Abstract Date              2009-06-07 Level             Master thesis in Information Technology and Business Administration, 15 hp, EIK024 Authors        Anna Karlsson, akn05009@student.mdh.se                      Lena-Maria Lindström, llm05002@student.mdh.se Tutor            Peter Ekman Title              IT Governance with an IT investment focus Keywords     IT Governance, IT investments, IT decisions Problem       To control and manage IT and IT functions in the organization has been a big challenge for many businesses for a long time. In order to make the management of IT more efficient IT Governance is needed. If the organization is going to be successful IT Governance is necessary and this type of governance enables a more effective use of IT that supports the business and its operations. The problem questions for this thesis are: How is the company’s IT Governance built up? How are decisions regarding the company’s IT investments taken? How is the connection between the company’s IT investments and the company’s IT Governance? Purpose        The purpose of this thesis is to describe and analyze how a company’s IT Governance is built up and how the company uses IT Governance to reach the desired results from the IT investments. Method        The thesis is a qualitative study. The thesis group has made three interviews; one at Swecon Anläggningsmaskiner AB, one at Volvo Construction Equipment AB and one at Telge nät AB. The respondents are all IT managers. The interviews were semi structured as the authors of the thesis wanted it to be more of an interview / discussion. framework Theoretical   The theoretical framework of the thesis begins with a presentation of decision making in the organizations followed by a background to IT investments. Finally a presentation of IT Governance which is divided into four parts follows: who takes the IT decisions, which decisions are made, how are these decisions made and monitored and the fourth part that focuses on the company management’s involvement in IT Governance. The part is finished with a summarizing analytic model made by the authors of the thesis.          Conclusion   We have concluded that the three companies all have some sort of IT Governance, but how the IT Governances are built up varies. We also have concluded that the companies' ambition by using IT Governance is to reach the desired results from their IT investments.  By using IT Governance the companies are forced to pay attention to certain aspects eg., that the investments really are aligned with the companies businesses and that certain metrics are estimated for investments in the IT investment approval process.

nÃo hà / A utilizaÃÃo da Tecnologia da InformaÃÃo (TI) està presente no cotidiano das instituiÃÃes corporativas fazendo com que a gestÃo da TI seja essencial, pois ampara os objetivos estratÃgicos de uma organizaÃÃo. Nas instituiÃÃes de ensino , o uso da TI auxilia nos processos de ensino, pesquisa e extensÃo. Assim sendo, este estudo tem como principal objetivo realizar uma investigaÃÃo nas InstituiÃÃes Federais de Ensino Superior do Brasil (IFES), quanto à gestÃo da TI propost a pela governanÃa d e TI, avalia ndo a eficiÃncia relativa por meio da AnÃlise EnvoltÃria de Dados (DEA). O estudo a presenta os conceitos da governanÃa e gestÃo da TI, os principais frameworks utilizados para prover o gerenciamento da TI, o Ãndice de governanÃa da TI (IgovTI) da Administr aÃÃo PÃblica Federal (APF) medido pelo Tribunal de Contas da UniÃo (TCU) e as principais caracterÃsticas do mÃtodo DEA. A abordagem da pesquisa à quantitativa, pois teve como base os dados do Ãltimo levantamento de governanÃa de TI realizado pelo TCU nos e ntes da APF. A natureza da pesquisa à do tipo aplicada, classificada quanto aos objetivos como exploratÃria, sendo o lÃcus da pesquisa as IFES . A anÃlise descritiva dos dados coletados apresentou que 36,43% das IFES nÃo adotam as prÃticas de gestÃo da TI e somente 12,26% exercem integralmente as prÃticas. Os fatores com maiores Ãndices de adoÃÃo das prÃticas de gestÃo da TI foi o plano de TI vigente ( input ) com 40,40% das IFES adotando integralmente e 27,27% parcialmente; e o fator contrataÃÃo de TI ( outpu t ) com 42,42% das IFES realizando integralmente e 17,17% parcialmente. AtravÃs da definiÃÃo do ranking de eficiÃncia entre as IFES constatou - se que d entre as 99 IFES analisadas 66 foram classificadas como eficientes e 33 como ineficientes. / The use of Information Technology (IT) is present in the daily life of corporate institutions, making IT management essential because it supports the strategic objectives of an organization. In educational institutions, the use of IT helps in learning, research and extension processes. Therefore, this study has as main objective to investigate in the Federal Institutions of Higher Education of Brazil (I FES), regarding IT management proposed by IT governance, evaluating the relative efficiency using Data Envelopment Analysis (DEA). Besides, this study presents the concepts of IT governance and management, the main frameworks used to provide IT management, the IT Governance Index (IgovTI) of the Federal Public Administration (APF) as measured by the Brazilian Court of Audit (TCU) and the main characteristics of the DEA method. The research approach is quantitative, as it based on data from the last survey o f IT governance conducted by the TCU in APF entities. The nature of the research is of the applied type, classified as the objectives as exploratory, being the locus of the research the IFES. The descriptive analysis of the collected data showed that 36.43 % of the IFES did not adopt IT management practices and only 12.26% carried out the practices in full. The factors with the highest adoption rates of IT management practices were the current IT plan (input) with 40.40% of IFES adopting in full and 27.27% i n part, and the IT contracting factor (output) with 42.42% of the IFES performing entirely and 17.17% partially. Through the definition of the efficiency ranking among the IFES, it verified that among the 99 IFES analyzed 66 was classified as efficient and 33 as inefficient.

Made available in DSpace on 2016-12-23T14:33:44Z (GMT). No. of bitstreams: 1 Dissertacao de Gleison Baioco.pdf: 1821375 bytes, checksum: 1f3ea977985979f854fd23c9e03a7bd8 (MD5) Previous issue date: 2009-08-21 / A tecnologia da informação (TI) vem se tornando essencial para as organizações. Nesse contexto, o gerenciamento de TI vem evoluindo para incluir gerenciamento de serviços e governança de TI, apontando para paradigmas de gerenciamento de TI orientado ao negócio. Dessa forma, o alinhamento entre a TI e o negócio tem sido considerado como um dos fatores preponderantes para a efetividade de tais paradigmas. Em adicional, são mencionadas as contribuições provenientes da automação das atividades de gerenciamento. Acompanhando essa evolução, o gerenciamento de configuração desempenha um papel fundamental, fornecendo informações precisas da TI a todos os envolvidos no gerenciamento. Todavia, em função desse estreito relacionamento com todas as entidades ligadas ao gerenciamento, a interoperabilidade entre esses componentes tem sido caracterizada como um dos principais desafios de pesquisa em gerenciamento de redes e serviços. Nesse sentido, o uso de ontologias, em especial ontologias de fundamentação, tem sido indicado como uma maneira pro issora de se obter interoperabilidade semântica no domínio de gerenciamento de configuração, uma vez que elas expressam o significado dos conceitos do domínio, bem como os relacionamentos existentes entre eles, de forma clara e explícita. Além disso, ontologias permitem que esse significado seja definido em um formato legível por máquinas, tornando o conhecimento compartilhado não apenas por agentes humanos, mas também por sistemas computacionais, possibilitando a automação de processos. Assim, esta dissertação apresenta uma proposta de modelagem conceitual do domínio de gerenciamento de configuração, no contexto do gerenciamento de serviços e governança de TI, baseada em ontologias de fundamentação. O propósito dessa ontologia é prover um modelo conceitual desse domínio, comprometido em maximizar a expressividade, a clareza e a veracidade dos conceitos pertencentes a ele. Ademais, esta dissertação apresenta uma proposta de modelo de implementação, derivado do modelo conceitual desenvolvido. O objetivo é realizar uma prova de conceito da ontologia e também demonstrar como essa ontologia pode apoiar as atividades de gerenciamento de maneira automatizada / Information technology (IT) is becoming essential for organizations. In this context, IT management has evolved to include service management and IT governance, towards business driven IT management paradigms. Thus, the alignment between IT and business has been regarded as one of the leading factors for the effectiveness of such paradigms. Furthermore, contributions arising from management activities automation are mentioned. Following this evolution, configuration management plays a key role in providing accurate IT information to all involved in management. However, due to this close relationship with all entities related to management, interoperability among these components has been characterized as one of the main research challenges in network and service management. In this sense, the use of ontologies, foundational ontologies in particular, has been indicated as a promising way to achieve semantic interoperability in the configuration management domain, since they express the meaning of domain concepts, as well as the existing relationships between them, in a clear and explicit way. Moreover, ontologies allow that this meaning be defined in a machine readable format, making the knowledge shared not only by human agents, but also by computer systems, enabling process automation. Thus, this dissertation proposes a conceptual model of configuration management domain in the context of service management and IT governance, based on foundational ontologies. The purpose of this ontology is to provide a conceptual model of this domain, committed to maximizing the expressiveness, clarity and truthfulness of concepts that belong thereto. Moreover, this dissertation proposes an implementation model, derived from the developed conceptual model. The goal is to perform an ontology proof of concept and also demonstrate how this ontology can support the management activities in an automated way

A comunidade empresarial e os profissionais de Sistemas e Processamento de Dados enfrentam atualmente um novo tipo de desafio: A ameaça dos computadores. O crescente volume de computadores e a larga utilização das tecnologias de teleprocessamento e de redes estão levando as organizações à crescente dependencia de sua Estrutura de Informatica e de seu principal produto: os sistemas de informação e os demais elementos a eles associados. Não é dificil constatar que o impacto destas tecnologias tem sido absorvido apenas parcialmente não só por usuários mas tambem pelos profissionais. De fato o desenvolvimento dos computadores não é acompanhado pelo correspondente desenvolvimento dos princípios de Administração de Processamento de Dados. Isso significa que os princípios e normas administrativos e de controle para este tipo de atividade não se encontram no estágio desejado, isto é, não foram estabelecidos princípios e normas definitivos para obter-se uma area de Processamento de Dados completamente segura e confiável. Esta \"janela aberta\" é, como consequência, o caminho mais curto para práticas criminosas e erros generalizados, os quais resultarão em danos ás operações e aos ativos das organizações. O conceito de segurança amplamente utilizado atualmente refere-se mais à segurança física e não inclui todos os componentes de uma área de Processamento de Dados, como deveria ser compreendida, a saber: a) As instalações físicas - Incluindo equipamentos, softwares, instalações, equipamentos auxiliares, linhas telefonicas, etc. b) Os sistemas de informação por computador (sistemas \"batch\" tradicionais) c) Os Sistemas de Informação por computador que utilizam tecnologias avançadas tais como Banco de Dados e Comunicação de Dados Neste estudo propõe-se que o conceito de segurança seja extendiido a todos os elementos do ambiente de processamento de dados, como um fator que contribui para sua integridade e eficácia. Este trabalho contribui para o estudo da administração em Processamento de Dados pois apresenta, para cada elemento de uma área de Processamento de Dados as causas de ameaças e os controles mais importantes na redução do impacto dessas causas. / The business community and the Data Processing and Information Systems professionals are facing today a new kind of challenge: the Computer threat. The increasing number of installed computers and the large utilization of teleprocessing and networking techniques are pushing the organizations to be greatly dependent on the Information Processing Facility and its final product: the computerized information systems and the associated environment. It is not very difficult to verify that the impact of this fast growing technology has been only partially absorbed not only by users but also by the computer professionals. In fact, the computer development is not being followed by the corresponding development of the Data Processing Administration Principles. This means that the control and administration guidelines for this type of activity are not in the desirable stage, i.e., no final conclusions have been set up on how to obtain a completely secure and reliable Data Processing Installation. This open Window is, as a consequence, the shortest way for criminal practices and generalized errors which will result in the damage of the organizations assets and operations. The concept of security largely used today refers mostly to the physical security and does not cover all the components of the Data Processing Installation as it should be understood: a) The Physical Installation - including the hardware, software, lay-out, auxiliary equipment, telephone lines , etc.. b) The computerized information system (formal batch system) c) The computerized information systems using advanced techniques such as Data Base and Data Communication. d) The Process of Information Systems Development (Methodology) In this study, we propose that the concept of security be extended to all the elements of the Data Processing environment, as a basic factor which contributes to its integrity and effectiveness. As a contribution to the study of the Data Processing Administration, we present, for each element, the most critical causes of exposures and the most important controls which may reduce the impact of these causes.

Submitted by Marcia Silva (marcia@latec.uff.br) on 2016-10-07T19:57:13Z No. of bitstreams: 1 Disssert Leandro Peçanha de Souza.pdf: 11466487 bytes, checksum: 099df51af11e59887ad31dab009228a8 (MD5) / Approved for entry into archive by Biblioteca da Escola de Engenharia (bee@ndc.uff.br) on 2017-01-26T12:26:11Z (GMT) No. of bitstreams: 1 Disssert Leandro Peçanha de Souza.pdf: 11466487 bytes, checksum: 099df51af11e59887ad31dab009228a8 (MD5) / Made available in DSpace on 2017-01-26T12:26:11Z (GMT). No. of bitstreams: 1 Disssert Leandro Peçanha de Souza.pdf: 11466487 bytes, checksum: 099df51af11e59887ad31dab009228a8 (MD5) Previous issue date: 2016-04-05 / A alta concorrência e a necessidade crescente de melhores resultados com recursos cada vez mais reduzidos impõem que as empresas selecionem e invistam em projetos que tenham maior potencial para gerar vantagem competitiva. O Comitê de TI (Tecnologia da Informação) é uma das estruturas de Governança de TI mais elementares e utilizadas nas organizações para potencializar o desempenho da TI, sendo que uma das suas principais atribuições consiste em priorizar os projetos de TI. Definir com clareza um portfólio alinhado aos objetivos estratégicos, não levando em conta somente fatores financeiros ou exclusivamente técnicos, é um problema de decisão multicritério complexo. Este estudo pretende demonstrar a utilização de uma metodologia de Apoio Multicritério à Decisão (AMD) através da aplicação de um método híbrido composto pelo AHP (Analytic Hierarchy Process) e TOPSIS (Technique for Order of Preference by Similarity to Ideal Solution), que permitirá ordenar (ranking) os projetos de investimento do portfólio da TI / The high competition and growing need for the best results with increasingly limited resources require companies to select and invest in projects that have the greatest potential to create a competitive advantage. The IT Committee (Information Technology) is one of the most basic IT Governance structures and is used in organizations to enhance IT performance, since one of its main attributes is prioritizing IT projects. Clearly defining a portfolio aligned to strategic objectives, taking into account not only financial or purely technical factors, is a complex multi-criteria problem for decision-making. This study aims to demonstrate the use of a Multi-criteria Decision Aid (MCDA) methodology, by applying a hybrid method composed of the AHP (Analytic Hierarchy Process) and TOPSIS (Technique for Order of Preference by Similarity to Ideal Solution), which will allow for sorting (ranking) IT portfolio investment projects

The main objective of this diploma thesis is to identify the problems (restrictions, impasses) which are connected with the practical implementation described in the ITIL publication - the processes of ITSM. For achieving these objectives it was necessary to study extensive library of methodologies and standards that are being used in the area of IT service management (i.e. ITIL, CobiT, and ISO 20000). The conclusion is based on the results of consultations with the practicing specialists. The form of these consultations was a questionnaire elaborated in advance. The whole thesis can be separated into two logical units: the theoretical one and the practical one. The structure of theoretical part and the content of individual chapters are designed so that the reader can progressively acquire knowledge about the position of ITSM/ITIL in the area of methodologies and legislative standards intended for operating organization as a whole. In the other part of this thesis the relationship between, actually the most prestigious, two approaches to IT service management: ITSM and IT Governance is described. The chapter presenting other similar methodologies for IT service management follows in logical sequences. The introduction of practical part is dedicated to the basic characteristics of various ways of ITSM implementation (from the position of system integrator, in the form of internal project and in the public sector). The conclusion is divided into three units of the same titles as the main headstones of ITSM, these headstones are: the people, the tools and the processes. For every single unit I have elaborated the summary of the restrictions and the impasses that can appear during practical implementation of ITSM. The main contribution of this diploma thesis is just the last-mentioned, the compilation of summary of impasses related do the practical implementation of IT Service Management.

O alinhamento do portfólio de projetos das empresas às estratégias de negócios das organizações é uma relevante e complexa tarefa. A Governança Corporativa e a Governança de Tecnologia da Informação são apontadas como importantes elementos para atingir esse objetivo. Entretanto, ainda são recentes os estudos sobre os benefícios e a importância da Governança de TI nas empresas e na condução de projetos de TI. Nesta dissertação, é apresentado um estudo sobre a percepção dos consultores e gerentes de projetos quanto à importância da Governança de Tecnologia da Informação na implementação de Sistemas de Informações Gerenciais (SIGs). Adotou-se, como método, a pesquisa exploratória que utilizou como delineamento um estudo de caso, com abordagem qualitativa. Os dados foram obtidos pela aplicação de um questionário e analisados por meio das técnicas estatístico-descritivo. Os resultados obtidos apontam que o uso das melhores práticas de Governança de TI, na percepção dos consultores e gerentes de Projetos de TI, são importantes para o sucesso na implementação de SIG. Com destaque para as questões de planejamento que apresentaram maior relevância em contrapartida as questões de controle consideradas de menor relevância. / The alignment of the project portfolio of the companies to the business strategies of the organizations is an important and complex task. The Corporate Governance and Governance of Information Technology are identified as important elements to achieve this goal. However, recent studies are still about the benefits and importance of IT governance in enterprises and conducting IT projects. This dissertation presents a study on the perceptions of consultants and project managers on the importance of Information Technology Governance implementation of Management Information Systems. It was adopted as a method, exploratory research design that used as a case study, with qualitative approach. Data were collected through questionnaire and the results based on descriptive statistical method. The results indicate that the best practices of IT governance, perceptions of consultants and managers of IT projects are important to the success of Management Information Systems implementation. Highlighting the issues of planning that was more relevant, on the other hand, control issues was considered less relevant.

Information security in the form of IT governance is part of corporate governance. Corporate governance requires that structures and processes are in place with appropriate checks and balances to enable directors to discharge their responsibilities. Accordingly, information security must be treated in the same way as all the other components of corporate governance. This includes making information security a core part of executive and board responsibilities. Critically, corporate governance requires proper checks and balances to be established in an organisation; consequently, these must be in place for all information security implementations. In order to achieve this, it is important to have the involvement of three key role players, namely information security professionals, ICT security auditors and regulatory officials (from now on these will be referred to collectively as the ‘role players’). These three role players must ensure that any information security controls implemented are properly checked and evaluated against the organisation’s strategic objectives and regulatory requirements. While maintaining their individual independence, the three role players must work together to achieve their individual goals with a view to, as a collective, contributing positively to the overall information security of an organisation. Working together requires that each role player must clearly understand its individual role, as well the role of the other players at different points in an information security programme. In a nutshell, the role players must be aligned such that their involvement will deliver maximum value to the organisation. This alignment must be based on a common framework which is understood and accepted by all three role players. This study proposes a South African Information Security Alignment (SAISA) framework to ensure the alignment of the role players in the implementation and evaluation of information security controls. The structure of the SAISA framework is based on that of the COBIT 4.1 (Control Objectives for Information and Related Technology). Hence, the SAISA framework comprises four domains, namely, Plan and Organise Information Security (PO-IS), Acquire and Implement Information Security (AI-IS), Deliver and Support Information Security (DS-IS) and Monitor and Evaluate Information Security (ME-IS). The SAISA framework brings together the three role players with a view to assisting them to understand their respective roles, as well as those of the other role players, as they implement and evaluate information security controls. The framework is intended to improve cooperation among the role players by ensuring that they view each other as partners in this process. Through the life cycle structure it adopts, the SAISA framework provides an effective and efficient tool for rolling out an information security programme in an organisation / Computer Science / M. Sc. (Computer Science)

På grund av digitala teknologins framväxt står organisationer inför utmaningar där de behövergenomgå digitala transformationer för att möta omgivningens nya krav och behov. För attlyckas i den digitala transformationen behöver organisationer arbeta aktivt med att styraorganisationens digitala resurser och se till att IT och verksamhet samverkar. Rollen somförvaltningsledare återfinns inom ramverket pm³, vilket är en förvaltningsstyrningsmodell somappliceras för att på ett strukturerat sätt kunna prioritera mellan förvaltningens uppdrag, skapaen samverkan mellan IT och verksamhet samt ge en helhetsbild över de digitala resurser somfinns inom organisationen. Syftet med studien är att undersöka och skapa förståelse för rollensom förvaltningsledare i praktiken i en kontext som karaktäriseras av förändring, digitaltransformation samt IT-styrning. Vilket görs genom att studera förvaltningsledarrollen i enmyndighet i Sverige vilken genomgår en digital transformation. Den empiri som studiengrundar sig i är interna dokument, observationer och intervjuer för att ge en rättvis bild av denkontext som studerats. Studiens resultat visar att förvaltningsledarna har en central roll inomden digitala transformationen eftersom de både leder och driver den framåt. De förutsättningarsom har visat sig nödvändiga för att förvaltningsledare ska vara framgångsrika i sin roll ärbland annat: att de har förtroende och stöd; att de har en gemensam vision; att de har deninformation som behövs för att kunna utföra sitt arbete; att samarbetet inom förvaltningen samtäven mellan förvaltningen och övriga delar av organisationen fungerar; att de har förståelse förderas roll som ledande i den digitala transformationen; att de har en organisationsstruktur ochorganisationskultur som främjar arbetet med förvaltning och den digitala transformationen.

Top executives are interested in more transparent and formalized structures, applicable measurements, and clear justification of alignment. Limited or improper information technology governance (ITG) affects the business strategy that will ultimately influence the overall business alignment in local city government agencies (LCGAs). The problem addressed in this study was the lack of information regarding LCGAs IT/business strategic alignment maturity model (SAMM) level and the LCGAs' employment size. The purpose of this survey study was to evaluate 48 LCGA participants in the Southwestern part of the United States and compare their alignment perceptions with their cities' employment size. The theoretical framework for this study was based on ITG and business strategy as measured by the SAMM instrument. An online survey was used for data collection and data results were analyzed using descriptive statistics and an Analysis of Variance. After using the SAMM instrument, the current snapshot maturity level of LCGAs was 2.49 out of a maximum 5.0 level. Results illustrated no significant relationship between LCGAs alignment maturity levels and a city's size. This study empowers positive social change by providing LCGAs 6 incremental steps to improve the overall alignment maturity level in areas of transparent and formalized structures, applicable measurements, and improved alignment measures.