A CIO wants a framework for the governance and management of enterprise information and technology that aligns IT goals with business objectives and stakeholder value. Other executives have proposed frameworks built for internal control over financial reporting, prioritized technical safeguards, or a catalog of security controls. Which framework fits the CIO's purpose?

COBIT, published by ISACA, is a framework for the governance and management of enterprise information and technology. It separates governance, which evaluates, directs and monitors, from management, which plans, builds, runs and monitors, and uses a goals cascade from stakeholder needs to IT alignment goals. That makes it the fit for a CIO seeking to align IT with business objectives and stakeholder value. The COSO Internal Control Integrated Framework defines components and principles of internal control, widely used for financial reporting assurance and regulatory compliance; it is enterprise-wide and control-focused rather than a framework for governing IT specifically. The CIS Critical Security Controls are a prioritized set of technical and operational safeguards for defending against common attacks; they tell an organization which security actions to take first, not how to govern IT investment. NIST SP 800-53 is a comprehensive catalog of security and privacy controls for information systems; it supplies controls to select and tailor, not a governance model for aligning IT with business goals. Exam caveat: the 2026 outline lists NIST, ISO, HIPAA, COBIT, CIS Controls and COSO alongside ITIL as sources of operational controls and standards, so expect questions that test their distinct purposes. Operational check: confirm the chosen governance framework maps IT goals to enterprise goals and that control frameworks are referenced from it rather than used in its place.