KGI/KPI Cascade
Management Guidelines provides a limited list of possible
KGIs and KPIs for each of the 34 COBIT IT processes, but not
their relationship. In analysing those proposed KGIs
specifically, it appears that these goal metrics are often defined
at different levels: IT process level, IT level and business level.
This insight enables users to define a cascade of metrics with
causal relationships among process KPIs, process KGIs, IT
KGIs and business KGIs as visualised in Figure 1.
Figure 1Causal Relationships at Process,
IT and Business Level
IT/COBIT Process
DS5: Ensure System Security
KPI
KGI
Security
expertise
Number of
incidents
because of
unauthorised
access
Process Level
KPI
KGI
Number of IT
security
incidents
IT Level
KGI
KPI
Number of incidents
causing public
embarrassment
Business Level
KPI
KPI
KPI
KPI
Process Level
KGI
KPI
KGI
KPI
KGI
KPI
KGI
KPI
KGI
KPI
KGI
IT Level
Business Level
Figure 3: Goals and Metrics of COBIT Process DS5 Ensure Systems Security
Activity Goals
Understanding security requirements,
vulnerabilities and threats
Managing user identities and
authorisations in a standardised manner
Defining security incidents
Testing security regularly
are measured by
Process Key Performance Indicators
# and type of security incidents
# and type of obsolete accounts
# of unauthorised IP addresses, ports and
traffic types denied
% of crytographic keys compromised and
revoked
# of access rights authorised, revoked,
reset or changed
Process Goals
Permit access to critical and sensitive
data to only authorised users.
Identify, monitor and report security
vulnerabilities and incidents.
Detect and resolve unauthorised access to
information, applications and
D infrastructure.
r Minimise the impact of security
i
v vulnerabilities and incidents.
e
are measured by
Process Key Goal Indicators
# and type of suspected and actual access
violations
# of violations in segregation of duties
% of users who do not comply with
password standards
# and type of malicious code prevented
IT Goals
Ensure critical and confidential
information is withheld from those who
should not have access to it.
Ensure automated business transactions
and information exchanges can be trusted.
Maintain the integrity of information and
processing infrastructure.
D
r Account for and protect all IT assets.
i
v Ensure IT services can resist and recover
e
from failures due to error, deliberate attack
or disaster.
are measured by
IT Key Goal Indicators
Time to grant, change and remove access
privileges
# of systems where security requirements
are not met
Endnotes
Research funded by ISACA/ITGI
ITGI, COBIT Management Guidelines, 2000
3
Van Grembergen; R. W. Saull; S. De Haes; Linking the IT
Balanced Scorecard to the Business Objectives at a Major
Canadian Financial Group, Journal of Information
Technology Cases and Applications, 2003
Van Grembergen, W.; The Balanced Scorecard and IT
governance, Information Systems Control Journal, 2000
4
Van Grembergen, W.; S. De Haes; J. Moons; Linking
Business Goals to IT Goals and COBIT Processes,
Information Systems Control Journal, volume 4, 2005
1
2
Steven De Haes
is responsible for the Information Systems Management
executive programs at the University of Antwerp Management
School. He is engaged in research in the domain of IT
governance and conducts research in this capacity for ITGI.
Currently, he is preparing a Ph.D. on the practices and
mechanisms of IT governance. He has published several
articles on IT governance, most recently in the Information
Systems Control Journal, the Journal for Information
Technology Case Studies and Applications (JITCA), and the
proceedings of the Hawaiian International Conference on
System Sciences (HICSS). He can be contacted at
steven.dehaes@ua.ac.be.
Information Systems Control Journal, formerly the IS Audit & Control Journal, is published by the Information Systems Audit and Control Association, Inc.. Membership in the association, a voluntary
organization of persons interested in information systems (IS) auditing, control and security, entitles one to receive an annual subscription to the Information Systems Control Journal.
Opinions expressed in the Information Systems Control Journal represent the views of the authors and advertisers. They may differ from policies and official statements of the Information Systems Audit
and Control Association and/or the IT Governance Institute and their committees, and from opinions endorsed by authors' employers, or the editors of this Journal. Information Systems Control Journal
does not attest to the originality of authors' content.
Copyright 2005 by Information Systems Audit and Control Association Inc., formerly the EDP Auditors Association. All rights reserved. ISCATM Information Systems Control AssociationTM
Instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. For other copying, reprint or republication, permission must be obtained in writing from the
association. Where necessary, permission is granted by the copyright owners for those registered with the Copyright Clearance Center (CCC), 27 Congress St., Salem, Mass. 01970, to photocopy articles
owned by the Information Systems Audit and Control Association Inc., for a flat fee of US $2.50 per article plus 25 per page. Send payment to the CCC stating the ISSN (1526-7407), date, volume,
and first and last page number of each article. Copying for other than personal use or internal reference, or of articles or columns not owned by the association without express permission of the
association or the copyright owner is expressly prohibited.
www.isaca.org