The objective of COBIT Implementation Phase 2 is to define the scope of the implementation using

COBIT’s mapping of enterprise goals to IT-related goals and the associated IT processes, and to

consider how risk scenarios could also highlight key processes on which to focus. This phase also

involves documenting the current capability and performance of the selected processes and

identifying opportunities for improvement12.

Reference

7 Phases in COBIT Implementation | COBIT Certification - Simplilearn

COBIT 2019 Design and Implementation COBIT Implementation, page 31.

According to the TM Forum’s Business Process Framework (eTOM), the business/process level is

responsible for defining the business strategy, objectives, and requirements, as well as monitoring

and controlling the performance and quality of the processes1. The implementation/operations level

is responsible for designing, developing, and executing the processes that deliver and support the

services1. When coordinating framework implementation, these two levels collaborate to assess

changes in current and future risks, such as market trends, customer expectations, regulatory

compliance, security threats, and operational issues2. This helps them to align the processes with

the business goals and outcomes, and to identify and mitigate any potential gaps or challenges3.

Reference: 1: Process Framework (eTOM) - TM Forum 2: Implement Dynamics 365 with a process-

focused approach 3: Operations Management Implementation - Smarter Solutions, Inc.

One of the objectives of CSF Step 6 is to translate improvement opportunities into justifiable,

contributing projects, which means to develop an action plan that addresses the gaps between the

current and target profiles, and that aligns with the organization’s mission drivers, risk appetite, and

resource constraints12.

Reference

Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide, page 8.

NIST CSF: The seven-step cybersecurity framework process

This represents a best practice for completing CSF Step 3: Create a Current Profile, because it

involves collaborating with relevant stakeholders to identify the current cybersecurity outcomes and

implementation status of the organization12. Engaging in a dialogue and obtaining input can help to

ensure that the Current Profile reflects the business drivers, mission, objectives, and risk appetite of

the organization, as well as the scope and boundaries of the cybersecurity program34.

Reference: 1: Cybersecurity Framework Components | NIST 2: Getting Started with the NIST

Cybersecurity Framework: A Quick Start Guide3 3: Implementing the NIST Cybersecurity Framework

Using COBIT 2019 | ISACA 4: NIST CSF: The seven-step cybersecurity framework process5

Identifying quick wins for implementation first is the best approach to gain support for the process,

as it can demonstrate the value and feasibility of the project, and motivate the stakeholders to

overcome the resistance and embrace the change12. Quick wins are those actions that can be

implemented rapidly and easily, and that can produce visible and measurable results3.

Reference

7 Phases in COBIT Implementation | COBIT Certification - Simplilearn

Implementing the NIST Cybersecurity Framework Using COBIT 2019, page 17.

What is a Quick Win? - Definition from Techopedia

According to the NIST Cybersecurity Framework, mission drivers are a primary consideration when

creating an action plan to address gaps identified in CSF Step 6, as they help to align the

cybersecurity program with the organization’s objectives, priorities, and risk appetite. Mission

drivers also help to determine the resources needed and the cost-benefit analysis of the proposed

solutions12.

Reference

7 Steps to Implement & Improve Cybersecurity with NIST

Cybersecurity Framework v1.1 - CSF Tools - Identity Digital, page 7.

This COBIT task and activity corresponds to CSF Step 1: Prioritize and Scope, because it involves

assessing the current state of the enterprise’s governance and management system, as well as its

readiness and ability to adopt changes12. This task and activity is part of the COBIT 2019

implementation phase "Where are we now?"3, which aligns with the CSF step of identifying the

business drivers, mission, objectives, and risk appetite of the organization4.

Reference: 1: COBIT 2019 Implementation Guide 2: COBIT 2019 Implementation - ISACA 3:

Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA 4: Cybersecurity Framework

Components | NIST

The goals cascade is a mechanism that translates the stakeholder needs into specific, actionable, and

customized goals at different levels of the enterprise12. The stakeholder needs are the drivers of the

governance system and reflect the expectations and requirements of the internal and external

parties that have an interest or influence on the enterprise34. The goals cascade supports the

prioritization of management objectives based on the stakeholder needs, as well as the alignment of

the enterprise goals, the alignment goals, and the governance and management objectives12.

Reference: 1: COBIT 2019 Goals Cascade: A Blueprint for Success 2: COBIT 2019 Framework – ITSM

Docs - ITSM Documents & Templates 3: COBIT | Control Objectives for Information Technologies |

ISACA 4: Aligning IT goals using the COBIT5 Goals Cascade

This principle corresponds to the CSF application stating that CSF profiles support flexibility in

content and structure, because both emphasize the need for tailoring the governance system to the

specific context and requirements of the enterprise12. The CSF profiles are based on the enterprise’s

business drivers, risk appetite, and current and target cybersecurity posture3. The COBIT 2019 design

factors are a set of parameters that influence the design and operation of the governance system,

such as enterprise strategy, size, culture, and regulatory environment4.

Reference: 1: COBIT | Control Objectives for Information Technologies | ISACA 2: COBIT 2019

Framework – ITSM Docs - ITSM Documents & Templates 3: Framework Documents | NIST 4:

Introduction to COBIT Principles - Testprep Training Tutorials

The most important reason to compare framework profiles is to identify gaps between the current

and target state of cybersecurity activities and outcomes, and to prioritize the actions needed to

address them12. Framework profiles are the alignment of the functions, categories, and

subcategories of the NIST Cybersecurity Framework with the business requirements, risk tolerance,

and resources of the organization3. By comparing the current profile (what is being achieved) and

the target profile (what is needed), an organization can assess its cybersecurity posture and develop

a roadmap for improvement4.

Reference: 1: Cybersecurity Framework Components | NIST 2: Implementing the NIST Cybersecurity

Framework Using COBIT 2019 | ISACA 3: Examples of Framework Profiles | NIST 4: Connecting COBIT

2019 to the NIST Cybersecurity Framework - ISACA