Actions

Difference between revisions of "COBIT (Control Objectives for Information and Related Technology)"

m
m
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
'''COBIT''' is a framework of the best practices for IT management (IT Governance). It is a set of best practices and procedures that help the organization to achieve strategic objectives through the effective use of available resources and minimization of IT risks. COBIT interconnects [[Corporate Governance|Enterprise governance]] and [[IT Governance]]. This connection is realized by linking business and IT goals, defining metrics and maturity models to measure the achievement of objectives, and defining the responsibilities of owners of the business and IT processes.<ref>[https://cioindex.com/reference/case-study-implementing-it-governance-using-the-cobit-framework/ Case Study – Implementing IT Governance Using The COBIT Framework]</ref>
+
'''COBIT''' is a framework published by [[Information Systems Audit and Control Association (ISACA)|ISACA]] for governing and managing an enterprise's information and technology in support of its [[Business Goals|business goals]] and [[Business Objective|objectives]]. It connects desired outcomes with responsibilities, practices and measures, helping an organization decide what to prioritize, how to direct technology-related work and what evidence to examine when judging performance against the enterprise's stated objectives.<ref name="overview">ISACA (n.d.), [https://www.isaca.org/resources/cobit COBIT], framework overview and descriptions of the COBIT 2019 core publications. Accessed 29 October 2026.</ref>
  
−
The first COBIT version was released by the [[Information Systems Audit and Control Association (ISACA)|ISACA organization]] in 1996. The first edition consisted of the framework, and the second one was extended to include audit guidelines, an implementation toolset, and control objectives. The third edition added management guidelines. The third edition of COBIT has been released by the ITG Institute (IT Governance Institute). The current edition is the fifth (COBIT 5), and the fifth version is available from April 2012. COBIT 5 consolidates and integrates the COBIT 4.1, Val IT 2.0, and [[Risk IT Framework]] and also draws significantly from the Business Model for Information Security (BMIS) and ITAF.<ref>[https://managementmania.com/en/cobit-control-objectives-for-information-and-related-technology  History of COBIT]</ref>
+
In plain terms, COBIT gives people a common reference for connecting technology decisions to organizational purpose. Its enterprise scope includes information and technology used across business activities, wherever responsibility for them sits. The organization must turn that reference into its own governance arrangements: who has authority, which practices operate, what resources they need and how results are reviewed. Reading or adopting a framework does not establish that those arrangements work.<ref name="overview" />
  
−
The latest version, COBIT 2019, was released in 2018. New insights from experts in IT and governance were included in the new version.
+
'''Edition scope (29 October 2026):''' ISACA has announced COBIT 7.<ref name="announcement">ISACA (n.d.), [https://www.isaca.org/training-and-events/online-training/webinars ISACA IS/IT Webinars &amp; Webcasts], announcement of ''A First Look at COBIT 7''. Accessed 29 October 2026.</ref> The detailed model explained below is '''COBIT 2019'''; its counts, terminology and assessment concepts are specific to that edition.
  
 +
== Scope and role ==
  
−
== Framework and Components of COBIT<ref>[https://en.wikipedia.org/wiki/COBIT Framework and Components of COBIT]</ref> ==
+
COBIT addresses the relationship between enterprise needs and the governance and management of information and technology. The distinction between the two functions is central:
−
COBIT was initially "Control Objectives for Information and Related Technologies," though, before the release of the framework, people talked of "CobiT" as "Control Objectives for IT" or "Control Objectives for Information and Related Technology." The framework defines a set of generic processes for the management of IT, with each process defined together with process inputs and outputs, key process activities, process objectives, performance measures, and an elementary maturity model. COBIT also provides a set of recommended best practices for the governance and control process of information systems and technology with the essence of aligning IT with business. COBIT 5 consolidates COBIT 4.1, Val IT, and Risk IT into a single framework acting as an enterprise framework aligned and interoperable with other frameworks and standards.
 
−
The business orientation of COBIT consists of linking business goals to IT goals, providing metrics and maturity models to measure their achievement, and identifying the associated responsibilities of business and IT process owners.
 
−
The process focus of COBIT is illustrated by a process model subdividing IT into four domains (Plan and Organize; Acquire and Implement; Deliver and Support; and Monitor and Evaluate) and 34 processes in line with the responsibility areas of plan, build, run, and monitor. It is positioned at a high level and has been aligned and harmonized with other, more detailed IT standards and good practices such as [[COSO Internal Control Integrated Framework|COSO]], [[ITIL (Information Technology Infrastructure Library)|ITIL]], BiSL, [[ISO 27000]], [[Capability Maturity Model Integration (CMMI)|CMMI]], [[The Open Group Architecture Framework (TOGAF)|TOGAF]], and PMBOK. COBIT acts as an integrator of these different guidance materials, summarizing key objectives under one umbrella framework that links the good practice models with governance and business requirements. COBIT 5 further consolidated and integrated the COBIT 4.1, [[Val IT Framework|Val IT 2.0]], and Risk IT frameworks and drew from ISACA's IT Assurance Framework (ITAF) and the [[Business Model for Information Security (BMIS)]].
 
−
The framework and its components can, when utilized well, also contribute to ensuring regulatory compliance. It can encourage less wasteful information management, improve retention schedules, increase business agility, and lower costs while better complying with data retention and management regulations.
 
  
 +
* '''Governance''' evaluates stakeholder needs and available options, sets direction, and monitors whether performance follows that direction.
 +
* '''Management''' plans, builds, operates and monitors activities within the direction established through governance.<ref name="assessment">Emeka Elue (27 July 2020), [https://www.isaca.org/resources/news-and-trends/industry-news/2020/effective-capability-and-maturity-assessment-using-cobit-2019 Effective Capability and Maturity Assessment Using COBIT 2019], ISACA. Accessed 29 October 2026.</ref>
  
−
COBIT components include:
+
This connects [[IT Governance|IT governance]] with [[IT Management (Information Technology Management)|IT management]] while keeping their responsibilities distinguishable. For example, deciding an acceptable level of business exposure is a different responsibility from organizing the work needed to remain within it. Monitoring occurs in both functions, but the questions and decision authority differ.
−
*Framework: Organizes IT governance objectives and good practices by IT domains and processes and links them to business requirements.
 
−
*Process descriptions: A reference process model and common language for everyone in an organization. The processes map to responsibility areas of planning, building, running, and monitoring.
 
−
*Control objectives: Provides a complete set of high-level requirements to be considered by management for effective control of each IT process.
 
−
*Management guidelines: Helps assign responsibility, agree on objectives, measure performance, and illustrate interrelationship with other processes.
 
−
*Maturity models: Assess maturity and capability per process and help to address gaps.
 
  
 +
[[Image:COBIT5.1.jpg|thumb|center|450px|alt=COBIT 5 diagram connecting business needs and governance evaluation, direction and monitoring with management planning, building, running and monitoring.|The relationship between governance and management in COBIT 5. Source: ISACA.]]
  
−
== The Principles of COBIT<ref>[https://www.bitsighttech.com/blog/cobit-vs-itil The Five Principles of COBIT 5]</ref> ==
+
An [[IT Strategy (Information Technology Strategy)|IT strategy]] establishes choices and priorities for using information technology to support business objectives. COBIT can help organize the governance around those choices. It does not select a strategy for the organization or replace the expertise needed to design technology, run services or assess individual risks.
−
Five principles make up COBIT: (see figure below)
 
−
*Meeting stakeholder needs. This is incredibly general, but COBIT points out that meeting the needs of the stakeholder while still meeting the needs of the company is valuable.
 
−
*Covering the enterprise end-to-end. You must have a complete solution—not just pieces here and there. It’s important to take an in-depth look at network devices, endpoint solutions, as well as signature, non-signature, and heuristic base protection (and much more).
 
−
*Applying a single integrated framework. This isn’t to say you need only a single vendor for your framework, but rather that your framework must be organized and well thought-out.
 
−
*Enabling a holistic approach. You must have a plan of action that attacks an IT problem from multiple angles.
 
−
*Separating governance from management. Governance ensures that there is oversight while management deals with the necessary processes and steps needed.
 
  
 +
Relevant participants can include governing bodies, business and technology executives, process owners, risk specialists and assurance professionals. Responsibilities depend on the organization's arrangements. A framework reference cannot settle a disagreement about who has authority unless that authority is established and accepted in practice.
  
−
[[File:Cobit5.jpg|400px|COBIT5 Principles]]<br />
+
== History and editions ==
−
source: ISACA
 
  
 +
COBIT originated as the abbreviation for ''Control Objectives for Information and Related Technology''.<ref name="glossary">ISACA (n.d.), [https://www.isaca.org/resources/glossary ISACA Interactive Glossary], entries for COBIT, governance component, governance enabler, governance framework, governance system and focus area. Accessed 29 October 2026.</ref> First released in 1996, it developed from an audit and control focus toward broader management and governance guidance. COBIT 5 followed in 2012.<ref name="history">ISACA (20 April 2026), [https://www.isaca.org/resources/news-and-trends/newsletters/atisaca/2026/volume-8/celebrating-three-decades-of-cobit Celebrating Three Decades of COBIT]. Accessed 29 October 2026.</ref>
  
−
== The COBIT Reference Model<ref>[https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?ID=193 The COBIT 5 Process Reference Model]</ref> ==
+
COBIT 5 brought together earlier COBIT guidance, including COBIT 4.1, with the previously separate [[Val IT Framework|Val IT]] and [[Risk IT Framework|Risk IT]] frameworks.<ref name="transition">Govind Kulkarni (11 November 2019), [https://www.isaca.org/resources/news-and-trends/industry-news/2019/transitioning-an-enterprise-from-cobit-5-to-cobit-2019 Transitioning an Enterprise From COBIT 5 to COBIT 2019], ISACA. Accessed 29 October 2026.</ref> COBIT 2019 was released in November 2018.<ref name="implementation">ISACA (11 December 2018), [https://www.isaca.org/about-us/newsroom/press-releases/2018/new-cobit-2019-resources-help-organizations-design-and-implement-tailored-governance-systems New COBIT 2019 Resources Help Organizations Design and Implement Tailored Governance Systems for Their Information and Technology]. Accessed 29 October 2026.</ref>
−
COBIT 5 is not delivered as a prescriptive model; rather, it advocates the implementation of governance and management processes within enterprises, as per the figure below. The COBIT 5 process reference model defines and describes in detail the governance and management processes normally found within an enterprise relating to IT activities, providing a common reference model understandable to operational IT and business managers. The COBIT 5 model delivers an operational model with a common language for all parts of the business involved in IT activities. It provides a framework for measuring and monitoring IT performance, communicating with service providers, and integrating best management practices.
 
  
 +
Material labeled COBIT 4.1, COBIT 5 or COBIT 2019 should be read in its edition context. A principle count, process description or assessment term from one edition cannot be assumed to describe another. The COBIT 7 announcement does not change which edition the following model explanation describes.
  
−
[[File:COBIT5.1.jpg|400px|COBIT5 1]]<br />
+
=== COBIT 5 and COBIT 2019 ===
−
source: [https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?ID=193 ISACA]
 
  
 +
The COBIT 5 principles illustration provides historical context for the later model. Its five themes concern stakeholder needs, enterprise-wide coverage, an integrated framework, a holistic approach, and separating governance from management.
  
−
The COBIT 5 process reference model divides the governance and management processes of enterprise IT into two main process domains:
+
[[Image:Cobit5.jpg|thumb|center|600px|alt=The five COBIT 5 principles: meeting stakeholder needs, covering the enterprise end to end, applying a single integrated framework, enabling a holistic approach, and separating governance from management.|The five principles of COBIT 5. Source: ISACA.]]
−
*Governance—Contains five governance processes with “evaluate, direct and monitor practices” defined within each process
 
−
*Management—Four domains, in line with the responsibility areas of plan, build, run and monitor (PBRM), providing the end-to-end coverage of IT. These domains are an evolution of the COBIT 4.1 domain and process structure:
 
−
**Align, Plan, and Organise (APO)
 
−
**Build, Acquire, and Implement (BAI)
 
−
**Delivery, Service, and Support (DSS)
 
−
**Monitor, Evaluate and Assess (MEA)
 
−
The COBIT 5 process reference model is the successor of the COBIT 4.1 process model, incorporating both the Risk IT and Val IT frameworks.
 
  
 +
The following comparison highlights selected changes; the subsequent sections explain the COBIT 2019 model in more detail.
  
−
== Analyzing COBIT<ref>[https://www.gartner.com/doc/1982323/updates-cobit--aim-greater COBIT - An Analysis]</ref> ==
+
{| class="wikitable"
−
A significant refresh of COBIT 4.1 and COBIT 5 improve this useful framework by integrating several of ISACA's frameworks, notably Val IT and Risk IT. The changes have made COBIT 5 broader and more complex. The scope of its guidance could overwhelm new users and inhibit its adoption; consequently, the online version of COBIT 5 will need to provide role-specific versions or logical views to make it more user-friendly.
+
! Aspect
 +
! COBIT 5
 +
! COBIT 2019
 +
|-
 +
| Core model
 +
| Process reference model containing 37 processes.
 +
| Core model containing 40 governance and management objectives, each with an associated process.<ref name="comparison">Kumaragunta Harisaiprasad (27 April 2020), [https://www.isaca.org/resources/news-and-trends/industry-news/2020/cobit-2019-and-cobit-5-comparison COBIT 2019 and COBIT 5 Comparison], ISACA, process-model changes. Accessed 29 October 2026.</ref><ref name="overview" />
 +
|-
 +
| Principles
 +
| Five principles.
 +
| Six governance-system principles and three governance-framework principles.<ref name="transition" />
 +
|-
 +
| Organizational elements
 +
| Uses the term ''enablers''.
 +
| Uses ''components'' for these elements; the wider organizational concerns remain.<ref name="transition" />
 +
|-
 +
| Design support
 +
| Enterprise-specific application remains necessary.
 +
| Adds explicit design factors to inform the governance-system design.<ref name="transition" />
 +
|}
  
−
Changes in COBIT 5 likely to have the greatest impact on organizations currently using COBIT include:
+
The additional identifiers in the 2019 core model include '''APO14 Managed Data''', '''BAI11 Managed Projects''' and '''MEA04 Managed Assurance'''.<ref name="comparison" /> Project management was already present in COBIT 5 alongside program management; COBIT 2019 separates their objectives.<ref name="transition" />
−
*A new process capability assessment approach, based on ISO/IEC 15504, replaces the Capability Maturity Model (CMM)-based modeling.
 
−
*Modifications to the process model, including changed processes and some new processes.
 
−
*Beyond the integration, this update also attempts to address a number of issues, including:
 
−
*Greater relevance to a wider business audience through increased separation of governance from management and clearer connection with board-level concerns.
 
−
*More explicit guidance to levers of change ("enablers") beyond processes, such as culture, ethics, behavior, people, skills, and competencies.
 
−
*Improved process capability assessments.
 
−
*Linkage between specific IT and enabler goals to broader enterprise-level goals.
 
−
*Greater emphasis on value creation through focusing on benefits realization, risk optimization, and resource optimization.
 
  
−
However, ISACA has overlooked or set aside some areas for this update:
+
Assessment approaches also differ. The original COBIT 5 Process Assessment Model (PAM) used ISO/IEC 15504.<ref name="pam-history">Joao Souza Neto, Rafael Almeida, Pedro Linares Pinto and Miguel Mira da Silva (26 January 2018), [https://www.isaca.org/resources/isaca-journal/issues/2018/volume-1/a-cobit-5-pam-update-compliant-with-isoiec-330xx-family A COBIT 5 PAM Update Compliant With ISO/IEC 330xx Family], ISACA Journal, volume 1, description of the original PAM. Accessed 29 October 2026.</ref> COBIT 2019 uses an approach to process capability based on [[Capability Maturity Model Integration (CMMI)|CMMI]].<ref name="assessment" /> A numerical rating therefore needs its edition and assessment reference to be interpretable.
−
*It ignores the blurring boundary between operational technology and information technology, which will have an increasing impact on the management of risk and delivery of value and will require additional controls.
 
−
*It is just about acknowledging but does not explicitly deal with or provide any useful guidance on sustainability.
 
−
*It still complements the Information Technology Infrastructure Library (ITIL) without replacing it.
 
  
 +
== The COBIT 2019 model ==
  
−
== COBIT 5 Vs. COBIT 2019<ref>[https://www.isaca.org/resources/news-and-trends/industry-news/2020/cobit-2019-and-cobit-5-comparison A Comparision between COBIT 5 and COBIT 2019]</ref> ==
+
=== Goals cascade ===
−
*Principles and Objectives
 
−
There are 6 governance system principles in COBIT 2019, compared to 5 in COBIT 5. Governance principles ensure that stakeholder needs are evaluated and agreed on based on enterprise objectives, to set direction through prioritization and decision-making, and to monitor performance and compliance against the set direction and objectives.
 
  
−
Along with including an additional governance principle, COBIT 2019 revises some of the terminologies used in defining the principles. However, the governance and management objectives are similar in both versions.
+
The COBIT 2019 goals cascade connects stakeholder needs with enterprise goals, then alignment goals, and then priorities among governance and management objectives.<ref name="cascade">Ioannis Routsis (26 May 2021), [https://www.isaca.org/resources/isaca-journal/issues/2021/volume-3/lost-in-the-woods-cobit-2019-and-the-it-balanced-scorecard Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard], ISACA Journal, volume 3. Accessed 29 October 2026.</ref> Alignment goals provide the intermediate connection between enterprise ambitions and the contribution expected from information and technology.
  
−
*Processes
+
The cascade makes that connection explicit enough to discuss and challenge. It does not remove judgment: two enterprises with a similar business goal may face different constraints and therefore emphasize different objectives. A mapping shows why an objective deserves attention; evidence from operation is still needed to establish whether the intended contribution occurs.
−
More changes can be noted in the processes that support the governance and management objectives. The number of processes is increased from 37 in COBIT 5 to 40 in COBIT 2019. The terminology is also changed slightly, from the use of the verb “manage” in COBIT 5 to the adjective “managed” in COBIT 2019. Specific examples include:
 
−
**In Align, Plan, and Organize (APO), 1 process is added (APO14 Managed Data) and the terminology in APO10 is changed from “supplier” to “vendor.”
 
−
**In Build, Acquire and Implement (BAI), one process is added (BAI11 Managed Projects). In addition, in COBIT 2019, BAI06 and BAI07 specify that the changes being managed, accepted and transitioned are IT changes.
 
−
**In Monitor, Evaluate and Assess (MEA), one process is added (MEA04 Managed Assurance) and the terminology in the other 3 MEA processes is changed to emphasize the use of “managed” instead of “Monitor, Evaluate and Assess.”
 
  
−
*Framework Principles
+
=== Objectives and domains ===
−
Governance framework principles are added to COBIT 2019. The conceptual model referred to in the first principle identifies key components and relationships among the components to maximize consistency and allow automation. Openness and flexibility cited in the second principle implies allowing the addition of new content and the ability to address new issues in a flexible way, thereby allowing integrity and consistency. The third principle points out that the model should be aligned to major standards, frameworks and regulations.
 
  
−
*Performance Management and Design Factors
+
The COBIT 2019 core model contains '''40 governance and management objectives'''.<ref name="overview" /> An objective describes a desired result. A corresponding process and other governance-system components support its achievement. The objectives are grouped into five domains; EDM concerns governance, while the other four concern management.<ref name="model">Mark Thomas (10 December 2018), [https://www.isaca.org/resources/news-and-trends/industry-news/2018/a-new-cobit-is-in-town-and-i-really-like-how-it-looks A New COBIT Is in Town and I Really Like How It Looks], ISACA. Accessed 29 October 2026.</ref>
−
Performance management in COBIT 2019 is based on the CMMI Performance Management Scheme, in which the capability and maturity levels are measured between 0 and 5, whereas the scale used in COBIT 5 is based on International Organization for Standardization(ISO)/International Electrotechnical Commission (IEC) ISO/IEC 33000 Software Process Improvement and Capability Determination—SPICE.  
 
  
−
Enablers have been removed from COBIT 2019 for simplification.
+
{| class="wikitable"
 +
! COBIT 2019 domain
 +
! Main concern
 +
|-
 +
| Evaluate, Direct and Monitor (EDM)
 +
| Governance direction and oversight.
 +
|-
 +
| Align, Plan and Organize (APO)
 +
| Organizing and planning the management of enterprise information and technology.
 +
|-
 +
| Build, Acquire and Implement (BAI)
 +
| Developing or obtaining capabilities and putting changes into use.
 +
|-
 +
| Deliver, Service and Support (DSS)
 +
| Operating and supporting services.
 +
|-
 +
| Monitor, Evaluate and Assess (MEA)
 +
| Examining performance and conformance.
 +
|}
  
−
Design factors, which are introduced in COBIT 2019, are the factors that influence the design of the enterprise governance system
+
These groupings help locate a concern within the model. They are not a required organization chart: one team may contribute to several objectives, and one objective may depend on several teams. Treating the model only as a process list would also overlook the people, information and organizational arrangements required to make processes work.<ref name="model" />
  
−
In Conclusion, COBIT 2019 has 6 governing principles instead of 5. The number of processes supporting the governance and management objectives is increased from 37 to 40, with some changes in terminology. Governance principles are added, and performance management is based on the CMMI performance management scheme instead of ISO/IEC 33000. Finally, 11 design factors that influence the design of the enterprise governance system are introduced and enablers are removed. An enterprise governance system can be designed using ISACA’s tool kit by inserting appropriate values in the respective fields. COBIT 2019 includes new technology and business trends in I&T. It can integrate with other international standards, guidelines, regulations and best practices unique to your organization and provide an effective EGIT framework.
+
=== Governance-system components ===
  
 +
COBIT 2019 identifies seven component types: '''processes'''; '''organizational structures'''; '''principles, policies and procedures'''; '''information'''; '''culture, ethics and behavior'''; '''people, skills and competencies'''; and '''services, infrastructure and applications'''.<ref name="glossary" /> The earlier term ''enablers'' became ''components''; these wider organizational concerns were not discarded.<ref name="model" />
  
−
== See Also ==
+
The practical implication is that a process description is only part of the picture. A reporting process, for example, needs reliable information, people who understand it, a recipient with authority to respond and a culture in which problems can be raised. Improving the procedure alone may leave the underlying governance problem unresolved.
−
*[[IT Governance]]
 
−
*[[Val IT Framework]]
 
−
*[[Risk IT Framework]]
 
  
 +
=== System principles and framework principles ===
 +
 +
COBIT 2019 distinguishes '''six principles for a governance system''' from '''three principles for a governance framework'''. The system principles concern stakeholder value, interconnected components, adaptation to change, distinct governance and management, enterprise-specific design, and coverage across the enterprise. The framework principles concern a consistent conceptual foundation, openness to extension, and compatibility with relevant standards, frameworks and regulations.<ref name="glossary" />
 +
 +
The distinction is between the arrangements an enterprise operates and the reference structure used to design them. Neither set is a list of security products, departments or technology vendors.
 +
 +
== Tailoring COBIT 2019 ==
 +
 +
COBIT 2019 uses '''design factors''' to inform the design of a governance system. Its Design Guide identifies eleven, including enterprise strategy, goals, risk conditions, size and sourcing choices. Such context can affect which objectives receive priority, how components are configured and the capability sought for relevant processes. Not every factor must be used in every situation.<ref name="design">Abdul Rafeq (4 February 2019), [https://www.isaca.org/resources/news-and-trends/industry-news/2019/cobit-design-factors COBIT Design Factors: A Dynamic Approach to Tailoring Governance in the Era of Digital Disruption], ISACA. Accessed 29 October 2026.</ref>
 +
 +
A '''focus area''' addresses a particular governance topic or issue through a relevant collection of objectives and components.<ref name="glossary" /> It is distinct from both a contextual design factor and one of the five core domains.
 +
 +
Tailoring connects the model with choices about [[IT Risk Management|IT risk management]], [[Resource Management|resource management]] and organizational priorities. It should explain why a particular arrangement fits the enterprise. Copying another organization's selected objectives or entering values into a design tool does not, by itself, establish that fit.
 +
 +
== Capability and maturity in COBIT 2019 ==
 +
 +
COBIT 2019 distinguishes '''process capability''' from '''focus-area maturity'''. Process capability concerns how well a defined process is implemented and performs; the model uses capability levels from zero to five. Maturity is associated with a focus area and the processes it encompasses.<ref name="assessment" /> These statements describe different units of assessment and should not be treated as interchangeable labels for an enterprise's overall quality.
 +
 +
An interpretable assessment identifies the process or focus area, the edition and assessment reference, the evidence examined, and the target relevant to the organization. An undocumented impression and a conclusion supported by observed practice are different kinds of evidence. A written policy may establish that an expectation exists; it does not alone demonstrate that people follow it.
 +
 +
A capability or maturity result can inform an improvement decision. It does not independently establish business value, effective governance or compliance with a particular obligation. The highest possible score is not automatically the appropriate target: the organization must consider the importance of the activity, the exposure involved and the resources required to improve it.
 +
 +
== Application and improvement ==
 +
 +
Applying COBIT requires connecting reference guidance to an actual governance concern. ISACA's COBIT 2019 design and implementation publications distinguish designing an appropriate system from implementing and continually improving it.<ref name="implementation" /> In organizational terms, this means understanding the starting situation, choosing priorities, establishing responsibilities, changing practices and examining what happens in operation.
 +
 +
That work needs people with authority to make decisions, owners able to carry them out, adequate skills and resources, and usable information. For example, an agreed objective may require a policy change, clearer escalation responsibilities or investment in information quality. The relevant changes depend on the diagnosed problem; adopting every possible document is not a substitute for understanding it.
 +
 +
[[Performance Measurement|Performance measurement]] supplies feedback about operation and results. Review can reveal that a practice is not being followed, that the selected measure is misleading, or that the underlying priority has changed. Each finding calls for a different response. Continuing review connects governance-system improvement with changing enterprise needs rather than treating adoption as a completed documentation exercise.
 +
 +
=== Hypothetical example: a customer service repeatedly goes offline ===
 +
 +
Suppose an organization relies on an online customer service that suffers recurring disruption. Its governing authority must determine how much disruption is acceptable in relation to customer needs, business exposure and available resources. Management must turn that direction into operating responsibilities and appropriate service arrangements.
 +
 +
Using the COBIT 2019 model, the organization could examine relevant delivery and support objectives alongside the components needed to support them. A procedure would be one component; staff skills, supplier responsibilities, reliable incident information and escalation authority would also matter.
 +
 +
An exercise or an actual disruption could then provide evidence about whether the arrangements work. If people cannot reach the authorized decision maker, rewriting the procedure may be insufficient: the allocation of authority or availability of responsible people may need to change. This illustration shows the relationship between direction, management, components and feedback; it makes no claim of an achieved result or assessment level.
 +
 +
== Benefits and limitations ==
 +
 +
COBIT's potential contribution is a more coherent way to relate goals, decisions, responsibilities, operating practices and evidence. A shared reference can make inconsistent expectations visible and help participants explain why an improvement matters. Following intended value through [[Benefits realization management|benefits realization management]] remains a separate organizational responsibility; selecting a framework does not deliver the benefit.
 +
 +
Common limitations follow from how the framework is applied. Treating every objective as equally urgent can disperse effort. Emphasizing documents over behavior can conceal weak execution. Pursuing ratings without a clear business purpose can consume resources without addressing the material problem. Combining terminology from different editions can make a seemingly precise assessment ambiguous.
 +
 +
COBIT can organize attention to control and compliance concerns, but a framework-based description is not proof that a particular requirement has been met. The applicable obligation, actual practices and supporting evidence still need to be examined. Its usefulness therefore depends on contextual judgment and effective organizational action as well as accurate understanding of the framework.
 +
 +
== Relationship to other frameworks ==
 +
 +
COBIT can be used alongside more specialized guidance. For example, ISACA's discussion of COBIT 2019 and [[ITIL (Information Technology Infrastructure Library)|ITIL]] 4 distinguishes enterprise information-and-technology governance from ITIL's service-management emphasis and describes their compatibility.<ref name="itil-relationship">ISACA (n.d.), [https://www.isaca.org/resources/white-papers/using-itil-4-and-cobit-2019-to-create-an-integrated-i-and-t-framework-environment Using ITIL 4 and COBIT 2019 to Create an Integrated I&amp;T Framework Environment], public publication description. Accessed 29 October 2026.</ref>
 +
 +
This relationship allows an organization to connect its governance objectives with service-management practices. The organization still needs to reconcile responsibilities, terminology and evidence across the guidance it uses. COBIT itself includes both governance and management; combining frameworks does not assign one entire function to each or establish that the resulting arrangements are effective.
 +
 +
== See also ==
 +
 +
* [[Corporate Governance|Corporate governance]] — the wider governance arrangements of a company.
 +
* [[IT Governance Framework|IT governance framework]] — the broader category of reference structures for IT governance.
 +
* [[Enterprise Architecture|Enterprise architecture]] — a related discipline concerned with enterprise structures and their relationships.
 +
 +
== Further reading ==
 +
 +
* [https://cioindex.com/magazine/cobit-goals-cascade/ COBIT Goals Cascade] — an applied CIO Index discussion of connecting goals and governance priorities.
 +
* [https://cioindex.com/references/cobit/ COBIT resources] — the CIO Index collection of articles and reference materials.
  
 
== References ==
 
== References ==
 +
 
<references />
 
<references />
−
 
−
 
−
== Further Reading ==
 
−
*[http://www.acc.ncku.edu.tw/chinese/faculty/shulc/courses/cas/articles/COBIT.pdf COBIT and its Utilization: A framework from the literature]
 
−
*[https://www.isaca.org/COBIT/focus/Pages/cobit-5-for-risk-making-sense-of-it-risk-management.aspx COBIT 5 for Risk: Making Sense of IT Risk Management]
 
−
*[https://www.isaca.org/COBIT/focus/Pages/how-cobit-5-can-help-reduce-the-likelihood-and-impact-of-the-top-5-cyberthreats.aspx How COBIT 5 Can Help Reduce the Likelihood and Impact of the Top 5 Cyberthreats]
 
−
*[http://airccse.org/journal/ijitcs/papers/3113ijitcs02.pdf COBIT Framework as a Guideline of Effective IT Governance in Higher Education: A Review]
 
−
__NOTOC__
 

Latest revision as of 22:48, 29 October 2026

COBIT is a framework published by ISACA for governing and managing an enterprise's information and technology in support of its business goals and objectives. It connects desired outcomes with responsibilities, practices and measures, helping an organization decide what to prioritize, how to direct technology-related work and what evidence to examine when judging performance against the enterprise's stated objectives.[1]

In plain terms, COBIT gives people a common reference for connecting technology decisions to organizational purpose. Its enterprise scope includes information and technology used across business activities, wherever responsibility for them sits. The organization must turn that reference into its own governance arrangements: who has authority, which practices operate, what resources they need and how results are reviewed. Reading or adopting a framework does not establish that those arrangements work.[1]

Edition scope (29 October 2026): ISACA has announced COBIT 7.[2] The detailed model explained below is COBIT 2019; its counts, terminology and assessment concepts are specific to that edition.

Scope and role

COBIT addresses the relationship between enterprise needs and the governance and management of information and technology. The distinction between the two functions is central:

  • Governance evaluates stakeholder needs and available options, sets direction, and monitors whether performance follows that direction.
  • Management plans, builds, operates and monitors activities within the direction established through governance.[3]

This connects IT governance with IT management while keeping their responsibilities distinguishable. For example, deciding an acceptable level of business exposure is a different responsibility from organizing the work needed to remain within it. Monitoring occurs in both functions, but the questions and decision authority differ.

COBIT 5 diagram connecting business needs and governance evaluation, direction and monitoring with management planning, building, running and monitoring.
The relationship between governance and management in COBIT 5. Source: ISACA.

An IT strategy establishes choices and priorities for using information technology to support business objectives. COBIT can help organize the governance around those choices. It does not select a strategy for the organization or replace the expertise needed to design technology, run services or assess individual risks.

Relevant participants can include governing bodies, business and technology executives, process owners, risk specialists and assurance professionals. Responsibilities depend on the organization's arrangements. A framework reference cannot settle a disagreement about who has authority unless that authority is established and accepted in practice.

History and editions

COBIT originated as the abbreviation for Control Objectives for Information and Related Technology.[4] First released in 1996, it developed from an audit and control focus toward broader management and governance guidance. COBIT 5 followed in 2012.[5]

COBIT 5 brought together earlier COBIT guidance, including COBIT 4.1, with the previously separate Val IT and Risk IT frameworks.[6] COBIT 2019 was released in November 2018.[7]

Material labeled COBIT 4.1, COBIT 5 or COBIT 2019 should be read in its edition context. A principle count, process description or assessment term from one edition cannot be assumed to describe another. The COBIT 7 announcement does not change which edition the following model explanation describes.

COBIT 5 and COBIT 2019

The COBIT 5 principles illustration provides historical context for the later model. Its five themes concern stakeholder needs, enterprise-wide coverage, an integrated framework, a holistic approach, and separating governance from management.

The five COBIT 5 principles: meeting stakeholder needs, covering the enterprise end to end, applying a single integrated framework, enabling a holistic approach, and separating governance from management.
The five principles of COBIT 5. Source: ISACA.

The following comparison highlights selected changes; the subsequent sections explain the COBIT 2019 model in more detail.

Aspect COBIT 5 COBIT 2019
Core model Process reference model containing 37 processes. Core model containing 40 governance and management objectives, each with an associated process.[8][1]
Principles Five principles. Six governance-system principles and three governance-framework principles.[6]
Organizational elements Uses the term enablers. Uses components for these elements; the wider organizational concerns remain.[6]
Design support Enterprise-specific application remains necessary. Adds explicit design factors to inform the governance-system design.[6]

The additional identifiers in the 2019 core model include APO14 Managed Data, BAI11 Managed Projects and MEA04 Managed Assurance.[8] Project management was already present in COBIT 5 alongside program management; COBIT 2019 separates their objectives.[6]

Assessment approaches also differ. The original COBIT 5 Process Assessment Model (PAM) used ISO/IEC 15504.[9] COBIT 2019 uses an approach to process capability based on CMMI.[3] A numerical rating therefore needs its edition and assessment reference to be interpretable.

The COBIT 2019 model

Goals cascade

The COBIT 2019 goals cascade connects stakeholder needs with enterprise goals, then alignment goals, and then priorities among governance and management objectives.[10] Alignment goals provide the intermediate connection between enterprise ambitions and the contribution expected from information and technology.

The cascade makes that connection explicit enough to discuss and challenge. It does not remove judgment: two enterprises with a similar business goal may face different constraints and therefore emphasize different objectives. A mapping shows why an objective deserves attention; evidence from operation is still needed to establish whether the intended contribution occurs.

Objectives and domains

The COBIT 2019 core model contains 40 governance and management objectives.[1] An objective describes a desired result. A corresponding process and other governance-system components support its achievement. The objectives are grouped into five domains; EDM concerns governance, while the other four concern management.[11]

COBIT 2019 domain Main concern
Evaluate, Direct and Monitor (EDM) Governance direction and oversight.
Align, Plan and Organize (APO) Organizing and planning the management of enterprise information and technology.
Build, Acquire and Implement (BAI) Developing or obtaining capabilities and putting changes into use.
Deliver, Service and Support (DSS) Operating and supporting services.
Monitor, Evaluate and Assess (MEA) Examining performance and conformance.

These groupings help locate a concern within the model. They are not a required organization chart: one team may contribute to several objectives, and one objective may depend on several teams. Treating the model only as a process list would also overlook the people, information and organizational arrangements required to make processes work.[11]

Governance-system components

COBIT 2019 identifies seven component types: processes; organizational structures; principles, policies and procedures; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications.[4] The earlier term enablers became components; these wider organizational concerns were not discarded.[11]

The practical implication is that a process description is only part of the picture. A reporting process, for example, needs reliable information, people who understand it, a recipient with authority to respond and a culture in which problems can be raised. Improving the procedure alone may leave the underlying governance problem unresolved.

System principles and framework principles

COBIT 2019 distinguishes six principles for a governance system from three principles for a governance framework. The system principles concern stakeholder value, interconnected components, adaptation to change, distinct governance and management, enterprise-specific design, and coverage across the enterprise. The framework principles concern a consistent conceptual foundation, openness to extension, and compatibility with relevant standards, frameworks and regulations.[4]

The distinction is between the arrangements an enterprise operates and the reference structure used to design them. Neither set is a list of security products, departments or technology vendors.

Tailoring COBIT 2019

COBIT 2019 uses design factors to inform the design of a governance system. Its Design Guide identifies eleven, including enterprise strategy, goals, risk conditions, size and sourcing choices. Such context can affect which objectives receive priority, how components are configured and the capability sought for relevant processes. Not every factor must be used in every situation.[12]

A focus area addresses a particular governance topic or issue through a relevant collection of objectives and components.[4] It is distinct from both a contextual design factor and one of the five core domains.

Tailoring connects the model with choices about IT risk management, resource management and organizational priorities. It should explain why a particular arrangement fits the enterprise. Copying another organization's selected objectives or entering values into a design tool does not, by itself, establish that fit.

Capability and maturity in COBIT 2019

COBIT 2019 distinguishes process capability from focus-area maturity. Process capability concerns how well a defined process is implemented and performs; the model uses capability levels from zero to five. Maturity is associated with a focus area and the processes it encompasses.[3] These statements describe different units of assessment and should not be treated as interchangeable labels for an enterprise's overall quality.

An interpretable assessment identifies the process or focus area, the edition and assessment reference, the evidence examined, and the target relevant to the organization. An undocumented impression and a conclusion supported by observed practice are different kinds of evidence. A written policy may establish that an expectation exists; it does not alone demonstrate that people follow it.

A capability or maturity result can inform an improvement decision. It does not independently establish business value, effective governance or compliance with a particular obligation. The highest possible score is not automatically the appropriate target: the organization must consider the importance of the activity, the exposure involved and the resources required to improve it.

Application and improvement

Applying COBIT requires connecting reference guidance to an actual governance concern. ISACA's COBIT 2019 design and implementation publications distinguish designing an appropriate system from implementing and continually improving it.[7] In organizational terms, this means understanding the starting situation, choosing priorities, establishing responsibilities, changing practices and examining what happens in operation.

That work needs people with authority to make decisions, owners able to carry them out, adequate skills and resources, and usable information. For example, an agreed objective may require a policy change, clearer escalation responsibilities or investment in information quality. The relevant changes depend on the diagnosed problem; adopting every possible document is not a substitute for understanding it.

Performance measurement supplies feedback about operation and results. Review can reveal that a practice is not being followed, that the selected measure is misleading, or that the underlying priority has changed. Each finding calls for a different response. Continuing review connects governance-system improvement with changing enterprise needs rather than treating adoption as a completed documentation exercise.

Hypothetical example: a customer service repeatedly goes offline

Suppose an organization relies on an online customer service that suffers recurring disruption. Its governing authority must determine how much disruption is acceptable in relation to customer needs, business exposure and available resources. Management must turn that direction into operating responsibilities and appropriate service arrangements.

Using the COBIT 2019 model, the organization could examine relevant delivery and support objectives alongside the components needed to support them. A procedure would be one component; staff skills, supplier responsibilities, reliable incident information and escalation authority would also matter.

An exercise or an actual disruption could then provide evidence about whether the arrangements work. If people cannot reach the authorized decision maker, rewriting the procedure may be insufficient: the allocation of authority or availability of responsible people may need to change. This illustration shows the relationship between direction, management, components and feedback; it makes no claim of an achieved result or assessment level.

Benefits and limitations

COBIT's potential contribution is a more coherent way to relate goals, decisions, responsibilities, operating practices and evidence. A shared reference can make inconsistent expectations visible and help participants explain why an improvement matters. Following intended value through benefits realization management remains a separate organizational responsibility; selecting a framework does not deliver the benefit.

Common limitations follow from how the framework is applied. Treating every objective as equally urgent can disperse effort. Emphasizing documents over behavior can conceal weak execution. Pursuing ratings without a clear business purpose can consume resources without addressing the material problem. Combining terminology from different editions can make a seemingly precise assessment ambiguous.

COBIT can organize attention to control and compliance concerns, but a framework-based description is not proof that a particular requirement has been met. The applicable obligation, actual practices and supporting evidence still need to be examined. Its usefulness therefore depends on contextual judgment and effective organizational action as well as accurate understanding of the framework.

Relationship to other frameworks

COBIT can be used alongside more specialized guidance. For example, ISACA's discussion of COBIT 2019 and ITIL 4 distinguishes enterprise information-and-technology governance from ITIL's service-management emphasis and describes their compatibility.[13]

This relationship allows an organization to connect its governance objectives with service-management practices. The organization still needs to reconcile responsibilities, terminology and evidence across the guidance it uses. COBIT itself includes both governance and management; combining frameworks does not assign one entire function to each or establish that the resulting arrangements are effective.

See also

Further reading

  • COBIT Goals Cascade — an applied CIO Index discussion of connecting goals and governance priorities.
  • COBIT resources — the CIO Index collection of articles and reference materials.

References

  1. ↑ 1.0 1.1 1.2 1.3 ISACA (n.d.), COBIT, framework overview and descriptions of the COBIT 2019 core publications. Accessed 29 October 2026.
  2. ↑ ISACA (n.d.), ISACA IS/IT Webinars & Webcasts, announcement of A First Look at COBIT 7. Accessed 29 October 2026.
  3. ↑ 3.0 3.1 3.2 Emeka Elue (27 July 2020), Effective Capability and Maturity Assessment Using COBIT 2019, ISACA. Accessed 29 October 2026.
  4. ↑ 4.0 4.1 4.2 4.3 ISACA (n.d.), ISACA Interactive Glossary, entries for COBIT, governance component, governance enabler, governance framework, governance system and focus area. Accessed 29 October 2026.
  5. ↑ ISACA (20 April 2026), Celebrating Three Decades of COBIT. Accessed 29 October 2026.
  6. ↑ 6.0 6.1 6.2 6.3 6.4 Govind Kulkarni (11 November 2019), Transitioning an Enterprise From COBIT 5 to COBIT 2019, ISACA. Accessed 29 October 2026.
  7. ↑ 7.0 7.1 ISACA (11 December 2018), New COBIT 2019 Resources Help Organizations Design and Implement Tailored Governance Systems for Their Information and Technology. Accessed 29 October 2026.
  8. ↑ 8.0 8.1 Kumaragunta Harisaiprasad (27 April 2020), COBIT 2019 and COBIT 5 Comparison, ISACA, process-model changes. Accessed 29 October 2026.
  9. ↑ Joao Souza Neto, Rafael Almeida, Pedro Linares Pinto and Miguel Mira da Silva (26 January 2018), A COBIT 5 PAM Update Compliant With ISO/IEC 330xx Family, ISACA Journal, volume 1, description of the original PAM. Accessed 29 October 2026.
  10. ↑ Ioannis Routsis (26 May 2021), Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard, ISACA Journal, volume 3. Accessed 29 October 2026.
  11. ↑ 11.0 11.1 11.2 Mark Thomas (10 December 2018), A New COBIT Is in Town and I Really Like How It Looks, ISACA. Accessed 29 October 2026.
  12. ↑ Abdul Rafeq (4 February 2019), COBIT Design Factors: A Dynamic Approach to Tailoring Governance in the Era of Digital Disruption, ISACA. Accessed 29 October 2026.
  13. ↑ ISACA (n.d.), Using ITIL 4 and COBIT 2019 to Create an Integrated I&T Framework Environment, public publication description. Accessed 29 October 2026.
Retrieved from "https://cio-wiki.org//index.php?title=COBIT_(Control_Objectives_for_Information_and_Related_Technology)&oldid=19537"