OneClickComply
    Book a demo
    COBIT 2019Supported in OneClickComply

    Put COBIT 2019 governance into practice with evidence to prove it

    COBIT 2019 is ISACA's framework for the governance and management of enterprise information and technology, organised into 40 governance and management objectives across five domains.

    See the COBIT requirements
    COBIT mapped
    Automated evidence
    Continuous monitoring
    Who needs COBIT

    Is COBIT right for your organisation?

    It replaced COBIT 5 and adds design factors and focus areas so each organisation can tailor its governance system rather than adopt a single fixed model. It is voluntary and there is no organisational COBIT certification, but it is widely used as the basis for IT audit and assurance.

    COBIT 2019 suits organisations whose boards, regulators or auditors expect a clear, structured account of how technology is governed, controlled and measured. It is common in banking, insurance, the public sector and other regulated industries, and with internal and external IT auditors. Teams often adopt it when maturing beyond ad hoc IT controls or aligning IT governance with SOX, ISO 27001 or risk management programmes.

    Adopting it is voluntary, though customers and auditors often expect it.

    How we help

    How OneClickComply helps with COBIT

    OneClickComply maps your controls to the COBIT 2019 management objectives, so evidence collected for ISO 27001, SOC 2 or other frameworks also counts towards COBIT. Automated evidence collection, continuous monitoring and AutoComplete policy generation cover the operational objectives such as Managed Security, Managed Vendors and Managed IT Changes. The risk register, vendor risk management and Ask an Auditor support the governance and assurance side.

    Requirements covered

    40 governance and management objectives across five domains: Evaluate, Direct and Monitor (EDM, 5), Align, Plan and Organise (APO, 14), Build, Acquire and Implement (BAI, 11), Deliver, Service and Support (DSS, 6) and Monitor, Evaluate and Assess (MEA, 4), each broken down into management practices and activities.

    Why automate

    Manual COBIT compliance vs OneClickComply

    Doing it manually

    • Translating 40 abstract objectives into concrete, testable controls
    • Gathering evidence by hand from dozens of IT and business systems
    • Maintaining separate control sets for COBIT, ISO 27001 and SOC 2
    • Capability assessments that go out of date as soon as they finish
    • Auditors chasing screenshots and spreadsheets every review cycle

    With OneClickComply

    • Ready-made control mapping to each COBIT 2019 objective
    • Evidence collected automatically from 13,000+ integrations
    • One control set reused across COBIT and other frameworks
    • Continuous monitoring that alerts you when controls drift
    • Audit-ready evidence and expert help from Ask an Auditor
    Capabilities

    Everything you need for COBIT

    • Controls mapped to all 40 COBIT 2019 objectives

    • Automated evidence for DSS and BAI operational objectives

    • AutoComplete policies for security, change and vendor management

    • Continuous monitoring to support MEA performance and conformance

    • Risk register aligned to EDM03 and APO12

    • Vendor risk management for APO10 Managed Vendors

    How it works

    Three steps to COBIT compliance

    1. Connect and scan

      Connect your cloud, identity and SaaS tools. OneClickComply checks them against COBIT and shows which controls pass and which fail.

    2. Fix and generate

      OneClickFix fixes supported misconfigurations automatically, and AutoComplete drafts COBIT policies from your real environment.

    3. Monitor and evidence

      Continuous monitoring flags drift as it happens, and our in-house audit team is on hand when you need expert guidance.

    See how far your current setup is from COBIT.

    Requirements

    COBIT 2019 requirements

    All 40 COBIT 2019 governance and management objectives across the five domains; each objective contains several management practices (for example APO13.01), which are not listed individually.

    ReferenceRequirement
    EDM01Ensured Governance Framework Setting and Maintenance
    EDM02Ensured Benefits Delivery
    EDM03Ensured Risk Optimization
    EDM04Ensured Resource Optimization
    EDM05Ensured Stakeholder Engagement
    APO01Managed I&T Management Framework
    APO02Managed Strategy
    APO03Managed Enterprise Architecture
    APO04Managed Innovation
    APO05Managed Portfolio
    APO06Managed Budget and Costs
    APO07Managed Human Resources
    APO08Managed Relationships
    APO09Managed Service Agreements
    APO10Managed Vendors
    APO11Managed Quality
    APO12Managed Risk
    APO13Managed Security
    APO14Managed Data
    BAI01Managed Programs

    Always check the official text of COBIT for the exact wording.

    FAQs

    COBIT questions, answered

    Can't find what you need? Our in-house auditors can talk you through COBIT on a 30-minute call.

    What is COBIT 2019?

    COBIT 2019 is ISACA's framework for the governance and management of enterprise information and technology. It defines 40 governance and management objectives grouped into five domains, and uses design factors and focus areas to help organisations tailor a governance system to their strategy, risk profile and size. It replaced COBIT 5 and is used by boards, IT leaders and auditors worldwide.

    Is COBIT 2019 mandatory?

    No. COBIT 2019 is a voluntary framework and no law requires it in its own right. However, regulators, auditors and boards often expect a recognised IT governance framework, and many banks, insurers and public bodies use COBIT to show how technology risks are governed. It is also widely used to structure IT general controls for financial reporting audits such as SOX.

    What are the five COBIT 2019 domains?

    COBIT 2019 has one governance domain and four management domains. The governance domain is Evaluate, Direct and Monitor (EDM). The management domains are Align, Plan and Organise (APO), Build, Acquire and Implement (BAI), Deliver, Service and Support (DSS), and Monitor, Evaluate and Assess (MEA). Together they contain 40 objectives: 5, 14, 11, 6 and 4 respectively.

    Can an organisation be certified against COBIT 2019?

    No. There is no organisational certification for COBIT 2019. Organisations instead assess the capability of their processes on a scale of 0 to 5, often with help from internal audit or advisers. ISACA does offer COBIT certificates for individuals, such as the COBIT Foundation certificate, which show a practitioner understands the framework.

    How does COBIT 2019 relate to ISO 27001?

    COBIT 2019 and ISO 27001 complement each other. COBIT covers governance and management of all enterprise IT, including strategy, value, projects and assurance, while ISO 27001 focuses on an information security management system and can be certified. Many organisations use COBIT for overall IT governance and ISO 27001 for security, mapping one set of controls to both.

    What changed from COBIT 5 to COBIT 2019?

    COBIT 2019 increased the number of objectives from 37 to 40, adding Managed Data (APO14), Managed Projects (BAI11) and Managed Assurance (MEA04). It introduced design factors and focus areas for tailoring, and replaced the COBIT 5 process capability approach with a CMMI-based capability and maturity scale. Enablers from COBIT 5 became governance system components.

    How long does it take to implement COBIT 2019?

    It depends on scope, size and starting maturity. COBIT is designed to be implemented incrementally: organisations use the design factors to prioritise the objectives that matter most, set target capability levels, then improve in cycles. A focused programme on a handful of priority objectives is far quicker than attempting all 40 at once.

    Does OneClickComply support COBIT 2019?

    Yes. COBIT 2019 is supported in OneClickComply today. Controls are mapped to the COBIT 2019 objectives, so evidence collected automatically from your connected tools counts towards COBIT as well as frameworks like ISO 27001 and SOC 2. Continuous monitoring, policy generation, risk and vendor management, and our in-house audit team help you show capability to auditors and your board.

    Start working towards COBIT

    Automate controls, gather evidence continuously and stay audit-ready, all on one platform.