Frameworks for governing IT, managing risk, running IT services and proving internal controls: COBIT, ITIL, ISO/IEC 20000-1, ISO 31000, COSO, SOX and ISO 9001.
IT governance answers a management question rather than a technical one: who decides what IT does, how its risks are judged and how the board knows it is working. The frameworks in this category give that question structure. Most are voluntary. One area is firmly mandatory: listed companies in the United States must maintain internal control over financial reporting under the Sarbanes-Oxley Act, and the IT systems behind their financial figures are part of that.
Governance, management and service delivery
COBIT and ISO/IEC 38500 set out how leadership directs and oversees IT. ITIL and ISO/IEC 20000-1 describe how IT services are planned, delivered and improved day to day. ISO 9001 sets out a quality management system that many software and IT services firms certify against. ISO 31000 and COSO give general risk and internal-control frameworks that the more specific IT standards plug into, and ISO/IEC 27005 and the NIST Risk Management Framework apply risk management to information security and information systems.
When it matters for IT companies
A software firm meets these frameworks in three ways. Its own management may adopt them to run the business better. Its enterprise customers may ask about them in due diligence (for example, how changes are approved and tested, which is a classic SOX IT general control). And a certification such as ISO 9001 or ISO/IEC 20000-1 may be a tender requirement.
Picking the right one
Use COBIT when the question is governance and accountability, ITIL or ISO/IEC 20000-1 when it is service management, ISO 9001 when customers want certified quality processes, and COSO when the concern is financial reporting controls. The guides explain each one and how they map to each other, so effort is not duplicated.
At a glance
Mandatory or voluntary: it governance & risk management
Companies with securities registered with the US SEC, including foreign private issuers, and by extension the service providers whose systems support their financial reporting.
US Congress; implemented by the Securities and Exchange Commission and the Public Company Accounting Oversight Board (PCAOB)
India. Applies to RBI-regulated entities, with separate entity-wise directions for commercial banks, small finance banks, NBFCs, credit information companies, all-India financial institutions and others.
COBIT 2019 (Control Objectives for Information and Related Technologies)
COBIT is ISACA's framework for the governance and management of enterprise information and technology. COBIT 2019 defines 40 governance and management objectives in five domains, describes the components a governance system needs, and uses design factors to tailor it to each organisation. It is voluntary, but auditors and regulators use it widely as a reference for IT controls, especially where IT supports financial reporting under SOX, and it complements ITIL for service management.
COSO Internal Control, Integrated Framework (2013) and COSO Enterprise Risk Management, Integrating with Strategy and Performance (2017)
COSO publishes the most widely used frameworks for internal control and enterprise risk management. The 2013 Internal Control, Integrated Framework organises control into five components and 17 principles and is the basis for SOX internal control over financial reporting and the SOC 2 common criteria. The 2017 ERM framework links risk to strategy and performance through 20 principles. In 2026, COSO added guidance on internal control over generative AI.
ISO/IEC 20000-1: Information technology, Service management, Part 1: Service management system requirements
ISO/IEC 20000-1 is the international standard for service management systems. It sets requirements for planning, delivering, monitoring and improving services, including IT services, through a management system with defined processes for service levels, incidents, problems, changes, releases, capacity, availability, continuity, suppliers and security. Organisations can be certified against it by accredited bodies, which makes it the auditable counterpart to practice guidance such as ITIL for managed service providers.
ISO/IEC 38500: Information technology, Governance of IT for the organization
ISO/IEC 38500 is the international standard for the governance of information technology. It is written for boards and other governing bodies and explains how they should direct, oversee and be accountable for an organisation's use of IT and data. The 2024 edition aligns IT governance with ISO 37000, the general standard on governance of organisations, adopting its outcomes and principles and applying them to technology, data, environmental and social considerations.
ISO 9001 is the international standard for quality management systems, used by more organisations than any other ISO management standard. It requires a process-based system focused on customer requirements, leadership commitment, risk-based planning, controlled operations, measurement and continual improvement. The 2026 edition, published in September 2026, keeps the same structure while strengthening quality culture, ethics and change management. It is voluntary and certifiable, and IT companies often need it for tenders and enterprise contracts.
ISO 31000 is the international guideline for managing any kind of risk, from strategy and operations to projects, technology and compliance. It defines risk as the effect of uncertainty on objectives and sets out eight principles, a framework for integrating risk management into governance and decision making, and a repeatable process for assessing, treating, monitoring and reporting risk. It is the parent of specialised standards such as ISO/IEC 27005 for information security risk.
ITIL (IT service management best practice framework), ITIL 4 and ITIL Version 5
ITIL is the most widely used best practice framework for IT service management. It describes how organisations plan, deliver, support and improve technology-enabled services, through a service value system, guiding principles, four dimensions and 34 management practices such as incident, change, problem and service level management. ITIL 4 was published in 2019 and ITIL Version 5 launched in 2026. It is voluntary and certifies people, not organisations; ISO/IEC 20000-1 is the matching certifiable standard.
NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
The NIST Risk Management Framework is the US government's process for managing security and privacy risk across a system's life cycle. Defined in SP 800-37 Rev. 2, it has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. Agencies use it to categorise systems by impact, choose and implement NIST SP 800-53 controls, assess them, decide whether to authorise operation, and monitor continuously. It underpins FedRAMP, FISMA compliance and many contractor requirements.
SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (Form 8-K Item 1.05 and Regulation S-K Item 106)
The SEC's cybersecurity disclosure rules require US public companies to disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality, and to describe their cybersecurity risk management, strategy and governance annually in Form 10-K under Regulation S-K Item 106. The rules, in force since December 2023, raise expectations on incident response, board oversight and third-party risk. Industry groups have asked the SEC to rescind the incident rule, but it remained in force as of October 2026.
Sarbanes-Oxley Act of 2002: internal control over financial reporting and IT general controls
The Sarbanes-Oxley Act is the US law that requires public companies to maintain and assess internal control over financial reporting, with executives certifying their reports and, for larger companies, auditors attesting to those controls. For IT, SOX means IT general controls over the systems that produce financial data: access, change management, development and operations. It applies to US-listed companies, including foreign ones, and reaches their software and cloud vendors through SOC 1 reports and contract requirements.
Capability Maturity Model Integration (CMMI), version 3.0, from the CMMI Institute (ISACA)
CMMI is a model for improving how organisations deliver software, services and other work. Version 3.0 organises good practices into practice areas across domains such as development, services, supplier management, security, safety, data and people, and defines maturity levels from 1 (initial) to 5 (optimizing). Organisations can be appraised by certified lead appraisers to obtain a maturity level rating, which many IT services companies use to show disciplined delivery to clients and government buyers.
Federal Information Security Modernization Act of 2014 (44 U.S.C. 3551 and following)
FISMA is the US federal law that requires every federal agency to run an agency-wide information security programme, protect its information systems according to NIST standards, report incidents to CISA, and be evaluated annually by its inspector general. The 2014 modernisation clarified the roles of OMB and the Department of Homeland Security and strengthened incident reporting. It applies to agencies directly and reaches IT contractors and cloud providers through contracts and programs such as FedRAMP.
ISO/IEC 23894: Information technology, Artificial intelligence, Guidance on risk management
ISO/IEC 23894 gives guidance on managing risks that arise when organisations develop, provide or use AI. It applies the ISO 31000 risk management principles, framework and process to AI, adds AI-specific objectives such as fairness, transparency, safety, security, privacy and accountability, lists common AI risk sources such as data quality, lack of transparency and level of automation, and maps risk management to each stage of the AI lifecycle. It complements ISO/IEC 42001 and the NIST AI RMF.
ISO/IEC 27005: Information security, cybersecurity and privacy protection, Guidance on managing information security risks
ISO/IEC 27005 is the international guidance standard for information security risk management. It explains how to set risk criteria, identify risks using asset-based or event-based approaches, analyse likelihood and consequences, evaluate and treat risks, and keep the process running. The 2022 edition aligns with ISO/IEC 27001:2022 and ISO 31000, and is the usual reference for designing the risk assessment that ISO 27001 certification requires.
ISO/IEC 42001 Information technology: Artificial intelligence: Management system
ISO/IEC 42001 is the international standard for an AI management system (AIMS): a structured way for organisations that develop, provide or use AI to set AI policy, assess AI risks and impacts, control the AI life cycle and keep improving. It follows the same clause structure as ISO/IEC 27001, adds AI-specific requirements such as an AI system impact assessment, and lists 38 reference controls in Annex A. It is voluntary and certifiable.
The NIST Cybersecurity Framework is voluntary guidance for managing cybersecurity risk, organised as six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0, published in 2024, added the Govern function and widened the audience from critical infrastructure to every organisation. It describes outcomes rather than prescribing controls, and uses profiles and tiers to compare current and target states. It is not certifiable, but it is one of the most widely used ways to structure a security programme.
NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management
The NIST Privacy Framework is a voluntary tool for managing privacy risk across an organisation. Modelled on the NIST Cybersecurity Framework, it organises privacy outcomes into Core functions for identifying, governing, controlling, communicating about and protecting data processing, and uses Profiles and Implementation Tiers to set targets and measure maturity. It is law-neutral, so organisations use it to build one privacy program that supports GDPR, US state laws, DPDP and other regimes.
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
NIST SP 800-34 is the US government's guide to contingency planning for information systems. It sets out a seven-step process: policy, business impact analysis, preventive controls, recovery strategies, a system contingency plan, testing and training, and maintenance. It explains how plans such as disaster recovery, continuity of operations and incident response fit together, defines terms like maximum tolerable downtime, RTO and RPO, and provides templates for low, moderate and high impact systems.
NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 is the US government's catalogue of security and privacy controls, organised in 20 families from access control to supply chain risk management. Revision 5 made the controls outcome-based and usable by any organisation, and Release 5.2.0 in 2025 added software update and patch integrity controls. Federal systems must select controls from baselines in SP 800-53B, and programs such as FedRAMP use them, so vendors selling to the US government meet this catalogue directly.
OWASP Software Assurance Maturity Model, version 2
OWASP SAMM is an open framework for assessing and improving how an organisation builds secure software. It defines five business functions (Governance, Design, Implementation, Verification and Operations), each with three security practices, and maturity levels for each practice. Teams score their current state, choose targets that fit their risk, and build a roadmap. It complements requirement standards such as the OWASP ASVS and frameworks such as the NIST SSDF, and it is free to use.
Reserve Bank of India Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (successor to the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices)
RBI's technology directions set how banks, NBFCs and other regulated entities govern IT, manage cyber and technology risk, run operations, audit systems and recover from disruption. Issued as entity-wise directions on 31 July 2026, they replace the 2023 IT Governance Master Direction and older cyber security circulars. They require board IT strategy committees, a CISO, IT and security policies, vulnerability testing, disaster recovery drills, IS audits, vendor oversight and cyber incident reporting to RBI within six hours.
SOC 1: report on controls at a service organization relevant to user entities' internal control over financial reporting (AICPA SSAE 18, AT-C 320; IAASB ISAE 3402)
A SOC 1 report is an independent auditor's report on a service organisation's controls that are relevant to its customers' financial reporting. Payroll processors, billing and revenue platforms, fund administrators, payment processors and IT providers running finance systems obtain SOC 1 reports so their customers and those customers' auditors can rely on them, especially for SOX. Type 1 covers control design at a date; Type 2 adds operating effectiveness over a period. ISAE 3402 is the international equivalent.
They answer different questions. COBIT is about governance and control objectives; ITIL is about running IT services. Many organisations use COBIT to set direction and ITIL practices to deliver.
Does SOX apply to software vendors?
SOX applies to companies listed in the US. A vendor is affected when its software or service supports a listed customer's financial reporting, which is why customers ask vendors for SOC 1 reports.
Is ISO 9001 worth it for a software company?
It depends on your customers. It is often a tender requirement in government and manufacturing supply chains. On its own it does not address security; that is ISO/IEC 27001.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
