The five COBIT 2019 domains
By Sam Rivera, Founder, SentinelPanda · June 20, 2026 · 1 min read · COBIT 2019
COBIT's 40 objectives live in five domains — one for governance, four for management. Knowing the domains is the map to the whole framework.
Governance and management, split
COBIT 2019's 40 objectives are organised into five domains, reflecting the governance/management split. The governance domain — Evaluate, Direct and Monitor (EDM) — is the board-level role. The four management domains cover the lifecycle of running IT: planning, building, delivering, and monitoring.
The management domains
- APO — Align, Plan and Organise: strategy, architecture, risk, and the planning of IT.
- BAI — Build, Acquire and Implement: turning plans into working solutions and changes.
- DSS — Deliver, Service and Support: running operations, service, and support day to day.
- MEA — Monitor, Evaluate and Assess: monitoring performance, compliance, and the system of internal control.
How they fit together
The domains map roughly to a management lifecycle: APO plans, BAI builds, DSS runs, MEA monitors — all under the governance direction of EDM. It mirrors the plan-build-run-monitor shape familiar from IT operations, organised for governance.
Using the domains
The domains are the navigation map: a governance concern about board oversight points to EDM; a question about service delivery to DSS; about risk and planning to APO. SentinelPanda's control mapping focuses on the security frameworks; COBIT's domains organise the broader IT-governance layer.