IT governance frameworks describe how leadership directs and controls technology: who decides, how services are run, how risk is judged and how quality is kept. Most are voluntary (COBIT, ITIL, ISO 31000), some are certifiable (ISO 20000-1, ISO 9001), and SOX turns IT controls into a legal duty for US-listed companies and the providers they rely on.
6 items in this category
6 related from other categories
Oct 30, 2026 statuses last checked
At a glance
IT governance and risk management compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Name
Type
Mandatory or voluntary
Where it applies
Current version
COBIT
Framework
Voluntary framework, no official certificate
Global
COBIT 2019, with 40 governance and management objectives.
ITIL
Framework
Voluntary framework, no official certificate
Global
ITIL 4 with 34 practices. ITIL Version 5 is being rolled out in phases during 2026, starting with Foundation.
ISO 20000-1
Certifiable standard
Voluntary, with independent certification
Global
ISO/IEC 20000-1:2018.
ISO 9001
Certifiable standard
Voluntary, with independent certification
Global
ISO 9001:2026 was published on 16 September 2026, with a transition period of about three years. ISO 9001:2015 certificates stay valid during the transition.
SOX IT controls
Law
Mandatory by law for organizations in scope
United States (SEC-registered companies)
The 2002 Act; most companies assess internal control against the COSO 2013 framework.
ISO 31000
Guidance
Voluntary guidance, no official certificate
Global
ISO 31000:2018.
Directory
What each one covers and who needs it
Framework Global
COBIT 2019
Control Objectives for Information and Related Technologies
COBIT is ISACA's framework for governing and managing enterprise information and technology. COBIT 2019 defines 40 governance and management objectives in five domains, design factors to tailor them, and capability levels to measure processes. It separates governance (evaluate, direct, monitor) from management (plan, build, run, monitor) and is popular with IT auditors and regulated sectors. It is voluntary; individuals can be certified, organizations cannot.
What it covers, who needs it and why
What it covers
IT strategy, risk, resources, portfolio, security, change, operations, assurance and the link between business goals and IT goals.
Who needs it
CIOs, IT auditors, banks and other regulated firms, and IT providers whose customers audit them against it.
Why it matters
It gives auditors and boards a structured way to judge whether IT is governed, which supports SOX and banking IT rules.
Key objectives
Align IT with business goals
Separate governance from management
Measure process capability
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
ISACA
Current version
COBIT 2019, with 40 governance and management objectives.
ITIL framework for IT and digital service management
ITIL is the most widely used framework of good practice for IT service management. ITIL 4 describes a service value system, guiding principles and 34 management practices, including incident, problem, change enablement and service level management. ITIL Version 5 is rolling out in 2026 with new modules, including AI governance. ITIL certifies people, not organizations; an organization that wants a certificate for its service management uses ISO/IEC 20000-1.
What it covers, who needs it and why
What it covers
How IT services are designed, delivered, supported and improved: service desk, incidents, problems, changes, releases, service levels, assets and continuity.
Who needs it
Managed service providers, internal IT departments, service desks and anyone bidding for IT service contracts.
Why it matters
Buyers often expect ITIL-aligned processes and ITIL-certified staff in managed service tenders.
Key objectives
Deliver value through services
Standardize service management practices
Improve services continually
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
PeopleCert (which acquired AXELOS)
Current version
ITIL 4 with 34 practices. ITIL Version 5 is being rolled out in phases during 2026, starting with Foundation.
ISO/IEC 20000-1 is the certifiable international standard for a service management system (SMS). It follows the same high-level structure as ISO 27001 and ISO 9001, and adds requirements for service portfolio, relationship and agreement management, supply and demand, service design and transition, resolution and fulfillment, and service assurance. Where ITIL certifies people, ISO 20000-1 lets an IT service provider certify the organization's service management.
What it covers, who needs it and why
What it covers
The full service lifecycle for the services in scope, plus the management system around it.
Who needs it
Managed service providers, outsourcers, data center and cloud operators, and internal IT shared services.
Why it matters
Some public sector and enterprise tenders ask for it as proof that services are run in a controlled way.
Key objectives
Plan and deliver services that meet agreed requirements
ISO 9001 is the international standard for a quality management system. It asks you to understand customer requirements, plan and control the processes that deliver your products and services, manage risks and opportunities, measure results and improve. For software and IT companies it is often a tender requirement, especially in government and manufacturing supply chains. The 2026 edition adds emphasis on quality culture and ethics, change management and organizational knowledge.
What it covers, who needs it and why
What it covers
Leadership, planning, support (people, competence, documented information), operations (design, development, delivery), performance evaluation and improvement.
Who needs it
Software development firms, IT service companies and any supplier whose customers require a certified quality system.
Why it matters
It is the most widely held management system certificate in the world and a common pre-qualification filter.
Key objectives
Consistently meet customer and legal requirements
Manage processes and risks
Improve customer satisfaction
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO (TC 176)
Current version
ISO 9001:2026 was published on 16 September 2026, with a transition period of about three years. ISO 9001:2015 certificates stay valid during the transition.
Sarbanes-Oxley Act of 2002, Sections 302 and 404, with the COSO internal control framework
The Sarbanes-Oxley Act requires public companies to maintain and assess internal control over financial reporting. Section 404 requires management to report on those controls, and for larger filers an external auditor attests to them. Because financial data lives in IT systems, auditors test IT general controls: access to systems, change management, computer operations and program development. SOX does not apply to private IT vendors directly, but customers pass its control demands to them, often by asking for a SOC 1 report.
What it covers, who needs it and why
What it covers
IT general controls over systems that affect financial reporting: user access and segregation of duties, change management, operations, backups and interfaces.
Who needs it
US-listed companies and the IT and SaaS providers that host or run their financial systems.
Why it matters
Weak IT controls are a common cause of reported material weaknesses, and officers personally certify the reports.
Key objectives
Reliable financial reporting
Documented and tested internal controls
Accountability of executives for reported figures
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Congress; SEC and PCAOB
Current version
The 2002 Act; most companies assess internal control against the COSO 2013 framework.
ISO 31000 gives principles, a framework and a process for managing any kind of risk in any organization. The process runs from establishing scope and context to risk identification, analysis and evaluation, treatment, monitoring and reporting. It is guidance, so it cannot be certified, but it shapes how ISO 27001, ISO 22301 and ISO 42001 expect risk to be handled and is a common reference for enterprise risk management programs.
What it covers, who needs it and why
What it covers
Enterprise and operational risk management principles, governance and process, applicable to IT, security, project and business risk.
Who needs it
Risk managers, security and compliance leads, and companies building one risk method across several standards.
Why it matters
A single, consistent risk method avoids running separate and conflicting risk registers for each standard.
System and Organization Controls 1 report on controls relevant to user entities' internal control over financial reporting
A SOC 1 report tells a customer's financial auditor whether a service provider's controls can be relied on for the customer's financial reporting. It matters when your system processes transactions, payroll, billing or other data that ends up in a customer's financial statements. Like SOC 2, it comes as Type I (design at a date) or Type II (operating effectiveness over a period) and is issued by a CPA firm. It is not a security report and does not replace SOC 2.
What it covers, who needs it and why
What it covers
Control objectives you define around transaction processing and the IT general controls that support them (access, change management, operations).
Who needs it
Payroll, billing, payment, fund administration, ERP hosting and other providers whose output affects customers' financial statements, often at the request of SOX-regulated customers.
Why it matters
Without one, a customer's auditor may have to test your controls directly, which is slow and disruptive for both sides.
Key objectives
Describe the service and control objectives
Show controls are designed to meet them
Test operating effectiveness over a period (Type II)
The NIST Cybersecurity Framework is a voluntary framework that helps any organization understand and reduce cybersecurity risk. Version 2.0 organizes outcomes into six functions (Govern, Identify, Protect, Detect, Respond and Recover), broken into categories and subcategories, with profiles to describe current and target states and tiers to describe rigor. It does not prescribe controls; it points to references such as NIST SP 800-53, ISO 27001 and CIS Controls. There is no certification.
What it covers, who needs it and why
What it covers
Cybersecurity governance and risk outcomes across the organization and its supply chain, from strategy to incident recovery.
Who needs it
Organizations of any size, especially US companies, critical infrastructure and suppliers whose customers or regulators reference it.
Why it matters
It is a common language for boards, regulators and customers, and many sector rules (SEBI CSCRF among them) reuse its functions.
Key objectives
Describe current and target cybersecurity posture
Prioritize improvements by risk
Communicate risk to leadership and partners
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
US National Institute of Standards and Technology (NIST)
Regulation United States (companies registered with the SEC)
SEC cybersecurity disclosure rules
US Securities and Exchange Commission rules on cybersecurity risk management, strategy, governance and incident disclosure
The SEC's 2023 rules require public companies to disclose material cybersecurity incidents on Form 8-K, generally within four business days of deciding an incident is material, and to describe their cybersecurity risk management, strategy and governance every year in Form 10-K. The rules do not prescribe controls, but they force a documented process for judging materiality and board oversight. IT vendors feel them through customers who now ask about incident notice timelines.
What it covers, who needs it and why
What it covers
Disclosure of material incidents, processes to assess and manage cyber risk, management's role and the board's oversight.
Who needs it
Companies listed in the US, including foreign private issuers (on Forms 6-K and 20-F), and indirectly their technology suppliers.
Why it matters
Late or misleading disclosure exposes the company and its officers to SEC enforcement.
Key objectives
Give investors timely incident information
Standardize disclosure of cyber governance
Push board-level oversight of cyber risk
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
US Securities and Exchange Commission (SEC)
Current version
Adopted July 2023. Form 8-K Item 1.05 incident disclosure has applied since 18 December 2023 for most registrants.
CMMI is a model of best practices for developing products and delivering services, with maturity levels that describe how well an organization's processes are defined, managed and improved. Organizations are appraised by certified lead appraisers, and the results are published by ISACA, so a "CMMI Level 3" claim can be checked. It is voluntary but common in software outsourcing and government contracts, particularly for Indian IT services firms.
What it covers, who needs it and why
What it covers
Practice areas for planning, estimating, requirements, design, verification, configuration management, process improvement and, in v3.0, security, safety and data management.
Who needs it
Software development and IT services companies bidding for large outsourcing or government programs.
Why it matters
Some buyers require a specific maturity level as a bid condition.
ISO/IEC 42001 is the first certifiable management system standard for artificial intelligence. It asks organizations that develop, provide or use AI to set an AI policy, assess AI risks and impacts on people, apply controls from its Annex A (such as data quality, transparency, human oversight and supplier management), and improve through audit and review. It uses the same structure as ISO 27001, so the two are often combined. Certification is voluntary and done by accredited bodies.
What it covers, who needs it and why
What it covers
Governance of AI across its lifecycle: policy, roles, risk and impact assessment, data, development, operation, monitoring and third parties.
Who needs it
AI product companies, SaaS vendors with AI features and enterprises that deploy AI and want auditable governance.
Why it matters
It gives customers independent proof of AI governance and supports readiness for laws such as the EU AI Act.
Security and resilience: business continuity management systems, requirements
ISO 22301 sets requirements for a business continuity management system (BCMS). You analyze which activities matter most and how long they can be down (business impact analysis), assess risks, choose continuity strategies, write and exercise plans, and review and improve. Certification by an accredited body is voluntary. For IT and SaaS companies it pairs with ISO/IEC 27031 and NIST SP 800-34 for disaster recovery of systems, and supports duties under DORA and NIS2.
What it covers, who needs it and why
What it covers
Business impact analysis, risk assessment, continuity strategies and solutions, plans and procedures, exercising and testing, and evaluation.
Who needs it
SaaS, cloud, data center and managed service providers whose customers depend on uptime, and firms in regulated sectors.
Why it matters
Customers and regulators want evidence that you can keep delivering through disruption, not just a backup policy.
Key objectives
Protect prioritized activities during disruption
Recover within agreed timeframes
Exercise and improve plans
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO (TC 292)
Current version
ISO 22301:2019 with Amendment 1:2024. Related guidance: ISO/IEC 27031 (ICT readiness) and NIST SP 800-34 (contingency planning).
Train your team on it governance and risk management requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
