COBIT.

What COBIT actually governs

COBIT is ISACA's framework for the governance and management of enterprise IT. Its core distinction, and the one practitioners trip over most, is the line it draws between governance and management. Governance is about the board and executive level setting direction, evaluating options, and monitoring outcomes. Management is about planning, building, running, and monitoring the activities that deliver against that direction. COBIT keeps these as separate domains so that the people who decide what IT should achieve are not the same people who report on whether it was achieved.

That separation is why auditors reach for COBIT when an information security standard is not enough. ISO 27001 tells you how to run an information security management system. NIST gives you a catalogue of controls and outcomes. COBIT sits above both: it answers whether IT as a whole is steered toward the enterprise's objectives, whether risk and resources are handled responsibly, and whether stakeholders get value. It is broader than security and deliberately less prescriptive than a control list.

The COBIT 2019 structure

The current edition is COBIT 2019. It organises work into objectives grouped under governance and management domains, and pairs each with the components needed to make it work: processes, organisational structures, policies, information flows, culture, skills, and services. The point is that a process on paper means nothing if the structures, skills, and culture around it are missing, so COBIT forces you to look at all of them together.

Two ideas make COBIT 2019 usable in practice rather than just a poster on a wall:

• Design factors. Enterprise strategy, risk profile, compliance requirements, role of IT, and sourcing model all shape which objectives deserve attention. COBIT does not assume every organisation needs the same governance system, so you tailor the framework to context instead of adopting it wholesale.
• Capability and maturity. Each governance and management objective can be rated on a capability scale, and the framework also supports a maturity view across focus areas. This is how the Big Four and internal audit teams produce a defensible "where are we, where should we be" picture instead of a subjective opinion.

Where COBIT fits next to other frameworks

Practitioners almost always run COBIT alongside other frameworks rather than instead of them. A common pattern: COBIT defines the governance objectives and the maturity baseline, ISO 27001 operationalises information security, ITIL handles service management, and a risk framework feeds the risk picture. COBIT becomes the umbrella that shows how these pieces serve enterprise goals and where the gaps are.

COBIT is also the body of knowledge behind ISACA's CGEIT credential, which targets professionals responsible for enterprise IT governance. If your role is to assure or design how IT is steered at board level, COBIT is the reference framework and CGEIT is the matching certification.