This chapter discussed the COBIT Delivery and Support Domain and why it is important, not only to SOX compliance activities, but also from an IT Department repositioning perspective. As part of this discussion, we identified the two biggest potential barriers to successfully executing the necessary control objectives identified in this chapter, which are:

• Given the number of IT resources, can these activities be sustained?

• Do we really need all of this bureaucracy?

We provided guidelines by which the control objectives in the COBIT Delivery and Support Domain can be minimized and customized. Finally, we discussed what constitutes an SLA, what are the key elements of an SLA, and the importance of SLAs as they relate to this chapter and the third domain of COBIT. The key elements of SLAs are:

• SLA metrics levels should be driven by business objectives and meet user requirements, be agreed upon by the parties involved, and be attainable.

• Executive management should understand the correlation between IT funding and the ability to deliver agreed-upon services and service levels.

• SLAs matrices should have performance cushions to allow for recovery from breaches.

• To avoid user dissatisfaction, it is essential that the service levels defined are achievable and measurable.

• Service levels should be monitored, managed, and measured on a continual basis. Monitoring and alerting should be done in a proactive manner and should contain a performance cushion.

• All performance matrices should be included in the appropriate documentation and, if feasible, contain sign offs.

• Communication is essential. If a...