Actions

Difference between revisions of "COBIT (Control Objectives for Information and Related Technology)"

m
m
 
(18 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
COBIT is a framework of the best practices for IT management ([[IT_Governance|IT Governance]]). It is a set of the best practices and procedures that help the organization to achieve strategic objectives through an effective use of available resources and minimization of the IT risks. COBIT interconnects Enterprise governance and [[IT_Governance|IT Governance]]. This connection is realized by linking business and IT goals, defining metrics and maturity models to measure achievement of objectives and defining the responsibilities of owners of business and IT processes.<ref>What is COBIT - Definition  [http://www.cioindex.com/article/articleid/1009/an-introduction-to-cobit-ii CIO Index]</ref>
+
'''COBIT''' is a framework published by [[Information Systems Audit and Control Association (ISACA)|ISACA]] for governing and managing an enterprise's information and technology in support of its [[Business Goals|business goals]] and [[Business Objective|objectives]]. It connects desired outcomes with responsibilities, practices and measures, helping an organization decide what to prioritize, how to direct technology-related work and what evidence to examine when judging performance against the enterprise's stated objectives.<ref name="overview">ISACA (n.d.), [https://www.isaca.org/resources/cobit COBIT], framework overview and descriptions of the COBIT 2019 core publications. Accessed 29 October 2026.</ref>
  
 +
In plain terms, COBIT gives people a common reference for connecting technology decisions to organizational purpose. Its enterprise scope includes information and technology used across business activities, wherever responsibility for them sits. The organization must turn that reference into its own governance arrangements: who has authority, which practices operate, what resources they need and how results are reviewed. Reading or adopting a framework does not establish that those arrangements work.<ref name="overview" />
  
−
The first COBIT version was released by ISACA organization in 1996.The first edition consisted of the framework, the second one was extended to include audit guidelines, an implementation toolset and control objectives. The third edition added management guidelines. The third edition of COBIT has been released by the ITG Institute (IT Governance Institute). Current edition is the fifth (COBIT 5), and the fifth version is available from April 2012. COBIT 5 consolidates and integrates the COBIT 4.1, [[Val_IT_Framework|Val IT]] 2.0 and [[Risk_IT_Framework|Risk IT]] frameworks and also draws significantly from the [[Business_Model_for_Information_Security_(BMIS)|Business Model for Information Security (BMIS)]] and [[IT_Assurance_Framework_(ITAF)|ITAF]].<ref>History of COBIT  [https://managementmania.com/en/cobit-control-objectives-for-information-and-related-technology  Management Mania]</ref>
+
'''Edition scope (29 October 2026):''' ISACA has announced COBIT 7.<ref name="announcement">ISACA (n.d.), [https://www.isaca.org/training-and-events/online-training/webinars ISACA IS/IT Webinars &amp; Webcasts], announcement of ''A First Look at COBIT 7''. Accessed 29 October 2026.</ref> The detailed model explained below is '''COBIT 2019'''; its counts, terminology and assessment concepts are specific to that edition.
  
 +
== Scope and role ==
  
−
'''Framework and Components of COBIT'''<ref> Framework and Components of COBIT [https://en.wikipedia.org/wiki/COBIT Wikipedia]</ref><br />
+
COBIT addresses the relationship between enterprise needs and the governance and management of information and technology. The distinction between the two functions is central:
−
COBIT was initially "Control Objectives for Information and Related Technologies," though before the release of the framework people talked of "CobiT" as "Control Objectives for IT" or "Control Objectives for Information and Related Technology." The framework defines a set of generic processes for the management of IT, with each process defined together with process inputs and outputs, key process-activities, process objectives, performance measures and an elementary maturity model. COBIT also provides a set of recommended best practices for governance and control process of information systems and technology with the essence of aligning IT with business. COBIT 5 consolidates COBIT 4.1, [[Val_IT_Framework|Val IT]] and [[Risk_IT_Framework|Risk IT]] into a single framework acting as an enterprise framework aligned and interoperable with other frameworks and standards.
 
−
The business orientation of COBIT consists of linking business goals to IT goals, providing metrics and maturity models to measure their achievement, and identifying the associated responsibilities of business and IT process owners.
 
−
The process focus of COBIT is illustrated by a process model that subdivides IT into four domains (Plan and Organize; Acquire and Implement; Deliver and Support; and Monitor and Evaluate) and 34 processes inline with the responsibility areas of plan, build, run, and monitor. It is positioned at a high level and has been aligned and harmonized with other, more detailed IT standards and good practices such as [[Committee_of_Sponsoring_Organizations_of_the_Treadway_Commission_(COSO)|COSO]], [[ITIL_(Information_Technology_Infrastructure_Library)|ITIL]], BiSL, ISO 27000, [[Capability_Maturity_Model_Integration_(CMMI)|CMMI]], [[The Open Group Architecture Framework (TOGAF)|TOGAF]] and [[Project_Management_Body_of_Knowledge_(PMBOK)|PMBOK]]. COBIT acts as an integrator of these different guidance materials, summarizing key objectives under one umbrella framework that link the good practice models with governance and business requirements. COBIT 5 further consolidated and integrated the COBIT 4.1, [[Val_IT_Framework|Val IT]] 2.0 and [[Risk_IT_Framework|Risk IT]] frameworks and drew from ISACA's [[IT_Assurance_Framework_(ITAF)|IT Assurance Framework (ITAF)]] and the [[Business_Model_for_Information_Security_(BMIS)|Business Model for Information Security (BMIS)]].
 
−
The framework and its components can, when utilized well, also contribute to ensuring regulatory compliance. It can encourage less wasteful information management, improve retention schedules, increase business agility, and lower costs while better complying with data retention and management regulations.
 
  
 +
* '''Governance''' evaluates stakeholder needs and available options, sets direction, and monitors whether performance follows that direction.
 +
* '''Management''' plans, builds, operates and monitors activities within the direction established through governance.<ref name="assessment">Emeka Elue (27 July 2020), [https://www.isaca.org/resources/news-and-trends/industry-news/2020/effective-capability-and-maturity-assessment-using-cobit-2019 Effective Capability and Maturity Assessment Using COBIT 2019], ISACA. Accessed 29 October 2026.</ref>
  
−
COBIT components include:
+
This connects [[IT Governance|IT governance]] with [[IT Management (Information Technology Management)|IT management]] while keeping their responsibilities distinguishable. For example, deciding an acceptable level of business exposure is a different responsibility from organizing the work needed to remain within it. Monitoring occurs in both functions, but the questions and decision authority differ.
−
*Framework: Organizes IT governance objectives and good practices by IT domains and processes and link them to business requirements.
 
−
*Process descriptions: A reference process model and common language for everyone in an organization. The processes map to responsibility areas of plan, build, run, and monitor.
 
−
*Control objectives: Provides a complete set of high-level requirements to be considered by management for effective control of each IT process.
 
−
*Management guidelines: Helps assign responsibility, agree on objectives, measure performance, and illustrate interrelationship with other processes.
 
−
Maturity models: Assesses maturity and capability per process and helps to address gaps.
 
  
 +
[[Image:COBIT5.1.jpg|thumb|center|450px|alt=COBIT 5 diagram connecting business needs and governance evaluation, direction and monitoring with management planning, building, running and monitoring.|The relationship between governance and management in COBIT 5. Source: ISACA.]]
  
−
'''The Principles of COBIT'''<ref>The Five Principles of COBIT 5 [https://www.bitsighttech.com/blog/cobit-vs-itil BitSight]</ref><br />
+
An [[IT Strategy (Information Technology Strategy)|IT strategy]] establishes choices and priorities for using information technology to support business objectives. COBIT can help organize the governance around those choices. It does not select a strategy for the organization or replace the expertise needed to design technology, run services or assess individual risks.
−
There are five principles that make up COBIT: (see figure below)
 
−
*Meeting stakeholder needs. This is incredibly general, but COBIT points out that meeting the needs of the stakeholder while still meeting the needs of the company is valuable.
 
−
*Covering the enterprise end-to-end. You must have a complete solution—not just pieces here and there. It’s important to take an in-depth look at network devices, endpoint solutions, as well as signature, non-signature, and heuristic base protection (and much more).
 
−
*Applying a single integrated framework. This isn’t to say you need only a single vendor for your framework, but rather that your framework must be organized and well thought-out.
 
−
*Enabling a holistic approach. You must have a plan of action that attacks an IT problem at multiple angles.
 
−
*Separating governance from management. Governance ensures that there is oversight, while management deals with the necessary processes and steps needed.
 
  
 +
Relevant participants can include governing bodies, business and technology executives, process owners, risk specialists and assurance professionals. Responsibilities depend on the organization's arrangements. A framework reference cannot settle a disagreement about who has authority unless that authority is established and accepted in practice.
  
−
[[File:Cobit5.jpg|400px|COBIT5 Principles]]<br />
+
== History and editions ==
−
source: [http://www.isaca.org/COBIT/focus/Pages/cobit-helps-organizations-meet-performance-and-compliance-requirements.aspx ISACA]
 
  
 +
COBIT originated as the abbreviation for ''Control Objectives for Information and Related Technology''.<ref name="glossary">ISACA (n.d.), [https://www.isaca.org/resources/glossary ISACA Interactive Glossary], entries for COBIT, governance component, governance enabler, governance framework, governance system and focus area. Accessed 29 October 2026.</ref> First released in 1996, it developed from an audit and control focus toward broader management and governance guidance. COBIT 5 followed in 2012.<ref name="history">ISACA (20 April 2026), [https://www.isaca.org/resources/news-and-trends/newsletters/atisaca/2026/volume-8/celebrating-three-decades-of-cobit Celebrating Three Decades of COBIT]. Accessed 29 October 2026.</ref>
  
−
'''The COBIT 5 Process Reference Model'''<ref>The COBIT 5 Process Reference Model [https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?ID=193 isaca.org]</ref><br />
+
COBIT 5 brought together earlier COBIT guidance, including COBIT 4.1, with the previously separate [[Val IT Framework|Val IT]] and [[Risk IT Framework|Risk IT]] frameworks.<ref name="transition">Govind Kulkarni (11 November 2019), [https://www.isaca.org/resources/news-and-trends/industry-news/2019/transitioning-an-enterprise-from-cobit-5-to-cobit-2019 Transitioning an Enterprise From COBIT 5 to COBIT 2019], ISACA. Accessed 29 October 2026.</ref> COBIT 2019 was released in November 2018.<ref name="implementation">ISACA (11 December 2018), [https://www.isaca.org/about-us/newsroom/press-releases/2018/new-cobit-2019-resources-help-organizations-design-and-implement-tailored-governance-systems New COBIT 2019 Resources Help Organizations Design and Implement Tailored Governance Systems for Their Information and Technology]. Accessed 29 October 2026.</ref>
−
COBIT 5 is not delivered as a prescriptive model; rather, it advocates the implementation of governance and management processes within enterprises, as per the figure below. The COBIT 5 process reference model defines and describes in detail the governance and management processes normally found within an enterprise relating to IT activities, providing a common reference model understandable to operational IT and business managers. The COBIT 5 model delivers an operational model with a common language for all parts of the business involved in IT activities and provides a framework for measuring and monitoring IT performance, communicating with service providers and integrating best management practices.
 
  
 +
Material labeled COBIT 4.1, COBIT 5 or COBIT 2019 should be read in its edition context. A principle count, process description or assessment term from one edition cannot be assumed to describe another. The COBIT 7 announcement does not change which edition the following model explanation describes.
  
−
[[File:COBIT5.1.jpg|400px|COBIT5 1]]<br />
+
=== COBIT 5 and COBIT 2019 ===
−
source: [https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?ID=193 ISACA]
 
  
 +
The COBIT 5 principles illustration provides historical context for the later model. Its five themes concern stakeholder needs, enterprise-wide coverage, an integrated framework, a holistic approach, and separating governance from management.
  
−
The COBIT 5 process reference model divides the governance and management processes of enterprise IT into two main process domains:
+
[[Image:Cobit5.jpg|thumb|center|600px|alt=The five COBIT 5 principles: meeting stakeholder needs, covering the enterprise end to end, applying a single integrated framework, enabling a holistic approach, and separating governance from management.|The five principles of COBIT 5. Source: ISACA.]]
−
*Governance—Contains five governance processes with “evaluate, direct and monitor practices” defined within each process
 
−
*Management—Four domains, in line with the responsibility areas of plan, build, run and monitor (PBRM), providing the end-to-end coverage of IT. These domains are an evolution of the COBIT 4.1 domain and process structure:
 
−
**Align, Plan and Organise (APO)
 
−
**Build, Acquire and Implement (BAI)
 
−
**Deliver, Service and Support (DSS)
 
−
**Monitor, Evaluate and Assess (MEA)
 
  
−
The COBIT 5 process reference model is the successor of the COBIT 4.1 process model, incorporating the both the Risk IT and Val IT frameworks.
+
The following comparison highlights selected changes; the subsequent sections explain the COBIT 2019 model in more detail.
  
 +
{| class="wikitable"
 +
! Aspect
 +
! COBIT 5
 +
! COBIT 2019
 +
|-
 +
| Core model
 +
| Process reference model containing 37 processes.
 +
| Core model containing 40 governance and management objectives, each with an associated process.<ref name="comparison">Kumaragunta Harisaiprasad (27 April 2020), [https://www.isaca.org/resources/news-and-trends/industry-news/2020/cobit-2019-and-cobit-5-comparison COBIT 2019 and COBIT 5 Comparison], ISACA, process-model changes. Accessed 29 October 2026.</ref><ref name="overview" />
 +
|-
 +
| Principles
 +
| Five principles.
 +
| Six governance-system principles and three governance-framework principles.<ref name="transition" />
 +
|-
 +
| Organizational elements
 +
| Uses the term ''enablers''.
 +
| Uses ''components'' for these elements; the wider organizational concerns remain.<ref name="transition" />
 +
|-
 +
| Design support
 +
| Enterprise-specific application remains necessary.
 +
| Adds explicit design factors to inform the governance-system design.<ref name="transition" />
 +
|}
  
−
'''COBIT - An Analysis'''<ref>COBIT - An Analysis [https://www.gartner.com/doc/1982323/updates-cobit--aim-greater Gartner]</ref><br />
+
The additional identifiers in the 2019 core model include '''APO14 Managed Data''', '''BAI11 Managed Projects''' and '''MEA04 Managed Assurance'''.<ref name="comparison" /> Project management was already present in COBIT 5 alongside program management; COBIT 2019 separates their objectives.<ref name="transition" />
−
A significant refresh of COBIT 4.1, COBIT 5 improves this useful framework by integrating several of ISACA's frameworks, notably Val IT and Risk IT. The changes have made COBIT 5 broader and more complex. The scope of its guidance could overwhelm new users and inhibit its adoption; consequently, the online version of COBIT 5 will need to provide role-specific versions or logical views to make it more user-friendly.
 
  
−
Changes in COBIT 5 likely to have greatest impact on organizations currently using COBIT include:
+
Assessment approaches also differ. The original COBIT 5 Process Assessment Model (PAM) used ISO/IEC 15504.<ref name="pam-history">Joao Souza Neto, Rafael Almeida, Pedro Linares Pinto and Miguel Mira da Silva (26 January 2018), [https://www.isaca.org/resources/isaca-journal/issues/2018/volume-1/a-cobit-5-pam-update-compliant-with-isoiec-330xx-family A COBIT 5 PAM Update Compliant With ISO/IEC 330xx Family], ISACA Journal, volume 1, description of the original PAM. Accessed 29 October 2026.</ref> COBIT 2019 uses an approach to process capability based on [[Capability Maturity Model Integration (CMMI)|CMMI]].<ref name="assessment" /> A numerical rating therefore needs its edition and assessment reference to be interpretable.
−
*A new process capability assessment approach, based on ISO/IEC 15504, which replaces the Capability Maturity Model (CMM)-based modeling.
 
−
*Modifications to the process model, including changed processes and some new processes.
 
−
*Beyond the integration, this update also attempts to address a number of issues, including:
 
−
*Greater relevance to a wider business audience through increased separation of governance from management and clearer connection with board-level concerns.
 
−
*More explicit guidance to levers of change ("enablers") beyond process, such as culture, ethics, behavior, people, skills and competencies.
 
−
*Improved process capability assessments.
 
−
*Linkage between specific IT and enabler goals to broader enterprise-level goals.
 
−
*Greater emphasis on value creation through focusing on benefits realization, risk optimization and resource optimization.
 
  
−
However, ISACA has overlooked or set aside some areas for this update:
+
== The COBIT 2019 model ==
−
*It ignores the blurring boundary between operational technology and information technology, which will have an increasing impact on the management of risk and delivery of value, and will require additional controls.
 
−
*It just about acknowledges, but does not explicitly deal with or provide any useful guidance on, sustainability.
 
−
*It still complements the Information Technology Infrastructure Library (ITIL) without replacing it.
 
  
 +
=== Goals cascade ===
  
−
===See Also===
+
The COBIT 2019 goals cascade connects stakeholder needs with enterprise goals, then alignment goals, and then priorities among governance and management objectives.<ref name="cascade">Ioannis Routsis (26 May 2021), [https://www.isaca.org/resources/isaca-journal/issues/2021/volume-3/lost-in-the-woods-cobit-2019-and-the-it-balanced-scorecard Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard], ISACA Journal, volume 3. Accessed 29 October 2026.</ref> Alignment goals provide the intermediate connection between enterprise ambitions and the contribution expected from information and technology.
−
[[IT_Governance|IT Governance]]<br />
 
−
[[ITIL_(Information_Technology_Infrastructure_Library)|ITIL]]<br />
 
−
[[Val_IT_Framework|Val IT]]<br />
 
−
[[Risk_IT_Framework|Risk IT]]<br />
 
−
[[Business_Model_for_Information_Security_(BMIS)|Business Model for Information Security (BMIS)]]<br />
 
−
[[Committee_of_Sponsoring_Organizations_of_the_Treadway_Commission_(COSO)|COSO]]<br />
 
−
[[Capability_Maturity_Model_Integration_(CMMI)|CMMI]]<br />
 
−
[[IT_Assurance_Framework_(ITAF)|IT Assurance Framework (ITAF)]]<br />
 
−
[[IT_Governance_Framework|IT Governance Framework]]<br />
 
−
[[ICT_Investment_Framework|ICT Investment Framework]]<br />
 
−
[[IT_Investment_Management_Framework_(ITIM)|Information Technology Investment Management (ITIM)]]<br />
 
−
[[The Open Group Architecture Framework (TOGAF)|The Open Group Architecture Framework (TOGAF®)]]
 
  
 +
The cascade makes that connection explicit enough to discuss and challenge. It does not remove judgment: two enterprises with a similar business goal may face different constraints and therefore emphasize different objectives. A mapping shows why an objective deserves attention; evidence from operation is still needed to establish whether the intended contribution occurs.
  
−
===References===
+
=== Objectives and domains ===
−
<references />
+
 
 +
The COBIT 2019 core model contains '''40 governance and management objectives'''.<ref name="overview" /> An objective describes a desired result. A corresponding process and other governance-system components support its achievement. The objectives are grouped into five domains; EDM concerns governance, while the other four concern management.<ref name="model">Mark Thomas (10 December 2018), [https://www.isaca.org/resources/news-and-trends/industry-news/2018/a-new-cobit-is-in-town-and-i-really-like-how-it-looks A New COBIT Is in Town and I Really Like How It Looks], ISACA. Accessed 29 October 2026.</ref>
 +
 
 +
{| class="wikitable"
 +
! COBIT 2019 domain
 +
! Main concern
 +
|-
 +
| Evaluate, Direct and Monitor (EDM)
 +
| Governance direction and oversight.
 +
|-
 +
| Align, Plan and Organize (APO)
 +
| Organizing and planning the management of enterprise information and technology.
 +
|-
 +
| Build, Acquire and Implement (BAI)
 +
| Developing or obtaining capabilities and putting changes into use.
 +
|-
 +
| Deliver, Service and Support (DSS)
 +
| Operating and supporting services.
 +
|-
 +
| Monitor, Evaluate and Assess (MEA)
 +
| Examining performance and conformance.
 +
|}
 +
 
 +
These groupings help locate a concern within the model. They are not a required organization chart: one team may contribute to several objectives, and one objective may depend on several teams. Treating the model only as a process list would also overlook the people, information and organizational arrangements required to make processes work.<ref name="model" />
 +
 
 +
=== Governance-system components ===
 +
 
 +
COBIT 2019 identifies seven component types: '''processes'''; '''organizational structures'''; '''principles, policies and procedures'''; '''information'''; '''culture, ethics and behavior'''; '''people, skills and competencies'''; and '''services, infrastructure and applications'''.<ref name="glossary" /> The earlier term ''enablers'' became ''components''; these wider organizational concerns were not discarded.<ref name="model" />
 +
 
 +
The practical implication is that a process description is only part of the picture. A reporting process, for example, needs reliable information, people who understand it, a recipient with authority to respond and a culture in which problems can be raised. Improving the procedure alone may leave the underlying governance problem unresolved.
 +
 
 +
=== System principles and framework principles ===
 +
 
 +
COBIT 2019 distinguishes '''six principles for a governance system''' from '''three principles for a governance framework'''. The system principles concern stakeholder value, interconnected components, adaptation to change, distinct governance and management, enterprise-specific design, and coverage across the enterprise. The framework principles concern a consistent conceptual foundation, openness to extension, and compatibility with relevant standards, frameworks and regulations.<ref name="glossary" />
 +
 
 +
The distinction is between the arrangements an enterprise operates and the reference structure used to design them. Neither set is a list of security products, departments or technology vendors.
 +
 
 +
== Tailoring COBIT 2019 ==
 +
 
 +
COBIT 2019 uses '''design factors''' to inform the design of a governance system. Its Design Guide identifies eleven, including enterprise strategy, goals, risk conditions, size and sourcing choices. Such context can affect which objectives receive priority, how components are configured and the capability sought for relevant processes. Not every factor must be used in every situation.<ref name="design">Abdul Rafeq (4 February 2019), [https://www.isaca.org/resources/news-and-trends/industry-news/2019/cobit-design-factors COBIT Design Factors: A Dynamic Approach to Tailoring Governance in the Era of Digital Disruption], ISACA. Accessed 29 October 2026.</ref>
 +
 
 +
A '''focus area''' addresses a particular governance topic or issue through a relevant collection of objectives and components.<ref name="glossary" /> It is distinct from both a contextual design factor and one of the five core domains.
 +
 
 +
Tailoring connects the model with choices about [[IT Risk Management|IT risk management]], [[Resource Management|resource management]] and organizational priorities. It should explain why a particular arrangement fits the enterprise. Copying another organization's selected objectives or entering values into a design tool does not, by itself, establish that fit.
 +
 
 +
== Capability and maturity in COBIT 2019 ==
 +
 
 +
COBIT 2019 distinguishes '''process capability''' from '''focus-area maturity'''. Process capability concerns how well a defined process is implemented and performs; the model uses capability levels from zero to five. Maturity is associated with a focus area and the processes it encompasses.<ref name="assessment" /> These statements describe different units of assessment and should not be treated as interchangeable labels for an enterprise's overall quality.
 +
 
 +
An interpretable assessment identifies the process or focus area, the edition and assessment reference, the evidence examined, and the target relevant to the organization. An undocumented impression and a conclusion supported by observed practice are different kinds of evidence. A written policy may establish that an expectation exists; it does not alone demonstrate that people follow it.
 +
 
 +
A capability or maturity result can inform an improvement decision. It does not independently establish business value, effective governance or compliance with a particular obligation. The highest possible score is not automatically the appropriate target: the organization must consider the importance of the activity, the exposure involved and the resources required to improve it.
 +
 
 +
== Application and improvement ==
 +
 
 +
Applying COBIT requires connecting reference guidance to an actual governance concern. ISACA's COBIT 2019 design and implementation publications distinguish designing an appropriate system from implementing and continually improving it.<ref name="implementation" /> In organizational terms, this means understanding the starting situation, choosing priorities, establishing responsibilities, changing practices and examining what happens in operation.
 +
 
 +
That work needs people with authority to make decisions, owners able to carry them out, adequate skills and resources, and usable information. For example, an agreed objective may require a policy change, clearer escalation responsibilities or investment in information quality. The relevant changes depend on the diagnosed problem; adopting every possible document is not a substitute for understanding it.
 +
 
 +
[[Performance Measurement|Performance measurement]] supplies feedback about operation and results. Review can reveal that a practice is not being followed, that the selected measure is misleading, or that the underlying priority has changed. Each finding calls for a different response. Continuing review connects governance-system improvement with changing enterprise needs rather than treating adoption as a completed documentation exercise.
 +
 
 +
=== Hypothetical example: a customer service repeatedly goes offline ===
 +
 
 +
Suppose an organization relies on an online customer service that suffers recurring disruption. Its governing authority must determine how much disruption is acceptable in relation to customer needs, business exposure and available resources. Management must turn that direction into operating responsibilities and appropriate service arrangements.
 +
 
 +
Using the COBIT 2019 model, the organization could examine relevant delivery and support objectives alongside the components needed to support them. A procedure would be one component; staff skills, supplier responsibilities, reliable incident information and escalation authority would also matter.
 +
 
 +
An exercise or an actual disruption could then provide evidence about whether the arrangements work. If people cannot reach the authorized decision maker, rewriting the procedure may be insufficient: the allocation of authority or availability of responsible people may need to change. This illustration shows the relationship between direction, management, components and feedback; it makes no claim of an achieved result or assessment level.
 +
 
 +
== Benefits and limitations ==
 +
 
 +
COBIT's potential contribution is a more coherent way to relate goals, decisions, responsibilities, operating practices and evidence. A shared reference can make inconsistent expectations visible and help participants explain why an improvement matters. Following intended value through [[Benefits realization management|benefits realization management]] remains a separate organizational responsibility; selecting a framework does not deliver the benefit.
 +
 
 +
Common limitations follow from how the framework is applied. Treating every objective as equally urgent can disperse effort. Emphasizing documents over behavior can conceal weak execution. Pursuing ratings without a clear business purpose can consume resources without addressing the material problem. Combining terminology from different editions can make a seemingly precise assessment ambiguous.
 +
 
 +
COBIT can organize attention to control and compliance concerns, but a framework-based description is not proof that a particular requirement has been met. The applicable obligation, actual practices and supporting evidence still need to be examined. Its usefulness therefore depends on contextual judgment and effective organizational action as well as accurate understanding of the framework.
 +
 
 +
== Relationship to other frameworks ==
 +
 
 +
COBIT can be used alongside more specialized guidance. For example, ISACA's discussion of COBIT 2019 and [[ITIL (Information Technology Infrastructure Library)|ITIL]] 4 distinguishes enterprise information-and-technology governance from ITIL's service-management emphasis and describes their compatibility.<ref name="itil-relationship">ISACA (n.d.), [https://www.isaca.org/resources/white-papers/using-itil-4-and-cobit-2019-to-create-an-integrated-i-and-t-framework-environment Using ITIL 4 and COBIT 2019 to Create an Integrated I&amp;T Framework Environment], public publication description. Accessed 29 October 2026.</ref>
 +
 
 +
This relationship allows an organization to connect its governance objectives with service-management practices. The organization still needs to reconcile responsibilities, terminology and evidence across the guidance it uses. COBIT itself includes both governance and management; combining frameworks does not assign one entire function to each or establish that the resulting arrangements are effective.
 +
 
 +
== See also ==
 +
 
 +
* [[Corporate Governance|Corporate governance]] — the wider governance arrangements of a company.
 +
* [[IT Governance Framework|IT governance framework]] — the broader category of reference structures for IT governance.
 +
* [[Enterprise Architecture|Enterprise architecture]] — a related discipline concerned with enterprise structures and their relationships.
 +
 
 +
== Further reading ==
 +
 
 +
* [https://cioindex.com/magazine/cobit-goals-cascade/ COBIT Goals Cascade] — an applied CIO Index discussion of connecting goals and governance priorities.
 +
* [https://cioindex.com/references/cobit/ COBIT resources] — the CIO Index collection of articles and reference materials.
  
 +
== References ==
  
−
===Further Reading===
+
<references />
−
*COBIT and its Utilization: A framework from the literature  [http://www.acc.ncku.edu.tw/chinese/faculty/shulc/courses/cas/articles/COBIT.pdf Gail Ridley,Judy Young, Peter Carroll]
 
−
*COBIT 5 for Risk: Making Sense of IT Risk Management [https://www.isaca.org/COBIT/focus/Pages/cobit-5-for-risk-making-sense-of-it-risk-management.aspx Syed Salman, CISA]
 
−
*How COBIT 5 Can Help Reduce the Likelihood and Impact of the Top 5 Cyberthreats [https://www.isaca.org/COBIT/focus/Pages/how-cobit-5-can-help-reduce-the-likelihood-and-impact-of-the-top-5-cyberthreats.aspx Sue Milton, CISA, CGEIT]
 
−
*COBIT Framework as a Guideline of Effective IT Governance in Higher Education: A Review [http://airccse.org/journal/ijitcs/papers/3113ijitcs02.pdf Rasha Adnan Khther and Dr. Marini Othman and Dr. Marini Othman]
 

Latest revision as of 22:48, 29 October 2026

COBIT is a framework published by ISACA for governing and managing an enterprise's information and technology in support of its business goals and objectives. It connects desired outcomes with responsibilities, practices and measures, helping an organization decide what to prioritize, how to direct technology-related work and what evidence to examine when judging performance against the enterprise's stated objectives.[1]

In plain terms, COBIT gives people a common reference for connecting technology decisions to organizational purpose. Its enterprise scope includes information and technology used across business activities, wherever responsibility for them sits. The organization must turn that reference into its own governance arrangements: who has authority, which practices operate, what resources they need and how results are reviewed. Reading or adopting a framework does not establish that those arrangements work.[1]

Edition scope (29 October 2026): ISACA has announced COBIT 7.[2] The detailed model explained below is COBIT 2019; its counts, terminology and assessment concepts are specific to that edition.

Scope and role

COBIT addresses the relationship between enterprise needs and the governance and management of information and technology. The distinction between the two functions is central:

  • Governance evaluates stakeholder needs and available options, sets direction, and monitors whether performance follows that direction.
  • Management plans, builds, operates and monitors activities within the direction established through governance.[3]

This connects IT governance with IT management while keeping their responsibilities distinguishable. For example, deciding an acceptable level of business exposure is a different responsibility from organizing the work needed to remain within it. Monitoring occurs in both functions, but the questions and decision authority differ.

COBIT 5 diagram connecting business needs and governance evaluation, direction and monitoring with management planning, building, running and monitoring.
The relationship between governance and management in COBIT 5. Source: ISACA.

An IT strategy establishes choices and priorities for using information technology to support business objectives. COBIT can help organize the governance around those choices. It does not select a strategy for the organization or replace the expertise needed to design technology, run services or assess individual risks.

Relevant participants can include governing bodies, business and technology executives, process owners, risk specialists and assurance professionals. Responsibilities depend on the organization's arrangements. A framework reference cannot settle a disagreement about who has authority unless that authority is established and accepted in practice.

History and editions

COBIT originated as the abbreviation for Control Objectives for Information and Related Technology.[4] First released in 1996, it developed from an audit and control focus toward broader management and governance guidance. COBIT 5 followed in 2012.[5]

COBIT 5 brought together earlier COBIT guidance, including COBIT 4.1, with the previously separate Val IT and Risk IT frameworks.[6] COBIT 2019 was released in November 2018.[7]

Material labeled COBIT 4.1, COBIT 5 or COBIT 2019 should be read in its edition context. A principle count, process description or assessment term from one edition cannot be assumed to describe another. The COBIT 7 announcement does not change which edition the following model explanation describes.

COBIT 5 and COBIT 2019

The COBIT 5 principles illustration provides historical context for the later model. Its five themes concern stakeholder needs, enterprise-wide coverage, an integrated framework, a holistic approach, and separating governance from management.

The five COBIT 5 principles: meeting stakeholder needs, covering the enterprise end to end, applying a single integrated framework, enabling a holistic approach, and separating governance from management.
The five principles of COBIT 5. Source: ISACA.

The following comparison highlights selected changes; the subsequent sections explain the COBIT 2019 model in more detail.

Aspect COBIT 5 COBIT 2019
Core model Process reference model containing 37 processes. Core model containing 40 governance and management objectives, each with an associated process.[8][1]
Principles Five principles. Six governance-system principles and three governance-framework principles.[6]
Organizational elements Uses the term enablers. Uses components for these elements; the wider organizational concerns remain.[6]
Design support Enterprise-specific application remains necessary. Adds explicit design factors to inform the governance-system design.[6]

The additional identifiers in the 2019 core model include APO14 Managed Data, BAI11 Managed Projects and MEA04 Managed Assurance.[8] Project management was already present in COBIT 5 alongside program management; COBIT 2019 separates their objectives.[6]

Assessment approaches also differ. The original COBIT 5 Process Assessment Model (PAM) used ISO/IEC 15504.[9] COBIT 2019 uses an approach to process capability based on CMMI.[3] A numerical rating therefore needs its edition and assessment reference to be interpretable.

The COBIT 2019 model

Goals cascade

The COBIT 2019 goals cascade connects stakeholder needs with enterprise goals, then alignment goals, and then priorities among governance and management objectives.[10] Alignment goals provide the intermediate connection between enterprise ambitions and the contribution expected from information and technology.

The cascade makes that connection explicit enough to discuss and challenge. It does not remove judgment: two enterprises with a similar business goal may face different constraints and therefore emphasize different objectives. A mapping shows why an objective deserves attention; evidence from operation is still needed to establish whether the intended contribution occurs.

Objectives and domains

The COBIT 2019 core model contains 40 governance and management objectives.[1] An objective describes a desired result. A corresponding process and other governance-system components support its achievement. The objectives are grouped into five domains; EDM concerns governance, while the other four concern management.[11]

COBIT 2019 domain Main concern
Evaluate, Direct and Monitor (EDM) Governance direction and oversight.
Align, Plan and Organize (APO) Organizing and planning the management of enterprise information and technology.
Build, Acquire and Implement (BAI) Developing or obtaining capabilities and putting changes into use.
Deliver, Service and Support (DSS) Operating and supporting services.
Monitor, Evaluate and Assess (MEA) Examining performance and conformance.

These groupings help locate a concern within the model. They are not a required organization chart: one team may contribute to several objectives, and one objective may depend on several teams. Treating the model only as a process list would also overlook the people, information and organizational arrangements required to make processes work.[11]

Governance-system components

COBIT 2019 identifies seven component types: processes; organizational structures; principles, policies and procedures; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications.[4] The earlier term enablers became components; these wider organizational concerns were not discarded.[11]

The practical implication is that a process description is only part of the picture. A reporting process, for example, needs reliable information, people who understand it, a recipient with authority to respond and a culture in which problems can be raised. Improving the procedure alone may leave the underlying governance problem unresolved.

System principles and framework principles

COBIT 2019 distinguishes six principles for a governance system from three principles for a governance framework. The system principles concern stakeholder value, interconnected components, adaptation to change, distinct governance and management, enterprise-specific design, and coverage across the enterprise. The framework principles concern a consistent conceptual foundation, openness to extension, and compatibility with relevant standards, frameworks and regulations.[4]

The distinction is between the arrangements an enterprise operates and the reference structure used to design them. Neither set is a list of security products, departments or technology vendors.

Tailoring COBIT 2019

COBIT 2019 uses design factors to inform the design of a governance system. Its Design Guide identifies eleven, including enterprise strategy, goals, risk conditions, size and sourcing choices. Such context can affect which objectives receive priority, how components are configured and the capability sought for relevant processes. Not every factor must be used in every situation.[12]

A focus area addresses a particular governance topic or issue through a relevant collection of objectives and components.[4] It is distinct from both a contextual design factor and one of the five core domains.

Tailoring connects the model with choices about IT risk management, resource management and organizational priorities. It should explain why a particular arrangement fits the enterprise. Copying another organization's selected objectives or entering values into a design tool does not, by itself, establish that fit.

Capability and maturity in COBIT 2019

COBIT 2019 distinguishes process capability from focus-area maturity. Process capability concerns how well a defined process is implemented and performs; the model uses capability levels from zero to five. Maturity is associated with a focus area and the processes it encompasses.[3] These statements describe different units of assessment and should not be treated as interchangeable labels for an enterprise's overall quality.

An interpretable assessment identifies the process or focus area, the edition and assessment reference, the evidence examined, and the target relevant to the organization. An undocumented impression and a conclusion supported by observed practice are different kinds of evidence. A written policy may establish that an expectation exists; it does not alone demonstrate that people follow it.

A capability or maturity result can inform an improvement decision. It does not independently establish business value, effective governance or compliance with a particular obligation. The highest possible score is not automatically the appropriate target: the organization must consider the importance of the activity, the exposure involved and the resources required to improve it.

Application and improvement

Applying COBIT requires connecting reference guidance to an actual governance concern. ISACA's COBIT 2019 design and implementation publications distinguish designing an appropriate system from implementing and continually improving it.[7] In organizational terms, this means understanding the starting situation, choosing priorities, establishing responsibilities, changing practices and examining what happens in operation.

That work needs people with authority to make decisions, owners able to carry them out, adequate skills and resources, and usable information. For example, an agreed objective may require a policy change, clearer escalation responsibilities or investment in information quality. The relevant changes depend on the diagnosed problem; adopting every possible document is not a substitute for understanding it.

Performance measurement supplies feedback about operation and results. Review can reveal that a practice is not being followed, that the selected measure is misleading, or that the underlying priority has changed. Each finding calls for a different response. Continuing review connects governance-system improvement with changing enterprise needs rather than treating adoption as a completed documentation exercise.

Hypothetical example: a customer service repeatedly goes offline

Suppose an organization relies on an online customer service that suffers recurring disruption. Its governing authority must determine how much disruption is acceptable in relation to customer needs, business exposure and available resources. Management must turn that direction into operating responsibilities and appropriate service arrangements.

Using the COBIT 2019 model, the organization could examine relevant delivery and support objectives alongside the components needed to support them. A procedure would be one component; staff skills, supplier responsibilities, reliable incident information and escalation authority would also matter.

An exercise or an actual disruption could then provide evidence about whether the arrangements work. If people cannot reach the authorized decision maker, rewriting the procedure may be insufficient: the allocation of authority or availability of responsible people may need to change. This illustration shows the relationship between direction, management, components and feedback; it makes no claim of an achieved result or assessment level.

Benefits and limitations

COBIT's potential contribution is a more coherent way to relate goals, decisions, responsibilities, operating practices and evidence. A shared reference can make inconsistent expectations visible and help participants explain why an improvement matters. Following intended value through benefits realization management remains a separate organizational responsibility; selecting a framework does not deliver the benefit.

Common limitations follow from how the framework is applied. Treating every objective as equally urgent can disperse effort. Emphasizing documents over behavior can conceal weak execution. Pursuing ratings without a clear business purpose can consume resources without addressing the material problem. Combining terminology from different editions can make a seemingly precise assessment ambiguous.

COBIT can organize attention to control and compliance concerns, but a framework-based description is not proof that a particular requirement has been met. The applicable obligation, actual practices and supporting evidence still need to be examined. Its usefulness therefore depends on contextual judgment and effective organizational action as well as accurate understanding of the framework.

Relationship to other frameworks

COBIT can be used alongside more specialized guidance. For example, ISACA's discussion of COBIT 2019 and ITIL 4 distinguishes enterprise information-and-technology governance from ITIL's service-management emphasis and describes their compatibility.[13]

This relationship allows an organization to connect its governance objectives with service-management practices. The organization still needs to reconcile responsibilities, terminology and evidence across the guidance it uses. COBIT itself includes both governance and management; combining frameworks does not assign one entire function to each or establish that the resulting arrangements are effective.

See also

Further reading

  • COBIT Goals Cascade — an applied CIO Index discussion of connecting goals and governance priorities.
  • COBIT resources — the CIO Index collection of articles and reference materials.

References

  1. ↑ 1.0 1.1 1.2 1.3 ISACA (n.d.), COBIT, framework overview and descriptions of the COBIT 2019 core publications. Accessed 29 October 2026.
  2. ↑ ISACA (n.d.), ISACA IS/IT Webinars & Webcasts, announcement of A First Look at COBIT 7. Accessed 29 October 2026.
  3. ↑ 3.0 3.1 3.2 Emeka Elue (27 July 2020), Effective Capability and Maturity Assessment Using COBIT 2019, ISACA. Accessed 29 October 2026.
  4. ↑ 4.0 4.1 4.2 4.3 ISACA (n.d.), ISACA Interactive Glossary, entries for COBIT, governance component, governance enabler, governance framework, governance system and focus area. Accessed 29 October 2026.
  5. ↑ ISACA (20 April 2026), Celebrating Three Decades of COBIT. Accessed 29 October 2026.
  6. ↑ 6.0 6.1 6.2 6.3 6.4 Govind Kulkarni (11 November 2019), Transitioning an Enterprise From COBIT 5 to COBIT 2019, ISACA. Accessed 29 October 2026.
  7. ↑ 7.0 7.1 ISACA (11 December 2018), New COBIT 2019 Resources Help Organizations Design and Implement Tailored Governance Systems for Their Information and Technology. Accessed 29 October 2026.
  8. ↑ 8.0 8.1 Kumaragunta Harisaiprasad (27 April 2020), COBIT 2019 and COBIT 5 Comparison, ISACA, process-model changes. Accessed 29 October 2026.
  9. ↑ Joao Souza Neto, Rafael Almeida, Pedro Linares Pinto and Miguel Mira da Silva (26 January 2018), A COBIT 5 PAM Update Compliant With ISO/IEC 330xx Family, ISACA Journal, volume 1, description of the original PAM. Accessed 29 October 2026.
  10. ↑ Ioannis Routsis (26 May 2021), Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard, ISACA Journal, volume 3. Accessed 29 October 2026.
  11. ↑ 11.0 11.1 11.2 Mark Thomas (10 December 2018), A New COBIT Is in Town and I Really Like How It Looks, ISACA. Accessed 29 October 2026.
  12. ↑ Abdul Rafeq (4 February 2019), COBIT Design Factors: A Dynamic Approach to Tailoring Governance in the Era of Digital Disruption, ISACA. Accessed 29 October 2026.
  13. ↑ ISACA (n.d.), Using ITIL 4 and COBIT 2019 to Create an Integrated I&T Framework Environment, public publication description. Accessed 29 October 2026.
Retrieved from "https://cio-wiki.org//index.php?title=COBIT_(Control_Objectives_for_Information_and_Related_Technology)&oldid=19537"