COBIT 2019: Updated Complete Guide

COBIT is a global IT governance framework created by ISACA that guides organizations in aligning technology, strategy, and business outcomes—balancing benefits, risks, and resources. COBIT 2019, the current and official version of the framework, offers greater flexibility, modernized components, and integration with standards such as ITIL, ISO 27001, and TOGAF. Platforms like ServiceNow accelerate its adoption by automating governance and asset management processes.

What is COBIT 2019?

COBIT 2019 is the evolution of COBIT 5, a global reference model for information technology governance and management. It guides organizations in creating value through IT by balancing benefits, risks, and resources. The 2019 version introduced the concept of a governance system, replacing the process-based approach, and allows each company to customize the application according to its size, sector, and digital maturity.

Why COBIT 2019 is essential for modern IT governance.

Technological advancement and digital transformation demand a solid framework for governing information and technology. COBIT 2019 was designed to be flexible, customizable, and integrable with other frameworks. Therefore, companies can use it in conjunction with ITIL, ISO 27001, PMBOK, and TOGAF, ensuring comprehensive management of corporate IT.

What changed in the 2019 version?

COBIT 2019 brought more flexibility, clarity, and adaptation to the context of each organization. One of the main changes was the introduction of the governance system concept, replacing the more rigid approach based solely on processes. This allows companies to customize the application of the framework according to their size, sector, and digital maturity.

Furthermore, the 2019 version more clearly separated governance and management, with well-defined objectives and structured components — principles, policies, information, culture, and people. The model became dynamic, with continuous updates and better alignment with modern frameworks.

COBIT 2019 vs. COBIT 5: Key Differences

1. Structure and components: COBIT 2019 introduced new governance components, expanding the scope of processes and practices. Each governance and management objective contains elements such as policies, culture, information, and infrastructure.
2. Focus on personalization: COBIT 5 had a more standardized approach. COBIT 2019 is modular and scalable, allowing each company to adapt the framework to its strategic context.
3. Continuous update: The new version can be continuously updated by ISACA, keeping pace with governance trends and technological innovation.

How to implement COBIT 2019 step by step.

The implementation of COBIT 2019 should begin with an understanding of the business's strategic objectives and how IT governance can support them. The first step is to assess the organization's current situation, identifying risks, challenges, and the level of maturity in governance and technology management.

Next, the governance system is defined, selecting the COBIT 2019 objectives most relevant to the company's reality. The process should be conducted incrementally, with continuous monitoring and adjustments as the organization evolves.

1. Initial diagnosis: Assess the current maturity level of IT governance.
2. Define governance objectives: Align IT goals with the company's strategy.
3. Choose the priority processes: Use the COBIT 2019 component model.
4. Adopt key performance indicators (KPIs): Monitor results and make adjustments.
5. Empower the team: Promote training based on the COBIT methodology.

The use of integrated governance platforms such as ServiceNow — implemented by experts like 4MATT, ServiceNow Elite Partner in Brazil Since February 2026 and winner of the Technology Excellence Partner Award 2024–2025 — it accelerates digital maturity and improves operational efficiency.

COBIT and other frameworks: integration with ITIL and ISO.

The COBIT framework was designed to work in an integrated way with other widely used frameworks, such as ITIL and ISO standards, especially ISO/IEC 27001. While COBIT 2019 focuses on governance and strategic alignment of IT with the business, ITIL acts on the operational management of services, offering detailed practices for delivery and support.

ISO standards complement COBIT by providing formal and standardized requirements, primarily in information security, quality, and compliance. The integration between COBIT, ITIL, and ISO allows organizations to create a robust model in which governance defines guidelines, management executes processes, and standards ensure control, compliance, and continuous improvement.

The five domains of COBIT 2019

COBIT 2019 organizes its processes into five main domains, ranging from planning to operational support.

1. EDM – Evaluate, Direct and Monitor

Focused on corporate governance, EDM ensures that strategic decisions are aligned with the organization's objectives. It helps leaders assess risks, direct investments, and monitor results.

EDM01	Setting up and maintaining the assured governance framework.
EDM02	Delivery of guaranteed benefits.
EDM03	Risk optimization guaranteed.
EDM04	Resource optimization guaranteed.
EDM05	Guaranteed stakeholder engagement.

2. APO – Align, Plan and Organize

APO deals with IT strategic planning, covering organizational structure, culture, communication, security, and human resources to ensure alignment with the business.

APO01	Define the IT management system, roles, and responsibilities.
APO02	Integrate IT and business strategies.
APO03	Develop a unified architecture for processes, data, and technology.
APO04	Monitor trends and adopt emerging technologies.
APO05	Plan and prioritize your portfolio of IT projects and investments.
APO06	Controlling financial resources and ensuring efficiency in IT spending.
APO07	To plan and develop the skills and capabilities of the IT team.
APO08	To promote effective communication between IT, business, and stakeholders.
APO09	Establish and monitor SLAs and KPIs for quality in IT services.
APO10	Select, monitor, and evaluate suppliers based on performance and risk.
APO11	Implement quality standards and continuous improvement in IT.
APO12	Identify, assess, and mitigate IT and information risks.
APO13	To guarantee the protection of information and technological infrastructure.
APO14	Establish data governance and management throughout the lifecycle.

3. BAI – Build, Acquire, and Implement

BAI encompasses the entire IT solution lifecycle, from development to delivery, ensuring that projects deliver value within deadlines and budgets.

BAI01	Managed programs.
BAI02	Definition of managed requirements.
BAI03	Identifying and building managed solutions.
BAI04	Managed availability and capacity.
BAI05	Managed organizational change.
BAI06	Managed IT change.
BAI07	Managed acceptance and transition of change.
BAI08	Managed knowledge.
BAI09	Assets under management.
BAI10	Managed configuration.
BAI11	Managed projects.

4. DSS – Deliver, Serve, and Support

The DSS handles day-to-day operations, including technical support, service continuity, and security.

DSS01	Managed operations.
DSS02	Managed service requests and incidents.
DSS03	Problems managed.
DSS04	Managed continuity.
DSS05	Managed security services.
DSS06	Managed business process controls.

5. MEA – Monitor, Evaluate and Analyze

MEA focuses on auditing and performance, collecting metrics and indicators to measure the success of governance practices. It ensures that IT processes comply with laws, regulations, and contractual requirements.

Key benefits of COBIT 2019 for businesses

• It increases transparency between IT and business.
• Reduces operational and compliance risks.
• It improves the efficiency of internal processes.
• It strengthens strategic decision-making.
• It facilitates international audits and certifications.
• It increases the organization's digital maturity.

For organizations already operating with ServiceNow, COBIT 2019 applies directly to the modules of CMDB and IT asset management — where reliable data is a prerequisite for any level of governance maturity.