IT Operating Model
See the 12 functions and 66 process groups. Look for gaps in ownership, measures, and handoffs.
Free IT planning guides
Start a practical IT discussion.
Give your leadership team a shared view of IT. Use the free planning tools to discuss costs, ownership, operational readiness, and where automation may help.
12 core IT functions and 66 process groups. A flexible starting point for your organization.
Email us your main concern. We'll reply to arrange a time.
Choose a guide or sample.
Free PDFs. No email or signup.
IT Automation & AI Opportunity Map
Explore repeatable work, then compare simpler steps, existing features, automation, and AI. The illustrative scores do not mean AI is required.
Sample Readiness Review
See an example of spending, priority risks, AI use, and a leadership roadmap. This sample is fictional.
Want help using the guides?
We will walk your leadership team through either guide in 30 minutes. No cost, no obligation.
Request a free guide walkthroughMore resources for leadership teams
Free PDFs. No email or signup.
Leadership Conversation Guide
Five questions to agree priorities, ownership, measures, and a practical next improvement.
Download the leadership conversation guide PDFExecutive Capabilities Overview
A one-page introduction to our services, engagement choices, and what leadership receives.
Download the capabilities overview PDFThe one-page model
See how the work connects.
A practical starting point, shaped around your business.
Use the 12 functions and 66 process groups as a starting reference. Compare them with your actual work, combine or refine groups where useful, and look for gaps and overlaps. They describe work across teams and providers, not mandatory departments. COBIT 2019 and ITIL 4 are reference points.
Choose work that matters to the business. Trace its inputs, handoffs, and dependencies; name the owner of the overall result; and agree on success criteria before choosing measures. Establish a baseline, improve the work, then assess repeatable steps for automation with safeguards and a tested fallback.
Select the image to enlarge it.
Need a larger print size? The same model is available for 11 x 17 inch paper.
Download the 11 x 17 model PDFThe scope of the model
12 core functions, connected to the services you need.
These functions describe areas of work that may span departments, teams, and service providers. We can help with one priority or a broader improvement program. Each service link opens the relevant details, including the work, deliverables, and example measures.
Strategy
Understand the mission and business needs, then align IT priorities, investment, modernization, and AI opportunities with goals and available resources.
Strategy servicesGovernance
Clarify decision rights and accountability, oversee investments, and give leaders clear reporting on value, cost, performance, and risk.
Governance servicesFinance & Vendor Management
Plan budgets, compare total costs and expected benefits, review licenses and contracts, and manage supplier negotiations, performance, and value.
Finance & Vendor Management servicesService Planning & Architecture
Understand how work gets done, then design the services, systems, and integrations the business needs, with a practical path from today to the target design.
Service Planning & Architecture servicesPeople & Knowledge
Build trust, develop people, delegate with accountability, retain knowledge, and support team and leadership transitions.
People & Knowledge servicesInfrastructure
Modernize cloud and hybrid platforms, networks, workplace technology, and recovery foundations to support dependable business services.
Infrastructure servicesOperations
Improve Tier 1, 2, and 3 support, service levels, monitoring, incident handling, and recurring problem resolution, with meaningful KPIs.
Operations servicesApplications
Improve enterprise business applications, collaboration tools, integrations, and secure software delivery around the way people work.
Applications servicesData & Analytics
Improve data quality, ownership, reporting, and insight so leaders can make informed decisions.
Data & Analytics servicesPPM & Project Delivery
Make the project queue visible, align capacity and funding, and guide analysis, design, development, testing, implementation, and transition to support.
PPM & Project Delivery servicesRelated: Lead oversightSecurity
Protect identities, endpoints, applications, and data with named control owners, monitoring, and response, including discovery and review of shadow IT and shadow AI.
Security servicesRisk
Assess risks, name accountable business owners, support compliance readiness, track remediation, and test continuity and recovery against business objectives.
Risk servicesAutomation and AI opportunities can appear in every function. We assess value, readiness, security, and human oversight before recommending what to automate.
Explore automation and AI across the modelSecure: four protection priorities
These priorities sit within Secure and draw on security, infrastructure, data, and risk processes across the model.
Identity
SEC-02: who can access systems, what they can do, and how access is reviewed and removed.
Endpoints
SEC-04 and INF-04: device protection, vulnerabilities, patching, and the digital workplace.
Data
SEC-05 and Data & Analytics: protect sensitive information, improve data quality, and manage retention.
Continuity
RSK-05 and INF-06: business continuity, critical dependencies, and recovery validated through exercises and technical tests against agreed recovery times and acceptable data loss.
Five steps, then keep improving
Build a foundation. Improve with evidence.
Select the diagram to enlarge.
Identify, Own, Measure, Improve, Automate. Ownership continues throughout. After the first pass, Measure, Improve, and Automate repeat as priorities and evidence change.
Automation and AI
Where could automation and AI improve the work?
Choose one process worth improving. Follow real cases and exceptions, identify its owner, and establish a small baseline before choosing the technology.
The IT Automation & AI Opportunity Map shows illustrative automation potential across the 12 IT functions. A high score does not mean AI is required, that your process is ready, or that savings are proven. Reassess the actual work, ownership, data, value, total cost, and risk.
Simplify the work first and check features already paid for. Use rules for clear, repeatable steps; consider AI for interpretation and an agent only where a bounded sequence needs one. Compare the full cost and risk of each option, with limits, review, monitoring, and a fallback.
Look first at repeatable operations, data, and security tasks. People retain strategic and risk decisions.
How to use the IT Automation & AI Opportunity Map
- Choose frequent work worth examining.
- Confirm owners, meaningful measures, and safeguards.
- Assess value, effort, readiness, and risk; shortlist up to three pilots.
One example: IT spending and vendor value
Turn a cost concern into accountable work.
Outcome
Leaders can see total IT costs, upcoming renewals, expected benefits, and how spending supports business priorities.
Owner
A named IT leader owns the review, with finance involved in budget decisions and business owners accountable for service needs.
Actions
Inventory services, contracts, and licenses; establish a spending baseline; review usage, renewals, and supplier performance; compare costs and expected benefits; and agree on prioritized changes.
Example measures
IT spending against budget, license utilization, renewal visibility, and validated savings from completed changes.
Measures and targets are agreed for the organization. These are examples, not a universal score or a compliance certification.
Across the business
Follow the work across departments.
Use the IT model to support the whole business flow, including the handoffs that cause delay or repeated work.
These are fictional planning examples. The measures are suggestions to baseline, not client results or promised savings.
Employee onboarding, role changes, and departures
A business owner coordinates HR, managers, IT, security, facilities, and providers. Use approved role bundles and workflow for known tasks; AI can identify missing information for review.
Review owned agents, credentials, jobs, and automations when someone leaves. Verify access removal and transfer responsibilities.
Measure readiness at the agreed start time, cycle time, overdue access removal, exceptions, and completion evidence.
Explore the employee lifecycleRecurring problems and service recovery
A service owner coordinates intake, routing, recovery, recurring-cause investigation, and reviewed knowledge. AI can summarize issues and suggest patterns; people validate the evidence and authorize fixes.
Use approved changes, test data, controlled destinations, and a fallback. Restore service while investigating recurrence.
Measure resolution time by priority, recurrence, reopen rate, backlog age, user feedback, and staff effort.
Explore recurring-issue resolutionFor a third example, compare SQL Server modernization and secure delivery. For decisions about cloud, local, hybrid, and risk, use the business automation and AI guide.
See the process-focused Readiness ReviewHow the references help
Use established guidance in context.
COBIT 2019 helps connect governance, business goals, risk, and accountability. ITIL 4 supports service management and improvement. Other references inform selected areas, including security, continuity, architecture, projects, data, and AI.
The model is our independent interpretation. A mapping helps organize work and evidence; it does not establish compliance or certification. HIPAA and NYDFS requirements remain legal obligations where they apply.
Show email addressAbout GoBauer
Request a guide walkthrough by email. We will reply to arrange a time.
Framework references and use of these resources
We offer the IT Operating Model and IT Automation & AI Opportunity Map as planning references. Start with 12 core IT functions and 66 process groups, then adapt the groupings and detail to how your organization works. The diagrams do not prescribe an organization structure or show every handoff and dependency.
COBIT® 2019 and ITIL® 4 are reference points. The model's COBIT identifiers are our interpretive mappings. Additional references in the supporting work include ISO/IEC 20000, TOGAF, TBM, FinOps, SFIA 9, NIST CSF 2.0, ISO/IEC 27001, ISO 31000, ISO 22301, NIST AI RMF, ISO/IEC 42001, OWASP application and GenAI security guidance, DAMA-DMBOK, DORA delivery metrics, PMBOK, MoP, and MSP. DORA here means software delivery research and metrics; it is distinct from the EU Digital Operational Resilience Act.
The map's colors indicate illustrative automation potential; AI badges identify AI-related processes. Neither directs every process to use AI. Scores are starting points, not findings about your organization or approval to automate. Reassess actual work, repeatability, ownership, readiness, data, full cost, value, and risk.
GoBauer's original material is copyrighted. Third-party frameworks, standards, content, and trademarks remain subject to their owners' rights and terms. Downloading these resources does not grant a license to underlying framework content. Validate interpretations against official sources and any applicable licensed texts. These resources do not establish certification, attestation, or legal compliance.
For the owners' current terms, see ISACA's intellectual property and licensing information and PeopleCert's marks usage policy.
Independent work; framework references and mappings are interpretive and not endorsed by the organizations named.
COBIT® is a registered trademark of ISACA. ITIL®, PRINCE2®, MSP®, and MoP® are registered trademarks of the PeopleCert group. TOGAF® belongs to The Open Group; PMBOK® to the Project Management Institute; SFIA® to the SFIA Foundation; and DAMA-DMBOK® to DAMA International. Other names and marks belong to their respective owners.