Op strategisch niveau gaat het om de vraag of voldoende leiderschap, structuren en processen binnen de organisatie aanwezig zijn om de doelstellingen te bereiken en de bedrijfsstrategie te ondersteunen. Met betrekking tot ICT gaat het dan om de volgende aspecten:

• Alignment of the ICT strategy with the strategies and objectives of the organization;
• The support of the organization's strategies and objectives through the ICT governance structure.

Met betrekking tot de ICT-governancestructuur zijn de volgende onderwerpen van belang:

• Organization structure:
  De ondersteuning van de strategieën en doelstellingen van de organisatie door de ICT-organisatiestructuur en het personeelsmanagement (personeelsbeheer).
• Policy:
  De ondersteuning van de ICT-strategie en het voldoen aan regelgevende en wettelijke vereisten door het ICT-beleid (en de bijbehorende normen en procedures en de processen voor hun ontwikkeling, goedkeuring, vrijgave / publicatie, implementatie en onderhoud).
• Accountability mechanisms:
  De tijdige en volledige informatie van de monitoring en rapportage van ICT key performance indicators (KPI’s) aan het management.
• Monitoring practices:
  Voldoende inzicht hebben in naleving van het beleid, de normen en procedures door middel van IT-management en monitoring van beheersmaatregelen (bijvoorbeeld Continue monitoring en kwaliteitsborging).

We can support you in obtaining assurance about these subjects.

At the tactical level, the central question is whether the methods, techniques and tools for purchasing, developing, testing and implementing information systems support the strategies and objectives of the organization. The following topics are important here:

• The business case for the intended investments in information systems;
• The internal and/or external IT vendors and the processes that ensure that the organization's service levels and management objectives are met;
• The project management and controls that ensure that business requirements are met in an effective and efficient manner while adequately managing risks to the organization;
• The qualitative and quantitative progress of a project in accordance with the project plans;
• The operation of control measures within the information systems during the development and testing phases;
• The "readiness" of information systems for implementation and migration to production;
• The functioning of systems after commissioning.

We can support you in obtaining assurance about these subjects.

At the operational level, it is important to ensure that IT service level expectations are derived from the company's business objectives and that these expectations are met by the IT organization. The following topics are important here:

• The IT service management framework and practices (internally or by third parties) to determine whether the service levels expected by the organization are being met and whether the strategic objectives are being met;
• The continued compliance of information systems with the objectives of the organization;
• IT management activities (operations, configuration management, capacity and performance management);
• IT maintenance (patches, upgrades);
• Database management;
• Data management;
• Problem and incident management;
• Change and release management;
• End-user computing (end-user computing);
• IT continuity (backups / recovery, disaster recovery).

We can support you in obtaining assurance about these subjects.

Information security ensures that the confidentiality, integrity and availability (CIA) of confidential data is ensured through the design, implementation and monitoring of controls. The following topics are important in this regard:

• The information security and privacy policy;
• Physical security;
• Logical access security;
• Data classification;
• Safe personnel;
• Encryption;
• Network security;
• Beveiligingsincidenten;
• Compliance with Laws and Regulations.

We can support you in obtaining assurance on these and other information security topics.