What is COBIT?
COBIT (Control Objectives for Information and Related Technologies) is ISACA's framework for directing and controlling enterprise IT. It answers how an enterprise makes sure its IT supports the business goals, and who decides on that with which responsibility. The current edition is COBIT 2019 (as of October 2026); it describes 40 governance and management objectives and adds focus areas, among them information security, DevOps and cloud.
COBIT is a design framework from which an organisation derives its own governance system. There is no certification for organisations; ISACA offers credentials for individuals.
What is IT governance, and how does COBIT separate it from management?
IT governance is the direction of IT by the governing body: it evaluates strategic options, sets the direction and monitors whether goals are met. Management is delivery: planning, building, running and monitoring. COBIT places the governance objectives in the EDM domain and the management objectives in the other four domains.
The split means this: a body that makes delivery decisions itself ends up overseeing its own decisions. Management without clear direction sets its own priorities, and no one measures them against the business goals.
| Domain | Meaning | Subject |
|---|---|---|
| EDM | Evaluate, Direct and Monitor | governance objectives: the governing body evaluates options, sets direction and monitors achievement |
| APO | Align, Plan and Organise | organisation, strategy and supporting activities for information and technology |
| BAI | Build, Acquire and Implement | definition, acquisition and implementation of solutions and their integration into business processes |
| DSS | Deliver, Service and Support | operation and support of IT services |
| MEA | Monitor, Evaluate and Assess | monitoring of performance and conformance, continual improvement |
Choosing objectives: the goals cascade
COBIT is built to be tailored. You do not implement all 40 objectives. A goals cascade shows which ones your enterprise needs, running from the enterprise goal to the alignment goals, and from there to the governance and management objectives. An ISACA article on business service continuity walks through this sequence step by step.
The cascade supports both directions of a decision. It tells management which enterprise goal a measure protects, and it justifies why you leave another objective for later.
Example: objectives for a recurring outage
Fictional example; the company and situation are invented, the objective names come from COBIT 2019. An online retailer has lost its web shop for several hours twice in a year. It already runs an ISMS under ISO/IECĀ 27001.
| Stage | Selection |
|---|---|
| Enterprise goal | EG06 "Business service continuity and availability" |
| Alignment goals | AG02 "Managed I&T-related risk", AG07 "Security of information, processing infrastructure and applications, and privacy" |
| Candidates | EDM03 "Ensured risk optimization", APO12 "Managed risk", APO13 "Managed security", DSS04 "Managed continuity", DSS05 "Managed security services" |
| Decision | DSS04 and EDM03 first; APO13 relies on the existing ISMS; APO12 and DSS05 in a second step |
| Responsibility | EDM03 with the managing directors, DSS04 with the head of IT, APO13 with the information security officer |
| Report | downtime and status of continuity plans in the management review |
The selection changes the plan: instead of tackling every security-related objective, the retailer concentrates on continuity, because the existing ISMS already carries the security side. Check your own selection by confirming that each chosen objective has an owner, a link to an enterprise goal and a metric in the report to management. If one of the three is missing, add it or drop the objective from the selection.
How COBIT relates to ISO/IECĀ 27001, ITIL and ISO/IECĀ 38500
COBIT sits at a different level from these frameworks:
| Framework | Subject | Relation to COBIT |
|---|---|---|
| ISO/IECĀ 27001 | requirements for an information security management system, certifiable | COBIT structures the direction of enterprise IT as a whole; organisations cannot be certified against it |
| ITIL | IT service management practices | describes the operational level that COBIT directs |
| ISO/IECĀ 38500 | guiding principles for members of governing bodies on the effective, efficient and acceptable use of IT | principles for the governing body; COBIT supplies the detail with named objectives |
If you run COBIT and ISO/IECĀ 27001 side by side, design the ISO/IECĀ 27001 management review as the report the governing body needs in terms of the EDM domain. A second, separate governance report creates double work and two diverging versions. How both fit into a governance, risk and compliance programme is covered in the entry on GRC.
Do DORA or the MaRisk require COBIT?
No. Neither Regulation (EU) 2022/2554 (DORA) nor the German MaRisk as amended by BaFin Circular 06/2026 (BA) of 30 June 2026 mentions COBIT. Section AT 7.2 of the MaRisk governs technical and organisational resources without referring to common standards. An institution chooses the framework for its IT governance itself and must be able to show that it meets the requirements of DORA and the MaRisk with it.