COBIT

What is COBIT?

COBIT (Control Objectives for Information and Related Technologies) is ISACA's framework for governing and managing enterprise information and technology. ISACA publishes it. It is aimed at the whole enterprise, not the IT department alone, and applies to any organisation that wants a structured way to govern its technology. The current version is COBIT 2019, an evolution of COBIT 5.

COBIT 2019 builds on COBIT 5 and on more than 25 years of development in enterprise governance of IT. ISACA defines enterprise information and technology (I&T) broadly: all the technology and information processing the enterprise puts in place to achieve its goals, wherever in the enterprise it happens. That definition is why the COBIT framework is not an IT-department manual. Its subject is who decides, who is accountable and how performance is measured, across the business.

The ISACA COBIT page is the publisher's own home for the framework and its supporting guidance.

Why it matters

The board asks who is accountable for technology risk. The answer is a list of tools and a few names.

COBIT gives that question a structure. Three pressures bring people to it:

• Board-level cyber governance. The UK government has published a mapping of its Cyber Governance Code of Practice to COBIT, written for boards, directors and CISOs. A framework that government maps against is one directors are likely to be asked about.
• Joining up what you already hold. ISACA designs COBIT 2019 to integrate other standards, guidelines, regulations and good practice into one governance solution. It is meant to sit around your existing standards, not replace them.
• Whole-enterprise scope. Technology decisions are made outside IT as well as inside it. COBIT is written for that reality.

People often search "COBIT vs ITIL". The ISACA material we checked does not compare the two, so neither does this entry. What ISACA does say is that COBIT covers the governance and management of enterprise I&T as a whole.

A governance framework nobody owns is a document.

Who it applies to

COBIT applies to any enterprise that wants to govern and manage its information and technology in a structured way: boards and executives who set direction, and the CIOs, CISOs, risk and audit leads who run and assure it. It is not limited to one sector or one size. Design factors and focus areas offer guidance on flexible adoption, so an organisation can apply COBIT 2019 to a specific project or implement it in full.

Obligation. The sources checked for this entry do not make COBIT a legal requirement, and ISACA publishes it as a framework to adopt. If a customer, auditor or internal policy names COBIT, the obligation is contractual or internal, and it comes from whoever named it.

Relationship to ISO 27001. ISO 27001 specifies an information security management system. COBIT works a level above, at the governance and management of all enterprise I&T. An ISO 27001 holder can use COBIT 2019 to place its ISMS inside a wider governance structure.

The UK position

No UK statute or regulator requires COBIT by name in the sources we checked. A UK firm meets it in two ways: through a customer, auditor or board that has chosen it, and through the government's published mapping.

That mapping, from DSIT and DCMS, sets the UK Cyber Governance Code of Practice against COBIT. It shows where the two are similar and where they differ across the Code's five principles: risk management, strategy, people, incident planning, response and recovery, and assurance and oversight. Organisations can use it to see which Code actions they may already meet through COBIT. The government calls it illustrative and a point of reference only, not authoritative and not legal advice on compliance.

Key requirements

COBIT is a framework to adopt and tailor, not a list of mandatory clauses. COBIT 2019 is organised around these elements:

1. The Core Model. The COBIT Core Model and its 40 governance and management objectives are the platform for setting up a governance programme. Each objective names an area of governance or management that the enterprise needs to address.
2. Design factors. These are the features of the enterprise that shape which objectives matter most and how the governance system is tailored to it.
3. Focus areas. These apply COBIT to a particular topic or domain rather than to the whole enterprise at once.
4. Performance management. The performance management system lets you measure maturity, capability or both, so you can track progress in the way that suits the enterprise.
5. Integration with other standards. COBIT 2019 is built to bring other standards, guidelines, regulations and best practices into the same governance solution.

The design factors and focus areas are what make the 40 objectives usable by an organisation of 50 people as well as one of 50,000. You do not adopt all of it at once.

A maturity score nobody acts on measures the paperwork, not the governance.

ISACA's COBIT 2019 Introduction and Methodology publication sets out the framework's principles, updated from COBIT 5, and an expanded definition of governance. The objective definitions, their links to alignment goals and enterprise goals, and the detailed guidance sit in ISACA's licensed publications, which are the source to cite for any control-level work.

Frequently asked questions