progress of the implementation and not hesitate to seek external assistance if help is required.

The post What is IT Governance? appeared first on Cybiant.