Years ago, the COBIT® 5 Process Assessment Model (PAM) was commonly used to assess the maturity level of a COBIT® implementation. The PAM provided indicators for nine attributes and six process capability levels and was used to guide auditors and IT departments.
There is no PAM for COBIT® 2019, but Capability Maturity Model Integration (CMMI) can be used to measure capability levels and combine that information with other factors to give value to the organizational process for measuring maturity. With that information, it is possible to create custom schemas and tools.
Building the Maturity Model
COBIT® 2019 Framework: Governance and Management Objectives describes the expected capability level for each of the 1202 COBIT activities. From the score obtained for each of those activities, it is possible to determine the maturity level for the 231 practices, the 40 objectives and the five domains constituting the COBIT 2019 framework.1 Figure 1 gives a sample of the governance practices, example metrics, activities and expected capability levels.
Source: ISACA, COBIT® 2019 Framework: Governance and Management Objectives, USA, 2018, https://www.isaca.org/resources/cobit
A total of 1202 activities comprise the foundation for the model. Based on CMMI, COBIT has defined six capability levels as shown in figure 2.
Source: ISACA, COBIT® 2019 Framework: Governance and Management Objectives, USA, 2018, https://www.isaca.org/resources/cobit
Determining Capability Level
Based on the activity’s capability level, the next step is to determine how to reflect the capability level for the practice. For organizations in early maturity stages, a simple average calculation for the activity values can be used to obtain the practice score or level. If an organization has a greater capacity for describing the maturity levels of their activities, then a weighted average, according to the capacity of the organization, is recommended to describe those activities.
Determining the maturity level entails using the capability level combined with other factors to get to a score that reflects not only the existence of the activities but also a holistic and integral view of the organization’s processes, when combined with other metrics, to present to management. To achieve this, it is necessary to correlate the capability level with other indicators to get a better descriptive score for the processes that can give a concise approach to the organizational status. It is also necessary to create milestones beyond the CMMI generic description for each practice to identify the expected evidence for the capability level in each activity. This is especially important for creating road maps for remediation and measuring the results along the way.
The building process schema consist of five steps as illustrated in figure 3.
All information should be integrated into a tool that allows an assessment of the organization and creates the proper reporting in a language that top-level management can understand and sponsor. Once all the information is integrated into the tool, the evaluation scorecard should look similar to Figure 4.
Fazit
Maturity models are becoming the common language used by organizations to understand the current state of their COBIT implementations. They also serve as guides to create gap analysis and road maps for improvement. Every organization is different, so different roads can achieve the desired result for different organizations, verticals, industries or regions.
Author’s Note
The author wishes to thank Mariela Varela and Raúl Rivera from the ISACA® Costa Rica Chapter for their review of this model and their suggestions for improvement.
MATURITY MODELS ARE BECOMING THE COMMON LANGUAGE USED BY ORGANIZATIONS TO UNDERSTAND THE CURRENT STATE OF THEIR COBIT IMPLEMENTATIONS.
Endnotes
1 ISACA®, COBIT® 2019 Framework: Governance and Management Objectives, USA, 2018, https://www.isaca.org/resources/cobit
Luis Gorgona, CISA CDPSE
Is a professional with 20 years of experience in IT and cybersecurity. Gorgona served as chief information security officer for Costa Rica’s Presidential House from 2006 to 2010. During that period, he was an instructor for the cybersecurity program of the Interamerican Committee Against Terrorism of the Organization of American States. From 2010 to the present, he has worked for several transnational enterprises in fields such as information security, cybersecurity and governance, risk, and compliance. In 2021, he joined the RSM Costa Rica as an IT consulting partner.