COBIT 2019

Why does it matter?

COBIT 2019 gives a board, an IT leadership team and an audit team one vocabulary for I&T governance: 40 named objectives, from EDM01 Ensured Governance Framework Setting and Maintenance to MEA04 Managed Assurance. It separates governance, which evaluates, directs and monitors, from management, which plans, builds, runs and monitors, and ties both to stakeholder needs.

Key benefits include:

• Governance kept distinct from management

The five EDM objectives are the governance objectives and the 35 objectives in APO, BAI, DSS and MEA are management objectives, so a board and an IT executive can each see what they own.

• Tailoring to the enterprise

Eleven design factors, from enterprise strategy and risk profile to compliance requirements and enterprise size, help an enterprise customize and prioritize its governance components.

• A measurable capability scale

Performance management uses the CMMI Performance Management Scheme with capability and maturity levels from 0 to 5, so progress on a process can be reported as a level.

• Alignment with other standards

The third governance framework principle calls for alignment with major standards, frameworks and regulations, and ISACA publishes guidance on implementing the NIST Cybersecurity Framework using COBIT 2019.

• A route from business goals to objectives

The goals cascade links stakeholder drivers and needs to 13 generic enterprise goals, then to alignment goals and then to objectives, so IT priorities trace back to business priorities.

How does it work?

The COBIT 2019 governance system rests on six principles: provide stakeholder value, a holistic approach, a dynamic governance system, governance distinct from management, tailored to enterprise needs, and an end-to-end governance system. The governance framework that ISACA builds on rests on three principles: a conceptual model that identifies key components and their relationships, openness and flexibility, and alignment with major standards, frameworks and regulations.

ISACA describes seven steps for customizing COBIT 2019: identify stakeholder needs; identify enterprise and alignment goals; identify governance and management objectives; select and customize goals and metrics; select and customize the governance components; prepare customized content and integrate it into enterprise practices; and implement performance and monitoring measures. The Design Guide supports the first steps and the Implementation Guide supports the rollout.

In SmartSuite, teams can hold the 40 objectives as records in Compliance Management, link them to risks in Enterprise Risk Management and Cyber & IT Risk, and schedule assurance work in Internal Audit Management, with Enterprise Reporting dashboards showing status by domain.

Key Elements

• Five domains and 40 objectives

EDM holds EDM01 to EDM05. APO holds APO01 to APO14, BAI holds BAI01 to BAI11, DSS holds DSS01 to DSS06 and MEA holds MEA01 to MEA04. Examples include APO12 Managed Risk, APO13 Managed Security, APO14 Managed Data, DSS05 Managed Security Services and MEA03 Managed Compliance With External Requirements.

• Goals cascade

Stakeholder drivers and needs lead to 13 generic enterprise goals, then to alignment goals that link to the governance and management objectives, so scoping starts from business needs rather than from a control list.

• Design factors

The Design Guide lists 11 factors: enterprise strategy, enterprise goals, risk profile, I&T-related issues, threat landscape, compliance requirements, role of IT, sourcing model for IT, IT implementation methods, technology adoption strategy and enterprise size. When a factor such as strategy or technology changes, the enterprise reassesses its governance system.

• Seven component types

A governance system combines processes; organizational structures; information; people, skills and competencies; principles, policies and procedures; culture, ethics and behavior; and services, infrastructure and applications. The components work together to support the objectives.

• Capability and performance management

COBIT 2019 uses the CMMI Performance Management Scheme with capability and maturity levels from 0 to 5. COBIT 5 used the ISO/IEC 33000 scale, so assessments made under COBIT 5 are not directly comparable.

• Focus areas and publications

Focus areas extend the core model for a topic. ISACA publishes COBIT focus areas for Information Security, Information and Technology Risk and DevOps, a COBIT 2019 edition for small and medium enterprises, and the core Introduction and Methodology and Governance and Management Objectives publications.

What does it cover?

COBIT 2019 covers the governance and management of enterprise I&T, meaning the technology and information an enterprise uses to reach its goals, across the whole enterprise and not only the IT department. Design factors let any size of enterprise tailor it, and ISACA publishes a COBIT 2019 edition for small and medium enterprises. It is a voluntary framework, not a law, and the certificates on ISACA's COBIT page are for individuals: the COBIT Foundation Certificate and the COBIT Design and Implementation Certificate Program.

What are its objectives?

COBIT 2019 sets out to make sure I&T creates value for stakeholders and is governed as part of enterprise governance.

Satisfy stakeholder needs and generate value from I&T by balancing benefits, risk and resources.

Keep governance and management as separate sets of activities with separate structures.

Cover the enterprise end to end, including the technology and information used to reach its goals.

Combine several component types so they work together in a holistic way.

Revisit the governance system when strategy, technology or another design factor changes.

Tailor the system to the enterprise using the design factors.

Framework in Context

COBIT 2019 is an evolution of COBIT 5, which ISACA released in 2012 and which had five principles; COBIT 2019 has six governance system principles and adds design factors. ISACA publishes guidance on implementing the NIST Cybersecurity Framework using COBIT 2019 and a COBIT-based edition of IT Control Objectives for Sarbanes-Oxley, and ISACA has announced COBIT 7 as the next version of the framework.

Common Framework Mappings

Organizations map COBIT 2019 objectives to the frameworks they already use, since ISACA built the framework to align with major standards, frameworks and regulations.

Mapped frameworks include:

COBIT 5

COSO ERM 2017

ISO/IEC 20000-1

ISO 27001:2022

ISO 27002:2022

ISO/IEC 38500

ITIL 4

NIST CSF 2.0