COBIT 2019 performance management

By Sam Rivera, Founder, SentinelPanda · June 20, 2026 · 1 min read · COBIT 2019

You cannot improve governance you do not measure. COBIT Performance Management is how the framework turns "are we governing well?" into a number you can track.

Measuring governance

COBIT Performance Management (CPM) is the model COBIT 2019 uses to express how well the governance and management system is working. It replaces the older maturity-only model with a more nuanced approach, so governance performance becomes measurable rather than asserted.

Capability and maturity

CPM works at two levels. Capability levels (0 to 5) assess how well an individual governance/management objective or process is performing. Maturity levels assess performance across a whole focus area — a higher-level rollup. Together they let you measure both specific objectives and broad areas.

From measurement to improvement

The point of measuring is improvement: assess current capability, set target levels for the objectives that matter (via design factors and the goals cascade), and the gap is your improvement plan. It is the same current-versus-target logic that drives the NIST CSF and any maturity model.

Using it

In practice you do not target level 5 everywhere — you set target capability proportionate to each objective's importance and risk, and improve toward it. SentinelPanda's evidence and control tracking feed exactly the kind of performance measurement CPM describes for the security-related objectives.