SAF and COBIT 2019
Nature and status of the approach
COBIT® 2019 is a framework for the governance and management of enterprise information and technology. It distinguishes governance, where needs are evaluated, direction is set, and results are monitored, from management, where activities are planned, built, run, and monitored. COBIT is neither an architectural metamodel nor a service catalog.
Purpose and audience
COBIT is intended for governing bodies, owners of governance and management objectives, IT leaders, risk and control functions, auditors, and governance practitioners. SAF provides them with a connected subject for decisions: services, capabilities, applications, data, and infrastructure to which objectives and controls apply.
Management scope and unit
COBIT 2019 contains 40 governance and management objectives across the EDM, APO, BAI, DSS, and MEA domains. Each objective considers governance-system components: processes, organizational structures, information flows and items, people and skills, culture and behavior, policies and procedures, services, infrastructure, and applications.
Concepts and SAF mappings
| COBIT 2019 | Nearest concept in SAF | Type / confidence | Boundary |
|---|---|---|---|
| Stakeholder needs and enterprise goals | Context of Actors, Services, and Capabilities | Partial / medium | Goal is not a SAF core type. |
| Governance/management objective | Capability and set of Processes | Composite / high | An objective includes all governance components, not one process. |
| Organizational structure | Actors and groupings | Partial / medium | SAF does not model governing bodies as a separate type. |
| Information flows and items | Information Objects and Integrations | Partial / medium | Management information is broader than business data. |
| Services, infrastructure and applications | Service, Systems, Components, Deployments, and resources | Composite / high | In COBIT, this is a governance-system component, not detailed architectural semantics. |
| Process capability | External assessment of a Process | Not applicable / high | This is not a SAF model maturity level. |
Relationships
COBIT connects stakeholder needs to enterprise and alignment goals, then to prioritized governance and management objectives and their components. SAF can serve as one source of facts for this chain. Particularly close areas include managed service agreements, assets, configuration, changes, operations, requests and incidents, problems, continuity, security, and data.
Lifecycle and organization of work
COBIT domains cover evaluation and direction, alignment and planning, building and implementation, delivery and support, and monitoring and evaluation. This is a management system around the lifecycle, not a sequence of SAF object states. Architectural decisions and facts become inputs, outputs, or evidence for the relevant objectives.
Roles and governance
The distinction between the governing body and management is fundamental. One SAF Actor may perform several roles, but authority for evaluation, direction, execution, and assurance must be recorded separately. The “owns” relationship is insufficient for COBIT's complete responsibility assignment.
Measures, maturity, and adaptation
COBIT Performance Management assesses process capability and maturity of focus areas. Design factors adapt the governance system to enterprise context. SAF profiles may inform such tailoring, but they do not replace design factors and cannot be converted into COBIT levels.
Using the approaches together
COBIT determines why and by whom an area is governed; SAF shows which objects and dependencies are within the decision boundary. In joint use, a COBIT objective links to a set of SAF objects, owners, measures, and evidence sources; SAF does not store every control activity or audit test.
Mapping limitations
Detailed COBIT publications are licensed by ISACA. The public description is sufficient for positioning, but not for reproducing the Core Model. Similar topics do not mean that SAF implements COBIT or can support assessment of its objectives without a separate governance system.