COBIT 2019 Design Toolkit TKT Eng 1218 (AutoRecovered)

02/17/2023
COBIT® 2019 Governance System Design Toolkit
COBIT® 2019 Governance System Design Workbook—Instructions
Terms & Definitions
Relative importance Relative importance (of governance and management objectives) is a number that indicates the influence of a certain design factor on the importance of a certain
COBIT governance or management objective as compared to a baseline (standard) situation. The number is calculated as a percentage difference between the
baseline and the current situation, as determined by the values given to the design factor at hand.
Instructions: See COBIT® 2019 Design Guide, Chapter 6
© 2018 ISACA. All rights reserved. 645518342.xlsx Instructions—Page 1

02/17/2023
COBIT® 2019 Governance System Design Workbook—Canvas
Step 2: Determine the initial scope of the Governance System Step 3: Refine the scope of the Governance System Step 4: Conclude the Scope of the Governance System
Enterprise I&T-Related Threat Role of Sourcing IT Implementation Refined Scope: Concluded Scope:
Design Factors: Enterprise Strategy Goals Risk Profile Issues
Initial Scope: Governance/
Management Objectives Landscape Compliance Req's IT Model Methods Technology Adoption Strategy
Governance/ Adjustment
(between -100 and Reason
Governance/ Suggested
Target Capability Agreed Target Reason
for IT Management Objectives Management Objectives Capability Level
Score +100) Level
Score Priority
Weight 1 1 1 1 1 1 1 1 1 1
EDM01—Ensured Governance Framework Setting & -5 10 -5 -10 ### -10 50 15 35 0 0 25 50 50 3 3

Maintenance
EDM02—Ensured Benefits Delivery 0 35 15 -5 ### 40 0 0 30 0 0 35 50 50 3 3
EDM03—Ensured Risk Optimization 0 -15 10 -10 ### -15 65 25 15 15 0 30 60 60 3 3
EDM04—Ensured Resource Optimization -20 30 -15 5 ### 0 0 0 25 0 0 15 20 20 1 1
EDM05—Ensured Stakeholder Engagement 5 -45 -15 -15 ### -65 30 15 25 0 0 30 15 15 1 1
APO01—Managed I&T Management Framework 0 5 15 -5 ### 15 50 10 25 0 0 40 65 65 3 3
APO02—Managed Strategy 10 35 -5 5 ### 40 0 0 30 0 0 25 45 45 2 2
APO03—Managed Enterprise Architecture 25 30 15 5 ### 70 50 0 20 0 0 50 90 90 4 4
APO04—Managed Innovation -10 40 45 20 ### 90 0 0 40 0 0 25 70 70 3 3
APO05—Managed Portfolio 0 30 -15 -5 ### 10 0 0 30 0 0 40 35 35 2 2
APO06—Managed Budget & Costs -20 -5 -20 -10 ### -50 0 0 25 0 0 -20 -20 -20 1 1
APO07—Managed Human Resources 15 35 15 15 ### 75 30 0 15 0 0 75 90 90 4 4
APO08—Managed Relationships 0 35 40 5 ### 75 0 0 25 0 0 55 70 70 3 3
APO09—Managed Service Agreements 0 30 10 -10 ### 30 30 0 10 15 0 0 40 40 2 2
APO10—Managed Vendors -20 30 -10 -10 ### -10 50 15 5 15 0 40 50 50 3 3
APO11—Managed Quality 5 0 30 -15 ### 20 30 0 15 0 0 0 30 30 2 2
APO12—Managed Risk 0 -10 50 -5 ### 35 65 25 20 10 0 20 80 80 4 4
APO13—Managed Security 0 -15 60 -15 ### 30 65 15 25 0 0 0 60 60 3 3
APO14—Managed Data 0 -35 35 -15 ### -15 50 10 25 0 0 20 40 40 2 2
BAI01—Managed Programs 20 30 15 15 ### 75 0 0 25 0 30 25 70 70 3 3
BAI02—Managed Requirements Definition -5 30 15 0 ### 40 0 0 30 0 60 30 70 70 3 3
BAI03—Managed Solutions Identification & Build -5 30 35 -10 ### 45 0 0 30 0 65 40 85 85 4 4
BAI04—Managed Availability & Capacity 5 25 35 -15 ### 45 30 0 5 0 0 0 40 40 2 2
BAI05—Managed Organizational Change 25 30 45 5 ### 100 0 0 25 0 40 35 95 95 4 4
BAI06—Managed IT Changes 10 30 45 0 ### 80 50 0 5 0 60 20 100 100 4 4
BAI07—Managed IT Change Acceptance and Transitioning 5 30 30 -5 ### 55 0 0 20 0 40 30 70 70 3 3
BAI08—Managed Knowledge -10 40 15 20 ### 60 0 0 25 0 0 30 55 55 3 3
BAI09—Managed Assets 0 -50 20 5 ### -25 0 0 25 0 0 0 0 0 1 1
BAI10—Managed Configuration 0 25 40 0 ### 60 50 0 15 0 15 30 80 80 4 4
BAI11—Managed Projects 15 30 35 10 ### 85 0 0 20 0 45 30 85 85 4 4
DSS01—Managed Operations 0 30 -5 -15 ### 10 0 0 10 0 0 0 10 10 1 1
DSS02—Managed Service Requests & Incidents 5 15 30 -20 ### 30 50 0 15 0 0 0 45 45 2 2
DSS03—Managed Problems 5 15 15 -5 ### 30 30 0 20 0 0 30 50 50 3 3
DSS04—Managed Continuity 5 15 15 -15 ### 20 65 15 20 0 0 30 70 70 3 3
© 2018 ISACA. All rights reserved. 645518342.xlsx Canvas—Page 2

02/17/2023
COBIT® 2019 Governance System Design Workbook—Canvas
Step 2: Determine the initial scope of the Governance System Step 3: Refine the scope of the Governance System Step 4: Conclude the Scope of the Governance System
Enterprise I&T-Related Threat Role of Sourcing IT Implementation Refined Scope: Concluded Scope:
Design Factors: Enterprise Strategy Goals Risk Profile Issues
Initial Scope: Governance/
Management Objectives Landscape Compliance Req's IT Model Methods Technology Adoption Strategy
Governance/ Adjustment
(between -100 and Reason
Governance/ Suggested
Target Capability Agreed Target Reason
for IT Management Objectives Management Objectives Capability Level
Score +100) Level
Score Priority
Weight 1 1 1 1 1 1 1 1 1 1
DSS05—Managed Security Services 0 -10 20 -15 ### -5 50 25 20 0 0 30 55 55 3 3
DSS06—Managed Business Process Controls 0 20 40 -25 ### 35 50 0 35 0 0 0 55 55 3 3
MEA01—Managed Performance and Conformance Monitoring 0 0 10 -5 ### 5 50 0 25 10 15 35 65 65 3 3
MEA02—Managed System of Internal Control 0 -15 5 -15 ### -25 30 0 25 0 0 0 15 15 1 1
MEA03—Managed Compliance with External Requirements 0 -30 25 -30 ### -35 50 25 15 0 0 0 25 25 2 2
MEA04—Managed Assurance 0 -25 20 -10 ### -15 50 20 25 0 0 0 35 35 2 2
© 2018 ISACA. All rights reserved. 645518342.xlsx Canvas—Page 3

02/17/2023
Information & Technology Governance System Design Information & Technology Governance System Design
Design Factor 1 Enterprise Strategy Design Factor 1 Enterprise Strategy
Input Section—Importance of Each Enterprise Strategy Archetype Input Section—Importance of Each Enterprise Strategy Archetype
Value Importance Baseline Design Factor 1 Enterprise Strategy

(1-5)
Importance of different strategies (Input)
Growth/Acquisition 5 3
Innovation/Differentiation 2 3
Cost Leadership 1 3
Client Service/Stability 3 3
5
Average 2.75 Strategy

Design Factor 1 Enterprise 4
Stdev
Importance of different strategies
1.48 (Input)
Correction Factor 1.09 3 3
0 1 2 4 5
5 1
Innovation/Differentiation
1
Client Service/Stability
Output Section—Resulting relative importance of each governance/management objective Output Section—Resulting relative importance of each governance/management objective
Resulting Governance/Management Design Factor 1 Enterprise Strategy Design Factor 1 Enterprise Strategy
Objectives Importance Resulting Governance/Management Objectives Resulting Governance/Management Objectives Importance (Output)
Importance (Output)
Governance /
Management Score Baseline Relative
EDM02 EDM01 MEA04
Objective Score Importance
EDM03 MEA03
-100 -75 -50 -25 0 25 50 75 100
EDM04 MEA02
EDM01 13 15 -5 EDM01 100
EDM05 MEA01
EDM02
EDM03 75
© 2018 ISACA. All rights reserved. 645518342.xlsx APO01 DSS06 DF1—Page 4
EDM04
50
EDM05 APO02 DSS05
Design Factor 1 Enterprise Strategy Design Factor 1 Enterprise Strategy
Resulting Governance/Management Objectives Resulting Governance/Management Objectives Importance (Output) 02/17/2023
Importance (Output)
EDM01
Information & Technology Governance System Design EDM03
Information
EDM02 & Technology
MEA04
MEA03
Governance System Design
-100 -75 -50 Design
-25 Factor
0 251 Enterprise
50 75Strategy
100
EDM04
Design Factor
MEA02
1 Enterprise Strategy
EDM01 100
EDM02 EDM05 MEA01
22 24 0 EDM02
EDM03 14 15 0 EDM03 75
APO01 DSS06
EDM04 16.5 22.5 -20 EDM04
50
EDM05 17.5 18 5 EDM05 APO02 DSS05
APO01 11 12 0 APO01 25
APO02 29 28.5 10 APO02 APO03 DSS04
0
APO03 28 24 25 APO03
APO04 17 21 -10 APO04 APO04 -25 DSS03
APO05 31 33 0 APO05
APO06 -50
APO06 16.5 22.5 -20 APO05 DSS02
APO07 16 15 15 APO07 -75
APO08 19.5 21 0 APO08
APO09 APO06 -100 DSS01
APO09 20.5 22.5 0
APO10 APO10
15 21 -20
APO11 APO11
20 21 5 APO07 BAI11
APO12 APO12
16.5 18 0
APO13
APO13 15.5 16.5 0
APO14 APO08 BAI10
APO14 11 12 0
BAI01
BAI01 30 27 20
BAI02 APO09 BAI09
BAI02 11.5 13.5 -5
BAI03
BAI03 11.5 13.5 -5
BAI04 APO10 BAI08
BAI04 17 18 5
BAI05
BAI05 29.5 25.5 25 APO11 BAI07
BAI06
BAI06 19.5 19.5 10
BAI07 APO12 BAI06
BAI07 17 18 5 BAI08
BAI08 APO13 BAI05
16 19.5 -10 BAI09 APO14 BAI04
BAI09 11 12 0 BAI01 BAI02 BAI03
BAI10
BAI10 11 12 0 BAI11
BAI11 28 27 15 DSS01
DSS01 12.5 13.5 0 DSS02
DSS02 20 21 5 DSS03
DSS03 17 18 5 DSS04
DSS04 20 21 5 DSS05
DSS05 15.5 16.5 0 DSS06
DSS06 12.5 13.5 0 MEA01
MEA01 11 12 0 MEA02
MEA02 11 12 0 MEA03
MEA03 11 12 0 MEA04
MEA04 11 12 0
© 2018 ISACA. All rights reserved. 645518342.xlsx DF1—Page 5

02/17/2023
Growth / Innovation / Client Service /

DF1 Acquisition Differentiation
Cost Leadership
Stability
EDM01 1.0 1.0 1.5 1.5
EDM02 1.5 1.0 2.0 3.5
EDM03 1.0 1.0 1.0 2.0
EDM04 1.5 1.0 4.0 1.0
EDM05 1.5 1.5 1.0 2.0
APO01 1.0 1.0 1.0 1.0
APO02 3.5 3.5 1.5 1.0
APO03 4.0 2.0 1.0 1.0
APO04 1.0 4.0 1.0 1.0
APO05 3.5 4.0 2.5 1.0
APO06 1.5 1.0 4.0 1.0
APO07 2.0 1.0 1.0 1.0
APO08 1.0 1.5 1.0 3.5
APO09 1.0 1.0 1.5 4.0
APO10 1.0 1.0 3.5 1.5
APO11 1.0 1.0 1.0 4.0
APO12 1.0 1.5 1.0 2.5
APO13 1.0 1.0 1.0 2.5
APO14 1.0 1.0 1.0 1.0
BAI01 4.0 2.0 1.5 1.5
BAI02 1.0 1.0 1.5 1.0
BAI03 1.0 1.0 1.5 1.0
BAI04 1.0 1.0 1.0 3.0
BAI05 4.0 2.0 1.0 1.5
BAI06 2.0 2.0 1.0 1.5
BAI07 1.5 2.0 1.0 1.5
BAI08 1.0 3.5 1.0 1.0
BAI09 1.0 1.0 1.0 1.0
BAI10 1.0 1.0 1.0 1.0
BAI11 3.5 3.0 1.5 1.0
DSS01 1.0 1.0 1.0 1.5
© 2018 ISACA. All rights reserved. 645518342.xlsx DF1map—Page 6

02/17/2023
Growth / Innovation / Client Service /

DF1 Acquisition Differentiation
Cost Leadership
Stability
DSS02 1.0 1.0 1.0 4.0
DSS03 1.0 1.0 1.0 3.0
DSS04 1.0 1.0 1.0 4.0
DSS05 1.0 1.0 1.0 2.5
DSS06 1.0 1.0 1.0 1.5
MEA01 1.0 1.0 1.0 1.0
MEA02 1.0 1.0 1.0 1.0
MEA03 1.0 1.0 1.0 1.0
MEA04 1.0 1.0 1.0 1.0

02/17/2023
Design Factor 2 Enterprise Goals Design Factor 2 Enterprise Goals
Input Section—Importance of Each Enterprise Goal Input Section—Importance of Each Enterprise Goal
Value Importance Baseline

(1-5)
EG01—Portfolio of competitive products and services 4 3 Design Factor 2 Enterprise Goals (Input)
EG02—Managed business risk 2 3
EG03—Compliance with external laws and regulations 2 3 EG01—Portfolio of competitive products and services 4
EG04—Quality of financial information 1 3
EG05—Customer-oriented service culture 2 3 EG02—Managed business risk 2
EG06—Business-service continuity and availability 3 3
EG07—Quality of management information 2 3 EG03—Compliance with external laws and regulations 2
EG08—Optimization of internal business process functionality 3 3
EG04—Quality of financial information 1
EG09—Optimization of business process costs 1 3
EG10—Staff skills, motivation and productivity 4 3
EG05—Customer-oriented service culture 2
EG11—Compliance with internal policies 2 3
EG12—Managed digital transformation programs 5 3
EG06—Business-service continuity and availability 3
EG13—Product and business innovation 5 3
Average 2.77
EG07—Quality of management information 2
Design Factor 2 Enterprise Goals (Input) Stdev 1.31
Correction Fact 1.08 EG08—Optimization of internal business process functionality 3
EG09—Optimization of business process costs 1

EG01—Portfolio of competitive products and services
EG13—Product and business innovation EG02—Managed business risk EG10—Staff skills, motivation and productivity 4
5
EG12—Managed digital transformation programs 4 EG03—Compliance with external laws and regulations
3 EG11—Compliance with internal policies 2
2
EG11—Compliance with internal policies 1 EG04—Quality of financial information
0 EG12—Managed digital transformation programs 5
EG10—Staff skills, motivation and productivity EG05—Customer-oriented service culture EG13—Product and business innovation 5
EG01—Portfolio of competitive products and services
EG13—Product and business innovation
EG02—Managed business risk EG10—Staff skills, motivation and productivity 4 02/17/2023
5
EG12—Managed digital transformation programs 4 EG03—Compliance with external laws and regulations
3 Information & Technology Governance System Design EG11—Compliance with internal policies 2
Information & Technology Governance System Design
2 Design Factor 2 Enterprise Goals Design Factor 2 Enterprise Goals
EG11—Compliance with internal policies 1 EG04—Quality of financial information
0 EG12—Managed digital transformation programs 5
EG10—Staff skills, motivation and productivity EG05—Customer-oriented service culture EG13—Product and business innovation 5
EG09—Optimization of business process costs EG06—Business-service continuity and availability

EG08—Optimization of internal business process functionality EG07—Quality of management information
Resulting Governance/ Management Objectives

Importance
Governance /
Management Score Baseline Relative Design Factor 2 Enterprise Goals
Score Importance Design Factor 2 Enterprise Goals Resulting Governance/Management Objectives Importance
Objective
Resulting Governance/ Man-
EDM01 99 99 10 agement Objectives Importance
EDM02 141 114 35
EDM03 48 63 -15
EDM04 156 129 30
-100 -75 -50 -25 0 25 50 75 100
EDM05 32 63 -45 EDM01
EDM01 EDM02 MEA04
APO01 174 180 5 EDM02
EDM03 MEA03
APO02 EDM04 MEA02
165 132 35 EDM03
APO03 163 135 30 EDM04 EDM05 100 MEA01
APO04 EDM05
156 120 40 APO01 75 DSS06
APO01
APO05 168 141 30 APO02
APO06 101 117 -5 APO02 50 DSS05
APO03
APO07 136 108 35 APO04 25
APO05 APO03 DSS04
APO08 237 189 35
APO06 0
APO07 APO04 DSS03
APO08 -25
APO09
-50
APO10 APO05 DSS02
EDM04 MEA02
EDM03
EDM04 EDM05 100 MEA01
EDM05 02/17/2023
COBIT® 2019 Governance System Design Toolkit APO01 DSS06
APO01 75
APO02
APO02 50 DSS05
Information & Technology
APO03 Governance System Design Information & Technology Governance System Design
APO04
Design Factor 2 Enterprise Goals 25 Design Factor 2 Enterprise Goals
APO05 APO03 DSS04
APO06 0
APO09 76 63 30 APO07 APO04 DSS03
APO10 94 78 30 APO08 -25
APO11 121 132 0 APO09
-50
APO10 APO05 DSS02
APO12 30 36 -10
APO11 -75
APO13 31 39 -15 APO12
APO14 45 78 -35 APO13 APO06 -100 DSS01
BAI01 155 129 30 APO14
BAI02 210 174 30 BAI01
BAI02 APO07 BAI11
BAI03 200 165 30 BAI03
BAI04 79 69 25 BAI04
APO08 BAI10
BAI05 220 183 30 BAI05
BAI06 108 90 30 BAI06
BAI07 APO09 BAI09
BAI07 82 69 30 BAI08
BAI08 172 135 40 BAI09 APO10 BAI08
BAI09 23 51 -50 BAI10
BAI10 21 18 25 BAI11 APO11 BAI07
DSS01
BAI11 165 138 30 APO12 BAI06
DSS02
DSS01 76 63 30 DSS03 APO13 BAI05
DSS02 57 54 15 DSS04 APO14 BAI04
DSS03 57 54 15 DSS05 BAI01 BAI02 BAI03
DSS06
DSS04 57 54 15
MEA01
DSS05 69 81 -10 MEA02
DSS06 114 105 20 MEA03
MEA01 123 135 0 MEA04
MEA02 108 135 -15
MEA03 26 39 -30
MEA04 79 111 -25

02/17/2023
Agile portfolio of Compliance with external Transparency and Customer-oriented service Business service continuity Quality of management Optimization of internal Optimization of business Staff skills, motivation and Compliance with internal Managed business Product and business
competitive products and Managed business risks accuracy of financial business process
services laws and regulations information culture and availability information functionality process costs productivity policies transformation programs innovation
4 2 2 1 2 3 2 3 1 4 2 5 5
AG01 AG02 AG03 AG04 AG05 AG06 AG07 AG08 AG09 AG10 AG11 AG12 AG13
IT compliance and Enablement and Competent and

Mapping table EG-GA support for business Managed Technology & Realized benefits from Quality of technology delivery of IT services Agility to turn business Security of information, support of business Delivery of programs Quality of IT motivated staff with Knowledge, expertise
processing on time, on budget, and IT compliance with
compliance with Information related IT-enabled investments related financial in line with business requirements into processes by Management mutual understanding and initiatives for
infrastructure and meeting requirements internal policies
external laws and risks and services portfolio information requirements operational solutions applications Integrating applications and quality standards Information of technology and business innovation
regulations and technology business.
EG01 Portfolio of agile and competitive 0 0 1 0 2 2 0 2 2 0 0 0 2

products and services
EG02 Managed business risks 1 2 0 0 0 0 1 0 0 0 1 0 0
Compliance with external laws and

EG03 2 0 0 0 0 0 0 0 0 0 2 0 0
regulations
Transparency and accuracy of financial
EG04 0 0 0 2 0 0 0 0 0 2 0 0 0
information
EG05 Customer-oriented service culture 0 0 1 0 1 1 0 2 1 0 0 1 0
Business service continuity and

EG06 0 1 0 0 1 0 2 0 0 0 0 0 0
availability
Accuracy (Quality?) of Management
EG07 0 0 0 2 0 0 0 0 0 2 0 0 0
Information
Optimization of business process
EG08 0 0 1 0 1 1 0 1 1 0 0 0 0
functionality
EG09 Optimization of business process costs 0 0 1 2 0 0 0 0 1 1 0 0 0
EG10 Staff skills, motivation and productivity 0 0 0 0 0 0 0 1 0 0 0 2 0
EG11 Compliance with internal policies 1 0 0 0 0 0 0 0 0 0 2 0 0
EG12 Managed business transformation 0 0 2 0 1 1 0 2 2 0 0 0 1

programs
EG13 Product and business innovation 0 0 0 0 0 1 0 1 1 0 0 0 2
AG01 AG02 AG03 AG04 AG05 AG06 AG07 AG08 AG09 AG10 AG11 AG12 AG13
IT compliance and Security of information, Enablement and Delivery of programs Competent and
support for business Managed Technology & Realized benefits from Quality of technology delivery of IT services Agility to turn business support of business Quality of IT motivated staff with Knowledge, expertise
compliance with Information related IT-enabled investments related financial in line with business requirements into processing processes by on time, on budget, and Management IT compliance with mutual understanding and initiatives for
infrastructure and meeting requirements internal policies
external laws and risks and services portfolio information requirements operational solutions Integrating applications Information of technology and business innovation
applications and quality standards
regulations and technology business.
8 7 20 8 21 23 8 34 29 7 10 10 23
EDM01 EDM02 EDM03 EDM04 EDM05 APO01 APO02 APO03 APO04 APO05 APO06 APO07 APO08 APO09 APO10 APO11 APO12 APO13 APO14 BAI01 BAI02 BAI03 BAI04 BAI05 BAI06 BAI07 BAI08 BAI09 BAI10 BAI11 DSS01 DSS02 DSS03 DSS04 DSS05 DSS06 MEA01 MEA02 MEA03 MEA04
Managed
Managed Managed IT Managed Managed Performance Managed Managed
Mapping Table AG-GMO Ensured Governance Managed Managed Managed Managed Managed Managed
Framework Setting & Ensured Benefits Delivery Ensured Risk Optimization Ensured Resource
Optimization
Ensured Stakeholder
Transparency
Managed IT Management Managed Strategy
Framework Managed Architecture Managed Innovation Managed Portfolio Managed Budget & Costs Managed
Resources
Human Managed Relationships Service Managed
Suppliers
Managed
Quality Managed Risk Information Managed
Data
Managed
Programs Requirements Solutions Managed IT
Identification Availability & Organizationa Changes
Change Managed
Acceptance & Knowledge
Managed
Assets
Managed Managed
Configuration Projects
Managed
Operations
Service
Requests &
Managed
Problems
Managed
Continuity Security Business
Process & System of
Internal
Compliance Managed
with External Internal Audit
Maintenance Agreements Security Definition & Build Capacity l Change Transitioning Incidents Services Controls Conformance Control Requirements
Monitoring
IT compliance and support for business

AG01 compliance with external laws and 1 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 2 1
regulations
Managed Technology & Information

AG02 related risks 1 0 2 0 0 1 0 0 0 0 0 0 0 0 0 0 2 1 1 0 0 0 0 0 1 1 0 0 0 0 0 1 1 1 2 1 0 1 0 1
AG03 Realized benefits from IT-enabled 2 2 0 1 0 2 1 1 1 2 1 1 1 0 0 1 0 0 0 2 1 1 0 2 0 0 1 0 0 2 0 0 0 0 0 0 1 0 0 0

investments and services portfolio
Quality of technology related financial
AG04 information 0 0 0 0 1 0 0 0 0 0 2 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 1 0 1
Delivery of IT services in line with business

AG05 requirements 0 1 0 1 0 1 1 1 0 2 0 1 2 2 2 1 0 0 0 0 2 2 2 1 1 0 0 0 1 1 2 2 2 2 1 1 2 1 0 1
AG06 Agility to turn business requirements into 0 1 0 1 0 0 1 2 2 1 0 0 2 0 1 0 0 0 0 1 2 2 0 1 2 2 1 0 0 2 0 0 0 0 0 0 0 0 0 0

operational solutions
Security of information, processing
AG07 infrastructure and applications 0 0 2 0 0 1 0 1 0 0 0 0 0 0 0 0 2 2 1 0 0 0 1 0 0 0 0 0 0 0 0 1 1 1 2 1 0 1 0 1
Enablement and support of business

AG08 processes by Integrating applications and 1 1 0 1 0 1 2 2 1 1 0 0 1 1 0 0 0 0 0 1 1 1 0 2 1 0 1 0 0 0 1 0 0 0 0 2 0 0 0 0
technology
Delivery of programs on time, on budget,

AG09 and meeting requirements and quality 0 0 0 2 0 1 0 0 0 1 2 1 1 0 1 2 0 0 0 2 2 2 1 2 0 1 1 0 0 2 0 0 0 0 0 0 1 1 0 0
standards
AG10 Quality of IT Management Information 0 0 0 0 2 1 0 0 0 0 1 0 0 0 0 2 0 0 2 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 2 1 0 1

AG11 IT compliance with internal policies 1 0 1 0 1 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 2 1 2
Competent and motivated staff with
AG12 mutual understanding of technology and 0 0 0 0 0 0 1 0 1 0 0 2 2 0 0 0 0 0 0 0 1 0 0 1 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0
business.
Knowledge, expertise and initiatives for
AG13 business innovation 0 1 0 0 0 0 1 0 2 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0
EDM01 EDM02 EDM03 EDM04 EDM05 APO01 APO02 APO03 APO04 APO05 APO06 APO07 APO08 APO09 APO10 APO11 APO12 APO13 APO14 BAI01 BAI02 BAI03 BAI04 BAI05 BAI06 BAI07 BAI08 BAI09 BAI10 BAI11 DSS01 DSS02 DSS03 DSS04 DSS05 DSS06 MEA01 MEA02 MEA03 MEA04
Managed Managed IT Managed Managed Managed

Ensured Governance Managed Managed Managed Managed Managed Managed Performance Managed Managed
Framework Setting & Ensured Resource Ensured Stakeholder Managed IT Management Managed Human Service Managed Managed Managed Managed Requirements Solutions Availability & Organizationa Managed IT Change Managed Managed Managed Managed Managed Service Managed Managed Business System of Compliance Managed
Ensured Benefits Delivery Ensured Risk Optimization Optimization Transparency Framework Managed Strategy Managed Architecture Managed Innovation Managed Portfolio Managed Budget & Costs Resources Managed Relationships Suppliers Quality Managed Risk Information Data Programs Identification Capacity Changes Acceptance & Knowledge Assets Configuration Projects Operations Requests & Problems Continuity
Security
Process
&
Maintenance Agreements Security Definition l Change Services Conformance Internal with External Internal Audit
& Build Transitioning Incidents Controls Monitoring Control Requirements
99 141 48 156 32 174 165 163 156 168 101 136 237 76 94 121 30 31 45 155 210 200 79 220 108 82 172 23 21 165 76 57 57 57 69 114 123 108 26 79
Baseline 99 114 63 129 63 180 132 135 120 141 117 108 189 63 78 132 36 39 78 129 174 165 69 183 90 69 135 51 18 138 63 54 54 54 81 105 135 135 39 111
Imp® 0 23 -24 20 -50 -4 25 20 30 19 -14 25 25 20 20 -9 -17 -21 -43 20 20 21 14 20 20 18 27 -55 16 19 20 5 5 5 -15 8 -9 -20 -34 -29

02/17/2023
Design Factor 3 Risk Profile Design Factor 3 Risk Profile
Input Section—Importance of Each Generic IT Risk Category Input Section—Importance of Each Generic IT Risk Category
Impact Likelihood Design Factor 3 IT Risk Profile

Risk Scenario Category (1-5) (1-5) Risk Rating Baseline
Risk Rating of IT Risk Scenario Categories (Input)
IT investment decision making, portfolio definition &
maintenance 2 2 9 Very High Risk 0 5 10 15 20 25
IT investment decision making, portfolio definition & maintenance
Program & projects life cycle management 4 3 9 High Risk
Program & projects life cycle management
IT cost & oversight 2 2 9 Normal Risk
IT cost & oversight
IT expertise, skills & behavior 4 4 9 Low Risk
IT expertise, skills & behavior
Enterprise/IT architecture 2 2 9
Enterprise/IT architecture
IT operational infrastructure incidents 3 2 9
Unauthorized actions 3 4 9 IT operational infrastructure incidents
Software adoption/usage problems 4 3 9 Unauthorized actions
Hardware incidents 2 2 9 Software adoption/usage problems

Software failures 3 3 9 Hardware incidents
Logical attacks (hacking, malware, etc.) 4 5 9
Software failures
Third-party/supplier incidents 2 2 9
Logical attacks (hacking, malware, etc.)
Noncompliance 3 3 9
Third-party/supplier incidents
Geopolitical Issues 2 2 9
Industrial action 1 3 9 Noncompliance
Acts of nature 3 3 9 Geopolitical Issues
Technology-based innovation 5 3 9 Industrial action

Environmental 2 3 9 Acts of nature
Data & information management 4 4 9
Technology-based innovation
Environmental
Average 8.89
Stdev 5.06 Data & information management
Correction Factor 1.01

02/17/2023
Resulting Governance/Management
Objectives Importance Design Factor 3 IT Risk Profile Design Factor 3 IT Risk Profile
Resulting Governance/Management Resulting Governance/Management Objectives Importance
Governance / Baseline Relative Objectives Importance
Management Score Score Importance
Objective
EDM01 181 189 -5 -100 -75 -50 -25 0 25 50 75 100

EDM02 152 135 15 EDM01
EDM03 EDM02
180 162 10
EDM04 EDM03
167 198 -15
EDM04
EDM05 156 189 -15
EDM05
APO01 366 324 15 EDM02 EDM01 MEA04
APO01 EDM03 MEA03
APO02 134 144 -5
APO02 EDM04 MEA02
APO03 192 171 15
APO03 EDM05 MEA01
APO04 64 45 45 100
APO04
APO05 118 144 -15 APO01 DSS06
APO05 75
APO06 118 153 -20 APO06 APO02 DSS05
APO07 250 216 15 50
APO07
APO08 213 153 40 APO08 25
APO03 DSS04
APO09 129 117 10 APO09 0
APO10 196 216 -10 APO10 APO04 DSS03
APO11 -25
128 99 30 APO11
APO12 132 90 50 APO12 APO05 -50 DSS02
APO13 155 99 60 APO13 -75
APO14 263 198 35 APO14
APO06 -100 DSS01
BAI01 92 81 15 BAI01
BAI02 134 117 15 BAI02
BAI03 155 117 35 BAI03 APO07 BAI11
BAI04 12 9 35 BAI04
BAI05 104 72 45 BAI05 APO08 BAI10
BAI06 192 135 45 BAI06
BAI07 BAI07 APO09 BAI09

148 117 30
BAI08
BAI08 151 135 15
BAI09 APO10 BAI08
BAI09 42 36 20
BAI10
BAI11 APO11 BAI07
© 2018 ISACA. All rights reserved. DSS01 645518342.xlsx APO12 BAI06 DF3—Page 14
DSS02 APO13 BAI05
BAI03 APO07 BAI11
BAI04
BAI05 02/17/2023
COBIT® 2019 Governance System Design Toolkit APO08 BAI10
BAI06
BAI07 APO09 BAI09
BAI08
Governance System Design Information & Technology Governance System Design
BAI09 APO10 BAI08
BAI10
BAI10 138 99 40 APO11 BAI07
BAI11
BAI11 48 36 35
DSS01 APO12 BAI06
DSS01 128 135 -5
DSS02 APO13 BAI05
DSS02 184 144 30 DSS03 APO14 BAI04
DSS03 125 108 15 BAI01 BAI02 BAI03
DSS04
DSS04 241 216 15 DSS05
DSS05 256 216 20 DSS06
DSS06 196 144 40 MEA01
MEA01 234 216 10 MEA02
MEA02 256 243 5 MEA03
MEA03 186 153 25 MEA04
MEA04 264 225 20

02/17/2023
RISKCAT01 RISKCAT02 RISKCAT03 RISKCAT04 RISKCAT05 RISKCAT06 RISKCAT07 RISKCAT08 RISKCAT09 RISKCAT10 RISKCAT11 RISKCAT12 RISKCAT13 RISKCAT14 RISKCAT15 RISKCAT16 RISKCAT17 RISKCAT18 RISKCAT19
DF3 IT Investment
Decision Making,
Program &
Projects Life IT Cost & IT Expertise,
Skills &
Enterprise/ IT Operational
Infrastructure
Unauthorized
Software
Adoption/ Hardware Software Logical Attacks
(Hacking,
Third-Party/
Supplier Noncompliance
Geopolitical Industrial
Acts of Nature
Technology-
Based Environmental
Data &
Information
Portfolio Definition & Cycle Oversight IT Architecture Actions Usage Incidents Failures Issues Action
Maintenance Management Behavior Incidents Problems Malware, etc.) Incidents Innovation Management
EDM01 3.0 2.0 3.0 0.0 0.0 0.0 2.0 0.0 0.0 0.0 0.0 0.0 3.0 2.0 0.0 0.0 2.0 2.0 2.0
EDM02 3.0 2.0 0.0 0.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 3.0 1.0 3.0
EDM03 2.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 2.0 0.0 3.0 3.0 0.0 0.0 0.0 2.0 3.0
EDM04 3.0 0.0 4.0 3.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 2.0 1.0 0.0 2.0 0.0 0.0 2.0 3.0
EDM05 3.0 1.0 3.0 0.0 0.0 0.0 2.0 0.0 0.0 1.0 0.0 1.0 3.0 3.0 0.0 0.0 0.0 2.0 2.0
APO01 2.0 3.0 2.0 0.0 2.0 2.0 4.0 2.0 0.0 2.0 3.0 3.0 3.0 0.0 0.0 0.0 3.0 2.0 3.0
APO02 2.0 0.0 0.0 0.0 3.0 0.0 0.0 2.0 1.0 0.0 1.0 2.0 0.0 0.0 0.0 0.0 2.0 2.0 1.0
APO03 2.0 0.0 0.0 0.0 4.0 0.0 0.0 2.0 0.0 2.0 2.0 2.0 0.0 0.0 0.0 0.0 2.0 0.0 3.0
APO04 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 4.0 0.0 0.0
APO05 4.0 2.0 2.0 0.0 2.0 0.0 0.0 2.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.0 0.0 0.0
APO06 2.0 3.0 4.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.0 0.0 2.0 0.0 0.0 2.0 2.0 0.0
APO07 0.0 0.0 0.0 4.0 0.0 2.0 3.0 3.0 0.0 0.0 2.0 0.0 0.0 2.0 4.0 0.0 2.0 2.0 0.0
APO08 0.0 0.0 0.0 2.0 2.0 0.0 0.0 4.0 0.0 0.0 2.0 2.0 0.0 0.0 0.0 0.0 3.0 0.0 2.0
APO09 0.0 0.0 2.0 0.0 0.0 0.0 2.0 3.0 0.0 1.0 2.0 3.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
APO10 0.0 2.0 3.0 0.0 0.0 0.0 2.0 2.0 3.0 2.0 2.0 4.0 2.0 2.0 0.0 0.0 0.0 0.0 0.0
APO11 0.0 3.0 0.0 0.0 0.0 0.0 0.0 2.0 0.0 4.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.0
APO12 0.0 0.0 0.0 0.0 0.0 0.0 3.0 0.0 0.0 2.0 3.0 0.0 0.0 0.0 0.0 2.0 0.0 0.0 0.0
APO13 0.0 0.0 0.0 0.0 0.0 0.0 4.0 0.0 0.0 0.0 4.0 0.0 3.0 0.0 0.0 0.0 0.0 0.0 0.0
APO14 0.0 0.0 0.0 0.0 0.0 0.0 3.0 2.0 0.0 0.0 2.0 0.0 3.0 0.0 2.0 4.0 2.0 0.0 4.0
BAI01 0.0 4.0 0.0 0.0 2.0 0.0 0.0 3.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI02 2.0 2.0 0.0 0.0 2.0 0.0 0.0 3.0 0.0 2.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI03 0.0 3.0 0.0 0.0 2.0 0.0 0.0 2.0 0.0 3.0 3.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI04 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI05 0.0 2.0 0.0 2.0 0.0 0.0 0.0 4.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI06 0.0 0.0 0.0 0.0 0.0 3.0 4.0 0.0 0.0 2.0 3.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 3.0
BAI07 0.0 0.0 0.0 0.0 0.0 2.0 3.0 2.0 0.0 4.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI08 0.0 0.0 0.0 2.0 0.0 3.0 0.0 3.0 0.0 3.0 0.0 0.0 0.0 0.0 2.0 0.0 0.0 0.0 2.0
BAI09 0.0 0.0 0.0 0.0 0.0 1.0 3.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI10 0.0 0.0 0.0 0.0 0.0 2.0 4.0 0.0 0.0 2.0 3.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
BAI11 0.0 4.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
DSS01 0.0 0.0 0.0 0.0 0.0 4.0 3.0 0.0 4.0 0.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 2.0 0.0
DSS02 0.0 0.0 0.0 0.0 0.0 3.0 2.0 3.0 2.0 2.0 4.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
DSS03 0.0 0.0 0.0 0.0 0.0 3.0 1.0 4.0 0.0 3.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
DSS04 0.0 0.0 0.0 0.0 0.0 3.0 3.0 0.0 3.0 0.0 4.0 0.0 2.0 0.0 3.0 4.0 0.0 0.0 2.0
DSS05 0.0 0.0 0.0 0.0 0.0 3.0 4.0 0.0 2.0 0.0 4.0 0.0 3.0 0.0 3.0 2.0 0.0 0.0 3.0
DSS06 0.0 0.0 0.0 0.0 0.0 3.0 4.0 2.0 0.0 0.0 2.0 0.0 2.0 0.0 0.0 0.0 0.0 0.0 3.0

02/17/2023
RISKCAT01 RISKCAT02 RISKCAT03 RISKCAT04 RISKCAT05 RISKCAT06 RISKCAT07 RISKCAT08 RISKCAT09 RISKCAT10 RISKCAT11 RISKCAT12 RISKCAT13 RISKCAT14 RISKCAT15 RISKCAT16 RISKCAT17 RISKCAT18 RISKCAT19
DF3 IT Investment
Decision Making,
Program &
Projects Life IT Cost & IT Expertise,
Skills &
Enterprise/ IT Operational
Infrastructure
Unauthorized
Software
Adoption/ Hardware Software Logical Attacks
(Hacking,
Third-Party/
Supplier Noncompliance
Geopolitical Industrial
Acts of Nature
Technology-
Based Environmental
Data &
Information
Portfolio Definition & Cycle Oversight IT Architecture Actions Usage Incidents Failures Issues Action
Maintenance Management Behavior Incidents Problems Malware, etc.) Incidents Innovation Management
MEA01 1.0 2.0 2.0 0.0 0.0 2.0 2.0 0.0 0.0 2.0 3.0 2.0 2.0 2.0 0.0 2.0 0.0 0.0 2.0
MEA02 1.0 2.0 2.0 0.0 0.0 3.0 3.0 0.0 0.0 2.0 3.0 2.0 2.0 3.0 0.0 2.0 0.0 0.0 2.0
MEA03 0.0 1.0 0.0 0.0 0.0 1.0 2.0 0.0 0.0 0.0 3.0 2.0 4.0 2.0 0.0 0.0 0.0 0.0 2.0
MEA04 1.0 2.0 0.0 0.0 0.0 0.0 3.0 0.0 0.0 2.0 3.0 2.0 2.0 4.0 0.0 2.0 2.0 0.0 2.0

02/17/2023
Design Factor 4 I&T-Related Issues Design Factor 4 I&T-Related Issues
Input Section—Importance of Each Generic I&T-Related Issue Input Section—Importance of Each Generic I&T-Related Issue
Importance
I&T-Related Issue (1-3) Baseline Design Factor 4 I&T-Related Issues
Importance of I&T-Related Issues (Input)
Frustration between different IT entities across the organization because
of a perception of low contribution to business value 2 No Issue 0 1 2 3
Frustration between business departments (i.e., the IT customer) and the

IT department because of failed initiatives or a perception of low 2 Issue
contribution to business value
Significant I&T-related incidents, such as data loss, security breaches,

project failure and application errors, linked to IT 2 Serious Issue
oard members, executives or senior management to engage with IT, or a lack of committed business sponsorship for IT
Service delivery problems by the IT outsourcer(s) 2
Failures to meet IT-related regulatory or contractual requirements 2
Regular audit findings or other assessment reports about poor IT

2
performance or reported IT quality or service problems
Substantial hidden and rogue IT spending, that is, I&T spending by user
departments outside the control of the normal I&T investment decision 2
mechanisms and approved budgets
Duplications or overlaps between various initiatives, or other forms of

2
wasted resources
Insufficient IT resources, staff with inadequate skills or staff

2
burnout/dissatisfaction
IT-enabled changes or projects frequently failing to meet business needs

and delivered late or over budget 2
Reluctance by board members, executives or senior management to

2
engage with IT, or a lack of committed business sponsorship for IT
Complex IT operating model and/or unclear decision mechanisms for IT-

related decisions 2
Excessively high cost of IT 2
Obstructed or failed implementation of new initiatives or innovations

2
caused by the current IT architecture and systems

Reluctance by board members, executives or senior management to enga
02/17/2023
Design Factor 4 I&T-Related Issues Design Factor 4 I&T-Related Issues
Gap between business and technical knowledge, which leads to business

users and information and/or technology specialists speaking different 2
languages
Regular issues with data quality and integration of data across various
sources 2
High level of end-user computing, creating (among other problems) a lack

of oversight and quality control over the applications that are being 2
developed and put in operation
Business departments implementing their own information solutions with

little or no involvement of the enterprise IT department (related to end-
user computing, which often stems from dissatisfaction with IT solutions
2 Average 1.85
and services)
Ignorance of and/or noncompliance with privacy regulations 2 Stdev 0.79

Correction
Inability to exploit new technologies or innovate using I&T 2 1.08
Factor
Resulting Governance/ Management Design Factor 4 I&T-Related Issues

Objectives Importance Resulting Governance/ Management Objectives Design Factor 4 I&T-Related Issues
Importance Resulting Governance/Management Objectives Importance
Governance /
Management Score Baseline Relative
-100 -75 -50 -25 0 25 50 75 100
EDM01 59.5 70 -10 EDM01
EDM02 EDM02
61 70 -5
EDM03 EDM03
39 47 -10
EDM04
EDM04 65.5 67 5 EDM02 EDM01 MEA04
EDM05 EDM03 MEA03
EDM05 33 41 -15
APO01 EDM04 MEA02
APO01 50 56 -5
APO02
APO02 48 50 5 EDM05 100 MEA01
APO03
APO03 64.5 66 5 APO04 APO01 75 DSS06
APO04 35.5 32 20 APO05
APO05 61 68 -5 APO06 APO02 50 DSS05
APO06 52 62 -10 APO07
25
APO07 49 47 15 APO08 APO03 DSS04
APO09 0
APO10 APO04 DSS03
© 2018 ISACA. All rights reserved. 645518342.xlsx -25 DF4—Page 19
APO11
APO12 -50
APO05 DSS02
APO01 EDM04 MEA02
APO02
EDM05 100 MEA01
APO03 02/17/2023
APO04 APO01 75 DSS06
APO05
APO06 Governance System Design APO02 Information
50 & Technology GovernanceDSS05
System Design
Design
APO07 Factor 4 I&T-Related Issues Design Factor 4 I&T-Related Issues
25
APO08 APO03 DSS04
APO08 67.5 70 5 APO09 0
APO09 36.5 43 -10 APO10 APO04 DSS03
-25
APO10 33 39 -10 APO11
APO11 34 43 -15 APO12 -50
APO05 DSS02
APO12 44.5 52 -5 APO13
APO14 -75
APO13 26.5 33 -15
BAI01
APO14 48.5 60 -15 APO06 -100 DSS01
BAI02
BAI01 37.5 35 15
BAI03
BAI02 47 51 0
BAI04 APO07 BAI11
BAI03 35 41 -10
BAI05
BAI04 18.5 23 -15 BAI06
BAI05 27.5 28 5 BAI07
APO08 BAI10
BAI06 38 42 0 BAI08
BAI07 34 38 -5 BAI09 APO09 BAI09
BAI08 34.5 31 20 BAI10
BAI09 22 23 5 BAI11 APO10 BAI08
BAI10 23 25 0 DSS01
BAI11 DSS02 APO11 BAI07
46.5 45 10
DSS01 21 27 -15 DSS03
APO12 BAI06
DSS02 24.5 33 -20 DSS04
APO13 BAI05
DSS03 DSS05
28 32 -5 APO14 BAI04
DSS04 DSS06 BAI01 BAI03
16.5 21 -15 BAI02
MEA01
DSS05 22.5 29 -15
MEA02
DSS06 20 29 -25
MEA03
MEA01 52.5 61 -5
MEA04
MEA02 38 48 -15
MEA03 18.5 29 -30
MEA04 47 58 -10

02/17/2023
Frustration between different Frustration between business Significant IT-related Regular audit findings or Substantial hidden and rogue IT IT-enabled changes or Reluctance by board members, Complex IT operating model Obstructed or failed Gap between business and technical High level of end-user computing,
Duplications or overlaps Insufficient IT resources, staff creating (among other problems) a Business departments implementing
IT entities across the departments (i.e., the IT customer) incidents, such as data loss, Service delivery problems by Failures to meet IT-related other assessment reports spending, that is, IT spending by user between various initiatives with inadequate skills or projects frequently failing to executives or senior management and/or unclear decision implementation of new knowledge, which leads to business Regular issues with data lack of oversight and quality their own information solutions with Ignorance of and/or Inability to exploit new
DF4 organization because of a and the IT department because of security breaches, project the IT outsourcer(s) regulatory or contractual about poor IT performance departments outside the control of or other forms of wasted staff burnout / meet business needs and to engage with IT, or a lack of Excessively high cost of IT initiatives or innovations users and information and/or quality and integration of noncompliance with technologies or innovate
perception of low contribution failed initiatives or a perception of failure and application requirements or reported IT quality or the normal IT investment decision delivered late or over committed business sponsorship mechanisms for IT-related caused by the current IT technology specialists speaking data across various sources control over the applications that little or no involvement of the privacy regulations using I&T
to business value low contribution to business value errors, linked to IT service problems mechanisms and approved budgets resources dissatisfaction budget for IT decisions architecture and systems different languages are being developed and put in enterprise IT department
operation
EDM01 3.0 3.0 1.0 1.0 2.0 2.0 2.0 1.0 1.0 1.0 3.0 3.5 1.0 1.0 1.0 1.0 2.0 3.0 1.5 1.0 35
EDM02 2.5 3.0 1.0 1.0 1.5 2.5 2.0 1.5 0.5 2.5 1.5 1.0 3.0 2.0 1.0 1.0 2.0 2.0 1.0 2.5 35
EDM03 1.0 1.0 2.0 1.0 2.0 2.0 1.0 1.0 0.0 0.5 1.0 0.0 1.0 1.5 1.0 2.0 1.0 1.0 2.5 1.0 24
EDM04 1.0 1.0 1.0 1.0 1.0 2.0 3.0 3.5 3.5 1.0 1.5 0.0 4.0 2.0 1.0 1.5 2.0 2.5 0.0 1.0 34
EDM05 1.0 1.0 1.0 1.0 1.5 2.0 1.0 1.0 0.0 1.0 3.0 1.5 1.5 0.5 0.0 0.5 1.0 1.0 1.0 0.0 21
APO01 2.0 1.0 2.0 1.0 2.0 2.0 1.0 1.0 0.0 0.5 1.5 4.0 1.0 2.0 1.0 1.0 1.5 2.0 0.5 1.0 28
APO02 1.5 1.5 1.5 1.5 1.0 1.5 1.0 1.0 0.0 1.0 2.5 0.5 0.5 1.5 1.5 0.5 2.0 2.0 0.0 2.5 25
APO03 1.0 1.5 1.0 2.0 0.5 1.5 2.0 1.5 1.0 3.5 0.5 0.5 1.0 4.0 1.0 3.5 2.0 3.0 0.0 2.0 33
APO04 1.0 1.0 1.0 1.0 0.5 0.5 0.5 0.5 0.0 0.0 0.5 1.0 0.5 2.0 1.0 0.0 0.5 0.5 0.0 4.0 16
APO05 3.0 3.0 1.0 1.5 2.0 2.0 1.5 3.5 0.5 2.0 2.0 1.5 2.0 1.0 0.5 0.0 2.5 2.5 0.0 2.0 34
APO06 3.5 2.0 1.0 1.5 1.5 2.0 4.0 3.0 1.0 2.0 1.0 1.5 4.0 0.0 0.0 0.0 1.0 2.0 0.0 0.0 31
APO07 1.5 1.0 1.0 1.0 1.0 1.5 2.0 2.0 4.0 1.0 0.0 0.0 1.0 0.0 3.0 0.0 0.5 0.5 1.5 1.0 24
APO08 2.5 2.0 1.0 2.5 1.5 1.0 2.5 2.0 1.5 1.0 3.0 1.0 0.5 1.0 4.0 1.0 3.0 3.5 0.0 0.5 35
APO09 2.0 1.5 2.0 4.0 1.0 2.5 1.5 2.0 0.5 1.0 0.0 0.0 1.0 0.0 0.0 0.0 1.0 1.5 0.0 0.0 22
APO10 1.0 1.0 2.0 4.0 1.5 1.5 1.5 0.0 1.5 1.0 0.0 0.0 1.0 0.0 0.0 0.0 0.5 2.0 1.0 0.0 20
APO11 1.0 1.0 3.0 1.5 1.0 3.0 0.0 0.0 0.0 2.0 0.0 0.0 0.0 0.5 0.5 3.0 2.0 2.0 0.0 1.0 22
APO12 1.0 0.5 2.5 1.5 2.0 2.0 1.0 1.0 0.5 1.0 1.0 1.0 1.0 1.0 1.0 2.0 1.0 1.5 2.5 1.0 26
APO13 0.0 0.0 3.5 1.0 2.0 1.0 0.0 1.0 0.0 0.5 0.0 0.0 0.0 0.0 0.0 1.5 2.0 1.0 2.0 1.0 17
APO14 1.0 1.5 3.0 1.0 2.5 1.5 1.0 1.5 0.0 1.5 0.0 0.0 0.5 2.5 0.5 4.0 2.5 2.0 3.0 0.5 30
BAI01 0.0 1.0 1.5 0.0 0.0 0.0 0.0 3.0 1.0 3.5 0.0 0.0 1.5 0.5 1.0 0.0 1.5 2.0 0.0 1.0 18
BAI02 0.0 3.0 0.0 0.0 0.5 2.0 0.0 2.0 0.0 3.5 0.0 1.0 1.0 2.0 2.0 1.5 2.5 3.0 0.5 1.0 26
BAI03 1.0 2.0 2.0 0.0 0.0 2.0 0.0 1.0 0.0 3.0 0.0 0.5 1.0 1.0 1.0 0.5 2.0 2.0 1.0 0.5 21
BAI04 0.5 0.0 2.0 3.0 0.0 2.0 0.0 0.0 0.0 0.0 0.0 0.0 0.5 0.0 0.0 1.0 1.0 1.0 0.0 0.5 12
BAI05 1.0 3.0 0.0 0.0 0.0 0.0 0.0 0.5 0.0 3.0 1.0 0.0 0.0 0.5 2.0 0.0 0.5 1.5 0.0 1.0 14
BAI06 0.0 0.0 2.5 3.0 0.5 1.5 0.0 1.0 0.0 1.5 0.0 1.0 0.5 1.0 0.5 2.0 2.0 2.0 1.0 1.0 21
BAI07 0.0 1.0 2.0 2.0 0.5 1.5 0.0 0.5 0.0 2.0 0.0 1.0 0.0 1.0 0.5 2.0 2.0 2.0 0.0 1.0 19
BAI08 0.0 0.0 0.0 1.5 0.5 0.5 0.0 1.0 2.0 0.5 0.0 0.5 0.0 1.0 3.0 2.0 1.0 1.5 0.0 0.5 16
BAI09 0.5 0.5 1.0 0.0 0.0 0.0 2.0 2.0 0.0 0.0 0.0 0.0 2.0 1.0 0.0 0.0 1.0 1.5 0.0 0.0 12
BAI10 0.0 0.0 2.5 2.0 0.5 0.0 0.0 0.5 0.0 0.0 0.0 0.0 1.0 1.5 0.0 1.5 1.0 2.0 0.0 0.0 13
BAI11 1.0 2.0 2.5 0.0 0.0 0.0 2.0 3.0 1.0 4.0 0.0 0.0 1.5 2.0 0.5 0.0 1.0 1.5 0.0 0.5 23

Step 2 Initial Design
Governance and Management Objectives Importance
-100 -80 -60 -40 -20 0 20 40 60 80 100

-10
EDM01
EDM02 40
-15
EDM03
0
EDM04
-65 EDM05
APO01 15
APO02 40
APO03 70
APO04 90
APO05 10
-50 APO06
APO07 75
APO08 75
APO09 30
-10
APO10
APO11 20
APO12 35
APO13 30
-15
APO14
BAI01 75
BAI02 40
BAI03 45
BAI04 45
BAI05 100
BAI06 80
BAI07 55
BAI08 60
-25 BAI09
BAI10 60
BAI11 85
DSS01 10
DSS02 30
DSS03 30
DSS04 20
-5
DSS05
DSS06 35
MEA01 5
-25 MEA02
-35 MEA03
-15
MEA04
02/17/2023
Design Factor 5 Threat Landscape Design Factor 5 Threat Landscape
Input Section—Importance of Threat Landscape Input Section—Importance of Threat Landscape
Value Importance (100%) Baseline Page intentionally left blank
High 75% 33%

Normal 25% 67%
Average
Stdev
Design Factor 5 IT Threat Landscape
Correction Factor
1.00
High Normal
25%
75%

02/17/2023
Design Factor 5 Threat Landscape Design Factor 5 Threat Landscape
75%

Importance Design Factor 5 Threat Landscape
Resulting Governance/Management Objectives Importance
Governance / Baseline Relative Design Factor 5 Threat Landscape
Management Score Score Importance Resulting Governance/Management
Objective Objectives Importance
EDM01 2.50 1.66 50
EDM02 1.00 1.00 0
-100 -75 -50 -25 0 25 50 75 100
EDM03 3.25 1.99 65
EDM01
EDM04 1.00 1.00 0 EDM02 EDM01
EDM05 EDM02 MEA04
1.75 1.33 30 EDM03 EDM03 MEA03
APO01 2.50 1.66 50 EDM04 EDM04 MEA02
APO02 1.00 1.00 0 EDM05 EDM05 MEA01
100
APO03 2.50 1.66 50 APO01
APO04 1.00 1.00 0
APO03
APO05 1.00 1.00 0 APO02 50 DSS05
APO04
APO06 1.00 1.00 0 APO05 25
APO07 1.75 1.33 30 APO06 APO03 DSS04
APO08 1.00 1.00 0 APO07 0
APO08 APO04 DSS03
-25
APO09
APO10 -50
© 2018 ISACA. All rights reserved. APO05
645518342.xlsx DSS02
DF5—Page 24
APO11
APO12 -75
EDM05 EDM05 MEA01
100
APO01
APO02 APO01 75 DSS06 02/17/2023
APO03
Information & Technology Governance
APO05 System Design Information25& Technology Governance System Design
Design Factor
APO06 5 Threat Landscape APO03 Design Factor 5 ThreatDSS04
Landscape
APO07 0
APO09 1.75 1.33 30 APO08 APO04 DSS03
-25
APO09
APO10 2.50 1.66 50
APO10 -50
APO11 1.75 1.33 30 APO11
APO05 DSS02
APO12 3.25 1.99 65 APO12 -75
APO13 3.25 1.99 65 APO13
APO06 -100 DSS01
APO14 2.50 1.66 50 APO14
BAI01 BAI01
1.00 1.00 0
BAI02 APO07 BAI11
BAI02 1.00 1.00 0
BAI03
BAI03 1.00 1.00 0 BAI04
BAI04 1.75 1.33 30 APO08 BAI10
BAI05
BAI05 1.00 1.00 0 BAI06
BAI06 BAI07 APO09 BAI09
2.50 1.66 50
BAI07 BAI08
1.00 1.00 0
BAI09 APO10 BAI08
BAI08 1.00 1.00 0 BAI10
BAI09 1.00 1.00 0 BAI11 APO11 BAI07
BAI10 2.50 1.66 50 DSS01
APO12 BAI06
BAI11 1.00 1.00 0 DSS02
DSS03 APO13 BAI05
DSS01 1.00 1.00 0
DSS04 APO14 BAI04
DSS02 2.50 1.66 50 BAI01 BAI02 BAI03
DSS05
DSS03 1.75 1.33 30 DSS06
DSS04 3.25 1.99 65 MEA01
DSS05 2.50 1.66 50 MEA02
DSS06 2.50 1.66 50 MEA03
MEA01 2.50 1.66 50 MEA04
MEA02 1.75 1.33 30

MEA03 2.50 1.66 50
MEA04 2.50 1.66 50

02/17/2023
DF5 High Normal

EDM01 3.0 1.0
EDM02 1.0 1.0
EDM03 4.0 1.0
EDM04 1.0 1.0
EDM05 2.0 1.0
APO01 3.0 1.0
APO02 1.0 1.0
APO03 3.0 1.0
APO04 1.0 1.0
APO05 1.0 1.0
APO06 1.0 1.0
APO07 2.0 1.0
APO08 1.0 1.0
APO09 2.0 1.0
APO10 3.0 1.0
APO11 2.0 1.0
APO12 4.0 1.0
APO13 4.0 1.0
APO14 3.0 1.0
BAI01 1.0 1.0
BAI02 1.0 1.0
BAI03 1.0 1.0
BAI04 2.0 1.0
BAI05 1.0 1.0
BAI06 3.0 1.0
BAI07 1.0 1.0
BAI08 1.0 1.0
BAI09 1.0 1.0
BAI10 3.0 1.0
BAI11 1.0 1.0
DSS01 1.0 1.0
DSS02 3.0 1.0

02/17/2023
DF5 High Normal

DSS03 2.0 1.0
DSS04 4.0 1.0
DSS05 3.0 1.0
DSS06 3.0 1.0
MEA01 3.0 1.0
MEA02 2.0 1.0
MEA03 3.0 1.0
MEA04 3.0 1.0

02/17/2023
Design Factor 6 Compliance Requirements Design Factor 6 Compliance Requirements
Input Section—Importance of Compliance Requirements Input Section—Importance of Compliance Requirements
Value Importance Baseline Page intentionally left blank

(100%)
High 25% 0%
Normal 75% 100%
Low 0% 0%
Average
Design Factor 6 Compliance Requirements
High Normal Low
25%
Stdev
75%

02/17/2023
Design Factor 6 Compliance Requirements Design Factor 6 Compliance Requirements
Correction Facto 1.00
Resulting Governance/ Management

Objectives Importance Design Factor 6 Compliance Requirements Design Factor 6 Compliance Requirements
Resulting Governance/Management Resulting Governance/Management Objectives Importance
Governance / Objectives Importance
Baseline Relative
Management Score
-100 -75 -50 -25 0 25 50 75 100
EDM01 2.25 2.00 15 EDM01
EDM02 1.00 1.00 0 EDM02
EDM03 2.50 2.00 25 EDM03
EDM04 1.00 1.00 0 EDM04
EDM05 1.13 1.00 15 EDM05 EDM02 EDM01 MEA04
APO01 EDM03 MEA03
APO01 1.63 1.50 10
APO02 EDM04 MEA02
APO02 1.00 1.00 0
APO03 EDM05 MEA01
APO03 1.00 1.00 0 100
APO04 APO01 DSS06
APO04 1.00 1.00 0 75
APO05
APO05 1.00 1.00 0 APO06 APO02 DSS05
50
APO06 1.00 1.00 0 APO07
25
APO07 1.00 1.00 0 APO08 APO03 DSS04
APO08 1.00 1.00 0 APO09 0
APO09 1.00 1.00 0 APO10 APO04 DSS03
-25
APO10 APO11
1.13 1.00 15
APO11 1.00 1.00 0
APO13
APO12 2.50 2.00 25 -75
APO14
APO13 1.13 1.00 15 BAI01 APO06 -100 DSS01
APO14 1.63 1.50 10 BAI02
BAI01 1.00 1.00 0 BAI03
APO07 BAI11
BAI02 1.00 1.00 0 BAI04
BAI03 1.00 1.00 0 BAI05
APO08 BAI10
BAI04 1.00 1.00 0 BAI06
BAI07
APO09 BAI09
BAI08
© 2018 ISACA. All rights reserved. BAI09 645518342.xlsx APO10 BAI08 DF6—Page 29
BAI10
BAI11
APO13
-75
APO14
BAI01 APO06 -100 DSS01
02/17/2023
BAI02
BAI03
APO07 BAI11
Information & Technology Governance
BAI04 System Design Information & Technology Governance System Design
Design Factor 6 Compliance
BAI05 Requirements Design Factor 6 Compliance Requirements
APO08 BAI10
BAI06
BAI07
BAI05 1.00 1.00 0 APO09 BAI09
BAI08
BAI06 1.00 1.00 0
BAI09
BAI07 1.00 1.00 0 BAI10
APO10 BAI08
BAI08 1.00 1.00 0 BAI11 APO11 BAI07
BAI09 1.00 1.00 0 DSS01
BAI10 1.00 1.00 0 DSS02 APO12 BAI06
BAI11 1.00 1.00 0 DSS03 APO13 BAI05
DSS04 APO14 BAI04
DSS01 1.00 1.00 0 BAI01 BAI02 BAI03
DSS02 DSS05
1.00 1.00 0
DSS06
DSS03 1.00 1.00 0
MEA01
DSS04 1.13 1.00 15 MEA02
DSS05 1.25 1.00 25 MEA03
DSS06 1.00 1.00 0 MEA04
MEA01 1.00 1.00 0
MEA02 1.00 1.00 0
MEA03 2.50 2.00 25
MEA04 2.38 2.00 20

02/17/2023
DF6 High Normal Low

EDM01 3.0 2.0 1.0
EDM02 1.0 1.0 1.0
EDM03 4.0 2.0 1.0
EDM04 1.0 1.0 1.0
EDM05 1.5 1.0 1.0
APO01 2.0 1.5 1.0
APO02 1.0 1.0 1.0
APO03 1.0 1.0 1.0
APO04 1.0 1.0 1.0
APO05 1.0 1.0 1.0
APO06 1.0 1.0 1.0
APO07 1.0 1.0 1.0
APO08 1.0 1.0 1.0
APO09 1.0 1.0 1.0
APO10 1.5 1.0 1.0
APO11 1.0 1.0 1.0
APO12 4.0 2.0 1.0
APO13 1.5 1.0 1.0
APO14 2.0 1.5 1.0
BAI01 1.0 1.0 1.0
BAI02 1.0 1.0 1.0
BAI03 1.0 1.0 1.0
BAI04 1.0 1.0 1.0
BAI05 1.0 1.0 1.0
BAI06 1.0 1.0 1.0
BAI07 1.0 1.0 1.0
BAI08 1.0 1.0 1.0
BAI09 1.0 1.0 1.0
BAI10 1.0 1.0 1.0
BAI11 1.0 1.0 1.0
DSS01 1.0 1.0 1.0
DSS02 1.0 1.0 1.0

02/17/2023
DF6 High Normal Low

DSS03 1.0 1.0 1.0
DSS04 1.5 1.0 1.0
DSS05 2.0 1.0 1.0
DSS06 1.0 1.0 1.0
MEA01 1.0 1.0 1.0
MEA02 1.0 1.0 1.0
MEA03 4.0 2.0 1.0
MEA04 3.5 2.0 1.0

02/17/2023
Design Factor 7 Role of IT Design Factor 7 Role of IT
Input Section—Importance of Role of IT Input Section—Importance of Role of IT
Value Importance (1-5) Baseline Page intentionally left blank

Support 1 3
Factory 1 3
Turnaround 2 3
Strategic 5 3
Average 2.25
Stdev 1.64
Correction Factor 1.33
Design Factor 7 Role of IT (Input)

0 1 2 3 4 5
Support 1
Factory 1
Turnaround 2
Strategic 5

Support 1
02/17/2023
Factory 1 Information & Technology Governance System Design Information & Technology Governance System Design
Turnaround 2
Strategic 5

Importance Design Factor 7 Role of IT
Design Factor 7 Role of IT Resulting Governance/Management Objectives Importance
Governance / Baseline Relative Resulting Governance/Management Ob-
Management Score
Objective Score Importance jectives Importance
EDM01 26.0 25.5 35

-100 -75 -50 -25 0 25 50 75 100
EDM02 22.0 22.5 30
EDM01
EDM03 21.0 24.0 15
EDM02
EDM04 14.0 15.0 25 EDM01
EDM03 EDM02 MEA04
EDM05 14.0 15.0 25 EDM04 EDM03 MEA03
APO01 18.0 19.5 25 EDM05
EDM04 MEA02
APO02 23.0 24.0 30 APO01 EDM05 100 MEA01
APO03 16.0 18.0 20 APO02
APO01 75 DSS06
APO04 28.5 27.0 40 APO03
APO05 22.0 22.5 30 APO04
50
APO02 DSS05
APO06 14.0 15.0 25 APO05
APO07 11.5 13.5 15 APO06 25
APO03 DSS04
APO07
0
APO08
© 2018 ISACA. All rights reserved. APO09 645518342.xlsx
APO04 DF7—Page 34
DSS03
-25
APO10
EDM04 MEA02
EDM05
APO01 EDM05 100 MEA01
02/17/2023
COBIT® 2019 Governance System Design Toolkit APO02
APO01 75 DSS06
APO03
APO04
Information & Technology Governance System Design APO02 Information
50 & Technology GovernanceDSS05
System Design
APO05
APO06 25
APO03 DSS04
APO08 18.5 19.5 25 APO07
0
APO09 16.0 19.5 10 APO08
APO09 APO04 DSS03
APO10 16.5 21.0 5 -25
APO10
APO11 15.5 18.0 15
APO11 -50
APO12 20.5 22.5 20 APO05 DSS02
APO12
APO13 21.0 22.5 25 -75
APO13
APO14 18.0 19.5 25
BAI01 18.5 19.5 25 BAI01
BAI02 23.0 24.0 30 BAI02
BAI03 23.0 24.0 30 BAI03 APO07 BAI11
BAI04 16.5 21.0 5 BAI04
BAI05 14.0 15.0 25 BAI05 APO08 BAI10
BAI06 15.5 19.5 5 BAI06
BAI07 16.0 18.0 20 BAI07
APO09 BAI09
BAI08 14.0 15.0 25 BAI08
BAI09 14.0 15.0 25 BAI09
APO10 BAI08
BAI10 14.5 16.5 15 BAI10
BAI11 16.0 18.0 20 BAI11
APO11 BAI07
DSS01 DSS01
21.5 25.5 10
DSS02 APO12 BAI06
DSS02 22.0 25.5 15
DSS03
DSS03 24.5 27.0 20 APO13 BAI05
DSS04
DSS04 24.5 27.0 20 APO14 BAI04
DSS05 BAI01 BAI02 BAI03
DSS05 24.5 27.0 20
DSS06
DSS06 16.5 16.5 35 MEA01
MEA01 14.0 15.0 25 MEA02
MEA02 14.0 15.0 25 MEA03
MEA03 11.5 13.5 15 MEA04
MEA04 14.0 15.0 25

02/17/2023
DF7 Support Factory Turnaround Strategic

EDM01 1.0 2.0 1.5 4.0
EDM02 1.0 1.0 2.5 3.0
EDM03 1.0 3.0 1.0 3.0
EDM04 1.0 1.0 1.0 2.0
EDM05 1.0 1.0 1.0 2.0
APO01 1.0 1.5 1.5 2.5
APO02 1.0 1.0 3.0 3.0
APO03 1.0 1.0 2.0 2.0
APO04 0.5 1.0 3.5 4.0
APO05 1.0 1.0 2.5 3.0
APO06 1.0 1.0 1.0 2.0
APO07 1.0 1.0 1.0 1.5
APO08 1.0 1.0 2.0 2.5
APO09 1.0 2.0 1.5 2.0
APO10 1.0 2.5 1.5 2.0
APO11 1.0 1.5 1.5 2.0
APO12 1.0 2.5 1.0 3.0
APO13 1.0 2.0 1.5 3.0
APO14 1.0 1.5 1.5 2.5
BAI01 1.0 1.0 2.0 2.5
BAI02 1.0 1.0 3.0 3.0
BAI03 1.0 1.0 3.0 3.0
BAI04 1.0 2.5 1.5 2.0
BAI05 1.0 1.0 1.0 2.0
BAI06 1.0 2.5 1.0 2.0
BAI07 1.0 1.0 2.0 2.0
BAI08 1.0 1.0 1.0 2.0
BAI09 1.0 1.0 1.0 2.0
BAI10 1.0 1.5 1.0 2.0
BAI11 1.0 1.0 2.0 2.0
DSS01 1.0 3.5 1.0 3.0
DSS02 1.0 3.0 1.5 3.0

02/17/2023
DF7 Support Factory Turnaround Strategic

DSS03 1.0 3.0 1.5 3.5
DSS04 1.0 3.0 1.5 3.5
DSS05 1.5 2.5 1.5 3.5
DSS06 1.0 1.0 1.0 2.5
MEA01 1.0 1.0 1.0 2.0
MEA02 1.0 1.0 1.0 2.0
MEA03 1.0 1.0 1.0 1.5
MEA04 1.0 1.0 1.0 2.0

02/17/2023
Design Factor 8 Sourcing Model for IT Design Factor 8 Sourcing Model for IT
Input Section—Importance of Sourcing Model for IT Input Section—Importance of Sourcing Model for IT
Value Importance (100%) Baseline

Outsourcing 30% 33% Page intentionally left blank
Cloud 50% 33%
Insourced 20% 34%
Average Design Factor 8 IT Sourcing Model (Input)

Stdev
Correction Facto 1.00
Outsourcing Cloud Insourced
20%
30%
50%

02/17/2023
Design Factor 8 Sourcing Model for IT Design Factor 8 Sourcing Model for IT
50%

Importance
Governance / Design Factor 8 Sourcing Model for IT Design Factor 8 Sourcing Model for IT
Baseline Relative Resulting Governance/ Management Objectives Importance
Management Score Score Importance Resulting Governance/Management Ob-
Objective jectives Importance
EDM01 1.00 1.00 0
EDM02 1.00 1.00 0
EDM03 1.50 1.33 15 -100 -75 -50 -25 0 25 50 75 100
EDM04 EDM01
1.00 1.00 0 EDM01
EDM02 EDM02 MEA04
EDM05 1.00 1.00 0 EDM03 MEA03
EDM03
APO01 1.00 1.00 0 EDM04 MEA02
EDM04
APO02 1.00 1.00 0 EDM05 EDM05 100 MEA01
APO03 1.00 1.00 0 APO01
APO01 75 DSS06
APO02
APO04 1.00 1.00 0
APO03
APO05 1.00 1.00 0 APO04
APO02 50 DSS05
APO06 1.00 1.00 0 APO05 25
APO07 APO03 DSS04
1.00 1.00 0 APO06
APO07 0
APO08 1.00 1.00 0
APO08 APO04 DSS03
APO09 3.40 2.98 15 -25
APO09
APO10 3.40 2.98 15 APO10 -50
APO11 1.00 1.00 0 APO05 DSS02
APO11
APO12 1.80 1.66 10 APO12 -75
APO13 APO13
1.00 1.00 0 APO06 -100 DSS01
APO14
APO14 1.00 1.00 0 BAI01
BAI01 1.00 1.00 0 BAI02
APO07 BAI11
BAI02 1.00 1.00 0 BAI03
BAI04
BAI05 APO08 BAI10
© 2018 ISACA. All rights reserved. BAI06 645518342.xlsx DF8—Page 39
BAI07 APO09 BAI09
APO10 -50
APO05 DSS02
APO11
APO12 -75 02/17/2023
APO13
APO06 -100 DSS01
APO14
BAI01 Information & Technology Governance System Design
Design BAI02
Factor 8 Sourcing Model for IT APO07
Design Factor 8 Sourcing
BAI11
Model for IT
BAI03
BAI03 1.00 1.00 0 BAI04
BAI05 APO08 BAI10
BAI04 1.00 1.00 0
BAI06
BAI05 1.00 1.00 0 BAI07 APO09 BAI09
BAI06 1.00 1.00 0 BAI08
BAI07 1.00 1.00 0 BAI09
APO10 BAI08
BAI08 1.00 1.00 0 BAI10
BAI11
BAI09 1.00 1.00 0 APO11 BAI07
DSS01
BAI10 1.00 1.00 0 DSS02 APO12 BAI06
BAI11 1.00 1.00 0 DSS03
APO13 BAI05
DSS01 1.00 1.00 0 DSS04
APO14 BAI04
DSS02 1.00 1.00 0 DSS05 BAI01 BAI02 BAI03
DSS06
DSS03 1.00 1.00 0
MEA01
DSS04 1.00 1.00 0 MEA02
DSS05 1.00 1.00 0 MEA03
DSS06 1.00 1.00 0 MEA04
MEA01 2.60 2.32 10
MEA02 1.00 1.00 0
MEA03 1.00 1.00 0
MEA04 1.00 1.00 0

02/17/2023
DF8 Outsourcing Cloud Insourcing

EDM01 1.0 1.0 1.0
EDM02 1.0 1.0 1.0
EDM03 1.0 2.0 1.0
EDM04 1.0 1.0 1.0
EDM05 1.0 1.0 1.0
APO01 1.0 1.0 1.0
APO02 1.0 1.0 1.0
APO03 1.0 1.0 1.0
APO04 1.0 1.0 1.0
APO05 1.0 1.0 1.0
APO06 1.0 1.0 1.0
APO07 1.0 1.0 1.0
APO08 1.0 1.0 1.0
APO09 4.0 4.0 1.0
APO10 4.0 4.0 1.0
APO11 1.0 1.0 1.0
APO12 2.0 2.0 1.0
APO13 1.0 1.0 1.0
APO14 1.0 1.0 1.0
BAI01 1.0 1.0 1.0
BAI02 1.0 1.0 1.0
BAI03 1.0 1.0 1.0
BAI04 1.0 1.0 1.0
BAI05 1.0 1.0 1.0
BAI06 1.0 1.0 1.0
BAI07 1.0 1.0 1.0
BAI08 1.0 1.0 1.0
BAI09 1.0 1.0 1.0
BAI10 1.0 1.0 1.0
BAI11 1.0 1.0 1.0
DSS01 1.0 1.0 1.0
DSS02 1.0 1.0 1.0

02/17/2023
DF8 Outsourcing Cloud Insourcing

DSS03 1.0 1.0 1.0
DSS04 1.0 1.0 1.0
DSS05 1.0 1.0 1.0
DSS06 1.0 1.0 1.0
MEA01 3.0 3.0 1.0
MEA02 1.0 1.0 1.0
MEA03 1.0 1.0 1.0
MEA04 1.0 1.0 1.0

02/17/2023
Design Factor 9 IT Implementation Methods Design Factor 9 IT Implementation Methods
Input Section—Importance of IT Implementation Methods Input Section—Importance of IT Implementation Methods
Agile 50% 15%
DevOps 10% 10%
Traditional 40% 75%
Design Factor 9 IT Implementation Methods

Agile DevOps Traditional
40%
50%
10%

02/17/2023
Design Factor 9 IT Implementation Methods Design Factor 9 IT Implementation Methods
10%

Importance
Governance / Design Factor 9 IT Implementation Methods Resulting Governance/Management Objectives Importance
Baseline Relative Resulting Governance/Management Objec-
Management Score Score Importance
Objective tives Importance
EDM01 1.00 1.00 0
EDM02 1.00 1.00 0
EDM02 EDM01 MEA04
EDM03 1.00 1.00 0 -100 -75 -50 -25 0 25 50 75 100 EDM03 MEA03
EDM04 1.00 1.00 0 EDM01 EDM04 MEA02
EDM05 1.00 1.00 0 EDM02
EDM05 100 MEA01
APO01 1.00 1.00 0 EDM03
EDM04 APO01 75 DSS06
APO02 1.00 1.00 0 EDM05
APO03 1.10 1.10 0 APO01
APO02 50 DSS05
APO04 1.00 1.00 0 APO02
APO05 1.00 1.00 0 APO03 25
APO04 APO03 DSS04
APO06 1.00 1.00 0 APO05 0
APO07 1.05 1.05 0 APO06
APO08 APO04 DSS03
1.00 1.00 0 APO07 -25
APO09 1.00 1.00 0 APO08
APO09 -50
APO10 1.00 1.00 0 APO05 DSS02
APO10
APO11 1.00 1.00 0 APO11 -75
APO12
APO14
BAI01
BAI02 APO07 BAI11
APO03 25
APO04 APO03 DSS04
APO05 0
APO06 02/17/2023
APO08
APO09 Governance System Design Information
-50 & Technology Governance System Design
Design FactorAPO10
9 IT Implementation Methods APO05 DSS02
APO11 -75
APO12 1.05 1.05 0 APO12
APO13 1.00 1.00 0
APO14
APO14 1.00 1.00 0 BAI01
BAI01 1.55 1.20 30 BAI02 APO07 BAI11
BAI02 2.35 1.48 60 BAI03
BAI03 BAI04
2.70 1.65 65
BAI05 APO08 BAI10
BAI04 1.00 1.00 0 BAI06
BAI05 1.80 1.28 40 BAI07
APO09 BAI09
BAI06 2.35 1.48 60 BAI08
BAI07 BAI09
1.90 1.38 40
BAI10 APO10 BAI08
BAI08 1.00 1.00 0 BAI11
BAI09 1.00 1.00 0 DSS01 APO11 BAI07
BAI10 1.35 1.18 15 DSS02
BAI11 DSS03 APO12 BAI06
1.75 1.23 45
DSS04
DSS01 1.15 1.15 0 DSS05 APO13 BAI05
DSS02 1.05 1.05 0 DSS06 APO14 BAI04
BAI01 BAI02 BAI03
DSS03 1.05 1.05 0 MEA01
DSS04 MEA02
1.00 1.00 0
MEA03
DSS05 1.00 1.00 0 MEA04
DSS06 1.00 1.00 0
MEA01 1.30 1.13 15
MEA02 1.00 1.00 0
MEA03 1.00 1.00 0
MEA04 1.00 1.00 0

02/17/2023
DF9 Agile DevOps Traditional

EDM01 1.0 1.0 1.0
EDM02 1.0 1.0 1.0
EDM03 1.0 1.0 1.0
EDM04 1.0 1.0 1.0
EDM05 1.0 1.0 1.0
APO01 1.0 1.0 1.0
APO02 1.0 1.0 1.0
APO03 1.0 2.0 1.0
APO04 1.0 1.0 1.0
APO05 1.0 1.0 1.0
APO06 1.0 1.0 1.0
APO07 1.0 1.5 1.0
APO08 1.0 1.0 1.0
APO09 1.0 1.0 1.0
APO10 1.0 1.0 1.0
APO11 1.0 1.0 1.0
APO12 1.0 1.5 1.0
APO13 1.0 1.0 1.0
APO14 1.0 1.0 1.0
BAI01 2.0 1.5 1.0
BAI02 3.5 2.0 1.0
BAI03 4.0 3.0 1.0
BAI04 1.0 1.0 1.0
BAI05 2.5 1.5 1.0
BAI06 3.5 2.0 1.0
BAI07 2.5 2.5 1.0
BAI08 1.0 1.0 1.0
BAI09 1.0 1.0 1.0
BAI10 1.5 2.0 1.0
BAI11 2.5 1.0 1.0
DSS01 1.0 2.5 1.0
DSS02 1.0 1.5 1.0

02/17/2023
DF9 Agile DevOps Traditional

DSS03 1.0 1.5 1.0
DSS04 1.0 1.0 1.0
DSS05 1.0 1.0 1.0
DSS06 1.0 1.0 1.0
MEA01 1.5 1.5 1.0
MEA02 1.0 1.0 1.0
MEA03 1.0 1.0 1.0
MEA04 1.0 1.0 1.0

02/17/2023
Design Factor 10 Technology Adoption Strategy Design Factor 10 Technology Adoption Strategy
Input Section—Importance of Technology Adoption Strategy Input Section—Importance of Technology Adoption Strategy
First mover 75% 15%

Follower 15% 70%
Slow adopter 10% 15%
Design Factor 10 Technology Adoption Strategy

First mover Follower Slow adopter
10%
15%
75%

02/17/2023
Design Factor 10 Technology Adoption Strategy Design Factor 10 Technology Adoption Strategy

Importance
Design Factor 10 Technology Adoption
Governance / Baseline Relative Strategy Design Factor 10 Technology Adoption Strategy
Management Score Score Importance Resulting Governance/Management Objec- Resulting Governance/Management Objectives Importance
Objective
tives Importance
EDM01 3.15 2.50 25
EDM02 3.53 2.58 35
EDM03 1.38 1.08 30 -100 -75 -50 -25 0 25 50 75 100
EDM04 2.33 2.00 15 EDM01
EDM01
EDM02 EDM02 MEA04
EDM05 1.38 1.08 30 EDM03 MEA03
EDM03 EDM04 MEA02
APO01 2.20 1.58 40 EDM04
APO02 3.60 2.93 25 EDM05 EDM05 100 MEA01
APO03 1.75 1.15 50 APO01 APO01 75 DSS06
APO04 APO02
3.55 2.85 25
APO05 3.48 2.50 40 APO04
APO06 1.08 1.35 -20 APO05 25
APO03 DSS04
APO07 2.13 1.23 75 APO06
APO07 0
APO08 2.58 1.65 55
APO08 APO04 DSS03
APO09 1.45 1.43 0 -25
APO09
APO10 2.20 1.58 40 APO10 -50
APO05 DSS02
APO11 1.45 1.43 0 APO11
APO12 -75
APO12 1.83 1.50 20
APO13
APO13 1.00 1.00 0 APO06 -100 DSS01
APO14
APO14 2.28 1.93 20 BAI01
BAI01 3.60 2.93 25 BAI02
APO07 BAI11
BAI02 3.10 2.43 30 BAI03
BAI04
BAI03 3.48 2.50 40
BAI05 APO08 BAI10
BAI04 1.45 1.43 0 BAI06
BAI05 2.65 2.00 35 BAI07
APO09 BAI09
BAI08
BAI09
BAI10 APO10 BAI08
BAI11
DSS01 APO11 BAI07
APO13
APO06 -100 DSS01
APO14
BAI01
02/17/2023
COBIT® 2019 Governance System Design Toolkit BAI02
APO07 BAI11
BAI03
BAI04
BAI05 APO08
BAI10
Design Factor 10 BAI06
Technology Adoption Strategy Design Factor 10 Technology Adoption Strategy
BAI07
APO09 BAI09
BAI06 2.28 1.93 20 BAI08
BAI09
BAI07 3.10 2.43 30 APO10 BAI08
BAI10
BAI08 1.38 1.08 30 BAI11
BAI09 1.00 1.00 0 DSS01 APO11 BAI07
BAI10 1.38 1.08 30 DSS02
APO12 BAI06
BAI11 DSS03
3.10 2.43 30 APO13 BAI05
DSS04
DSS01 1.00 1.00 0 DSS05 APO14 BAI04
BAI01 BAI02 BAI03
DSS02 1.00 1.00 0 DSS06
DSS03 1.38 1.08 30 MEA01
DSS04 1.38 1.08 30 MEA02
MEA03
DSS05 1.38 1.08 30 MEA04
DSS06 1.00 1.00 0
MEA01 2.65 2.00 35
MEA02 1.00 1.00 0
MEA03 1.00 1.00 0
MEA04 1.00 1.00 0

02/17/2023
DF10 First Mover Follower Slow Adopter

EDM01 3.5 2.5 1.5
EDM02 4.0 2.5 1.5
EDM03 1.5 1.0 1.0
EDM04 2.5 2.0 1.5
EDM05 1.5 1.0 1.0
APO01 2.5 1.5 1.0
APO02 4.0 3.0 1.5
APO03 2.0 1.0 1.0
APO04 4.0 3.0 1.0
APO05 4.0 2.5 1.0
APO06 1.0 1.5 1.0
APO07 2.5 1.0 1.0
APO08 3.0 1.5 1.0
APO09 1.5 1.5 1.0
APO10 2.5 1.5 1.0
APO11 1.5 1.5 1.0
APO12 2.0 1.5 1.0
APO13 1.0 1.0 1.0
APO14 2.5 2.0 1.0
BAI01 4.0 3.0 1.5
BAI02 3.5 2.5 1.0
BAI03 4.0 2.5 1.0
BAI04 1.5 1.5 1.0
BAI05 3.0 2.0 1.0
BAI06 2.5 2.0 1.0
BAI07 3.5 2.5 1.0
BAI08 1.5 1.0 1.0
BAI09 1.0 1.0 1.0
BAI10 1.5 1.0 1.0
BAI11 3.5 2.5 1.0
DSS01 1.0 1.0 1.0
DSS02 1.0 1.0 1.0

02/17/2023
DF10 First Mover Follower Slow Adopter

DSS03 1.5 1.0 1.0
DSS04 1.5 1.0 1.0
DSS05 1.5 1.0 1.0
DSS06 1.0 1.0 1.0
MEA01 3.0 2.0 1.0
MEA02 1.0 1.0 1.0
MEA03 1.0 1.0 1.0
MEA04 1.0 1.0 1.0

Governance and Management Objectives Importance (All Design Factors)
-100 -80 -60 -40 -20 0 20 40 60 80 100

EDM01 50
EDM02 50
EDM03 60
EDM04 20
EDM05 15
APO01 65
APO02 45
APO03 90
APO04 70
APO05 35
-20 APO06
APO07 90
APO08 70
APO09 40
APO10 50
APO11 30
APO12 80
APO13 60
APO14 40
BAI01 70
BAI02 70
BAI03 85
BAI04 40
BAI05 95
BAI06 100
BAI07 70
BAI08 55
BAI09
0
BAI10 80
BAI11 85
DSS01 10
DSS02 45
DSS03 50
DSS04 70
DSS05 55
DSS06 55
MEA01 65
MEA02 15
MEA03 25
MEA04 35
02/17/2023
Design Factor 1 Enterprise Strategy Design Factor 2 Enterprise Goals

Resulting Governance/Management Resulting Governance/ Management Initial Summary—Governance and Management Objectives
Objectives Importance Objectives Importance
-100 -50 0 50 100 150
EDM02 EDM01 MEA04 EDM01
EDM03 MEA03
EDM02
EDM03
MEA04
MEA03 -10
EDM01—Ensured Governance Framework Setting & Maintenance
EDM04 MEA02 EDM04 MEA02
EDM05 100 MEA01 100 EDM02—Ensured Benefits Delivery 40
EDM05 MEA01
APO01 75 DSS06 APO01 75 DSS06 -15
EDM03—Ensured Risk Optimization
50 50 0
EDM04—Ensured Resource Optimization
APO02 DSS05 APO02 DSS05
25 25
APO03 DSS04 APO03 DSS04 -65 EDM05—Ensured Stakeholder Engagement
0 0
APO04 DSS03
APO01—Managed I&T Management Framework 15
APO04 -25 DSS03 -25
-50
APO02—Managed Strategy 40
-50 APO05 DSS02
APO05 DSS02
-75 -75 APO03—Managed Enterprise Architecture 70
APO06 -100 DSS01 APO06 -100 DSS01 APO04—Managed Innovation 90
APO05—Managed Portfolio 10
APO07 BAI11 APO07 BAI11
-50 APO06—Managed Budget & Costs
APO07—Managed Human Resources 75
APO09 BAI09 APO09 BAI09 APO08—Managed Relationships 75
APO10 BAI08 APO10 BAI08 APO09—Managed Service Agreements 30
APO11 BAI07 APO11 BAI07 -10
APO10—Managed Vendors
APO12 BAI06
APO12 BAI06 APO11—Managed Quality 20
APO13 BAI05
APO13 BAI05
APO14 BAI04
APO14
BAI01 BAI03
BAI04 BAI01 BAI02 BAI03 APO12—Managed Risk 35
BAI02
APO13—Managed Security 30
-15
APO14—Managed Data
Design Factor 3 Risk Profile Design Factor 4 I&T-Related Issues BAI01—Managed Programs 75
Resulting Governance/Management Resulting Governance/Management BAI02—Managed Requirements Definition 40
BAI03—Managed Solutions Identification & Build 45
EDM02 EDM01 MEA04 EDM01
BAI04—Managed Availability & Capacity 45
EDM03 MEA03
EDM04 MEA02
EDM04 MEA02 BAI05—Managed Organizational Change 100
EDM05 100 MEA01 EDM05 100 MEA01
75
BAI06—Managed IT Changes 80
APO01 DSS06 APO01 75 DSS06
50 BAI07—Managed IT Change Acceptance and Transitioning 55
APO02 DSS05 APO02 50 DSS05
25 25
BAI08—Managed Knowledge 60
0 0 -25
BAI09—Managed Assets
-25 -25 BAI10—Managed Configuration 60
-50 -50
APO05 DSS02 APO05 DSS02 BAI11—Managed Projects 85
-75 -75
DSS01—Managed Operations 10
APO06 -100 DSS01 APO06 -100 DSS01
DSS02—Managed Service Requests & Incidents 30
APO07 BAI11 APO07 BAI11 DSS03—Managed Problems 30
APO08 BAI10
DSS04—Managed Continuity 20
APO08 BAI10
-5
DSS05—Managed Security Services
DSS06—Managed Business Process Controls 35
MEA01—Managed Performance and Conformance Monitoring 5
-25of Internal Control
MEA02—Managed System
APO12 BAI06
APO12 BAI06
APO13 BAI05
APO13 BAI05 MEA03—Managed Compliance-35
with External Requirements
APO14 BAI04
APO14 BAI04 BAI01 BAI02 BAI03
BAI01 BAI02 BAI03 -15
MEA04—Managed Assurance
© 2018 ISACA. All rights reserved. 645518342.xlsx Dashboard1—Page 54

02/17/2023
Design Factor 5 Threat Landscape Design Factor 6 Compliance Requirements

Resulting Governance/Management Resulting Governance/Management
Objectives Importance Objectives Importance Governance and Management Objectives Importance (All Design Factors)
EDM02 EDM01 MEA04 EDM02 EDM01 MEA04

EDM01—Ensured Governance Framework Setting & Maintenance 50
EDM05 100 MEA01 EDM05 100 MEA01 EDM02—Ensured Benefits Delivery 50
APO01 75 DSS06 APO01 75 DSS06
APO02 50 DSS05 APO02 50 DSS05 EDM03—Ensured Risk Optimization 60

25 25
0 0
EDM04—Ensured Resource Optimization 20
APO04 -25 DSS03 APO04 -25 DSS03
APO05
-50
DSS02 APO05
-50
DSS02 EDM05—Ensured Stakeholder Engagement 15
-75 -75
APO06 -100 DSS01 APO06 -100 DSS01

APO01—Managed I&T Management Framework 65
APO02—Managed Strategy 45
APO09 BAI09 APO09 BAI09 APO03—Managed Enterprise Architecture 90

APO04—Managed Innovation 70

APO05—Managed Portfolio 35
BAI01 BAI02 BAI03 BAI01 BAI02 BAI03
-20Budget & Costs

APO06—Managed
APO07—Managed Human Resources 90
Design Factor 7 Role of IT Design Factor 8 Sourcing Model for IT APO08—Managed Relationships 70
Resulting Governance/Management Resulting Governance/Management
APO09—Managed Service Agreements 40
APO10—Managed Vendors 50
EDM01 EDM02 EDM01 MEA04
EDM03 MEA03
EDM04 MEA02 EDM04 MEA02 APO11—Managed Quality 30
EDM05 100 MEA01 EDM05 100 MEA01
APO01 75 DSS06
APO01 75 DSS06
APO12—Managed Risk 80
50 APO02 50 DSS05
APO02 DSS05
25
APO03
25
DSS04 APO03 DSS04 APO13—Managed Security 60
0 0
APO04 DSS03 APO04 -25 DSS03

-25
APO14—Managed Data 40
-50 -50
-75 -75
BAI01—Managed Programs 70
APO06 -100 DSS01 APO06 -100 DSS01
APO07 BAI11 APO07 BAI11 BAI02—Managed Requirements Definition 70

BAI03—Managed Solutions Identification & Build 85
APO10 BAI08 APO10 BAI08 BAI04—Managed Availability & Capacity 40

APO12 BAI06
BAI05—Managed Organizational Change 95
APO12 BAI06
© 2018 ISACA. All rights reserved. APO14 BAI04 645518342.xlsx Dashboard2—Page 55
APO14
BAI01 BAI02 BAI03
BAI04 BAI01 BAI02 BAI03 BAI06—Managed IT Changes 100
BAI07—Managed IT Change Acceptance and Transitioning

APO10 BAI08 APO10 BAI08 BAI04—Managed Availability & Capacity 40

02/17/2023
COBIT® 2019 Governance System Design Toolkit APO11 BAI07
APO11 BAI07

BAI05—Managed Organizational Change 95
APO14 BAI04
APO14
BAI01 BAI02 BAI03
BAI04 BAI01 BAI02 BAI03 BAI06—Managed IT Changes 100
BAI07—Managed IT Change Acceptance and Transitioning 70
BAI08—Managed Knowledge 55
Design Factor 9 IT Implementation Methods Design Factor 10 Technology Adoption Strategy
Resulting Governance/Management Resulting Governance/Management 0
BAI09—Managed Assets
BAI10—Managed Configuration 80
EDM02 EDM01 MEA04 EDM02 EDM01 MEA04

BAI11—Managed Projects 85
EDM05 100 MEA01 EDM05 100 MEA01 DSS01—Managed Operations 10
APO01 75 DSS06 APO01 75 DSS06
APO02 50 DSS05 APO02 50 DSS05 DSS02—Managed Service Requests & Incidents 45

25 25
0 0 DSS03—Managed Problems 50
APO04 -25 DSS03 APO04 -25 DSS03
APO05
-50
DSS02 APO05
-50
DSS02 DSS04—Managed Continuity 70
-75 -75
APO06 -100 DSS01 APO06 -100 DSS01 DSS05—Managed Security Services 55

DSS06—Managed Business Process Controls 55

MEA01—Managed Performance and Conformance Monitoring 65

MEA02—Managed System of Internal Control 15

APO13 BAI05
MEA03—Managed Compliance with External Requirements 25
APO13 BAI05
BAI01 BAI02 BAI03 BAI01 BAI02 BAI03
MEA04—Managed Assurance 35
© 2018 ISACA. All rights reserved. 645518342.xlsx Dashboard2—Page 56

COBIT 2019 Design Toolkit TKT Eng 1218 (AutoRecovered)

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

COBIT 2019 Design Toolkit TKT Eng 1218 (AutoRecovered)

Uploaded by

Copyright:

Available Formats

02/17/2023

COBIT® 2019 Governance System Design Toolkit

COBIT® 2019 Governance System Design Workbook—Instructions

Terms & Definitions

Instructions: See COBIT® 2019 Design Guide, Chapter 6

© 2018 ISACA. All rights reserved. 645518342.xlsx Instructions—Page 1

COBIT® 2019 Governance System Design Workbook—Canvas

EDM01—Ensured Governance Framework Setting & -5 10 -5 -10 ### -10 50 15 35 0 0 25 50 50 3 3

EDM02—Ensured Benefits Delivery 0 35 15 -5 ### 40 0 0 30 0 0 35 50 50 3 3

EDM03—Ensured Risk Optimization 0 -15 10 -10 ### -15 65 25 15 15 0 30 60 60 3 3

EDM04—Ensured Resource Optimization -20 30 -15 5 ### 0 0 0 25 0 0 15 20 20 1 1

EDM05—Ensured Stakeholder Engagement 5 -45 -15 -15 ### -65 30 15 25 0 0 30 15 15 1 1

APO01—Managed I&T Management Framework 0 5 15 -5 ### 15 50 10 25 0 0 40 65 65 3 3

APO02—Managed Strategy 10 35 -5 5 ### 40 0 0 30 0 0 25 45 45 2 2

APO03—Managed Enterprise Architecture 25 30 15 5 ### 70 50 0 20 0 0 50 90 90 4 4

APO04—Managed Innovation -10 40 45 20 ### 90 0 0 40 0 0 25 70 70 3 3

APO05—Managed Portfolio 0 30 -15 -5 ### 10 0 0 30 0 0 40 35 35 2 2

APO07—Managed Human Resources 15 35 15 15 ### 75 30 0 15 0 0 75 90 90 4 4

APO08—Managed Relationships 0 35 40 5 ### 75 0 0 25 0 0 55 70 70 3 3

APO09—Managed Service Agreements 0 30 10 -10 ### 30 30 0 10 15 0 0 40 40 2 2

APO10—Managed Vendors -20 30 -10 -10 ### -10 50 15 5 15 0 40 50 50 3 3

APO11—Managed Quality 5 0 30 -15 ### 20 30 0 15 0 0 0 30 30 2 2

APO12—Managed Risk 0 -10 50 -5 ### 35 65 25 20 10 0 20 80 80 4 4

APO13—Managed Security 0 -15 60 -15 ### 30 65 15 25 0 0 0 60 60 3 3

APO14—Managed Data 0 -35 35 -15 ### -15 50 10 25 0 0 20 40 40 2 2

BAI01—Managed Programs 20 30 15 15 ### 75 0 0 25 0 30 25 70 70 3 3

BAI02—Managed Requirements Definition -5 30 15 0 ### 40 0 0 30 0 60 30 70 70 3 3

BAI03—Managed Solutions Identification & Build -5 30 35 -10 ### 45 0 0 30 0 65 40 85 85 4 4

BAI04—Managed Availability & Capacity 5 25 35 -15 ### 45 30 0 5 0 0 0 40 40 2 2

BAI05—Managed Organizational Change 25 30 45 5 ### 100 0 0 25 0 40 35 95 95 4 4

BAI06—Managed IT Changes 10 30 45 0 ### 80 50 0 5 0 60 20 100 100 4 4

BAI07—Managed IT Change Acceptance and Transitioning 5 30 30 -5 ### 55 0 0 20 0 40 30 70 70 3 3

BAI08—Managed Knowledge -10 40 15 20 ### 60 0 0 25 0 0 30 55 55 3 3

BAI09—Managed Assets 0 -50 20 5 ### -25 0 0 25 0 0 0 0 0 1 1

BAI10—Managed Configuration 0 25 40 0 ### 60 50 0 15 0 15 30 80 80 4 4

BAI11—Managed Projects 15 30 35 10 ### 85 0 0 20 0 45 30 85 85 4 4

DSS01—Managed Operations 0 30 -5 -15 ### 10 0 0 10 0 0 0 10 10 1 1

DSS02—Managed Service Requests & Incidents 5 15 30 -20 ### 30 50 0 15 0 0 0 45 45 2 2

DSS03—Managed Problems 5 15 15 -5 ### 30 30 0 20 0 0 30 50 50 3 3

DSS04—Managed Continuity 5 15 15 -15 ### 20 65 15 20 0 0 30 70 70 3 3

© 2018 ISACA. All rights reserved. 645518342.xlsx Canvas—Page 2

COBIT® 2019 Governance System Design Workbook—Canvas

DSS05—Managed Security Services 0 -10 20 -15 ### -5 50 25 20 0 0 30 55 55 3 3

DSS06—Managed Business Process Controls 0 20 40 -25 ### 35 50 0 35 0 0 0 55 55 3 3

MEA01—Managed Performance and Conformance Monitoring 0 0 10 -5 ### 5 50 0 25 10 15 35 65 65 3 3

MEA02—Managed System of Internal Control 0 -15 5 -15 ### -25 30 0 25 0 0 0 15 15 1 1

MEA03—Managed Compliance with External Requirements 0 -30 25 -30 ### -35 50 25 15 0 0 0 25 25 2 2

MEA04—Managed Assurance 0 -25 20 -10 ### -15 50 20 25 0 0 0 35 35 2 2

© 2018 ISACA. All rights reserved. 645518342.xlsx Canvas—Page 3

Value Importance Baseline Design Factor 1 Enterprise Strategy

Average 2.75 Strategy

© 2018 ISACA. All rights reserved. 645518342.xlsx DF1—Page 5

Growth / Innovation / Client Service /

© 2018 ISACA. All rights reserved. 645518342.xlsx DF1map—Page 6

Growth / Innovation / Client Service /

© 2018 ISACA. All rights reserved. 645518342.xlsx DF1map—Page 7

Value Importance Baseline

EG09—Optimization of business process costs 1

EG09—Optimization of business process costs EG06—Business-service continuity and availability

Resulting Governance/ Management Objectives

© 2018 ISACA. All rights reserved. 645518342.xlsx DF2—Page 10

IT compliance and Enablement and Competent and

EG01 Portfolio of agile and competitive 0 0 1 0 2 2 0 2 2 0 0 0 2