04 COBIT 2019

COBIT 2019 is a framework for the governance and management of enterprise information and technology.

Where frameworks such as:

NIST CSF

focus on cybersecurity outcomes, and:

CIS Controls

focus on practical cybersecurity safeguards, COBIT takes a broader enterprise view.

It helps organizations answer questions such as:

Are Technology Investments
Supporting Business Goals?

Who Is Accountable
for Technology Decisions?

Are Risks Being Managed?

Are Controls Effective?

Are Technology Services
Delivering Value?

Are We Meeting
Regulatory Requirements?

How Do We Measure
Technology Performance?

How Does Leadership
Govern Information
and Technology?

COBIT connects:

Enterprise Strategy
      ↓
Stakeholder Needs
      ↓
Governance
      ↓
Information & Technology
      ↓
Management Objectives
      ↓
Controls
      ↓
Performance
      ↓
Business Value

Learning Objectives

By the end of this lesson, you will be able to:

Explain the purpose of COBIT 2019.
distinguish governance from management.
understand the COBIT governance system.
understand governance and management objectives.
understand the EDM domain.
understand the APO domain.
understand the BAI domain.
understand the DSS domain.
understand the MEA domain.
understand COBIT principles.
understand governance components.
understand design factors.
understand focus areas.
understand goals cascade.
understand enterprise goals.
understand alignment goals.
understand capability levels.
understand performance management.
understand risk and compliance integration.
understand assurance.
map COBIT to enterprise controls.
build a COBIT-based governance model.
design COBIT dashboards.
understand how COBIT integrates with NIST, ISO, ITIL, and other frameworks.

1. What Is COBIT?

COBIT is a framework designed to help enterprises govern and manage information and technology.

At a high level:

Stakeholder Needs
      ↓
Enterprise Objectives
      ↓
Governance
      ↓
Management
      ↓
Technology
      ↓
Business Outcomes

COBIT is broader than cybersecurity.

It considers areas such as:

IT Strategy

Risk

Compliance

Security

Architecture

Projects

Operations

Service Delivery

Data

Vendors

Performance

Assurance

2. Why COBIT Exists

Technology has become fundamental to most organizations.

Businesses depend on:

Cloud Services

Applications

Data

Networks

Automation

AI

Cybersecurity

Third Parties

Digital Services

Without strong governance:

Technology Investment
      ↓
Disconnected Decisions
      ↓
Uncontrolled Risk
      ↓
Poor Performance
      ↓
Limited Business Value

COBIT helps create:

Alignment

Accountability

Risk Governance

Performance

Control

Assurance

3. Governance vs Management

One of the most important COBIT concepts is the difference between:

Governance

and:

Management

4. Governance

Governance is primarily concerned with:

Evaluate

Direct

Monitor

Leadership evaluates stakeholder needs, directs priorities, and monitors outcomes.

Conceptually:

Stakeholder Needs
      ↓
Evaluate
      ↓
Direct
      ↓
Monitor

5. Management

Management focuses on:

Plan

Build

Run

Monitor

Management executes the direction established by governance.

6. Simple Difference

Governance asks:

Are We Doing
the Right Things?

Management asks:

Are We Doing
Things Right?

Both are required.

7. COBIT Governance and Management Domains

COBIT organizes objectives into five domains:

EDM

APO

BAI

DSS

MEA

8. Domain Overview

EDM
Evaluate, Direct
and Monitor

APO
Align, Plan
and Organize

BAI
Build, Acquire
and Implement

DSS
Deliver, Service
and Support

MEA
Monitor, Evaluate
and Assess

9. Governance Domain — EDM

EDM represents governance activities.

It focuses on:

Evaluate

Direct

Monitor

Examples include:

Governance Framework

Benefits Delivery

Risk Optimization

Resource Optimization

Stakeholder Engagement

10. EDM — Evaluate

Leadership evaluates:

Stakeholder Expectations

Strategic Priorities

Risk

Value

Resources

Performance

11. EDM — Direct

Leadership sets:

Policies

Priorities

Accountability

Risk Direction

Investment Direction

12. EDM — Monitor

Leadership monitors:

Performance

Risk

Compliance

Benefits

Resource Use

13. EDM Example

Executive leadership wants to move critical customer systems to cloud.

Governance evaluates:

Business Benefits

Cyber Risk

Cost

Regulatory Impact

Resilience

Then directs:

Cloud Strategy

Risk Requirements

Funding

Accountability

And monitors:

Migration Progress

Cloud Risk

Cost

Service Availability

Compliance

14. Management Domain — APO

APO stands for:

Align, Plan
and Organize

This domain focuses on setting up the management structures required to execute enterprise direction.

Areas may include:

Strategy

Architecture

Innovation

Portfolio

Budget

Human Resources

Relationships

Service Agreements

Vendors

Risk

Security

Data

15. APO and Strategy

Technology strategy should align with business strategy.

Conceptually:

Business Strategy
      ↓
Technology Strategy
      ↓
Initiatives
      ↓
Projects

16. Strategy Misalignment

Weak:

Business Wants
Cloud Agility

while:

IT Strategy
Only Supports
On-Premises Systems

COBIT encourages alignment.

17. Enterprise Architecture

Architecture connects:

Business

Applications

Data

Technology

A strong architecture approach improves:

Consistency

Integration

Security

Resilience

Cost Management

18. Portfolio Management

Organizations must prioritize investments.

Example portfolio:

Cloud Migration

Zero Trust

ERP Upgrade

AI Program

Security Modernization

Governance should determine:

Priority

Value

Risk

Cost

Dependencies

19. Budget and Cost Management

Technology resources should be allocated based on:

Business Value

Risk

Strategy

Operational Need

20. Human Resources

Technology governance also depends on:

Skills

Roles

Responsibilities

Capacity

Training

21. Relationship Management

IT must maintain effective relationships with:

Business Teams

Customers

Partners

Suppliers

Executives

22. Service Agreements

Technology services should have defined expectations such as:

Availability

Performance

Support

Recovery

Security

23. Vendor Management

External providers should be governed across:

Selection

Contracting

Performance

Security

Risk

Exit

24. Risk Management

COBIT connects technology risk with enterprise risk.

Technology Event
      ↓
Business Impact
      ↓
Enterprise Risk

25. Security Management

Security should align with:

Business Objectives

Risk Appetite

Legal Requirements

Technology Strategy

26. Data Management

Data is treated as a critical enterprise resource.

Governance should consider:

Ownership

Quality

Classification

Privacy

Security

Lifecycle

27. Management Domain — BAI

BAI stands for:

Build, Acquire
and Implement

This domain covers changes and solutions.

Typical areas include:

Programs

Projects

Requirements

Solution Development

Availability

Capacity

Change

Knowledge

Assets

Configuration

28. Program Management

Large initiatives may include:

Cloud Transformation

Cybersecurity Program

ERP Modernization

Data Platform

AI Transformation

Programs need:

Governance

Funding

Risk

Benefits

Ownership

29. Project Management

Projects should manage:

Scope

Schedule

Budget

Quality

Risk

Resources

30. Requirements Management

Technology solutions should reflect:

Business Requirements

Security Requirements

Privacy Requirements

Compliance Requirements

Operational Requirements

31. Build vs Buy

Organizations may choose:

Build Internally

Buy Product

Use SaaS

Outsource

Governance should evaluate:

Cost

Risk

Capability

Dependency

Security

Strategic Fit

32. Change Management

Changes should follow:

Request
      ↓
Assess
      ↓
Approve
      ↓
Test
      ↓
Implement
      ↓
Validate

33. Poor Change Management

Uncontrolled changes can create:

Outage

Security Vulnerability

Compliance Failure

Data Loss

34. Configuration Management

Organizations should maintain accurate information about:

Systems

Applications

Assets

Dependencies

Configurations

35. Knowledge Management

Critical operational knowledge should not exist only:

Inside
One Person's Head

Maintain:

Documentation

Runbooks

Architecture

Procedures

Lessons Learned

36. Management Domain — DSS

DSS stands for:

Deliver, Service
and Support

It focuses on operating technology services.

Areas may include:

Operations

Service Requests

Incidents

Problems

Continuity

Security Services

Business Process Controls

37. IT Operations

Operations teams manage:

Infrastructure

Applications

Jobs

Monitoring

Backups

Cloud Services

38. Service Requests

Examples:

Password Reset

Software Request

Access Request

Device Request

should follow defined workflows.

39. Incident Management

An incident is:

Unplanned Disruption
or Degradation
of Service

Examples:

Application Outage

Authentication Failure

Network Issue

Cloud Service Failure

40. Incident Lifecycle

Detect
      ↓
Log
      ↓
Classify
      ↓
Prioritize
      ↓
Resolve
      ↓
Close

41. Problem Management

Problem management focuses on:

Underlying
Root Cause

Example:

Repeated Database
Outages
      ↓
Root Cause
      ↓
Storage Capacity
Issue

42. Continuity

Technology services need resilience.

Consider:

RTO

RPO

Backups

Failover

Recovery

Testing

43. Security Services

Operational security may include:

SOC

IAM

Vulnerability Management

Endpoint Security

Cloud Security

Incident Response

44. Business Process Controls

Technology often supports financial and operational controls.

Examples:

Payment Approval

Segregation of Duties

Automated Reconciliation

Transaction Validation

45. Management Domain — MEA

MEA stands for:

Monitor, Evaluate
and Assess

It focuses on evaluating performance, control effectiveness, and compliance.

Areas include:

Performance Monitoring

Internal Control

Compliance

Assurance

46. Performance Monitoring

Organizations should monitor:

Service Performance

Project Performance

Risk

Control Health

Investment Benefits

47. Internal Control Monitoring

Evaluate whether controls are:

Designed Properly

Implemented

Operating Effectively

48. Compliance Monitoring

Assess compliance with:

Laws

Regulations

Contracts

Policies

Standards

49. Assurance

Assurance may be provided by:

Internal Audit

External Audit

Independent Assessors

Compliance Reviews

50. COBIT Goals Cascade

The Goals Cascade helps connect stakeholder needs to specific governance and management objectives.

Conceptually:

Stakeholder Drivers
      ↓
Stakeholder Needs
      ↓
Enterprise Goals
      ↓
Alignment Goals
      ↓
Governance &
Management Objectives

51. Enterprise Goals

Enterprise goals may include:

Business Value

Risk Optimization

Regulatory Compliance

Customer Service

Operational Continuity

Innovation

52. Alignment Goals

Alignment goals connect technology with enterprise goals.

Examples:

Technology Risk
Managed

IT Services
Reliable

Security
Adequate

Technology Costs
Optimized

53. Goals Cascade Example

Enterprise goal:

Maintain Customer
Trust

Alignment goal:

Information Security
and Privacy

Management objectives:

Manage Security

Manage Risk

Manage Data

Manage Services

54. Governance System Principles

A strong governance system should:

Provide Stakeholder Value

Take a Holistic Approach

Adapt to Enterprise Needs

Separate Governance
from Management

55. Holistic Approach

Governance is more than:

Policies

It includes:

Processes

Structures

Information

People

Culture

Technology

56. Governance Components

COBIT describes components that support the governance system.

Examples include:

Processes

Organizational Structures

Policies and Procedures

Information

Culture and Behavior

People and Skills

Services and Infrastructure

57. Processes

Processes define:

Activities

Inputs

Outputs

Responsibilities

58. Organizational Structures

Examples:

Board

Risk Committee

Architecture Board

Security Committee

Change Advisory Board

59. Policies and Procedures

Provide:

Direction

Consistency

Control

Expectations

60. Information

Good governance depends on:

Accurate

Relevant

Complete

Timely

information.

61. Culture and Behavior

Technology governance can fail even with strong processes if organizational culture encourages:

Bypassing Controls

Ignoring Risk

Poor Accountability

62. People and Skills

Governance requires appropriate:

Competence

Experience

Capacity

Training

63. Services and Infrastructure

Governance also depends on the technology that supports operations.

64. Design Factors

COBIT recognizes that organizations should not implement identical governance models.

Design factors help customize the governance system.

65. Examples of Design Factors

Consider:

Enterprise Strategy

Enterprise Goals

Risk Profile

Technology Issues

Threat Landscape

Compliance Requirements

Role of IT

Sourcing Model

Implementation Methods

Technology Adoption

66. Enterprise Strategy

Strategy may emphasize:

Growth

Innovation

Cost Leadership

Customer Service

Stability

Governance should reflect those priorities.

67. Risk Profile

Organizations with high:

Cyber Risk

Privacy Risk

Operational Risk

Third-Party Risk

may need stronger governance around those areas.

68. Threat Landscape

A defense or financial organization may face more sophisticated threats than a small local business.

Governance should adapt accordingly.

69. Compliance Requirements

Organizations operating across regulated sectors may require stronger:

Control

Audit

Documentation

Assurance

70. Role of IT

In some organizations:

IT Supports
the Business

In others:

Technology
IS the Business

This significantly changes governance requirements.

71. Sourcing Model

Consider:

Internal IT

Cloud

SaaS

Outsourcing

Managed Services

More outsourcing increases governance needs around suppliers.

72. Focus Areas

COBIT can support specific focus areas.

Examples might include:

Cybersecurity

Digital Transformation

Cloud

Privacy

DevOps

Risk

73. COBIT Performance Management

Organizations need to understand how well governance and management objectives are performing.

This includes:

Capability

Performance

Outcomes

Metrics

74. Capability Levels

Capability can be considered progressively.

Conceptually:

Incomplete
      ↓
Performed
      ↓
Managed
      ↓
Defined
      ↓
Quantitatively Managed
      ↓
Optimizing

Organizations should use their approved COBIT performance approach when making formal assessments.

75. Capability Is Not Just Documentation

A process may be well documented but still:

Fail Operationally

Assessment should consider actual performance.

76. Example — Change Management

Level of capability might improve from:

Ad Hoc Changes

to:

Defined Process

then:

Measured Change
Performance

and eventually:

Continuous Improvement

77. COBIT Metrics

Potential metrics include:

IT Service Availability

Project Success

Security Incidents

Risk Appetite Breaches

Change Failure Rate

Vendor Performance

Audit Findings

Control Effectiveness

78. KPI Example

Successful Changes
─────────────── × 100
Total Changes

79. KRI Example

Critical Technology
Risks Above Appetite

80. KCI Example

Privileged Access
Reviews Completed

81. COBIT and Enterprise Risk

COBIT should connect technology risk to business impact.

Example:

Cloud Outage
      ↓
Customer Platform
Unavailable
      ↓
Revenue Loss
      ↓
Customer Impact

82. Technology Risk Register

A risk record may include:

Risk

Business Objective

Technology Dependency

Owner

Controls

Residual Risk

Treatment

83. Risk Optimization

Governance does not attempt to eliminate all risk.

It seeks:

Risk
Aligned with
Enterprise Appetite

84. Example

Business wants rapid digital innovation.

A zero-risk approach might:

Stop All
New Technology

which may damage business strategy.

Instead:

Innovation
      +
Managed Risk

is the goal.

85. COBIT and Compliance

COBIT helps establish:

Compliance Ownership

Monitoring

Control Framework

Assurance

Reporting

86. Compliance Operating Model

Requirements
      ↓
Controls
      ↓
Owners
      ↓
Monitoring
      ↓
Assessment
      ↓
Reporting

87. COBIT and Internal Audit

Internal Audit may use COBIT when evaluating:

IT Governance

Risk Management

IT Operations

Change Management

Security

Service Delivery

88. Three Lines Perspective

A simplified model:

1st Line
Technology Operations

2nd Line
Risk / Compliance

3rd Line
Internal Audit

89. First Line

Owns and operates:

Technology

Processes

Controls

Risk

90. Second Line

Provides:

Oversight

Risk Framework

Compliance Guidance

Monitoring

91. Third Line

Provides:

Independent Assurance

92. COBIT and Security Governance

Security governance should connect:

Business Objectives
      ↓
Cyber Risk
      ↓
Security Strategy
      ↓
Controls
      ↓
Metrics
      ↓
Executive Oversight

93. Example Security Governance

Leadership defines:

Risk Appetite

Security translates this into:

Security Requirements

Technology implements:

Controls

GRC monitors:

Risk & Compliance

Audit provides:

Independent Assurance

94. COBIT and Cloud Governance

Cloud governance can use COBIT to structure:

Cloud Strategy

Architecture

Risk

Security

Cost

Vendors

Operations

Performance

95. Cloud Example

Enterprise objective:

Improve
Time to Market

Technology strategy:

Cloud Adoption

Risks:

Cloud Misconfiguration

Cost Overrun

Vendor Lock-In

Data Exposure

Governance must balance:

Value

Risk

Resources

96. COBIT and Third-Party Governance

Outsourcing does not remove governance accountability.

Organizations should manage:

Supplier Selection

Contract

Security

Performance

Risk

Exit

97. Vendor Dashboard

Potential metrics:

Critical Vendors

SLA Breaches

High-Risk Findings

Security Incidents

Contracts Near Expiry

98. COBIT and NIST CSF

Simplified:

COBIT
      ↓
Enterprise Governance
of Information
and Technology

NIST CSF
      ↓
Cybersecurity
Risk Outcomes

They can complement each other.

99. Example Integration

COBIT:

Manage Security

may align with NIST CSF areas such as:

Govern

Protect

Detect

Respond

Recover

100. COBIT and NIST RMF

COBIT provides broader technology governance.

RMF provides a detailed security and privacy risk lifecycle for systems.

Conceptually:

COBIT
Enterprise Technology Governance
      ↓
RMF
System Risk Management

101. COBIT and CIS Controls

COBIT provides governance and management structure.

CIS provides practical cybersecurity safeguards.

COBIT
      ↓
Security Governance
      ↓
CIS Controls
      ↓
Operational Safeguards

102. COBIT and ISO 27001

COBIT:

Enterprise
Technology Governance

ISO 27001:

Information Security
Management System

Both can exist within the same enterprise governance architecture.

103. COBIT and ITIL

COBIT focuses heavily on:

Governance

Control

Objectives

Accountability

ITIL focuses heavily on:

IT Service
Management Practices

They can complement each other.

104. Example

COBIT may establish:

Manage Service
Requests and Incidents

while ITIL provides detailed service-management practices.

105. COBIT Assessment

A practical assessment may follow:

Define Scope
      ↓
Understand Enterprise Goals
      ↓
Identify Objectives
      ↓
Assess Current Capability
      ↓
Identify Gaps
      ↓
Assess Risk
      ↓
Create Improvement Plan

106. Step 1 — Define Scope

Examples:

Enterprise IT

Cybersecurity

Cloud Governance

IT Risk

IT Operations

Digital Transformation

107. Step 2 — Identify Stakeholder Needs

Ask:

What Does
the Business
Expect from IT?

Examples:

Reliability

Innovation

Security

Compliance

Cost Efficiency

108. Step 3 — Identify Enterprise Goals

Example:

Customer Trust

Revenue Growth

Operational Resilience

Regulatory Compliance

109. Step 4 — Identify Alignment Goals

Translate enterprise goals into technology expectations.

Example:

Operational Resilience
      ↓
Reliable Technology
Services

110. Step 5 — Identify COBIT Objectives

Determine which governance and management objectives are most relevant.

111. Step 6 — Assess Current Capability

Use a consistent assessment model.

Possible status:

Weak

Developing

Established

Managed

Optimized

for internal training purposes.

112. Step 7 — Collect Evidence

Examples:

Policies

Process Documentation

Committee Minutes

Metrics

Risk Registers

Tickets

Audit Reports

Dashboards

113. Step 8 — Identify Gaps

Example:

Objective:
Manage Risk

Current:
Technology risks tracked
independently by teams

Target:
Enterprise technology
risk register

Gap:
No centralized
risk governance

114. Step 9 — Assess Business Impact

Ask:

What Happens
If the Gap
Remains?

115. Step 10 — Build Improvement Roadmap

Document:

Gap

Risk

Action

Owner

Priority

Due Date

Metric

116. Example Improvement Register

Gap	Risk	Action	Priority
IT risks fragmented	Poor executive visibility	Centralize risk register	High
Changes inconsistently approved	Outage/security risk	Standardize change process	High
Vendor metrics missing	Third-party risk	Build vendor dashboard	Medium
IT strategy outdated	Business misalignment	Refresh strategy	High

117. COBIT Governance Dashboard

An executive dashboard could include:

Technology Value

Technology Risk

Service Performance

Project Performance

Compliance

Control Health

Vendor Risk

118. Example Dashboard

ENTERPRISE I&T GOVERNANCE

Critical Technology Risks        5

Risk Appetite Breaches           3

Critical Services Meeting SLA   96%

Major Projects On Track         82%

Critical Audit Findings          4

High-Risk Vendors                7

119. Benefits Reporting

Governance should answer:

Did the Investment
Deliver the Expected
Business Value?

Example:

Cloud migration target:

Deployment Time
5 Days → 1 Hour

Actual:

5 Days → 3 Hours

Benefits are significant but below target.

120. Resource Optimization

Organizations should understand whether:

People

Technology

Budget

Data

are being used effectively.

121. Example Resource Risk

Only One Engineer
Understands
Critical Platform

This creates:

Key Person Risk

122. Common Mistake — Treat COBIT as an IT Checklist

COBIT is primarily about:

Governance

Management

Alignment

Value

Risk

not simply technical control completion.

123. Common Mistake — IT Owns Governance

Governance ultimately involves:

Executive Leadership

Board

Business Management

not only the IT department.

124. Common Mistake — Confuse Governance and Management

Executives should not necessarily perform operational IT management.

Management should not independently define enterprise governance direction.

125. Common Mistake — Too Many Objectives at Once

Prioritize based on:

Enterprise Goals

Risk

Design Factors

Business Need

126. Common Mistake — No Business Alignment

Avoid:

IT Strategy
Disconnected
from Business Strategy

127. Common Mistake — Measure Activity Instead of Value

Weak:

100 Projects
Completed

Better:

Projects Delivered
Expected Business
Benefits

128. Common Mistake — Risk Reporting Without Business Impact

Avoid:

15 IT Risks

Explain:

Which Business
Objectives Are
Threatened?

129. Common Mistake — Outsource Responsibility

Vendor Manages It

does not mean:

Enterprise Has
No Accountability

130. Common Mistake — Ignore Culture

A perfect process can fail if employees routinely bypass it.

131. Common Mistake — Audit Owns Controls

Audit should generally provide independent assurance rather than operate management controls.

132. Common Mistake — Capability Score Becomes the Objective

Higher capability should support:

Better Outcomes

Lower Risk

Higher Value

not simply better scores.

133. End-to-End Example — Cloud Transformation

Business goal:

Accelerate
Digital Services

EDM

Governance evaluates:

Value

Risk

Investment

Strategic Fit

and directs cloud adoption.

APO

Management establishes:

Cloud Strategy

Architecture

Security

Risk

Vendor Model

BAI

Teams:

Build Landing Zone

Migrate Applications

Implement Controls

DSS

Operations manage:

Cloud Services

Incidents

Security

Availability

MEA

Management evaluates:

Performance

Risk

Compliance

Benefits

134. End-to-End Example — Cybersecurity Governance

Enterprise risk:

Ransomware

Governance:

Risk Appetite

Security Strategy

Investment

Management:

EDR

MFA

Backups

SOC

Incident Response

Monitoring:

KRIs

KCIs

Incidents

Recovery Tests

Assurance:

Internal Audit

135. End-to-End Example — IT Service Outage

Business objective:

Maintain
Customer Availability

Technology event:

Database Failure

DSS:

Incident Response

BAI:

Permanent Architecture Fix

MEA:

Review Availability Metrics

EDM:

Monitor Risk
and Resilience

136. End-to-End Example — Vendor Risk

Critical provider:

Cloud Provider

APO:

Vendor Governance

Risk Requirements

Contract

DSS:

Monitor Service
Performance

MEA:

Assess Compliance
and Risk

EDM:

Monitor Strategic
Dependency

137. Enterprise COBIT Operating Model

Board / Executives
      ↓
EDM
Governance
      ↓
Enterprise Goals
      ↓
Alignment Goals
      ↓
APO
Planning
      ↓
BAI
Change
      ↓
DSS
Operations
      ↓
MEA
Monitoring
      ↓
Governance Reporting

138. COBIT Implementation Roadmap

A practical roadmap may follow:

Phase 1
Understand Business Context

Phase 2
Identify Stakeholder Needs

Phase 3
Define Enterprise Goals

Phase 4
Assess Design Factors

Phase 5
Prioritize COBIT Objectives

Phase 6
Assess Current Capability

Phase 7
Identify Gaps

Phase 8
Build Improvement Plan

Phase 9
Implement Governance

Phase 10
Monitor & Improve

139. Phase 1 — Business Context

Understand:

Strategy

Business Model

Technology Dependence

Regulation

Risk

140. Phase 2 — Stakeholder Needs

Identify expectations of:

Board

Executives

Customers

Regulators

Employees

Partners

141. Phase 3 — Enterprise Goals

Define measurable business goals.

142. Phase 4 — Design Factors

Assess:

Risk Profile

Threat Landscape

Compliance

Sourcing

Technology Strategy

143. Phase 5 — Prioritize Objectives

Select the most relevant COBIT governance and management objectives.

144. Phase 6 — Assess Capability

Determine current performance.

145. Phase 7 — Identify Gaps

Compare:

Current
      vs
Target

146. Phase 8 — Improvement Plan

Assign:

Action

Owner

Budget

Due Date

Metric

147. Phase 9 — Implement

Update:

Structures

Processes

Policies

Technology

Metrics

148. Phase 10 — Monitor

Use:

Performance

Risk

Audit

Compliance

Benefits

to drive continuous improvement.

COBIT Governance Assessment Checklist

Governance — EDM

stakeholder needs understood.
governance responsibilities assigned.
benefits monitored.
enterprise technology risk monitored.
resources optimized.
stakeholder reporting established.

Align, Plan & Organize — APO

IT strategy aligned with business.
enterprise architecture maintained.
portfolio governance established.
budgets governed.
skills and capacity managed.
vendor management established.
risk management established.
security governance established.
data governance established.

Build, Acquire & Implement — BAI

programs governed.
projects managed.
requirements documented.
solution risk assessed.
changes controlled.
configuration maintained.
knowledge documented.
benefits tracked.

Deliver, Service & Support — DSS

operations monitored.
service requests managed.
incidents managed.
root causes managed.
continuity maintained.
security services operated.
operational controls monitored.

Monitor, Evaluate & Assess — MEA

performance monitored.
internal controls assessed.
compliance evaluated.
assurance activities established.
findings tracked.
management actions monitored.

COBIT Deliverables

After completing this lesson, you should be able to create:

01 COBIT Governance Scope

02 Stakeholder Needs Register

03 Enterprise Goals Map

04 Alignment Goals Map

05 COBIT Objective Mapping

06 Design Factor Assessment

07 IT Governance RACI

08 Technology Risk Register

09 Technology Strategy Assessment

10 Enterprise Architecture Governance Model

11 IT Portfolio Register

12 Vendor Governance Register

13 Change Governance Assessment

14 IT Service Governance Assessment

15 IT Control Framework

16 Technology Performance Dashboard

17 COBIT Capability Assessment

18 COBIT Gap Register

19 COBIT Improvement Roadmap

20 Executive I&T Governance Dashboard

Practical Activity — Build a Goals Cascade

Scenario:

Business Goal:
Improve Customer
Digital Experience

Identify:

Stakeholder Need

Enterprise Goal

Alignment Goal

Relevant COBIT Objectives

Then explain how technology governance supports the business goal.

Practical Activity — Assess Technology Risk Governance

Your organization has:

AWS

Azure

Microsoft 365

Customer SaaS

Critical Vendors

Technology risks are currently stored in separate spreadsheets.

Assess:

Current State

Risk

Governance Gap

Target State

Owner

Priority

Design a centralized technology risk-governance model.

Practical Activity — Assess Change Governance

Current state:

Developers Can
Deploy Directly
to Production

Incidents show:

25% of Production
Outages Follow Changes

Determine:

Governance Concern

Relevant Management Objective

Control Improvements

KPI

KRI

Practical Activity — Build an Executive Governance Dashboard

Include:

Technology Value

Technology Risk

Service Availability

Project Performance

Control Health

Compliance

Vendor Risk

Audit Findings

Then identify:

What Requires
Executive Decision?

COBIT GRC Mindset

When applying COBIT, ask:

What Does
the Business
Need from Technology?

Who Are
the Stakeholders?

What Enterprise
Goals Matter?

How Does
Technology Support
Those Goals?

Who Governs
Technology?

Who Manages
Technology?

Are Governance
and Management
Clearly Separated?

Are Technology
Investments Delivering
Business Value?

Are Technology
Risks Within Appetite?

Are Resources
Used Effectively?

Is Technology
Strategy Aligned
with Business Strategy?

Is Architecture
Governed?

Are Programs
Delivering Benefits?

Are Projects
Controlled?

Are Changes
Managed?

Are Services
Reliable?

Are Incidents
Handled?

Are Root Causes
Addressed?

Can Critical
Services Recover?

Are Security
Services Effective?

Are Vendors
Governed?

Are Controls
Operating?

Are Compliance
Requirements Met?

Is Assurance
Independent?

Are Metrics
Useful?

Are We Measuring
Activity?

Or Are We
Measuring Value?

Are Technology
Decisions Supporting
Enterprise Strategy?

Can Leadership
Trust the Information?

Is Governance
Driving Better
Business Outcomes?

That is the mindset of a GRC professional using COBIT 2019.

Key Takeaways

COBIT 2019 is a framework for governance and management of enterprise information and technology.
COBIT is broader than cybersecurity and includes strategy, architecture, projects, operations, risk, compliance, service delivery, and assurance.
Governance and management are distinct.
Governance evaluates stakeholder needs, directs priorities, and monitors outcomes.
Management plans, builds, operates, and monitors activities to achieve governance direction.
EDM represents governance.
APO focuses on alignment, planning, and organization.
BAI focuses on building, acquiring, implementing, and managing change.
DSS focuses on delivering and supporting technology services.
MEA focuses on monitoring, evaluating, compliance, controls, and assurance.
COBIT’s Goals Cascade connects stakeholder needs to enterprise goals, alignment goals, and governance or management objectives.
Governance should focus on stakeholder value.
Technology strategy should align with business strategy.
COBIT uses a holistic governance system involving processes, structures, information, people, culture, and technology.
Design factors help tailor governance to the organization.
Technology governance should reflect enterprise strategy, risk profile, threat landscape, compliance, sourcing, and technology dependence.
Capability assessment should support business outcomes rather than become a scoring exercise.
Technology risk should be connected to business impact.
Risk optimization means managing risk within enterprise appetite, not eliminating all risk.
Outsourcing does not remove enterprise accountability.
Internal Audit should provide independent assurance rather than own management controls.
COBIT can complement NIST CSF, NIST RMF, CIS Controls, ISO 27001, and ITIL.
Executive reporting should connect technology value, risk, performance, compliance, and management action.
COBIT should be treated as an enterprise governance system rather than an IT checklist.

Knowledge Check

Before continuing, make sure you can answer:

What is COBIT 2019?
What is the primary purpose of COBIT?
What is the difference between governance and management?
What does EDM stand for?
What happens in the EDM domain?
What does APO stand for?
What activities belong to APO?
What does BAI stand for?
What activities belong to BAI?
What does DSS stand for?
What activities belong to DSS?
What does MEA stand for?
What activities belong to MEA?
What is the COBIT Goals Cascade?
What are stakeholder needs?
What are enterprise goals?
What are alignment goals?
What are governance components?
Why is culture important to governance?
What are COBIT design factors?
Why should governance systems be customized?
What is a technology risk profile?
How does sourcing affect governance?
What is capability assessment?
Why should capability scores not become the primary objective?
How does COBIT support enterprise risk management?
What is risk optimization?
How does COBIT support compliance?
How can COBIT support Internal Audit?
What is the difference between first, second, and third lines?
How does COBIT support cybersecurity governance?
How can COBIT support cloud governance?
How does COBIT support third-party governance?
How does COBIT differ from NIST CSF?
How does COBIT complement NIST RMF?
How can CIS Controls complement COBIT?
How can COBIT and ISO 27001 work together?
How can COBIT and ITIL complement one another?
What should a COBIT executive dashboard contain?
What makes a COBIT governance program effective?

What’s Next?

➡️ Next: 05 — ISO 31000 Risk Management

In the next lesson, you will move from governance of enterprise information and technology into a broader enterprise risk-management framework.

You will learn how ISO 31000 structures risk management around:

Leadership & Commitment
      ↓
Integration
      ↓
Design
      ↓
Implementation
      ↓
Evaluation
      ↓
Improvement

and how the risk-management process connects:

Scope & Context
      ↓
Risk Identification
      ↓
Risk Analysis
      ↓
Risk Evaluation
      ↓
Risk Treatment
      ↓
Monitoring & Review
      ↓
Communication & Consultation

The focus will be on understanding how organizations create a consistent enterprise approach for identifying, evaluating, treating, monitoring, and communicating risk across cybersecurity, technology, operational, third-party, privacy, compliance, financial, and strategic domains.

➡️ Next: 05 — ISO 31000 Risk Management