Sosialisasi Seri SNI ISO/IEC Sistem Manajemen Layanan

Transkripsi

1 Sosialisasi Seri SNI ISO/IEC Sistem Manajemen Layanan Sarwono Sutikno, Dr.Eng.,CISA,CISSP,CISM Ketua WG Tata Kelola dan Layanan TI PT35-01 Teknologi Informasi Makassar 7 Mei

2 Sarwono Sutikno, Dr.Eng.,CISA,CISSP,CISM Current: Director of Certification CRISC & CGEIT, ISACA Indonesia Chapter ISACA Academic Advocate at ITB SME for Information Security Standard for ISO at ISACA HQ Associate Professor at School of Electrical Engineering and Informatics, Institut Teknologi Bandung Ketua WG Layanan dan Tata Kelola TI, anggota WG Keamanan Informasi serta Anggota Panitia Teknis Program Nasional Penetapan Standar bidang Teknologi Informasi, BSN Kominfo. Past: Ketua Kelompok Kerja Evaluasi TIK Nasional, Dewan TIK Nasional ( ) Plt Direktur Operasi Sistem PPATK (Indonesia Financial Transaction Reports and Analysis Center, INTRAC), April 2009 May 2011 Professional Certification: Professional Engineering (PE), the Principles and Practice of Electrical Engineering, College of Engineering, the University of Texas at Austin IRCA Information Security Management System Lead Auditor Course, 2004 ISACA Certified Information System Auditor (CISA). CISA Number: , 2005 Brainbench Computer Forensic, 2006 (ISC) 2 Certified Information Systems Security Professional (CISSP), No: , 2007 ISACA Certified Information Security Manager (CISM). CISM Number: , 2007 Award: (ISC) 2 Asia Pacific Information Security Leadership Achievements (ISLA) 2011 award in category Senior Information Security Professional. 2

3 Bloom s Taxonomy of Educational Objectives Evaluate judge, critique, justify, verify, assess, recommend Analyze compare, contrast, classify, categorize, derive, model Comprehend explain, paraphrase Synthesize create, construct, design, improve, produce, propose Apply calculate, solve, determine, apply Remember list, recite

4 Kategori Kontrol berbasis Risiko Source: Transforming Cybersecurity: Using COBIT 5, ISACA,

5 technical management board level Kerangka dan Standar tinjauan SNI ISO COSO PP60/ 2008 COBIT ITIL v2 ITIL v3 SNI ISO SNI ISO 2700x SNI ISO 900x Common Criteria SNI ISO SNI ISO 27013

6 Seri SNI Sistem Manajemen Layanan ISO/IEC :2011 SNI ISO/IEC :2013 Teknologi Informasi - Manajemen Layanan - Bagian 1: Persyaratan sistem manajemen layanan IEEE Std ISO/IEC :2012 SNI ISO/IEC :2013 Teknologi informasi - Manajemen layanan - Bagian 2: Pedoman penerapan sistem manajemen layanan IEEE Std ISO/IEC TR :2012 SNI ISO/IEC TR :2013 Teknologi informasi - Manajemen layanan - Bagian 3: Pedoman pendefinisian lingkup dan kesesuaian dari SNI ISO/IEC ISO/IEC TR :2010 SNI ISO/IEC TR :2013 Teknologi informasi - Manajemen layanan - Bagian 4: Model referensi proses ISO/IEC TR :2010 replaced by ISO/IEC TR :2013 SNI ISO/IEC TR :2013 Teknologi informasi - Manajemen layanan - Bagian 5: Contoh acuan perencanaan implementasi SNI ISO/IEC ISO/IEC 27013: 2012 SNI ISO/IEC 27013: 2013 Teknologi informasi - Teknik keamanan - Pedoman penerapan terintegrasi SNI ISO/IEC dan SNI ISO/IEC Akan diusulkan menjadi SNI ISO/IEC TR :2013 Information technology -- Service management -- Part 10: Concepts and terminology 6

7 7

8 Process assessment Action plan Assessment of the audited processes and Actions plan to reach level. Extend assessment througth the overall organisation to be able to compare same referential with same objectives and continuity of processes Lvl 5 : Value Lvl 4 : Service Lvl 3 : Proactiv RFC Process Problem Management Implementation Knowledge Improvement Communications Process OLAs Implementation Catalogues of Services Improvement Lvl 2 : Reactiv Lvl 1 : Chaos Service Desk Incident Management Problem Management Change Management Service Level Management Month 200X Page 8

9 Trying to Run Before Walking Level 1 Chaotic Ad hoc Undocumented Unpredictable Multiple help desks Minimal IT operations User call notification Level 2 Reactive Fight fires Inventory Desktop SW distribution Initiate problem mgt process Alert and event mgt Level 3 Measure component availability (up/down) Tool Leverage Proactive Analyze trends Set thresholds Predict problems Measure application availability Automate Mature problem, configuration, change, asset and performance mgt processes Level 4 Service IT as a service provider Define services, classes, pricing Understand costs Guarantee SLAs Measure & report service availability Integrate processes Capacity mgt Operational Process Engineering Level 5 Value IT as strategic business partner IT and business metric linkage IT/business collaboration improves business process Real-time infrastructure Business planning Manage IT as a Business Service and Account Management Service Delivery Process Engineering

10 Diskusi 10