---
name: cobit-2019
description: Use when asked to apply COBIT 2019, the ISACA framework for enterprise IT governance and management, for risk management, regulatory compliance, cybersecurity, and corporate governance. Distinct from [[itil-5]] and [[iso-iec-20000]] (service management) and [[risk-register]] (a single risk tool).
---

# COBIT 2019

COBIT 2019 is ISACA's comprehensive framework for enterprise governance and management of information and technology. It suits enterprises that focus heavily on risk management, regulatory compliance, cybersecurity, and overall corporate governance. It updates the earlier COBIT 5; if a contract, auditor, or older material refers to COBIT 5, confirm which version is required.

## Input required

- The enterprise, its stakeholders, and its governance structure.
- The official COBIT 2019 material available to the user.
- Key drivers: regulation, risk appetite, audit findings, cybersecurity concerns.
- Current IT processes and controls.

## Questions to ask first

1. Which COBIT version is required or in use?
2. Which enterprise goals and stakeholder needs drive the work?
3. Which regulations or audits apply?
4. Which governance and management objectives are in scope?
5. Who owns governance decisions, and who owns management?

## Method

1. **Separate governance from management.** Governance sets direction and checks results; management plans, builds, runs, and monitors. Assign each to the right body.
2. **Start from enterprise goals.** Translate stakeholder needs into enterprise goals and alignment goals, using the official goals cascade.
3. **Tailor the governance system.** Use the official design factors, such as risk profile, compliance requirements, threat landscape, and IT sourcing model, to decide which objectives and focus areas matter most.
4. **Select objectives.** Pick the governance and management objectives in scope and name an owner for each.
5. **Assess performance.** Assess current capability and set targets using the performance management method in the official material.
6. **Address risk and compliance.** Tie objectives to the [[risk-register]] and to legal and regulatory duties.
7. **Plan improvements.** Prioritize gaps by risk and value, assign actions, and define reporting to the governing body.

## Output format

- Goals cascade table: stakeholder need, enterprise goal, alignment goal, objective.
- Design factor summary and tailoring decisions.
- Objective scope and ownership table.
- Capability gap list, roadmap, and reporting plan.

## Ground rules

- Do not quote objective lists, capability levels, principles, or design factor details beyond what the user supplied or official ISACA text confirms.
- Do not invent compliance claims.
- COBIT is a framework, not a certifiable standard for organizations.

## Self-check before answering

- Is the COBIT version stated as 2019?
- Are governance and management responsibilities separated?
- Is each objective traced to an enterprise goal and an owner?

## Common pitfalls

- **Adopting every objective** instead of tailoring with the design factors.
- **Mixing COBIT 5 and COBIT 2019 terms.**
- **Treating it as a checklist** rather than a governance system tailored to the enterprise.
- **No board-level ownership.**

## Example prompt

"Use COBIT 2019 to map our regulatory and cybersecurity goals to governance and management objectives, and propose a capability improvement roadmap."

## Learn more

- Related: [[itil-5]], [[iso-iec-20000]], [[verism]], [[risk-register]].
- Official source: [ISACA](https://www.isaca.org/).