Which framework provides a comprehensive governance and control framework for IT processes and practices?

• A. ITIL (Information Technology Infrastructure Library)
• B. COBIT (Control Objectives for Information and Related Technologies)
• C. ISO 27001
• D. PMBOK (Project Management Body of Knowledge)

Answer: (B)

Governance and control of IT processes across the enterprise require a framework that not only lists procedures but also aligns IT with business objectives, defines governance objectives, manages risk, and provides measurement and assurance. COBIT does exactly that. It’s designed as a comprehensive governance and management framework for enterprise IT, offering a structured set of control objectives, processes, and metrics that span the full IT lifecycle—from governance to operational execution. This helps leaders ensure IT resources are used effectively, risks are managed, and compliance is maintained while linking IT outcomes to business goals.

ITIL focuses on IT service management and operations—how services are delivered and supported—rather than providing a complete governance structure for all IT processes. ISO 27001 centers on information security management systems, offering a framework to manage security risks and controls, not a broad governance framework for all IT activities. PMBOK guides project management practices, not the ongoing governance and control of IT processes across the organization. So COBIT is the best fit for a comprehensive governance and control framework for IT.