COBIT: who decides about IT, and how you know it works
We help you use ISACA's COBIT framework to set up governance for enterprise IT that management understands and auditors can follow.
Overview
What COBIT is
COBIT is ISACA's framework for the governance and management of enterprise information and technology. It separates governance, where the board evaluates, directs and monitors, from management, where teams plan, build, run and monitor. Its objectives are grouped into domains along that line.
COBIT does not hand you a fixed set of controls. You tailor a governance system to your organisation using design factors such as strategy, risk profile and the role IT plays, then focus on the objectives that matter. Processes can be assessed for capability, so you can say how mature they are and where you want them.
COBIT is not certifiable for organisations. ISACA certifies individuals in the framework, not companies. It sits well above and alongside ISO/IEC 27001 and the NIST frameworks, and we map between them so one set of evidence serves several purposes.
Who it is for
Organisations where IT is central to the business and the board wants to govern it rather than hear about it afterwards, groups with several IT functions that need common decision rules, and organisations whose auditors or regulators already speak COBIT.
The work, from scoping to evidence.
What we do
Governance system design
We work through the design factors with you and decide which governance and management objectives deserve priority.
Roles and decision rights
Who sets direction, who approves, who runs and who checks, written down so it survives a reorganisation.
Capability assessment
An assessment of how mature the processes in scope are today, based on interviews and evidence, and the level you want to reach.
Security and risk objectives
Particular attention to the objectives on risk, security and continuity, where COBIT meets the rest of your security programme.
Mapping to ISO/IEC 27001 and NIST
We map COBIT objectives to ISO/IEC 27001 controls and the NIST Cybersecurity Framework, so the frameworks support each other instead of competing.
How the engagement runs
Kickoff
We agree the scope, the people involved and what management wants from the exercise, and sign an NDA first if you need one.
Proposal
A business proposal with the method, the scope and the contract type that suits you.
Design workshops
Sessions with management and IT to work through the design factors and choose the priority objectives.
Assessment
Interviews and evidence review on the objectives in scope, ending in a capability rating for each.
Results handover
The governance design, the assessment, the mapping to other frameworks and a roadmap, presented to management.
Closing
Project close with feedback, and optional support as you put the roadmap into practice.
What you receive
- Tailored governance system with priority objectives
- Roles, responsibilities and decision rights
- Capability assessment of the processes in scope
- Mapping to ISO/IEC 27001 and the NIST CSF
- Roadmap with owners
- Business report for the board and management
Questions
Can our organisation be certified in COBIT?
No. COBIT has no certification for organisations. ISACA offers certifications for individuals who work with the framework. What you can have is an independent assessment of your governance and process capability.
Does COBIT replace ISO/IEC 27001?
No. COBIT covers governance and management of all enterprise IT. ISO/IEC 27001 is a certifiable management system for information security. Many organisations use COBIT for the overall governance and ISO/IEC 27001 for security, and map one to the other.
Is COBIT only for large organisations?
It is most common in larger organisations, but the design factors exist to scale it down. A smaller organisation can focus on a handful of objectives and still get clear decision rights out of it.
Do you also cover the security side?
Yes. That is our main ground. We pay particular attention to the risk, security and continuity objectives and connect them to your controls and policies.
Related services
- Governance and riskNIST Cybersecurity FrameworkNIST CSF 2.0 support from Black Fox Security: current and target profiles across Govern, Identify, Protect, Detect, Respond and Recover, and a plan to close the gap.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Advisory and responseVirtual CISOA virtual CISO from Black Fox Security: security strategy and roadmap, board reporting, policy ownership, audits and customer security questionnaires.
- Governance and riskPolicies and proceduresBlack Fox Security writes and reviews your security policies: acceptable use, access control, incident response, suppliers, backup and more, in plain language.
Decide who decides
Tell us how IT decisions are made today. We will help you make them deliberate.