Information Technology Reference
In-Depth Information
to management in terms of how operational performance contributes to meeting
tactical objectives that align with strategic plans. Management refines operations
input to generate reports to the executive level (governance) in terms of meeting
strategic objectives.
narratie
Provide a narrative of the problem. If necessary, use the problem assertion docu-
ment (appendix I) to assist in identifying and articulating the problem narrative.
The narrative will evolve in an iterative process as understanding of the situation
at hand translates into better articulation. Do not wait to understand the situation
before attempting to generate a narrative; more often than not, articulating the
situation will help you to understand it.
example narratie
Techno Wonder Widgets, Inc. is subject to Sarbanes-Oxley Act of 2002 (SOX).
How do we track the effectiveness of a security awareness and training program as
part of an overall SOX compliance program?
Note
:
The problem narrative below
uses X to represent all possible numeric values. The actual values come later.
Techno Wonder Widgets, Inc. desires to have SOX
awareness
level (AL) for X%
of the enterprise population. An additional objective is for X% of the population to
have an acceptable level of
understanding
of SOX (UL).
There is an enterprise population (EP) of X distributed among X sites (S). Enter-
prise population consists of X direct employees (E) and X contractors (C). X%
of the enterprise population have computer access (CA) on a regular basis. The
potential mediums for distributing awareness and training material include e-mail,
live training, printed material, video training, and audio. An effective awareness
program provides at least X opportunities to see and hear the message (M) within
an X month timeframe (TF).
Commentary
: The generation of the above narrative occurred in multiple iterations.
The first iteration did not include the abbreviations of potential parameters. The point
is, IAQP is an iterative process.
parameters
Use the frameworks described in this topic to assist in identifying key entities in the
narrative. Consider what parameters may represent characteristics or states of the
key entities. Enterprise dynamics and Enterprise Context Framework (ECF) pres-
