COBIT

What is COBIT?

COBIT is a framework for the governance and management of enterprise information and technology (I&T). It is published by ISACA, the professional association behind the CISA and CISM certifications. The name began as “Control Objectives for Information and Related Technology”; today it is simply COBIT. The current version is COBIT 2019.

COBIT is about how an organisation directs and controls technology as a whole, including how decisions are made, who is accountable and how performance is measured. Security is one part of that, not the whole.

How is it structured?

COBIT 2019 separates governance (setting direction and overseeing) from management (planning, building, running and monitoring). Its core model has 40 objectives in five domains:

• EDM, Evaluate, Direct and Monitor: the governance domain, for the board and senior leadership;
• APO, Align, Plan and Organise: strategy, architecture, risk, security, suppliers and people;
• BAI, Build, Acquire and Implement: programmes, requirements, solutions, change and configuration;
• DSS, Deliver, Service and Support: operations, service requests, incidents, problems, continuity and security services;
• MEA, Monitor, Evaluate and Assess: performance, internal control, compliance and assurance.

For each objective COBIT describes the components of a working governance system: processes, organisational structures, policies, information, culture, people and skills, and supporting technology.

How is it tailored?

COBIT 2019 introduced design factors, such as the enterprise’s strategy, risk profile, threat landscape, compliance requirements and the role of IT, to decide which objectives matter most and how mature each should be. Performance is measured with capability levels for processes. The result is a governance system shaped to the organisation rather than a single checklist.

Who uses it?

• IT auditors and internal audit, as a reference model for reviewing IT controls, including IT general controls in financial-reporting audits.
• Chief information officers and governance teams, to organise IT management and report to the board.
• Regulated firms, particularly in financial services, where supervisors expect structured IT governance.

How does it relate to other frameworks?

COBIT works as an umbrella. It points to detailed standards and practices for specific areas rather than repeating them: ISO/IEC 27001 and NIST frameworks for security, ITIL and ISO/IEC 20000-1 for service management, and ISO 31000 for risk. ISACA’s focus-area guides apply COBIT to topics such as information security, I&T risk, DevOps and AI governance.

Common misconceptions

There is no COBIT certification for an organisation. ISACA offers certificates for individuals, and an organisation can assess itself, or be assessed, against COBIT’s capability levels. COBIT is also not just for auditors: it is meant to help an organisation run technology well, with audit as one of its users.