blockmine 1.24.0 → 1.25.0

package/.claude/skills/general-it-engineering/resources/it-governance.md

@@ -1,753 +0,0 @@
-# IT Governance
-
-COBIT framework, IT policies, compliance, risk management, audits, and governance structures for managing IT effectively and securely.
-
-## Table of Contents
-
-- [IT Governance Overview](#it-governance-overview)
-- [COBIT Framework](#cobit-framework)
-- [IT Policies](#it-policies)
-- [Compliance Management](#compliance-management)
-- [Risk Management](#risk-management)
-- [IT Audits](#it-audits)
-- [Best Practices](#best-practices)
-
-## IT Governance Overview
-
-### Purpose
-
-IT Governance ensures:
-- Alignment of IT with business goals
-- Value delivery from IT investments
-- Risk management
-- Resource optimization
-- Performance measurement
-
-### Key Principles
-
-```
-1. Meeting Stakeholder Needs
-   - Focus on stakeholder benefits
-   - Balance competing interests
-   - Deliver value
-
-2. Covering End-to-End
-   - Governance and management
-   - IT and business integration
-   - Functions and processes
-
-3. Applying Single Framework
-   - Consistent approach
-   - Unified language
-   - Reduced complexity
-
-4. Enabling Holistic Approach
-   - People, processes, technology
-   - Internal and external factors
-   - All organizational levels
-
-5. Separating Governance from Management
-   - Governance: Direction, monitoring
-   - Management: Execution, delivery
-```
-
-## COBIT Framework
-
-### COBIT 2019 Overview
-
-```
-COBIT (Control Objectives for Information and Related Technologies)
-
-Purpose: Governance and management framework for enterprise IT
-
-Components:
-├── Governance Objectives (5)
-│   ├── EDM01: Ensured Governance Framework Setting
-│   ├── EDM02: Ensured Benefits Delivery
-│   ├── EDM03: Ensured Risk Optimization
-│   ├── EDM04: Ensured Resource Optimization
-│   └── EDM05: Ensured Stakeholder Engagement
-│
-└── Management Objectives (35)
-    ├── Align, Plan, and Organize (APO) - 14
-    ├── Build, Acquire, and Implement (BAI) - 11
-    ├── Deliver, Service, and Support (DSS) - 6
-    └── Monitor, Evaluate, and Assess (MEA) - 4
-```
-
-### Key COBIT Objectives
-
-**EDM01: Governance Framework:**
-```yaml
-Purpose: Maintain effective governance
-
-Activities:
-  - Define governance structure
-  - Establish decision rights
-  - Assign accountability
-  - Monitor governance effectiveness
-
-Outputs:
-  - Governance charter
-  - Roles and responsibilities
-  - Escalation procedures
-  - Governance metrics
-```
-
-**EDM03: Risk Optimization:**
-```yaml
-Purpose: Ensure IT risk is acceptable
-
-Activities:
-  - Risk appetite definition
-  - Risk assessment
-  - Risk treatment
-  - Risk monitoring
-
-Outputs:
-  - Risk register
-  - Risk treatment plans
-  - Risk reports
-  - Risk dashboard
-```
-
-**APO01: IT Strategy:**
-```yaml
-Purpose: Align IT strategy with business strategy
-
-Activities:
-  - Strategic planning
-  - Portfolio management
-  - Investment decisions
-  - Value realization
-
-Outputs:
-  - IT strategic plan
-  - Project portfolio
-  - Investment decisions
-  - Value metrics
-```
-
-**DSS05: Security Services:**
-```yaml
-Purpose: Protect information assets
-
-Activities:
-  - Security strategy
-  - Identity and access management
-  - Security monitoring
-  - Incident response
-
-Outputs:
-  - Security policies
-  - Access controls
-  - Security alerts
-  - Incident reports
-```
-
-## IT Policies
-
-### Policy Hierarchy
-
-```
-┌─────────────────────────────────────┐
-│ IT Policy Framework                  │
-├─────────────────────────────────────┤
-│                                      │
-│  Policies (What)                     │
-│  ├── High-level principles          │
-│  ├── Mandatory requirements         │
-│  └── Board-approved                 │
-│                                      │
-│  Standards (How - Specific)          │
-│  ├── Technical specifications       │
-│  ├── Approved tools and platforms   │
-│  └── Measurable requirements        │
-│                                      │
-│  Procedures (Step-by-Step)           │
-│  ├── Detailed instructions          │
-│  ├── Workflow diagrams              │
-│  └── Operational guidance           │
-│                                      │
-│  Guidelines (Recommendations)        │
-│  ├── Best practices                 │
-│  ├── Suggested approaches           │
-│  └── Optional guidance              │
-│                                      │
-└─────────────────────────────────────┘
-```
-
-### Essential IT Policies
-
-**1. Acceptable Use Policy (AUP):**
-```yaml
-Purpose: Define appropriate use of IT resources
-
-Key Elements:
-  Permitted Uses:
-    - Business-related activities
-    - Reasonable personal use
-    - Professional communication
-
-  Prohibited Uses:
-    - Illegal activities
-    - Harassment or discrimination
-    - Unauthorized access
-    - Malware distribution
-    - Excessive personal use
-
-  Responsibilities:
-    - Protect credentials
-    - Report security incidents
-    - Use approved software only
-    - Comply with licenses
-
-  Consequences:
-    - Warning (first offense)
-    - Suspension (repeat offense)
-    - Termination (serious violation)
-    - Legal action (illegal activity)
-
-Review Frequency: Annual
-```
-
-**2. Information Security Policy:**
-```yaml
-Purpose: Protect confidentiality, integrity, availability of information
-
-Key Elements:
-  Data Classification:
-    - Public: No restrictions
-    - Internal: Internal use only
-    - Confidential: Limited access
-    - Restricted: Highest protection
-
-  Access Control:
-    - Least privilege principle
-    - Role-based access control
-    - Regular access reviews
-    - Multi-factor authentication
-
-  Data Protection:
-    - Encryption requirements
-    - Backup procedures
-    - Data retention
-    - Secure disposal
-
-  Incident Response:
-    - Reporting procedures
-    - Investigation process
-    - Containment measures
-    - Recovery steps
-```
-
-**3. Password Policy:**
-```yaml
-Purpose: Ensure strong authentication
-
-Requirements:
-  Complexity:
-    - Minimum 12 characters
-    - Upper and lowercase
-    - Numbers and special characters
-    - No dictionary words
-
-  Management:
-    - Unique per account
-    - No password reuse (last 10)
-    - Change if compromised
-    - Use password manager
-
-  Protection:
-    - Never share passwords
-    - Don't write passwords down
-    - No password in emails
-    - Secure password storage
-
-  Multi-Factor Authentication:
-    - Required for:
-      * Remote access
-      * Admin accounts
-      * Financial systems
-      * Customer data access
-```
-
-**4. Change Management Policy:**
-```yaml
-Purpose: Control changes to IT environment
-
-Requirements:
-  All Changes Must:
-    - Have business justification
-    - Be documented (RFC)
-    - Undergo risk assessment
-    - Be approved by CAB
-    - Have rollback plan
-    - Be tested before production
-
-  Emergency Changes:
-    - Expedited approval process
-    - Post-implementation review
-    - Documentation catch-up
-
-  Standard Changes:
-    - Pre-approved procedures
-    - Low risk
-    - Automation encouraged
-```
-
-**5. Data Retention Policy:**
-```yaml
-Purpose: Define how long data is kept
-
-Retention Periods:
-
-Financial Records:
-  - Invoices: 7 years
-  - Tax records: 7 years
-  - Payroll: 7 years
-
-Employee Records:
-  - Active employees: Duration + 7 years
-  - Terminated: 7 years after termination
-
-Customer Data:
-  - Active customers: Duration of relationship
-  - Inactive: 3 years
-  - After deletion: Backup retention period
-
-Email:
-  - General: 3 years
-  - Executive: 7 years
-  - Legal hold: Indefinite (until released)
-
-Backups:
-  - Daily: 7 days
-  - Weekly: 4 weeks
-  - Monthly: 12 months
-  - Yearly: 7 years
-```
-
-### Policy Management
-
-```yaml
-Policy Lifecycle:
-
-1. Develop:
-   - Identify need
-   - Draft policy
-   - Stakeholder input
-   - Legal review
-
-2. Approve:
-   - Management review
-   - Board approval (if required)
-   - Sign-off
-
-3. Publish:
-   - Policy repository
-   - Communication plan
-   - Training materials
-   - Awareness campaign
-
-4. Implement:
-   - Roll-out plan
-   - Technical controls
-   - Monitoring
-   - Compliance checks
-
-5. Review:
-   - Annual review
-   - Update as needed
-   - Version control
-   - Change tracking
-
-6. Retire:
-   - Superseded by new policy
-   - Archive old version
-   - Communicate changes
-```
-
-## Compliance Management
-
-### Common Compliance Frameworks
-
-**SOX (Sarbanes-Oxley):**
-```yaml
-Applies To: Public companies
-Focus: Financial reporting controls
-IT Requirements:
-  - Access controls
-  - Change management
-  - Audit trails
-  - Data integrity
-  - Segregation of duties
-```
-
-**HIPAA (Health Insurance Portability and Accountability Act):**
-```yaml
-Applies To: Healthcare organizations
-Focus: Protected Health Information (PHI)
-IT Requirements:
-  - Encryption
-  - Access controls
-  - Audit logs
-  - Breach notification
-  - Risk assessments
-```
-
-**PCI DSS (Payment Card Industry Data Security Standard):**
-```yaml
-Applies To: Organizations handling credit cards
-Focus: Cardholder data protection
-IT Requirements:
-  - Firewalls
-  - Encryption
-  - Access controls
-  - Monitoring
-  - Vulnerability management
-  - Regular testing
-```
-
-**GDPR (General Data Protection Regulation):**
-```yaml
-Applies To: Organizations handling EU citizen data
-Focus: Personal data protection and privacy
-IT Requirements:
-  - Data protection by design
-  - Consent management
-  - Right to erasure
-  - Data portability
-  - Breach notification (72 hours)
-  - Privacy impact assessments
-```
-
-### Compliance Management Program
-
-```yaml
-Compliance Program Structure:
-
-1. Identify Requirements:
-   - Applicable regulations
-   - Industry standards
-   - Contractual obligations
-   - Internal policies
-
-2. Gap Analysis:
-   - Current state assessment
-   - Compare to requirements
-   - Identify gaps
-   - Prioritize remediation
-
-3. Implement Controls:
-   - Technical controls (firewalls, encryption)
-   - Administrative controls (policies, procedures)
-   - Physical controls (access, cameras)
-
-4. Monitor Compliance:
-   - Automated compliance checks
-   - Manual reviews
-   - Audit trails
-   - Exception reports
-
-5. Report:
-   - Compliance dashboard
-   - Management reports
-   - Board updates
-   - Regulatory filings
-
-6. Continuous Improvement:
-   - Learn from audits
-   - Update controls
-   - Adapt to changes
-   - Industry best practices
-```
-
-## Risk Management
-
-### Risk Management Process
-
-```
-┌────────────────────────────────────┐
-│  1. Risk Identification            │
-│     - What could go wrong?         │
-│     - Threat modeling              │
-│     - Vulnerability assessment     │
-└─────────┬──────────────────────────┘
-          ↓
-┌────────────────────────────────────┐
-│  2. Risk Analysis                  │
-│     - Likelihood assessment        │
-│     - Impact assessment            │
-│     - Risk rating                  │
-└─────────┬──────────────────────────┘
-          ↓
-┌────────────────────────────────────┐
-│  3. Risk Evaluation                │
-│     - Compare to risk appetite     │
-│     - Prioritize risks             │
-│     - Determine treatment          │
-└─────────┬──────────────────────────┘
-          ↓
-┌────────────────────────────────────┐
-│  4. Risk Treatment                 │
-│     - Mitigate (reduce)            │
-│     - Transfer (insurance)         │
-│     - Accept (tolerate)            │
-│     - Avoid (eliminate)            │
-└─────────┬──────────────────────────┘
-          ↓
-┌────────────────────────────────────┐
-│  5. Risk Monitoring                │
-│     - Track risk levels            │
-│     - Review controls              │
-│     - Report to management         │
-└────────────────────────────────────┘
-```
-
-### Risk Register
-
-```yaml
-Risk Register Example:
-
-Risk ID: RISK-001
-Title: Data Breach via Phishing Attack
-
-Description:
-  Employees may fall victim to phishing emails, leading to
-  credential compromise and unauthorized access to customer data.
-
-Category: Security
-Owner: CISO
-
-Assessment:
-  Likelihood: High (frequent phishing attempts)
-  Impact: Critical (customer data breach)
-  Inherent Risk: Critical
-  Residual Risk: Medium (after controls)
-
-Treatment: Mitigate
-
-Controls:
-  1. Security awareness training (quarterly)
-  2. Email filtering (anti-phishing tools)
-  3. Multi-factor authentication (MFA required)
-  4. Privileged access management
-  5. Data loss prevention (DLP)
-
-Control Effectiveness:
-  - Training completion: 95%
-  - Phishing test pass rate: 88%
-  - MFA adoption: 100%
-  - DLP policy violations: 3/month (low)
-
-Monitoring:
-  - Monthly phishing simulations
-  - Quarterly training assessments
-  - Daily security alerts
-  - Annual penetration test
-
-Status: Active
-Last Review: 2024-10-15
-Next Review: 2025-01-15
-```
-
-## IT Audits
-
-### Types of Audits
-
-**Internal Audit:**
-```yaml
-Conducted By: Internal audit team
-Frequency: Annual or as needed
-Scope: Specific IT processes or controls
-Purpose: Assess compliance, identify improvements
-Result: Internal report with recommendations
-```
-
-**External Audit:**
-```yaml
-Conducted By: Third-party auditor
-Frequency: Annual (regulatory) or as required
-Scope: Comprehensive or specific (e.g., SOX)
-Purpose: Independent assessment, compliance certification
-Result: Audit report, opinion, certification
-```
-
-**Regulatory Audit:**
-```yaml
-Conducted By: Regulatory body
-Frequency: As mandated or triggered
-Scope: Specific regulatory requirements
-Purpose: Verify compliance
-Result: Findings, potential penalties
-```
-
-### Audit Process
-
-```yaml
-IT Audit Process:
-
-1. Planning (2-4 weeks):
-   - Define scope
-   - Identify key controls
-   - Request documentation
-   - Schedule interviews
-   - Prepare audit plan
-
-2. Fieldwork (4-8 weeks):
-   - Review documentation
-   - Interview personnel
-   - Test controls
-   - Sample transactions
-   - Document findings
-
-3. Reporting (2-3 weeks):
-   - Draft audit report
-   - Management review
-   - Remediation discussion
-   - Finalize report
-   - Present to board
-
-4. Follow-up (Ongoing):
-   - Track remediation
-   - Verify fixes
-   - Monitor improvements
-   - Report status
-```
-
-### Common Audit Findings
-
-```yaml
-Access Control Issues:
-  - Excessive permissions
-  - Shared accounts
-  - Terminated users not removed
-  - No access reviews
-  - Weak passwords
-
-Change Management Issues:
-  - Unauthorized changes
-  - Inadequate testing
-  - Missing approvals
-  - No rollback plans
-  - Poor documentation
-
-Security Issues:
-  - Unpatched systems
-  - Missing encryption
-  - Inadequate logging
-  - No vulnerability scanning
-  - Weak configurations
-
-Backup and Recovery Issues:
-  - Backups not tested
-  - No offsite backups
-  - Missing DR plan
-  - Inadequate retention
-  - No restore testing
-```
-
-## Best Practices
-
-### 1. Governance Structure
-
-```yaml
-IT Governance Structure:
-
-Board of Directors
-    ↓
-IT Steering Committee
-  - CEO
-  - CIO
-  - CFO
-  - Business Unit Heads
-  - IT Leadership
-    ↓
-IT Governance Board
-  - CIO (Chair)
-  - IT Directors
-  - Enterprise Architect
-  - Security Officer
-    ↓
-Working Groups
-  - Security
-  - Architecture
-  - Change Advisory Board
-  - Project Portfolio
-```
-
-### 2. Metrics and KPIs
-
-```yaml
-Governance Metrics:
-
-Strategic Alignment:
-  - IT spending as % of revenue
-  - Projects aligned with strategy (%)
-  - Business satisfaction score
-
-Value Delivery:
-  - ROI on IT projects
-  - Time to market
-  - Cost savings achieved
-
-Risk Management:
-  - Open security vulnerabilities
-  - Audit findings (count)
-  - Incidents due to non-compliance
-
-Resource Optimization:
-  - Asset utilization rate
-  - License compliance %
-  - Cloud cost optimization
-
-Performance:
-  - System availability
-  - Change success rate
-  - Project on-time delivery %
-```
-
-### 3. Policy Awareness
-
-```yaml
-Policy Awareness Program:
-
-New Employee Onboarding:
-  - Policy overview
-  - Acknowledgment form
-  - Quiz on key policies
-
-Annual Training:
-  - Refresher on policies
-  - Updates to policies
-  - Compliance scenarios
-  - Assessment
-
-Communication:
-  - Policy portal (intranet)
-  - Email notifications
-  - Posters and reminders
-  - Lunch and learns
-
-Enforcement:
-  - Monitor compliance
-  - Investigate violations
-  - Consistent consequences
-  - Appeal process
-```
-
-### 4. Continuous Improvement
-
-Learn from audits, incidents, and industry changes.
-
-### 5. Documentation
-
-Maintain comprehensive, up-to-date documentation of all governance activities.
-
----
-
-**Related Resources:**
-- [itil-framework.md](itil-framework.md) - IT governance practices
-- [asset-management.md](asset-management.md) - IT asset governance
-- [change-management.md](change-management.md) - Change governance