COBIT (Control Objectives for Information and Related Technology) is a globally recognized framework for IT governance and management. Developed by ISACA, it is intended to provide a comprehensive structure that helps organizations develop, implement, monitor, and improve their IT governance strategies. Over the years, COBIT has evolved significantly to adapt to emerging technologies and changing organizational needs. Two major versions—COBIT 5 and COBIT 2019—represent critical stages in that evolution.
At its core, COBIT provides a bridge between business goals and IT processes. It is designed to align IT objectives with strategic business outcomes. It helps stakeholders by delivering a structured approach that ensures information and technology are governed and managed effectively across the enterprise.
The framework includes several key components:
1. Framework Structure This is the foundational structure that organizes governance objectives and good practices across different IT domains. It ensures that all IT-related activities are aligned with enterprise goals and provides an integrated view of the organization’s technology landscape.
2. Process Descriptions COBIT defines specific processes for managing and governing enterprise IT. Each process includes clear guidance on what needs to be done, who should be responsible, and how performance can be measured.
3. Control Objectives These are detailed specifications of desired outcomes for each process. They help organizations identify key activities necessary for achieving goals and minimizing risks.
4. Management Guidelines These guidelines offer tools for assigning responsibility, tracking performance, and identifying inter-process relationships. They aid in decision-making and accountability.
5. Maturity Models Used to assess the current state of IT governance in the organization. These models help determine the capability levels of each process and highlight areas for improvement.
6. Metrics These are used to measure how well processes are performing in relation to predefined goals. Metrics provide feedback for continual improvement.
COBIT’s value lies in its applicability across a wide range of industries and organizational types. It is especially valuable for enterprises that rely heavily on technology and data to conduct business. The framework has become essential not only for IT professionals but also for executives and auditors who are responsible for corporate governance and risk management.
COBIT’s holistic approach means it is not limited to the IT department but spans the entire enterprise. It helps ensure the delivery of value from IT, manages risk, and optimizes resources. As organizations become more reliant on information technology, the need for such frameworks becomes even more essential.
The original COBIT framework was designed primarily for auditors. However, its scope has expanded significantly. With each iteration, COBIT has introduced new principles, components, and methodologies that address modern challenges such as cybersecurity, digital transformation, and regulatory compliance.
COBIT 5, released in 2012, was a major step forward. It integrated various IT governance frameworks into one model and introduced the concept of enablers—factors that influence the effectiveness of governance. COBIT 5 was holistic and flexible, supporting a wide range of business goals and IT-related objectives.
COBIT 2019, released as a successor to COBIT 5, further refined the framework. It introduced updated governance components, a new performance management model, and practical guidance for tailoring governance systems to organizational needs. With this release, COBIT became more adaptable and aligned with global standards such as ISO/IEC and CMMI.
Understanding the evolution from COBIT 5 to COBIT 2019 is key to appreciating how governance needs have shifted. It also highlights how the framework has adapted to new business realities such as digital transformation, agile practices, and increased regulatory scrutiny.
In the following sections, we will explore COBIT 5 and COBIT 2019 in greater detail, compare their structures and principles, and identify the critical differences between them. This will provide a comprehensive understanding of how organizations can leverage COBIT effectively based on their specific needs and maturity levels.
COBIT 5 – Foundation, Structure, and Implementation
COBIT 5, introduced in 2012, was developed as a comprehensive framework for the governance and management of enterprise IT. It represented a significant enhancement over earlier versions of COBIT by providing a unified model that integrates other major frameworks, standards, and practices. COBIT 5 focuses on meeting stakeholder needs, covering the entire enterprise, and enabling a holistic approach to IT governance.
One of the foundational elements of COBIT 5 is its five core principles. These principles define how organizations can achieve effective governance and management of IT resources:
1. Meeting Stakeholder Needs This principle emphasizes the alignment of enterprise goals with IT goals, ensuring that stakeholder needs are translated into actionable and prioritized IT-related goals. It uses the concept of goals cascade to establish this alignment.
2. Covering the Enterprise End-to-End Unlike earlier iterations that focused primarily on the IT function, COBIT 5 extends its scope to cover all technology-related decisions across the enterprise. This approach ensures that all relevant stakeholders are considered and that IT governance integrates with corporate governance.
3. Applying a Single Integrated Framework COBIT 5 is designed to be a comprehensive framework that harmonizes with other industry standards and best practices. It integrates principles from ISO/IEC 38500, ITIL, TOGAF, and others, providing a common language and approach for IT governance.
4. Enabling a Holistic Approach This principle introduces enablers as key elements that influence governance and management outcomes. Enablers in COBIT 5 include processes, organizational structures, culture and behavior, policies, information, services, and people. Each enabler is essential in supporting governance objectives.
5. Separating Governance from Management COBIT 5 clearly distinguishes between governance and management activities. Governance ensures stakeholder needs are evaluated, direction is set, and performance is monitored. Management is responsible for planning, building, running, and monitoring activities to achieve enterprise objectives.
The COBIT 5 framework consists of a set of 37 governance and management processes, grouped into five domains:
COBIT 5 is a comprehensive and globally recognized framework for the governance and management of enterprise IT. COBIT stands for “Control Objectives for Information and Related Technologies,” and it provides a comprehensive set of guidelines that enable businesses to achieve their strategic objectives through effective IT governance and management. It was developed by ISACA (Information Systems Audit and Control Association) to help organizations align their IT practices with business goals, ensure the optimization of resources, and mitigate risks. COBIT 5, as the latest version of the framework, offers a structure of 37 processes divided into five domains: Evaluate, Direct, and Monitor (EDM), Align, Plan, and Organize (APO), Build, Acquire, and Implement (BAI), Deliver, Service, and Support (DSS), and Monitor, Evaluate, and Assess (MEA). Each domain plays a specific role in ensuring that IT is effectively governed and managed to meet organizational objectives.
- Evaluate, Direct, and Monitor (EDM) – Governance Domain
The Evaluate, Direct, and Monitor (EDM) domain focuses on ensuring that IT governance is effectively established, maintained, and aligned with the overall business objectives. This domain is concerned with the highest level of governance and is designed to ensure that all IT-related decisions support the achievement of business goals. It deals with the management of risks, the allocation of resources, and the overall performance of the organization’s IT systems.
The processes within this domain ensure that IT activities are well-defined and aligned with business strategies, legal and regulatory requirements, and stakeholders’ needs. There are five key activities within the EDM domain:
- Evaluate, Direct, and Monitor (EDM01) – This process involves determining whether the overall IT governance structure is capable of meeting the enterprise’s strategic and operational needs.
- Evaluate IT performance (EDM02) – This process ensures that the performance of IT systems is evaluated regularly to determine whether it supports business goals.
- Ensure benefits delivery (EDM03) – This process ensures that IT investments are delivering the expected benefits, both in terms of functionality and business performance.
- Monitor and evaluate IT governance (EDM04) – This process ensures that the governance processes themselves are regularly monitored and evaluated to ensure they remain relevant and effective.
The EDM domain aims to provide strategic direction and governance across the enterprise’s IT landscape, ensuring that IT investments align with overall organizational goals.
- Align, Plan, and Organize (APO) – Management Domain
The Align, Plan, and Organize (APO) domain focuses on the development of IT-related plans, ensuring that IT is aligned with the business’s strategic objectives. This domain is concerned with the planning and organizing of resources and processes to achieve these objectives efficiently and effectively. The main goal of the APO domain is to ensure that IT delivers value by aligning with business needs and optimizing the use of resources.
The processes in this domain support the alignment of IT systems, policies, and strategies with business goals. The key activities in the APO domain include:
- Manage Strategy (APO01) – Involves the development of an overall IT strategy aligned with business goals.
- Manage IT architecture (APO02) – Ensures that the IT infrastructure and architecture support business processes and needs.
- Manage innovation (APO03) – Focuses on identifying, prioritizing, and adopting innovative IT solutions that will provide value to the business.
- Manage portfolio (APO04) – This process involves overseeing IT projects, ensuring they are aligned with business objectives, and managing resource allocation.
- Manage human resources (APO05) – Ensures the effective management of IT personnel, from recruitment to development and retention.
The APO domain focuses on organizing and planning for IT success, making sure that it is not only aligned with business goals but also optimized for efficiency and effectiveness.
- Build, Acquire, and Implement (BAI) – Management Domain
The Build, Acquire, and Implement (BAI) domain is focused on the processes related to the design, acquisition, and implementation of IT solutions and systems. This domain covers all stages from the initial design and acquisition of IT systems to their actual implementation within the organization. The main goal of the BAI domain is to ensure that IT systems are built and implemented in a way that meets both the organization’s needs and its governance requirements.
The processes in this domain ensure that IT solutions are properly designed, built, acquired, and implemented in line with the business strategy and operational requirements. Some of the key activities in the BAI domain include:
- Manage programs and projects (BAI01) – Ensures that IT projects are managed efficiently, on time, and within budget.
- Manage requirements (BAI02) – Focuses on gathering, documenting, and validating IT requirements to ensure that IT solutions meet business needs.
- Manage solutions identification and design (BAI03) – Ensures that IT solutions are properly identified and designed to meet the specified business and technical requirements.
- Manage change implementation (BAI04) – This process focuses on implementing changes to IT systems with minimal disruption to business operations.
The BAI domain ensures that IT projects and systems are developed, acquired, and implemented in a structured and organized manner to maximize value for the business.
- Deliver, Service, and Support (DSS) – Management Domain
The Deliver, Service, and Support (DSS) domain is focused on the delivery and ongoing support of IT services. It is concerned with ensuring that IT services are effectively delivered to meet business needs and that IT infrastructure operates efficiently. The processes in this domain focus on the management and maintenance of IT services and their ongoing improvement.
The DSS domain addresses the operational aspects of IT services, ensuring that service levels are maintained and performance is optimized. Key activities in the DSS domain include:
- Manage service requests and incidents (DSS01) – Ensures that service requests and incidents are handled effectively and efficiently to minimize downtime and disruption to business operations.
- Manage problems and known errors (DSS02) – This process is aimed at identifying and resolving problems that impact service delivery, as well as preventing future issues.
- Manage third-party services (DSS03) – Ensures the effective management of third-party service providers, ensuring they meet the agreed-upon service levels and contractual obligations.
The DSS domain focuses on maintaining and supporting IT services to ensure continuous and reliable service delivery.
- Monitor, Evaluate, and Assess (MEA) – Management Domain
The Monitor, Evaluate, and Assess (MEA) domain focuses on monitoring and evaluating the performance of IT processes and services to ensure they are operating as expected. This domain is responsible for assessing the effectiveness of IT governance and management, ensuring that processes align with business objectives and that performance is consistently optimized.
The processes in the MEA domain are critical for maintaining and improving IT governance. Key activities in the MEA domain include:
- Monitor, evaluate, and assess performance (MEA01) – Ensures that performance metrics are monitored, evaluated, and assessed regularly to identify areas for improvement.
- Monitor, evaluate, and assess compliance (MEA02) – This process ensures that IT services and processes comply with relevant policies, regulations, and standards.
- Monitor and evaluate internal controls (MEA03) – Ensures that internal controls are in place and effective in mitigating risks and maintaining compliance.
The MEA domain focuses on the continuous improvement of IT governance by regularly monitoring and evaluating performance, compliance, and controls.
COBIT 5 is a comprehensive framework that provides a structured approach to IT governance and management. By breaking down IT governance and management processes into five distinct domains—EDM, APO, BAI, DSS, and MEA—it provides a clear roadmap for organizations to align their IT strategies with business objectives, optimize resource usage, mitigate risks, and ensure compliance. Through its detailed processes, COBIT 5 helps organizations create value, maintain service reliability, and continuously improve IT governance practices.
Each process is defined with specific goals, inputs, outputs, activities, and roles, making the framework both structured and flexible for different organizational contexts.
COBIT 5 also introduced a robust process capability assessment model. Based on ISO/IEC 15504, this model allows organizations to assess their maturity levels across each process. The assessment helps identify capability gaps and prioritize areas for improvement.
To support implementation, COBIT 5 includes the “Implementation Guide” which presents a seven-phase lifecycle approach. This approach covers:
- Identifying drivers for IT governance
- Defining the problems and opportunities
- Setting improvement targets
- Creating a roadmap
- Planning and executing implementation
- Embedding changes
- Reviewing outcomes and sustaining improvements
The enablers concept in COBIT 5 is especially important. These enablers function together to ensure a consistent approach to governance. For example, effective communication policies must be aligned with cultural behavior and supported by trained personnel and accurate information.
COBIT 5’s emphasis on creating value from IT investments is particularly significant. The framework supports cost-effective management of IT while also ensuring alignment with business strategy. This makes it suitable for both large enterprises and smaller organizations seeking standardized governance practices.
Another important element is stakeholder engagement. COBIT 5 recognizes that successful governance requires the involvement of internal and external stakeholders. By ensuring accountability and transparency, organizations can build trust and achieve broader acceptance of governance policies.
The benefits of using COBIT 5 include:
- Enhanced alignment of IT with business objectives
- Improved risk management and regulatory compliance
- Better resource optimization and cost control
- A structured approach to IT performance measurement
- Greater accountability and clarity in roles and responsibilities
Although COBIT 5 was a significant step forward, certain limitations became apparent over time. For instance, while the framework allowed for customization, it lacked practical guidance on tailoring governance systems for specific enterprise needs. Furthermore, the model for performance measurement, though effective, was based on older standards and lacked integration with more modern capability maturity models.
As digital transformation accelerated and technology environments grew more complex, a need emerged for a more adaptable and customizable framework. This led to the development of COBIT 2019, which retained the foundational strengths of COBIT 5 but introduced several enhancements to make it more flexible, scalable, and aligned with contemporary governance needs.
COBIT 2019 – Advancements, Flexibility, and Tailored Governance
COBIT 2019 was developed to address evolving enterprise needs and overcome the limitations identified in COBIT 5. It retains the core principles and strengths of COBIT 5 while introducing a more adaptable and detailed model that can be tailored to specific enterprise governance requirements. This modernized version brings greater alignment with other international standards, provides improved guidance, and incorporates practical tools for flexible implementation.
One of the most significant updates in COBIT 2019 is the shift in terminology and structure. While COBIT 5 included five core principles, COBIT 2019 expands that to six. The updated principles reflect a deeper understanding of the governance landscape and emphasize the importance of customizing governance systems.
The six principles of COBIT 2019 are:
- Provide stakeholder value
- Holistic approach
- Dynamic governance system
- Governance distinct from management
- Tailored to enterprise needs
- End-to-end governance system
This expanded set of principles places strong emphasis on customization and adaptability. COBIT 2019 acknowledges that organizations differ significantly in terms of structure, objectives, size, industry, and risk profile. Therefore, it introduces design factors—contextual, strategic, and tactical elements that influence how governance should be designed.
Design factors include aspects like enterprise strategy, threat landscape, compliance requirements, IT role in the business, and risk tolerance. These factors are used to build a governance system that is tailored to each organization’s unique environment.
COBIT 2019 also updates the number and structure of processes. While COBIT 5 had 37 processes, COBIT 2019 introduces 40 governance and management objectives. The naming convention has changed from verbs like “Manage” to adjectives such as “Managed” and “Ensured,” reflecting a focus on outcomes rather than just actions.
The governance and management objectives are still grouped into five domains:
- Evaluate, Direct and Monitor (EDM)
- Align, Plan and Organize (APO)
- Build, Acquire and Implement (BAI)
- Deliver, Service and Support (DSS)
- Monitor, Evaluate and Assess (MEA)
However, each of the 40 objectives includes a purpose statement, related guidance, and reference objectives that allow organizations to develop practical, outcome-focused governance mechanisms.
Another advancement in COBIT 2019 is the updated performance management model. While COBIT 5 used a maturity model based on ISO/IEC 15504, COBIT 2019 adopts a performance management scheme inspired by the CMMI model. This change brings greater granularity and clarity in assessing performance and improvement potential.
Performance levels in COBIT 2019 include:
- Incomplete
- Performed
- Managed
- Established
- Predictable
- Optimizing
These levels allow organizations to evaluate how well governance components are functioning and identify specific areas for development.
COBIT 2019 also introduces components—formerly called enablers in COBIT 5. These include organizational structures, policies and procedures, information flows, skills and competencies, services, infrastructure, and culture. This new terminology and structure bring COBIT closer to modern enterprise management practices.
One of the most valuable tools introduced in COBIT 2019 is the COBIT Design Guide. This guide walks organizations through the process of tailoring governance systems using design factors and supporting guidance. It also provides templates and examples to simplify implementation.
In addition, COBIT 2019 includes an updated implementation methodology. The implementation approach is now structured around three key stages:
- Making the case for governance improvement
- Planning and designing governance solutions
- Implementing and sustaining governance systems
Each stage is supported with practical tools, real-world examples, and best practices. Organizations are encouraged to develop business cases for their governance initiatives, which helps secure leadership buy-in and ensures that the program aligns with strategic goals.
Another critical development is COBIT 2019’s emphasis on alignment with other global frameworks and standards. It integrates principles and terminology from ISO standards, ITIL, CMMI, TOGAF, and others. This interoperability makes COBIT 2019 more versatile and easier to adopt for organizations already using other governance or process frameworks.
Benefits of adopting COBIT 2019 include:
- Greater flexibility in governance design and implementation
- Improved alignment with enterprise strategy and priorities
- More comprehensive performance evaluation
- Consistent and structured terminology for clarity and integration
- Stronger stakeholder engagement through a value-focused approach
- Enhanced guidance on how to tailor governance to fit real-world needs
Overall, COBIT 2019 represents a more modern, practical, and business-aligned approach to IT governance. It provides organizations with a set of tools and strategies that not only ensure regulatory compliance and risk management but also help drive innovation and performance improvement.
Comparing COBIT 5 and COBIT 2019 – Key Differences and Strategic Considerations
While both COBIT 5 and COBIT 2019 share the same foundational goal—to guide enterprises in governing and managing information and technology effectively—the newer version builds upon and significantly enhances the capabilities introduced in COBIT 5. Understanding the differences between these two frameworks is critical for organizations deciding which version better suits their governance objectives.
One of the most visible differences is in the number of principles. COBIT 5 is built on five principles, while COBIT 2019 adds a sixth principle focused on tailoring the governance system to enterprise needs. This highlights the shift from a one-size-fits-all model toward a more customized and context-sensitive approach in COBIT 2019.
Another key update is the introduction of design factors in COBIT 2019. These factors—such as enterprise strategy, regulatory landscape, threat levels, and sourcing models—guide the creation of governance systems suited to each organization. This mechanism was not present in COBIT 5, which required practitioners to make customization decisions without formal structure.
In terms of processes, COBIT 5 includes 37 governance and management processes. COBIT 2019 expands this number to 40 governance and management objectives. This reflects a broader scope of governance elements that better match today’s complex enterprise IT environments. COBIT 2019 also shifts terminology to reflect a more outcome-oriented mindset—changing verbs like “Manage” and “Ensure” to their past-participle forms “Managed” and “Ensured.”
COBIT 2019 introduces an updated performance management model. While COBIT 5 used a maturity model inspired by ISO/IEC 15504, COBIT 2019 aligns more closely with CMMI performance levels. These six levels—ranging from Incomplete to Optimizing—provide greater clarity and consistency for assessing and improving governance processes.
The concept of enablers in COBIT 5 evolves into components in COBIT 2019. These components encompass organizational structures, culture, information flows, skills, and services that work collectively to ensure effective governance. The shift in terminology signifies not just a name change but a refined understanding of how enterprise governance systems operate in a dynamic environment.
COBIT 2019 also offers new guidance tools such as the COBIT Design Guide and the COBIT Implementation Guide. These resources support practical execution of governance strategies, including how to tailor and sustain governance systems across different organizational contexts. This kind of prescriptive guidance was more limited in COBIT 5, which relied heavily on interpretive application.
The governance principles themselves are more explicitly defined in COBIT 2019. For instance, the concept of end-to-end governance and providing stakeholder value has been refined to better align with modern organizational objectives. COBIT 2019 also places greater emphasis on the dynamic nature of governance, encouraging ongoing assessment and evolution rather than static compliance.
Another enhancement in COBIT 2019 is the better alignment with international frameworks such as ISO, ITIL, TOGAF, and CMMI. This facilitates interoperability and eases the adoption process for organizations already using other frameworks. COBIT 5 had similar intentions, but COBIT 2019 makes this alignment more explicit and practical.
Here are the core differences between the two frameworks:
COBIT 5 is built on five governance principles, while COBIT 2019 includes six, with an emphasis on tailoring the governance system to enterprise needs. COBIT 5 contains 37 processes, whereas COBIT 2019 expands to 40 governance and management objectives. Terminology has evolved from action-oriented verbs like “Manage” and “Ensure” to outcome-based terms such as “Managed” and “Ensured,” which emphasize results.
In terms of performance measurement, COBIT 5 relied on ISO/IEC 15504-based scales, while COBIT 2019 adopts a model influenced by CMMI, offering more granular assessment levels. The concept of enablers in COBIT 5 transitions into components in COBIT 2019, broadening the understanding of governance mechanisms. Design factors, absent in COBIT 5, are included in COBIT 2019, providing guidance for customizing governance based on specific organizational characteristics.
COBIT 2019 offers enhanced support for implementation through detailed guidance tools like the COBIT Design Guide and Implementation Guide. It also integrates more clearly with other international frameworks, ensuring smoother adoption for organizations already familiar with those standards.
These differences illustrate that COBIT 2019 is not merely a revision but an expansion that introduces meaningful flexibility, improved usability, and relevance to modern IT and business environments. While COBIT 5 provides a strong foundational framework, COBIT 2019 enhances its applicability through structured customization, clearer terminology, and better integration with other standards.
Organizations currently using COBIT 5 may consider transitioning to COBIT 2019 to leverage these enhancements. However, the transition should be approached methodically. Enterprises must evaluate their current governance maturity, identify specific business needs, and determine how the design factors in COBIT 2019 align with their context.
Ultimately, the decision between COBIT 5 and COBIT 2019 depends on the organization’s goals. For enterprises seeking a modern, flexible, and performance-oriented approach, COBIT 2019 is the superior choice. For those already embedded in COBIT 5 practices and requiring only foundational governance, remaining with COBIT 5 may still offer value.
Final Thoughts
The evolution from COBIT 5 to COBIT 2019 reflects the growing complexity and strategic importance of information and technology governance. In a business environment that is increasingly reliant on digital infrastructure, cloud services, and agile practices, governance frameworks must be adaptable, scalable, and closely aligned with organizational goals. COBIT 2019 rises to meet this challenge by expanding upon the foundation laid by COBIT 5 and introducing significant improvements in structure, flexibility, and integration.
COBIT 5 served as a robust, reliable framework for nearly a decade, supporting organizations in achieving IT governance maturity. Its principles, process-oriented approach, and enabler model provided a solid structure for implementing IT governance across a wide range of industries. However, the limitations in its ability to support tailored governance systems, keep pace with emerging technologies, and integrate seamlessly with other methodologies created the need for a more contemporary solution.
COBIT 2019 addresses these needs head-on by introducing the concept of design factors and focusing on enterprise-specific customization. It brings governance to the forefront of digital transformation by recognizing that organizations vary in size, industry, culture, risk tolerance, and strategic priorities. As a result, COBIT 2019 is not only a governance framework but also a toolkit for building and adapting governance systems that evolve with the enterprise.
The inclusion of performance management improvements, the shift in terminology toward outcome-focused language, and better alignment with global standards all contribute to making COBIT 2019 a more effective and usable framework. By offering updated guidance documents and promoting a continuous improvement mindset, COBIT 2019 empowers organizations to proactively shape their governance journey.
Enterprises considering a transition from COBIT 5 to COBIT 2019 should begin by assessing their current state. This includes evaluating the maturity of their governance processes, identifying key drivers for change, and engaging stakeholders from both IT and business domains. A phased approach can ease the transition, allowing organizations to adopt COBIT 2019 principles incrementally while preserving the strengths of their existing governance practices.
The release of COBIT 2019 comes at a time when IT is no longer a support function—it is a central enabler of business strategy. Governance must ensure that technology investments are aligned with desired outcomes, that risks are well-managed, and that compliance is maintained without stifling innovation. COBIT 2019 provides the tools and guidance to achieve this balance.
As organizations navigate digital disruption, regulatory challenges, and changing market demands, adopting a modern governance framework like COBIT 2019 becomes not just beneficial but essential. It allows enterprises to remain agile, resilient, and focused on delivering value through their technology capabilities.
In conclusion, COBIT 5 and COBIT 2019 are both valuable frameworks, each with its merits. However, for organizations looking to future-proof their IT governance and unlock new strategic potential, COBIT 2019 offers the clarity, customization, and control needed to lead in the digital era.