What is IT governance?

Although sometimes used interchangeably, IT governance and IT management are not actually the same thing.

IT governance provides a clear framework for building strategy, establishing roadmaps, aligning IT with business priorities, and mitigating risk and compliance issues. Essentially, IT governance determines the plan of action for the organization to follow.

IT management is not as involved in the planning or strategy, instead focusing on the day-to-day activities associated with IT implementations and processes and making sure that ongoing IT management is being handled effectively and lawfully. IT management translates strategic direction into action, moving the business forward towards achieving its objectives.

Implementing an IT governance program begins with choosing a framework. IT governance frameworks are created by industry experts, and generally include vital guides and tutorials to help businesses make a smooth transition into IT governance. Some of the most popular IT governance frameworks include the following:

Originally designed as a framework for IT auditing, COBIT has expanded to fully encompass IT governance, with a special focus on risk mitigation and management.

For those organizations that are most interested in improving IT performance, the CMMI framework may be the optimal solution. CMMI uses a numerical scale (1–5) to assess a company’s IT performance, profitability, and quality.

Less specifically tailored to IT than some of the other frameworks, COSO is nevertheless an effective IT governance solution for organizations that wish to put greater focus on fraud deterrence, enterprise risk management, and other aspects of business.

FAIR is a newer IT governance framework, designed to more directly address operational-risk factors and cyber security. Although this framework is newer than many others, it has already gained a substantial following.

Perhaps the most well-rounded of the frameworks, ITIL combines IT management with IT governance to help ensure that all relevant IT services are in line with the business’ core processes.

The NIST framework exists specifically to help manage and reduce IT infrastructure security risks, and includes standards and guidelines for preventing, identifying, and responding to cyberattacks.

ISO 27001 establishes information-security standards that have been internationally agreed upon by IT experts. ISO helps organizations optimize their existing cyber security controls into complete information security management systems (ISMS).

A specialized framework that focuses on technical and security operational controls, CIS eschews risk analysis and risk management in favor of reducing risk by increasing resilience in IT infrastructures.

With many different options to choose from, businesses may have a difficult time deciding which IT governance framework to use. The good news is that, when properly implemented, any of the above-mentioned frameworks may be a suitable solution for nearly any company. On the other hand, certain frameworks are more directly focused on specific tasks, departments, or objectives, and may be a better or worse fit for some organizations. When choosing between available frameworks, consider the following:

What are the business objectives that are driving the search for an IT governance framework? As addressed above, different frameworks offer different advantages; researching the available frameworks with a focus on the needs of the company can help narrow down the list of prospective candidates.

The organization’s culture should also play a role in deciding on a framework. Remember, it’s always easier to change an IT governance approach than it is to revamp the entire way an organization operates and interacts, so finding a framework that speaks to corporate culture and resonates well with stakeholders should be a top priority.

If no single framework feels like the right solution, combining two (or potentially more) frameworks may be the answer. Certain frameworks—such as ITIL and COBIT—complement each other extremely well.