Governance Frameworks Comparison

Governance Frameworks Comparison

A side-by-side comparison of the four governance and management frameworks most commonly tested on the CISA exam.

Attribute	COBIT	ITIL	ISO 27001	NIST CSF
Publisher	ISACA	Axelos (PeopleCert)	ISO/IEC	NIST (U.S.)
Primary Focus	IT governance and management	IT service management	Information security management	Cybersecurity risk management
Structure	6 principles, 40 governance/management objectives	Service value system, 34 practices	ISMS with 93 controls (Annex A)	6 functions, 22 categories
Certifiable?	No (individual cert only)	No (individual cert only)	Yes (organizational)	No
Best For	Aligning IT with business goals	Improving service delivery	Building an ISMS	Assessing cybersecurity posture
Audit Relevance	Primary framework for IT audit criteria	Audit service management processes	Audit security controls and ISMS	Benchmark security programs

COBIT Key Concepts

• Governance objectives (EDM): Evaluate, Direct, Monitor
• Management objectives: Align, Plan, Organize (APO); Build, Acquire, Implement (BAI); Deliver, Service, Support (DSS); Monitor, Evaluate, Assess (MEA)
• Separates governance (board responsibility) from management (executive responsibility)

NIST CSF 2.0 Six Functions

Function	Purpose
Govern	Establish and monitor cybersecurity risk management strategy, expectations, and policy
Identify	Understand assets, risks, and governance context
Protect	Implement safeguards for critical services
Detect	Identify security events promptly
Respond	Take action on detected incidents
Recover	Restore capabilities after an incident

CISA Exam Tip

COBIT is the most heavily tested framework. Know that it bridges business goals and IT processes. When a question asks about the "best framework for IT governance," the answer is almost always COBIT.