{"id":79578,"date":"2026-10-28T07:44:39","date_gmt":"2026-10-28T07:44:39","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=79578"},"modified":"2026-10-28T07:44:40","modified_gmt":"2026-10-28T07:44:40","slug":"cobit-explained-how-to-govern-enterprise-technology-assess-capability-and-connect-it-decisions-to-business-value","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/cobit-explained-how-to-govern-enterprise-technology-assess-capability-and-connect-it-decisions-to-business-value\/","title":{"rendered":"COBIT Explained: How to Govern Enterprise Technology, Assess Capability, and Connect IT Decisions to Business Value"},"content":{"rendered":"\n

Imagine a company that invests heavily in cloud services yet cannot answer three basic questions: Who decides which systems deserve funding? Who accepts the risks of critical suppliers? And how does leadership know whether technology investments are delivering the promised benefits?<\/p>\n\n\n\n

These are not primarily help-desk problems. They are governance problems<\/strong>. COBIT provides a structured way to connect enterprise objectives with the decisions, controls, processes, information, people, and technologies needed to achieve them.<\/p>\n\n\n\n

1. What COBIT does\u2014and what it does not do<\/h2>\n\n\n\n

COBIT is maintained by ISACA and is a framework for the governance and management of enterprise information and technology (I&T)<\/strong>. Its currently established core model is associated with COBIT 2019<\/strong>, the edition name used in ISACA publications. It is not limited to the IT department: business leadership, procurement, security, finance, compliance, and service owners all participate in technology governance.<\/p>\n\n\n\n

COBIT helps an organization balance three outcomes: realize benefits, optimize risk, and optimize resources<\/strong>. It does not replace every specialized discipline. ITIL offers detailed service-management guidance; ISO standards may establish auditable management-system requirements; COBIT helps leaders connect all of these to enterprise direction.<\/p>\n\n\n\n

2. Governance versus management<\/h2>\n\n\n\n

The distinction is fundamental:<\/p>\n\n\n\n

Governance<\/th>Management<\/th><\/tr><\/thead>
Evaluates stakeholder needs, options, and risk<\/td>Plans and executes activities consistent with direction<\/td><\/tr>
Sets direction and tolerances<\/td>Designs controls, operates services, and manages staff<\/td><\/tr>
Monitors whether objectives are achieved<\/td>Reports performance and improves execution<\/td><\/tr>
Typically accountable to a governing body<\/td>Typically accountable to executives and operational leaders<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

For example, a board or delegated governing body may direct that critical customer data must remain recoverable within approved limits. Technology management selects architectures, tests recovery, operates backup systems, and reports whether the desired outcome is achievable.<\/p>\n\n\n\n

A governance committee should not become a second help desk. Its job is to make consequential decisions and oversee their results.<\/p>\n\n\n\n

3. Understand the five COBIT domains<\/h2>\n\n\n\n

The COBIT core model contains 40 governance and management objectives<\/strong> organized into five domains.<\/p>\n\n\n\n

Domain<\/th>Full name<\/th>Practical question<\/th>Example objective<\/th><\/tr><\/thead>
EDM<\/td>Evaluate, Direct and Monitor<\/td>Are we making and overseeing the right decisions?<\/td>EDM03: Ensured Risk Optimization<\/td><\/tr>
APO<\/td>Align, Plan and Organize<\/td>Are strategy, architecture, suppliers, and risks organized appropriately?<\/td>APO12: Managed Risk<\/td><\/tr>
BAI<\/td>Build, Acquire and Implement<\/td>Are changes, projects, and solutions introduced under control?<\/td>BAI06: Managed IT Changes<\/td><\/tr>
DSS<\/td>Deliver, Service and Support<\/td>Are services, incidents, security, and continuity handled effectively?<\/td>DSS02: Managed Service Requests and Incidents<\/td><\/tr>
MEA<\/td>Monitor, Evaluate and Assess<\/td>Do we have evidence of performance, controls, and conformance?<\/td>MEA03: Managed Compliance With External Requirements<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

EDM focuses on governance. APO, BAI, DSS, and MEA focus on management. Each objective is supported by more than a process: organizational structures, policies, information, skills, culture, and technology also matter.<\/p>\n\n\n\n

4. The seven governance-system components<\/h2>\n\n\n\n

An organization can own the correct policy and still fail because staff lack skills or the reporting data is unreliable. COBIT addresses this problem through an interconnected set of governance-system components:<\/p>\n\n\n\n

    \n
  1. Processes.<\/li>\n\n\n\n
  2. Organizational structures.<\/li>\n\n\n\n
  3. Principles, policies, and frameworks.<\/li>\n\n\n\n
  4. Information.<\/li>\n\n\n\n
  5. Culture, ethics, and behavior.<\/li>\n\n\n\n
  6. People, skills, and competencies.<\/li>\n\n\n\n
  7. Services, infrastructure, and applications.<\/li>\n<\/ol>\n\n\n\n

    Example:<\/strong> For cloud-cost governance, a finance-approved budget is only one component. Effective execution also needs tagged cloud resources, accountable service owners, usage reports, engineers able to optimize workloads, and a management review that can act on overspending.<\/p>\n\n\n\n

    5. Start with enterprise goals, not a checklist of all 40 objectives<\/h2>\n\n\n\n

    COBIT uses goal cascading<\/strong> and design factors<\/strong> to tailor governance to the enterprise. The starting point should be a business goal, such as reducing payment failures while expanding into new markets.<\/p>\n\n\n\n

    A practical cascade is:<\/p>\n\n\n

    Business goal: reliable digital revenue\n       |\nEnterprise risks and stakeholder expectations\n       |\nTechnology alignment goals\n       |\nRelevant governance and management objectives\n       |\nPolicies, practices, owners, evidence and metrics\n       |\nReview of business outcomes\n<\/code><\/span><\/pre>\n\n\n
    Design factors include enterprise strategy, goals, risk profile, regulatory demands, threat conditions, technology strategy, sourcing arrangements, enterprise size, and other context. A small company that relies on managed cloud services will require different controls from a bank operating legacy systems in several jurisdictions.<\/p>\n\n\n\n
    Decision rule:<\/strong> Select objectives because they affect an important enterprise outcome, not merely because they exist in COBIT.<\/p>\n\n\n\n
    6. Worked example: govern a cloud migration<\/h2>\n\n\n\n
    Situation:<\/strong> A subscription business wants to migrate its order-processing platform to managed infrastructure without interrupting customers or losing control of costs.<\/p>\n\n\n\n
    Step 1 \u2014 Define the desired outcome.<\/strong> Leadership agrees that business continuity, acceptable operating cost, and secure customer data are higher priorities than migration speed alone.<\/p>\n\n\n\n
    Step 2 \u2014 Identify relevant objectives.<\/strong> Consider EDM03 for risk optimization, APO10 for supplier management, APO12 for risk, BAI06 for change, DSS02 for incident handling, DSS04 for continuity, and MEA03 for compliance. This is a tailored selection, not the full COBIT model.<\/p>\n\n\n\n
    Step 3 \u2014 Assign accountability.<\/strong> A steering group owns investment and risk decisions; a platform lead owns technical execution; a security lead assesses relevant controls; a service owner accepts readiness for operational handover.<\/p>\n\n\n\n
    Step 4 \u2014 Define evidence.<\/strong> Require a supplier due-diligence record, migration design, cost model, security assessment, recovery-test results, deployment change record, and post-migration scorecard.<\/p>\n\n\n\n
    Step 5 \u2014 Set stop\/go criteria.<\/strong> Migration should not proceed if recovery cannot be demonstrated, required data-handling conditions are unmet, or financial exposure exceeds the agreed tolerance without approval.<\/p>\n\n\n\n
    Step 6 \u2014 Monitor and correct.<\/strong> After migration, compare actual monthly spending, service availability, incident trends, and recovery readiness against agreed objectives.<\/p>\n\n\n\n
    A useful oversight record looks like this:<\/p>\n\n\n\n
    Decision<\/th>Accountable role<\/th>Required evidence<\/th>Escalation trigger<\/th><\/tr><\/thead>
    Approve migration wave<\/td>Executive sponsor<\/td>Readiness and risk review<\/td>Critical control not demonstrated<\/td><\/tr>
    Select provider<\/td>Procurement and service owner<\/td>Supplier evaluation<\/td>Contract or residency gap<\/td><\/tr>
    Approve production cutover<\/td>Change authority<\/td>Test and rollback records<\/td>Recovery objective not met<\/td><\/tr>
    Accept residual risk<\/td>Authorized risk owner<\/td>Risk register and treatment options<\/td>Exposure above tolerance<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    7. Capability levels and performance assessment<\/h2>\n\n\n\n
    COBIT’s performance-management approach supports assessments of processes and governance performance. The familiar 0\u20135 process capability scale<\/strong> is associated with its published methodology:<\/p>\n\n\n\n
    Level<\/th>General interpretation<\/th><\/tr><\/thead>
    0<\/td>Incomplete: the process is absent or does not achieve its intended purpose<\/td><\/tr>
    1<\/td>Performed: its purpose is achieved<\/td><\/tr>
    2<\/td>Managed: work is planned and controlled, with managed outputs<\/td><\/tr>
    3<\/td>Established: a defined process is used consistently<\/td><\/tr>
    4<\/td>Predictable: performance is measured and controlled within understood limits<\/td><\/tr>
    5<\/td>Optimizing: performance is systematically improved<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    These summaries explain the progression; actual assessment must follow the relevant official criteria, activities, evidence, and scoring rules. A process capability level is not automatically the maturity of the entire enterprise.<\/strong> Moreover, a level 5 target is not necessary for every process. The right target depends on criticality, cost, and risk.<\/p>\n\n\n\n
    Example capability gap review<\/h3>\n\n\n\n
    Selected process<\/th>Illustrative current level<\/th>Target level<\/th>Gap-closing action<\/th><\/tr><\/thead>
    DSS02 \u2014 service requests and incidents<\/td>2<\/td>3<\/td>Standardize escalation and ownership<\/td><\/tr>
    BAI06 \u2014 IT changes<\/td>1<\/td>3<\/td>Introduce repeatable risk-based change controls<\/td><\/tr>
    DSS04 \u2014 continuity<\/td>1<\/td>3<\/td>Define recovery objectives and test them<\/td><\/tr>
    APO12 \u2014 risk<\/td>2<\/td>3<\/td>Link technical risks to enterprise decision owners<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    These are hypothetical internal assessments, not certified COBIT ratings.<\/p>\n\n\n\n
    8. Design a governance dashboard<\/h2>\n\n\n\n
    A dashboard must answer what decision a metric supports<\/strong>. An executive committee generally does not need every operational graph.<\/p>\n\n\n\n
    Outcome<\/th>Leading indicator<\/th>Lagging indicator<\/th><\/tr><\/thead>
    Reliable customer service<\/td>Recovery tests completed successfully<\/td>Customer-impacting outage minutes<\/td><\/tr>
    Controlled cloud costs<\/td>Percentage of resources assigned to owners<\/td>Actual-versus-approved spend<\/td><\/tr>
    Secure service delivery<\/td>Critical risks treated by due date<\/td>Security or compliance incidents<\/td><\/tr>
    Controlled changes<\/td>High-risk changes with approved plans<\/td>Change-related disruptions<\/td><\/tr>
    Accountable suppliers<\/td>Material suppliers reviewed<\/td>Supplier-linked service failures<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    An effective dashboard names the owner, data source, refresh frequency, target, current result, decision threshold, and latest action. Reducing a risk score without verifying exposure should not count as success.<\/p>\n\n\n\n
    9. Hands-on governance workshop<\/h2>\n\n\n\n
    Scenario:<\/strong> Your company uses three cloud providers, has no central asset inventory, and has recently suffered a supplier-related outage.<\/p>\n\n\n\n
    Task A:<\/strong> Write one business objective and two measurable outcomes. For example: maintain a customer-facing service within agreed availability and restore a critical dependency within the approved recovery period.<\/p>\n\n\n\n
    Task B:<\/strong> Choose four relevant COBIT objectives across at least three domains. Explain why each supports the outcome.<\/p>\n\n\n\n
    Task C:<\/strong> Draw a simple accountability map: who evaluates the supplier risk, who directs treatment, who performs controls, and who independently reviews results?<\/p>\n\n\n\n
    Task D:<\/strong> For one objective, collect three evidence items and identify two gaps. Assign one improvement owner and deadline.<\/p>\n\n\n\n
    Task E:<\/strong> Present a one-page board summary with the top three decisions required, not just the top three technical problems.<\/p>\n\n\n\n
    Expected result:<\/strong> A tailored governance plan covering objectives, owners, evidence, metrics, and decisions\u2014not a generic 40-objective checklist.<\/p>\n\n\n\n
    10. Common implementation failures<\/h2>\n\n\n\n