COBIT

What is COBIT?

COBIT is a framework from the international professional association ISACA for the governance and management of information and technology (I&T), describing the goals, processes, roles and controls an organisation needs to align IT with its business objectives, manage risk and deliver value. The name originally stood for Control Objectives for Information and Related Technologies; today ISACA almost exclusively uses the acronym. The current version is COBIT 2019, with 40 governance and management objectives; ISACA has announced its successor, COBIT 7, for October 2026. COBIT was developed primarily for IT, but it is also usable in OT environments, particularly where IT and OT converge and risk management and regulatory compliance have to be organised at board level.

🕰️ How did COBIT originate and which versions exist?

ISACA was founded in 1969 as an association of EDP auditors. COBIT started in 1996 as a set of control objectives for financial auditors and grew over just over twenty years into a complete governance framework.

With COBIT 2019, ISACA dropped sequential version numbering so that the framework could be updated more often, for example through focus areas and white papers on AI governance and on NIS2 and DORA. Even so, ISACA announced a new major version, COBIT 7, for October 2026. The COBIT 2019 Foundation certificate is replaced by a COBIT 7 Foundation certificate on 27 October 2026. The 40 objectives and domains in this article are those of COBIT 2019, the version most organisations and auditors currently work with.

🧠 How is COBIT 2019 structured?

COBIT is not technical: it does not tell you how to configure a firewall, but who decides what, which objectives apply and how you demonstrate that it works. The core consists of four publications: Introduction and Methodology, Governance and Management Objectives, the Design Guide and the Implementation Guide.

• Six principles for the governance system - stakeholder value, a holistic approach, a dynamic system, governance distinct from management, tailoring to enterprise needs and an end-to-end approach
• Three principles for the framework itself - a conceptual model, openness and flexibility, and alignment with other standards and regulations
• Seven components - processes; organisational structures; principles, policies and procedures; information; culture, ethics and behaviour; people, skills and competencies; services, infrastructure and applications
• Eleven design factors - four initial factors (strategy, enterprise goals, risk profile and current I&T-related issues) and seven refining factors (threat landscape, compliance requirements, the role of IT, the sourcing model, IT implementation methods, technology adoption strategy and enterprise size); they determine which objectives carry the most weight for you
• Focus areas - guidance for a specific theme, such as information security, I&T risk, DevOps and small and medium-sized enterprises
• Capability levels 0–5 - based on CMMI, from incomplete (0) through defined (3) to optimising (5); COBIT 5 still used a scale based on ISO/IEC 15504

🔧 Which 40 objectives does COBIT define?

The 40 objectives are divided over one governance domain (for the board and executive management) and four management domains (for the operational organisation). This separation between governance and management is one of the core ideas of COBIT.

Each objective describes its purpose, the related processes and activities, the accountable roles (RACI), the required information flows and example metrics. Those metrics work well as KPIs for management and oversight.

🏭 How do you apply COBIT in OT environments?

COBIT speaks of information and technology in a broad sense, and OT logically falls under it once production systems are connected to the business network. In practice organisations use COBIT for:

• Direction and control of access management, patch management and asset inventory (APO13, DSS05, BAI09)
• Aligning OT security objectives with business risks, such as production continuity, safety and delivery reliability (EDM03, APO12, DSS04)
• Lifecycle management of SCADA systems and MES, from procurement to decommissioning (BAI03, BAI09)
• Governance of OT outsourcing and suppliers, such as system integrators and machine builders (APO10, supplemented by third-party risk management)
• Linking to technical OT standards: IEC 62443-2-1 for the OT security programme, IEC 62443-2-4 for requirements on service providers and NIST SP 800-82 for technical measures

Mind the differences between IT and OT. A COBIT-aligned change process (BAI06) taken from office IT assumes frequent releases and fast patching; in a plant, changes are bound to shutdown windows, process safety and vendor approval. Include OT explicitly in the design factors (role of IT, threat landscape, compliance requirements) instead of extending IT processes to the plant floor unchanged.

🔄 How does COBIT differ from NIST CSF, IEC 62443, ISO 27001 and ITIL?

COBIT is an overarching framework: it defines the what and who, while other standards fill in the how. ISACA itself publishes a guide to implementing the NIST CSF using COBIT 2019.

A common combination: COBIT for governance and accountability, ISO 27001 for the management system, IEC 62443 for OT-specific requirements and ITIL for day-to-day IT processes.

🇪🇺 How is COBIT used in the Netherlands and the EU?

• Financial sector - the Dutch central bank (DNB) assesses information security with its Good Practice Informatiebeveiliging. Its maturity model is based on the definitions from COBIT 4.1 (levels 0 to 5). An institution is demonstrably in control at level 3 or higher, with at least six months of demonstrable operation, and at level 4 for the risk management controls. DORA has applied in addition since 17 January 2025.
• IT audit - IT auditors have used COBIT for decades as a reference for IT general controls in financial statement audits and for the control framework behind assurance reports such as ISAE 3402. SOC 2 uses the AICPA Trust Services Criteria, but COBIT often serves as the underlying structure there too.
• NIS2 and the Dutch Cyberbeveiligingswet - NIS2 explicitly places responsibility for cybersecurity with the management body. The Dutch Cyberbeveiligingswet entered into force on 15 August 2026. COBIT’s EDM domain in particular helps directors fulfil that responsibility demonstrably, including for OT.

🛠️ How do you implement COBIT step by step?

The COBIT Implementation Guide describes a lifecycle of seven phases:

1. What are the drivers? - for example an audit finding, NIS2 or an incident on the plant floor
2. Where are we now? - determine the current capability levels of the relevant objectives
3. Where do we want to be? - choose target levels using the design factors; for most OT processes level 3 is a realistic target
4. What needs to be done? - translate the gaps into improvement projects
5. How do we get there? - implement the improvements, with ownership in both IT and OT
6. Did we get there? - measure results with the COBIT metrics
7. How do we keep the momentum going? - embed the approach in the PDCA cycle

Start small: a limited set of five to ten objectives (for example APO12, APO13, BAI06, BAI09, DSS04 and DSS05) delivers results faster than rolling out all 40 at once. COBIT pays off most in large or regulated organisations with explicit maturity targets; for smaller companies ISACA publishes a separate SME edition.

🔐 What role does COBIT play in security?

• Supports risk management, compliance and audit-trail management
• Contains objectives for access control, change management, incident response and business continuity
• Improves communication between IT, OT, business and security through shared terminology and RACI roles
• Fits within a defence-in-depth strategy at governance level
• Links maturity levels to OT processes for continuous improvement, similar to a cybersecurity maturity model

COBIT helps to integrate cybersecurity with broader business goals and risk strategies.

❓ Frequently asked questions

What does the acronym COBIT stand for?

COBIT originally stood for Control Objectives for Information and Related Technologies. Since COBIT 5, ISACA almost exclusively uses the acronym, because the framework has become much broader than a list of control objectives.

Is COBIT 2019 still the latest version?

COBIT 2019 has been the current version since November 2018, but ISACA has announced its successor, COBIT 7, for October 2026. The COBIT 2019 Foundation certificate is replaced by COBIT 7 Foundation on 27 October 2026. Existing COBIT 2019 implementations remain usable, but it is wise to include the move to COBIT 7 in your planning.

Can an organisation be certified against COBIT?

No, an organisation cannot be certified against COBIT, unlike ISO 27001. Individuals can earn COBIT certificates from ISACA, and auditors can assess the capability level at which an organisation’s COBIT processes operate.

Is COBIT suitable for OT and industrial companies?

COBIT is suitable for OT as a governance layer, because it defines who is accountable for risks, changes, suppliers and continuity of production systems. For technical OT measures, COBIT has to be supplemented with IEC 62443 or NIST SP 800-82.

What is the difference between COBIT and ITIL?

COBIT defines at governance level which objectives IT must achieve and how the board oversees them. ITIL describes how IT services are delivered and managed in day-to-day practice, and is often used to fulfil COBIT objectives from the DSS domain.

Does COBIT help with NIS2 compliance?

COBIT helps with NIS2 and the Dutch Cyberbeveiligingswet because both make the management body accountable for cybersecurity measures. COBIT’s EDM domain and RACI roles make visible how the board assesses risks, takes decisions and oversees implementation.

📌 In summary

With 40 objectives in five domains, seven components and eleven design factors, COBIT 2019 offers a coherent framework for governing information and technology. It does not replace technical standards such as IEC 62443, but connects them to business goals, oversight and accountability. For OT convergence, that is exactly the missing link between the boardroom and the plant floor.

COBIT is ISACA’s governance framework that aligns the risks, controls and performance of information and technology, including OT, with business objectives.