COBIT, governance of enterprise IT
Link IT to business goals, with clear ownership and measurable results.
Official sources
Use these official places to read the text and find the latest version.
Get the document
The framework is available from ISACA. Some material is free with registration.
Open the official page ↗What COBIT is
COBIT is a framework from ISACA for governing and managing enterprise IT. It ties IT activities to business goals and defines who is responsible for what.
It is often used by boards, auditors and IT leaders to show that technology spending and risk are under control.
How COBIT got to where it is today
The milestones that changed what organisations have to do.
COBIT 1
First released by ISACA as a set of control objectives for the audit community.
COBIT 5
Becomes a full governance and management framework.
COBIT 2019
More flexible, with design factors for tailoring.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
The board asks how IT supports the strategy.
You need to show IT governance to auditors.
IT roles and decisions are unclear.
You manage many frameworks and want one structure.
What it asks of you
The requirements fall into six areas.
Evaluate, direct, monitor
The board sets direction and checks results.
Align, plan, organise
Strategy, architecture and budgets.
Build, acquire, implement
Projects and changes.
Deliver, service, support
Run IT operations well.
Monitor, evaluate, assess
Measure performance and conformance.
Tailoring
Adapt to your size and goals.
The 5 domains and 40 objectives (5 governance, 35 management)
One governance domain and four management domains hold forty objectives. Each objective says what good looks like for one part of running IT.
12 themes · 40 objectives
EDMEvaluate, Direct and Monitor (EDM)Governance objectives: the board and senior leaders set direction and check results.2 themes · 5 objectives
EDM-ADirection and engagementSet the governance model and keep stakeholders involved.2 objectives
- EDM01
Ensured governance framework setting and maintenance: set up and keep a governance system for IT that fits the organisation.
What you do
- Agree who decides what about IT and review it yearly
- EDM05
Ensured stakeholder engagement: make sure stakeholders get clear, timely and reliable reporting on IT.
What you do
- Send leaders and the board a regular IT report
Evidence to keep
- Governance charter
- Decision rights matrix
- Stakeholder communication plan
EDM-BValue, risk and resourcesMake sure IT delivers value, within risk appetite, using resources well.3 objectives
- EDM02
Ensured benefits delivery: make sure IT investments deliver the expected value.
What you do
- Track benefits for each major project after go-live
- EDM03
Ensured risk optimisation: make sure IT risk stays within the agreed appetite.
What you do
- Approve a risk appetite and review top IT risks quarterly
- EDM04
Ensured resource optimisation: make sure people, money and technology meet needs at best cost.
What you do
- Review capacity and skills against plans each year
Evidence to keep
- Benefits tracking
- Risk appetite statement
- Resource plan
APOAlign, Plan and Organise (APO)Management objectives for strategy, structure, suppliers, risk and security.4 themes · 14 objectives
APO-AStrategy and architectureSet IT direction, design and innovation.4 objectives
- APO01
Managed I and T management framework: define the policies, roles and structure for managing IT.
What you do
- Write an IT operating model with named roles
- APO02
Managed strategy: set an IT strategy aligned to business goals.
What you do
- Link IT plans to company objectives and review yearly
- APO03
Managed enterprise architecture: describe how systems and data fit together.
What you do
- Keep current and target architecture diagrams
- APO04
Managed innovation: assess new technology opportunities.
What you do
- Hold a yearly review of new tools that could help the business
Evidence to keep
- IT strategy
- Architecture documents
- Innovation backlog
APO-BPortfolio, money and peoplePlan investment, cost and workforce.3 objectives
- APO05
Managed portfolio: choose and oversee the programmes and services that get funded.
What you do
- Rank initiatives on value and risk
- APO06
Managed budget and costs: plan, track and report IT spend.
What you do
- Track spend against budget monthly
- APO07
Managed human resources: recruit, develop and keep the right IT skills.
What you do
- Keep a skills matrix and training plan
Evidence to keep
- Portfolio list
- Budget and cost reports
- Skills matrix
APO-CRelationships, services and suppliersAgree what IT provides and manage suppliers.3 objectives
- APO08
Managed relationships: keep good communication between IT and the business.
What you do
- Name business relationship owners and meet regularly
- APO09
Managed service agreements: agree and monitor service levels.
What you do
- Document service targets and report against them
- APO10
Managed vendors: select, contract and monitor suppliers.
What you do
- Assess critical suppliers and review performance and risk
Evidence to keep
- Service catalogue
- Service level agreements
- Supplier contracts and reviews
APO-DQuality, risk, security and dataControl quality, risk, security and data.4 objectives
- APO11
Managed quality: set and apply quality standards for IT work.
What you do
- Define acceptance criteria and review defects
- APO12
Managed risk: identify, assess and treat IT risks.
What you do
- Keep an IT risk register with owners
- APO13
Managed security: define and run an information security management system.
What you do
- Adopt a security policy and a plan for improving it
- APO14
Managed data: govern data across its life and keep it fit for use.
What you do
- Assign data owners and set data quality rules
Evidence to keep
- Quality plan
- IT risk register
- Security policy
- Data governance policy
BAIBuild, Acquire and Implement (BAI)Management objectives for delivering change and solutions.3 themes · 11 objectives
BAI-AProgrammes, requirements and buildPlan, specify and build solutions.4 objectives
- BAI01
Managed programmes: run programmes to deliver the planned benefits.
What you do
- Set programme goals, budget and review gates
- BAI02
Managed requirements definition: agree what solutions must do before building.
What you do
- Record and approve requirements with the business
- BAI03
Managed solutions identification and build: choose, design and build solutions.
What you do
- Compare options and test before release
- BAI11
Managed projects: run projects with agreed scope, time and cost.
What you do
- Use a standard project method and track delivery
Evidence to keep
- Programme and project plans
- Requirements documents
- Design and test records
BAI-BChange, people and knowledgeManage change and its impact on people.4 objectives
- BAI05
Managed organisational change: prepare people for change.
What you do
- Plan training and communication for each major change
- BAI06
Managed IT changes: control changes to live systems.
What you do
- Require approval, testing and a rollback plan
- BAI07
Managed IT change acceptance and transitioning: move changes into live safely.
What you do
- Run acceptance tests and a go-live checklist
- BAI08
Managed knowledge: keep and share useful knowledge.
What you do
- Maintain a searchable knowledge base
Evidence to keep
- Change records
- Change communications
- Knowledge base
BAI-CCapacity, assets and configurationKeep services available and know what you run.3 objectives
- BAI04
Managed availability and capacity: meet current and future demand.
What you do
- Monitor usage and plan upgrades
- BAI09
Managed assets: track and control IT assets through their life.
What you do
- Keep an asset register with owners
- BAI10
Managed configuration: know how services and components are configured.
What you do
- Keep configuration records and compare them with the live setup
Evidence to keep
- Capacity reports
- Asset register
- Configuration records
DSSDeliver, Service and Support (DSS)Management objectives for running IT services day to day.2 themes · 6 objectives
DSS-AOperations and supportRun services and fix issues.3 objectives
- DSS01
Managed operations: run IT operations to agreed standards.
What you do
- Use runbooks and scheduled jobs with monitoring
- DSS02
Managed service requests and incidents: handle requests and restore service quickly.
What you do
- Use a ticket system with priorities and targets
- DSS03
Managed problems: find and fix root causes of repeat incidents.
What you do
- Review recurring incidents monthly
Evidence to keep
- Operations runbooks
- Incident and problem tickets
- Request catalogue
DSS-BContinuity, security and business controlsStay running, secure and in control.3 objectives
- DSS04
Managed continuity: plan for and recover from disruption.
What you do
- Test recovery and keep a continuity plan
- DSS05
Managed security services: protect against threats day to day.
What you do
- Run patching, access control and monitoring routines
- DSS06
Managed business process controls: keep automated and manual business controls effective.
What you do
- Review controls such as approvals and reconciliations
Evidence to keep
- Continuity plan
- Security operations records
- Business process control tests
MEAMonitor, Evaluate and Assess (MEA)Management objectives for measuring performance, control and compliance.1 theme · 4 objectives
MEA-APerformance, control, compliance and assuranceMeasure, check and prove that IT is working as intended.4 objectives
- MEA01
Managed performance and conformance monitoring: set and review measures of IT performance.
What you do
- Choose a small set of measures and report them regularly
- MEA02
Managed system of internal control: check controls are designed and working.
What you do
- Test key controls and fix weaknesses
- MEA03
Managed compliance with external requirements: identify and meet laws and contracts.
What you do
- Keep a register of obligations and review it yearly
- MEA04
Managed assurance: plan and carry out independent assurance.
What you do
- Schedule internal or external reviews of key areas
Evidence to keep
- Performance reports
- Internal control reviews
- Compliance register
- Assurance reports
Nothing matches. Clear the search or pick another domain.
Outcomes and implementation examples are from COBIT 2019 Framework: Governance and Management Objectives, ISACA, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Understand your context
Goals, size, risk.
- 2
Pick the objectives that matter
Do not try all.
- 3
Assess maturity
Where you are today.
- 4
Plan improvements
Owners and timelines.
- 5
Measure
And report to the board.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Evaluate, direct, monitor | Governance reviews |
| Align, plan, organise | Roadmaps and ownership |
| Build, acquire, implement | Change records |
| Deliver, service, support | Service and incident records |
| Monitor, evaluate, assess | KPI dashboards |
| Tailoring | Design factor worksheet |
Free COBIT readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Objective selection sheet
- Maturity assessment
- RACI template
- Board report outline
Share or cite this page
Writing about COBIT? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/cobit/">COBIT explained in plain English - Optimus CyberX</a>Common questions
Is COBIT mandatory?
No. COBIT is voluntary. Boards, auditors and IT leaders choose it as a way to show that IT is governed well.
Is it only for large companies?
It scales if you pick relevant objectives.
Can we be certified?
No. Individuals can take ISACA certifications.
How is it different from ISO 27001?
COBIT covers all IT governance, not only security.
Related frameworks
See how ready you are for COBIT
Answer questions across every area. We email you a report showing where you comply and where you do not.