IT Compliance Hub

IT Governance & Risk Management

How IT is governed, run and improved: COBIT, ITIL 4, ISO/IEC 20000-1, ISO 9001, CMMI, risk management standards and the internal control frameworks behind SOX.

  • 7 guides in this area
  • Mandatory and voluntary clearly labelled
  • Official sources in every guide
Where to start

Which one do you need?

Find the line that matches your situation. Many companies need more than one; the guides explain how they overlap.

If this is youStart withType
Clients or tenders ask for a quality certificateISO 9001 Certifiable standard
You want proven practices for running IT servicesITIL Framework / guidance
Your board or auditors want a governance framework for ITCOBIT Framework / guidance
All guides

IT Governance & Risk Management guides

Framework / guidance Global

COBIT

Control Objectives for Information and Related Technologies

COBIT is ISACA's framework for governing and managing enterprise information and technology. COBIT 2019 defines 40 governance and management objectives in five domains, design factors to tailor them, and capability levels to measure them. It is voluntary and widely used by IT auditors, boards and regulators, especially in banking. ISACA has announced COBIT 7 for late 2026; COBIT 2019 remains the reference until it is released.

Voluntary: Voluntary; widely used by auditors and regulators as a reference

Quick facts
What it covers
How the board and management set direction for IT, align it with business goals, manage risk, resources and performance, and monitor and assure IT processes.
Who needs it
IT governance, audit and risk teams; firms subject to SOX
Why it matters
It is the common language of IT auditors and many financial regulators, and it links technology decisions to business outcomes in a way boards understand.
Key requirements
  • Evaluate, Direct and Monitor (EDM) - 5 governance objectives for the board
  • Align, Plan and Organise (APO) - 14 management objectives
  • Build, Acquire and Implement (BAI) - 11 management objectives
  • Deliver, Service and Support (DSS) - 6 management objectives
  • Monitor, Evaluate and Assess (MEA) - 4 management objectives
  • Design factors to tailor the governance system; capability levels 0 to 5
Where it applies
Global
Category
IT Governance & Risk Management
Read the COBIT guide
Certifiable standard Global

ISO 9001

ISO 9001: Quality management systems. Requirements

ISO 9001 is the world's most widely used standard for quality management systems. It requires an organisation to understand its customers, plan and control how it delivers products and services, manage risks, measure results and keep improving. It is voluntary and certifiable. ISO 9001:2026 was published in September 2026, and certificates to the 2015 edition are expected to remain valid during a transition period ending in September 2029.

Voluntary: Voluntary; often required in tenders and enterprise contracts

Quick facts
What it covers
Customer focus, leadership, planning, resources, operational control of products and services, supplier control, measurement, internal audit and improvement.
Who needs it
Software companies and IT service providers bidding for enterprise and government work
Why it matters
Government and enterprise tenders, especially in India, the Middle East and Europe, often require ISO 9001, and it gives software and IT service companies a disciplined way to deliver consistently.
Key requirements
  • Context, interested parties and QMS scope (clause 4)
  • Leadership, quality policy and roles (clause 5)
  • Risks and opportunities, quality objectives, planning changes (clause 6)
  • Resources, competence, awareness, documented information (clause 7)
  • Operational planning, requirements, design, suppliers, delivery and nonconforming outputs (clause 8)
  • Monitoring, customer satisfaction, internal audit, management review (clause 9)
  • Nonconformity, corrective action and continual improvement (clause 10)
Where it applies
Global
Category
IT Governance & Risk Management
Read the ISO 9001 guide
Framework / guidance Global

ITIL

Information Technology Infrastructure Library

ITIL is the most widely used body of best practice for IT service management: how to design, deliver, support and improve IT and digital services. It is voluntary and not certifiable for organisations; individuals take ITIL certifications. ITIL Version 5, released in early 2026, keeps ITIL 4's guiding principles, four dimensions, service value system and 34 practices, and adds a unified digital product and service lifecycle and AI guidance.

Voluntary: Voluntary best practice

Quick facts
What it covers
Service strategy, design, change, incident and problem management, service desk, service levels, continual improvement and the wider digital product and service lifecycle.
Who needs it
IT service providers, MSPs, internal IT operations
Why it matters
Customers, especially enterprises and government, expect IT service providers to run incidents, changes and service levels in a recognisable, ITIL-aligned way.
Key requirements
  • Seven guiding principles, such as focus on value and start where you are
  • Four dimensions - organisations and people, information and technology, partners and suppliers, value streams and processes
  • The service value system and value chain
  • 34 management practices, including incident, change, problem and service level management
  • Continual improvement model
Where it applies
Global
Category
IT Governance & Risk Management
Read the ITIL guide

Also relevant to it governance & risk management

Law / regulation USA

FISMA

Federal Information Security Modernization Act of 2014 (originally the Federal Information Security Management Act of 2002)

FISMA is the US federal law that requires every federal agency to run an information security programme for its information and systems, including those operated by contractors on its behalf. Agencies apply NIST standards, chiefly the Risk Management Framework and SP 800-53 controls, authorise systems to operate, report incidents to CISA and report annually to OMB and Congress. IT companies meet FISMA requirements through their contracts when they build, host or operate systems for federal agencies.

Mandatory: Mandatory for US federal agencies; flows down to contractors operating federal systems

Quick facts
What it covers
Security programmes, risk management, system authorisation, continuous monitoring, incident reporting and annual evaluation for federal information and systems.
Who needs it
Federal agencies, contractors operating federal systems
Why it matters
IT contractors and service providers that build or run systems for US federal agencies inherit FISMA obligations through contract clauses, and must deliver systems that can receive an authority to operate.
Key requirements
  • Agency-wide information security programme led by the CIO and CISO
  • Categorise systems (FIPS 199) and apply minimum security requirements (FIPS 200)
  • Select and implement NIST SP 800-53 controls
  • Assess, authorise (ATO) and continuously monitor systems under the NIST RMF
  • Report incidents to CISA and major incidents to Congress
  • Annual independent evaluation by the agency Inspector General and reporting to OMB
Where it applies
USA (federal)
Category
Cybersecurity
Read the FISMA guide
Framework / guidance USA, Global

NIST CSF

NIST Cybersecurity Framework (CSF) 2.0

The NIST Cybersecurity Framework (CSF) is a voluntary framework for managing cybersecurity risk, published by the US National Institute of Standards and Technology. Version 2.0, released in February 2024, organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It applies to organisations of any size or sector worldwide. There is no certification; organisations use profiles and tiers to measure where they are and plan improvements.

Voluntary: Voluntary; required by some contracts and sector rules

Quick facts
What it covers
Cybersecurity governance, risk management, supply chain risk, asset management, protection, detection, incident response and recovery outcomes.
Who needs it
Any organisation building or benchmarking a security program
Why it matters
It gives leadership and engineers a shared language for cybersecurity, and many US customers, insurers and regulators use it as their reference point.
Key requirements
  • Six functions - Govern, Identify, Protect, Detect, Respond, Recover
  • 22 categories and 106 subcategories of outcomes
  • Current and target organisational profiles
  • Tiers 1 to 4 describing the rigour of risk governance and management
  • Supply chain risk management under Govern
  • Informative references mapping to other standards
Where it applies
USA origin, used globally
Category
Cybersecurity
Read the NIST CSF guide
Framework / guidance USA

NIST SP 800-53

NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations

NIST SP 800-53 is the US government's catalogue of security and privacy controls, organised into 20 families such as access control, incident response and supply chain risk. US federal agencies must use it under FISMA, and cloud providers selling to them meet it through FedRAMP. Anyone else can use it voluntarily as a detailed control library. Revision 5 is current, with baselines for low, moderate and high impact systems published in SP 800-53B.

Voluntary: Mandatory for US federal systems under FISMA; voluntary for others, but required for FedRAMP cloud services

Quick facts
What it covers
Technical, operational and management controls for security and privacy across 20 control families, with enhancements for higher-risk systems.
Who needs it
Federal agencies, FedRAMP cloud providers, government contractors
Why it matters
It is the control set behind FISMA, FedRAMP and much US government contracting, and the most detailed free control catalogue available for designing a security programme.
Key requirements
  • Categorise the system by impact (low, moderate, high)
  • Select the matching baseline from SP 800-53B and tailor it
  • Implement controls across 20 families
  • Document them in a system security plan
  • Assess controls using SP 800-53A procedures
  • Authorise and continuously monitor the system
Where it applies
USA
Category
Cybersecurity
Read the NIST SP 800-53 guide
Law / regulation USA

SOX

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act (SOX) is a US federal law that requires public companies to maintain and report on effective internal control over financial reporting. Executives must certify financial reports, and larger companies need an independent auditor's opinion on those controls. For IT teams, SOX means IT general controls over access, change management and operations for every system that affects the financial statements, including SaaS vendors' systems, which is why customers ask vendors for SOC 1 reports.

Mandatory: Mandatory for SEC-registered public companies; vendors are affected through customers' audits

Quick facts
What it covers
Internal control over financial reporting, including IT general controls and application controls for financial systems, plus executive certification and record retention.
Who needs it
Public companies and IT vendors supporting financial reporting systems
Why it matters
IT and SaaS companies preparing to list in the US must build SOX controls, and vendors whose software affects customers' financial reporting are pulled into their customers' SOX audits.
Key requirements
  • CEO and CFO certification of financial reports (Section 302)
  • Management assessment of internal control over financial reporting (Section 404(a))
  • Auditor attestation for accelerated and large accelerated filers (Section 404(b))
  • IT general controls - access, change management, operations, and development
  • Evidence of controls operating throughout the year
  • Record retention and penalties for destroying audit records (Section 802)
Where it applies
USA (and foreign companies registered with the SEC)
Category
Payment & Financial Data Security
Read the SOX guide
Other areas

More IT compliance categories

Information Security Data Privacy & Protection Cybersecurity Cloud Security Secure Software Development Payment & Financial Data Security Healthcare IT AI Governance & Compliance Business Continuity & Disaster Recovery International IT Regulations Indian IT Laws & Regulations All IT compliance guides
IT compliance help

Not sure which it governance & risk management rules apply to you?

Tell us what you build, where your customers are and what they ask for. We reply with suggested next steps.

  • No obligation
  • NDA on request
  • Reply within one business day
Prefer to talk first? Book a call WhatsApp iamvishavjeet@gmail.com

Get an IT compliance assessment

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Need a custom Tutor LMS solution?

Tell us what you are building or what is broken. A Tutor LMS developer reads every inquiry and replies with next steps and a free estimate.

Get a free consultation Book a call

Get a free Tutor LMS consultation

Tell us what you are building or fixing. A Tutor LMS developer replies with honest advice and next steps.

  • No obligation
  • Tutor LMS and Pro specialists
  • Your details stay private

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.