Comments on ISACA Sacramento Web Log: FISMA Compliance: Metrics or Management?

I totally agree that COBIT is the best answer to t...

2011-04-20T05:25:17.066-07:00

I totally agree that COBIT is the best answer to the management requirement of IT industry. But can it work without affecting the efficiency?

@Encrypted Flash Guy So... is Federal management ...

2011-02-09T09:21:52.897-08:00

@Encrypted Flash Guy

So... is Federal management incapable? Personally, I think that the govt's efficiency issues originate at a higher level than agency management. The most talented managers executing against the most relevant metrics won't correct systemic policy and organizational shortcomings that lead to complacency, malignant redundancy, and fiefdom-building. Goals, carrots, and sticks are all misguided, and root causes are difficult at best, impossible at worst, to correct.

FISMA has allocated precise tasks to the groups Na...

2011-02-08T03:39:52.695-08:00

FISMA has allocated precise tasks to the groups National Institute of Standards and Technology (NIST) and Office of the Management and Budget (OMB). Metrics are a sine qua non situation of a capable management; in fact management cannot be based just leading perception, it has to be underpinned by figures. A Strategy-Focused association aligns its every day actions and communicates that approach during the enterprise.

Hello all, I would also like to give my opinion on...

2008-07-14T04:00:00.000-07:00

Hello all, I would also like to give my opinion on Risk and Compliance.
IT governance, risk and compliance (IT GRC) is about striking an appropriate balance between business reward and risk. The maturity of IT GRC practices for managing reward and risk has a direct impact on the organization. IT GRC encompasses the practices for delivering: Greater business value from IT strategy, investment and alignment, Significantly reduced business and financial risk from the use of IT, and Conformance with policies of the organization and its external legal and regulatory compliance mandates. IT GRC energizes the entire organization to imagine what it can achieve, establishes methods for achieving their objectives, and demonstrates the practices that are proven to work for minimizing business and financial risk. Fundamentally, IT GRC is about striking an appropriate balance between business reward and risk, enabling an organization to more effectively anticipate and manage business risk while more effectively delivering value for the organization. IT governance, risk, compliance, IT GRC, White paper, compliance survey report, 2008 compliance report.
You can also get more information from http://www.compliancehome.com/symantec/

rybolov,

Very humorous sarcasm! That was...

2008-06-19T17:48:00.000-07:00
rybolov,

Very humorous sarcasm! That was sarcasm, right? Seriously, I’m so excited about your ideas that I’m going to link back to you.

Yes, NIST Risk Management Framework closely resembles—and in some cases borrows from—COBIT. It’s less structured and much more comprehensive, given all the Special Publications that comprise it. COBIT attempts to specify what you should do to achieve high-performing IT-driven operations. As I view it, the NIST framework attempts to tell you both what you should do and, in verbose detail, how you should do it.

When your smart friends figure out how to dismantle the barriers to quality and performance management in government, please include me in the celebration. I’ve been working on that problem most of my adult life.

I work in a large State government, so I can empathize with your plight. Sounds like the Fed faces conditions very similar to ours. I’m not sure that I can agree, though, that there are not enough skillfull/clueful people to meet demand. I find that a great many skillful—and clueful—people are chewed up and spit out by institutions that were purposefully designed not to change, evolve, or die. The theory of evolution does not hold true for government. Of course, DC is a very different place from Sacramento. Heck, LA is a very different place from Sacramento. California’s difficulty, I think, is:

1. Our constitution gives broad powers to individual agencies to manage as they see fit.

2. Influencers at the Executive level have two levers to shape the will of agencies: policy, i.e. administrative regulations, and law.

But...

3. Administrative regulation is largely ignored, with no ramifications befalling those in positions to know better.

4. Politics makes law impossible to effect.

A few years ago, the Governor commissioned a task force to find ways to improve operations. The group identified over 200 vectors in the problem space. But in short order, cold hard reality befell the naïve Governor’s best laid plans. Between a Legislature and public employees’ union bent on stonewalling all attempts to mandate change, and the utter inability of the Administration to apply pressure on agencies that had been ordained as kingdoms in the State Constitution, the initiative quietly died with only a handful of its recommendations realized.

Incidentally, I’ve been told that the Canadian government has been successful—you define success—at implementing the COBIT framework. I would sure like to visit Ottawa to see what everyone’s talking about.

Cavalcade of Risk #54 is up, and your post is in i...

2008-06-18T05:51:00.000-07:00
Cavalcade of Risk #54 is up, and your post is in it:

http://www.bargaineering.com/articles/cavalcade-of-risk-54.html

Yes, the government's metrics are broken right now...

2008-06-16T06:54:00.000-07:00
Yes, the government's metrics are broken right now. Some really smart people that I know are working on changing that, but it's slow because the culture of Government is to resist change.

I agree with you that PCI is the road to go down. In fact, I wrote a tongue-in-cheek rebuttal on my blog at FISMA: Better if PCI. WTF?

While COBIT makes some sense, the problem is that government is driven by a different set of laws and standards that the private sector. Looking through your description of COBIT, it's exactly what NIST has created in their Risk Management Framework.

The biggest problem that we have in the Government is one of scale:
1. We do not have information security models above the enterprise level.
2. We do not have enough skillfull/clueful people in the DC area to keep up with the demand.

No matter what the framework you use, you still will get the same results because it's not about the framework, it's about the people.

Have a look at the presentation I put together on security and the Government, I go through some of this.

Comments on ISACA Sacramento Web Log: FISMA Compliance: Metrics or Management?

I totally agree that COBIT is the best answer to t...

@Encrypted Flash Guy So... is Federal management ...

FISMA has allocated precise tasks to the groups Na...

Hello all, I would also like to give my opinion on...

rybolov,Very humorous sarcasm! That was...

Cavalcade of Risk #54 is up, and your post is in i...

Yes, the government's metrics are broken right now...

rybolov,

Very humorous sarcasm! That was...