# A Dynamic and Adaptive Cybersecurity Governance Framework
## 2 Review of Existing IT and Cybersecurity Governance Frameworks
### Cobiet 2019  
The Control Objectives for Information and Related Technology (COBIT) framework was developed by the Information Systems Audit and Control Association (ISACA) [14; 15; 16; 17; 18]. As shown in Figure 1, COBIT 5 framework has the following governance processes: evaluation, direct, monitoring, performance, and compliance. It also has management processes: plan, build, run and monitor daily activities [19]. The revised and amended version of COBIT 5 was released as COBIT 2019.  
As shown in Figure 2, there are six governance system principles in COBIT 2019 as compared with COBIT 5. Moreover, COBIT 2019 was developed based on two main principles; principles, which present the core requirements of the government system and governance system principles, which are used to build the governance system for organizations. There are also three principles for a governance framework; the governance framework should be based on a conceptual model, open and flexible, and align with other regulations, frameworks, and standards.  
COBIT 2019 provide guidelines and directions for organizations to achieve their goals towards the governance of an IT system that supports business operations and processes. This framework can be integrated and aligned with other standards and best practices of ISACA frameworks and IT programs, such as the IT Assurance Framework, COBIT, Val IT, Risk IT, and the Business Model for IS [19]. It clearly distinguishes between the governance and management aspects of the IT system. Moreover, the focus is to provide an end-to-end view of the governance of the IT system and follows a holistic approach.  
The COBIT 2019 governance framework mainly provides detailed guidance on governing IT systems across the organization's strategic, tactical, and operational levels. The number of processes increased from 37 in COBIT 5 to 40 in COBIT 2019 [18].  
Figure 1: COBIT and ISO/IEC 27014 governance process.  
Figure 2: COBIT 5 and 2019 Principles.  
The governance and management objectives of COBIT 2019 are: Evaluate, Direct, and Monitor (EDM); Align, Plan, and Organize (APO); Build, Acquire, and Implement (BAI); Deliver, Support, and Service (DSS); Monitor, Evaluate, and Assess (MEA). Table 1 shows the comparison of COBIT 5 and 2019 using different governance parameters.  
If properly implemented, the COBIT 2019 governance processes will ensure IT risk optimization, framework implementation and maintenance, value delivery, and efficient usage of resources.  
It also has six main principles: following a holistic approach, covering the organization end-to-end, ascertaining stakeholders' needs, tailoring to enterprise needs, creating a dynamic governance system, and separating the governance from management [18].  
However, some practical problems of COBIT 5 and COBIT 2019 are identified, such as complex and complicated concepts and structure, lack of guidelines for the implementation and well justified and confirmed benefits, creating some misunderstanding with other IT best practices and standards. Moreover, it mainly focused on IT systems that didn't fully address the issue of cybersecurity. The other problem with the COBIT framework is it is costly to implement. Therefore, many organizations have avoided their implementation. It also requires a lot of skill and knowledge, so it is not used for organizations with a low security posture. Since it is vast in content, it takes a lot of time for the IT auditors to assess the whole components, frameworks, and other parts of the framework. The requirement level of IT professionals and experts to implement and audit is high. It also requires high training for implementation.  
The COBIT framework, mainly considered an IT governance framework, is a business framework used to solve a business problem.