COBIT, initially an acronym for "Control objectives for information and related technology" (though before the release of the framework people talked of "CobiT" as "Control Objectives for IT"), defines a set of generic processes for the management of IT. The framework defines each process together with process inputs and outputs, key process-activities, process objectives, performance measures and an elementary maturity model.
The business orientation of COBIT consists of linking business goals to IT goals, providing metrics and maturity models to measure their achievement, and identifying the associated responsibilities of business and IT process owners.
The process focus of COBIT 4.1 is illustrated by a process model that subdivides IT into four domains (Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate) and 34 processes in line with the responsibility areas of plan, build, run and monitor. It is positioned at a high level and has been aligned and harmonized with other, more detailed, IT standards and good practices such as COSO, ITIL, ISO 27000, CMMI, TOGAF and PMBOK. COBIT acts as an integrator of these different guidance materials, summarizing key objectives under one umbrella framework that link the good practice models with governance and business requirements.
The COBIT 4.1 framework specification can be obtained as a complimentary PDF at the ISACA download website. (Free self-registration may be required.)
COBIT 5 was released in April 2012. COBIT 5 consolidates and integrates the COBIT 4.1, Val IT 2.0 and Risk IT frameworks, and draws from ISACA's IT Assurance Framework (ITAF) and the Business Model for Information Security (BMIS). It aligns with frameworks and standards such as Information Technology Infrastructure Library (ITIL), International Organization for Standardization (ISO), Project Management Body of Knowledge (PMBOK), PRINCE2 and The Open Group Architecture Framework (TOGAF).
COBIT has had five major releases:
In 1996, the first edition of COBIT was released.
In 1998, the second edition added "Management Guidelines".
In 2000, the third edition was released.
In 2003, an on-line version became available.
In December 2005, the fourth edition was initially released.
In May 2007, the 4.1 revision was released.
COBIT 5 was released in June 2012. It consolidates and integrates the COBIT 4.1, Val IT 2.0 and Risk IT frameworks, and also draws significantly from the Business Model for Information Security (BMIS) and ITAF.
In December 2012, one add-on document was released, COBIT 5 for information security.
In June 2013, a second add-on document was released, COBIT 5 for assurance.
The COBIT components include:
Framework: Organize IT governance objectives and good practices by IT domains and processes, and links them to business requirements
Process descriptions: A reference process model and common language for everyone in an organization. The processes map to responsibility areas of plan, build, run and monitor.
Control objectives: Provide a complete set of high-level requirements to be considered by management for effective control of each IT process.
Management guidelines: Help assign responsibility, agree on objectives, measure performance, and illustrate interrelationship with other processes
Maturity models: Assess maturity and capability per process and helps to address gaps.
^CobiT: Control Objectives for Information Technlogy. CobiT Framework, Exposure Draft, August 1995, CobiT Steering Committee; the Information Systems Audit and Control Foundation Research Board and the Information Systems Audit and control Foundation Standards Board. Cited in: Katsikas, Sokratis; Gritzalis, Dimitris, eds. (1996). Information Systems Security: Facing the Information Society of the 21st Century. IFIP Advances in Information and Communication Technology. Springer. p. 362. ISBN9780412781209. Retrieved 2013-05-24.