COBIT 2019 DSS domain (Deliver, Service, Support)

By Sam Rivera, Founder, SentinelPanda · June 20, 2026 · 1 min read · COBIT 2019

DSS is the keep-the-lights-on domain — operations, service desk, incidents, and the security services that run every day, not just on audit day.

The operations domain

DSS — Deliver, Service and Support — is the management domain for the day-to-day running of IT. It is where service actually gets delivered to users: operations, support, incident and problem handling, continuity, and operational security. If APO plans and BAI builds, DSS runs.

What it covers

DSS objectives span managing operations, service requests and incidents, problems, continuity (business continuity and disaster recovery), security services (the operational side of security), and controls over business processes. It is the operational layer where most users actually experience IT governance — or its absence.

Security operations and continuity

DSS includes the operational delivery of security services and the management of continuity — the run-time counterparts to the security and BC/DR planning that sits in APO. This is where COBIT connects to the operational security controls (monitoring, incident response, continuity) that security frameworks also require.

The visible layer

DSS is the most visible domain to the business — uptime, support response, incident handling. Strong DSS means reliable service; weak DSS means outages and unresolved incidents regardless of how good the plans were. It is governance made operational.