Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
This guide covers ISACA's COBIT Foundation certificate as of October 2026, from the eight weighted topics and 75-question format of the COBIT 2019 Foundation exam to the framework's principles, components and 40 objectives, the jobs it supports, how it compares to CGEIT, ITIL and CISA, and what the October 27 switch to COBIT 7 means if you haven't tested yet. A reference for anyone weighing COBIT Foundation or trying to understand what it covers.
COBIT Foundation is ISACA's entry-level certificate for the COBIT framework. It shows you understand how COBIT aligns IT goals with business objectives, and it is the first step on ISACA's COBIT certificate track.
COBIT itself is ISACA's framework for governing and managing enterprise information and technology. ISACA first released it in 1996, and the version tested today, COBIT 2019, came out in 2018. The Foundation exam checks that you know the framework's structure and vocabulary: its principles, the seven components of a governance system, the 40 governance and management objectives, the design factors used to tailor it, and how an enterprise implements it. It doesn't ask whether you've run a governance program.
There are no prerequisites, the exam costs the same US$175 whether or not you're an ISACA member, and you take it online with a remote proctor. It is issued by ISACA, the association behind CISA, CISM and CGEIT. The date that matters most on this page is October 27, 2026, when ISACA replaces COBIT 2019 Foundation with the COBIT 7 Foundations Certificate.
Six principles for a governance system and three for a governance framework. 13% of the exam.
Seven component types, from processes and organizational structures to information and culture. Part of the heaviest topic at 30%.
40 governance and management objectives in five domains: EDM, APO, BAI, DSS and MEA. 23% of the exam.
11 design factors that tailor the governance system to one enterprise. Designing a tailored system is 7% of the exam.
Three things that set COBIT Foundation apart from ISACA's certifications, plus the version change every candidate has to plan around this year.
CISA, CISM, CRISC and CGEIT each ask for three to five years of work before you can hold them. COBIT Foundation asks for none. It tests whether you understand the framework itself: how COBIT separates governance from management, what each of the five domains is for, how the goals cascade links stakeholder needs to the 40 objectives, and how design factors tailor the system to one enterprise. That puts it within reach of a student, a new auditor or a regulator who hasn't yet built the resume ISACA's certifications ask for.
The exam costs US$175 for members and non-members alike, so there's no membership math to do. It's closed book, you take it online with a PSI remote proctor, and your result shows up the moment you submit. ISACA offers it in English, Chinese Simplified, Japanese and Spanish.
ISACA says the knowledge gained through COBIT prepares you for the CGEIT certification exam. If governance leadership is where you're headed, our CGEIT guide covers the five-year experience rule and the four domains that come next.
ISACA is publishing COBIT 7 in October 2026, with a new digital presentation of the framework, assessment tools and supporting guidance. On October 27, the COBIT 7 Foundations Certificate replaces COBIT 2019 Foundation. October 26, 2026 is the last day to buy the 2019 exam or its exam prep, and ISACA sunsets the 2019 program on April 26, 2027.
As of October 21, 2026, ISACA has not published the COBIT 7 Foundations exam format, fee or topic weights. Every exam fact on this page describes the COBIT 2019 Foundation exam. Check the ISACA COBIT Foundation page for the new exam details before you book.
The certificate, the COBIT 2019 Foundation exam, and the dates that govern the changeover to COBIT 7, as of October 2026.
COBIT Foundation is a first step. The next move depends on whether you want to go further into COBIT itself or turn framework knowledge into an ISACA certification that proves experience. All three below come from ISACA.
ISACA's Certified in the Governance of Enterprise IT is the certification COBIT knowledge feeds most directly, and ISACA says COBIT study prepares you for it. It's a 150-question, four-hour exam, and it asks for five years of governance experience across at least three of its four domains. See our CGEIT guide.
ISACA's next COBIT certificate puts the Design Guide and the Implementation Guide into practice: applying design factors, working through the design workflow and planning an implementation. It requires COBIT 2019 Foundation and is a 60-question, three-hour exam at US$275. It is also moving to a COBIT 7 version in 2027, and October 26, 2026 is the last day to buy the 2019 exam. See ISACA's program page.
ISACA's Certified Information Systems Auditor covers information systems audit and assurance across five domains, and auditors use COBIT objectives as a reference when they assess IT governance and controls. It requires five years of IS audit, control or security experience. See our CISA guide.
COBIT Foundation is usually an early credential. People pick it up while working in IT, audit, risk or compliance, often next to service management training, and then build toward an ISACA certification once they have the years of experience those ask for.
Work near IT decisions
Learn the language of IT governance
Two questions to answer before you commit: which exam you can take, and should you pursue COBIT Foundation at all. Here's a straight answer to both.
You can still test on COBIT 2019.
There are no prerequisites, so anyone can register. If you've already studied COBIT 2019, buy the exam on or before October 26, 2026, the last day ISACA sells it. Eligibility lasts six months from purchase and ISACA sunsets the 2019 program on April 26, 2027, so book your appointment early enough to leave room for a retake. The pass mark is 65% on 75 questions.
The route for new learners from October 27.
From October 27, 2026, the COBIT 7 Foundations Certificate is the one ISACA sells. ISACA hadn't published its exam format, fee or topic weights as of October 21, 2026. If you are starting from scratch after the changeover, study COBIT 7 material rather than COBIT 2019 material, and check ISACA's page for the new exam details before you book.
COBIT Foundation rarely gets someone hired on its own. It works as a supporting credential in audit, risk, governance and IT management roles, where knowing the framework is part of the job. These are the six titles where it fits best.
Tests whether IT governance and controls work as designed. COBIT gives the auditor a reference model to test against, with objectives such as MEA02 Managed System of Internal Control and MEA04 Managed Assurance, and Foundation is a low-cost first ISACA credential for an audit hire working toward CISA.
Maps policies, controls and evidence to the frameworks the organization has committed to. COBIT is one of the frameworks GRC teams are expected to put into practice, and Foundation gives the analyst the vocabulary to connect a control to the objective it supports.
Keeps the governance system running: the decision rights, committees, policies and reporting that tie IT to enterprise goals. This is the job the framework describes most directly, from the EDM governance objectives to the goals cascade.
Identifies, assesses and reports IT risk against the appetite leadership has set. COBIT covers this ground in EDM03 Ensured Risk Optimization and APO12 Managed Risk, so the framework gives risk staff a way to tie their findings to governance objectives.
Runs IT teams, programs or portfolios and has to show how the work supports the business. The goals cascade and objectives such as BAI01 Managed Programs and APO05 Managed Portfolio give that argument a structure executives recognize.
Assesses a client's governance against a framework and helps design the improvements. ISACA names consultants and regulators among the people COBIT Foundation is built for, and the design factors are how a consultant tailors a governance system to one client.
A framework certificate, a governance certification, a service management certification and an audit certification. They get mentioned in the same breath, but they test very different things and ask for very different amounts of experience. Here's how they line up.
| COBIT 2019 Foundation | CGEIT | ITIL Foundation (Version 5) | CISA | |
|---|---|---|---|---|
| Issuer | ISACA | ISACA | PeopleCert | ISACA |
| Focus | The COBIT 2019 framework | Governance of enterprise IT | Digital product and service management | Information systems audit |
| Domains | 8 weighted topics | 4 | 8 syllabus areas, unweighted | 5 |
| Exam Format | 75 questions, 2 hours | 150 questions, 4 hours | 40 questions, 60 minutes | 150 questions, 4 hours |
| Experience | None | 5 yrs governance across 3+ domains | None | 5 yrs IS audit, control, or security |
| Passing Score | 65% | 450 / 800 | 65% | 450 / 800 |
| Exam Cost | $175 member or non-member | $575 member / $760 non-member | Varies by provider and region | $575 member / $760 non-member |
| Renewal | No CPE requirement listed | 120 CPEs over 3 years | Every 3 years (60 CPD points) | 120 CPEs over 3 years |
| Version Status | Replaced by COBIT 7 Foundations Oct 27, 2026 | Outline effective 2020 | Released Feb 12, 2026 | Outline effective August 2024 |
| Best For | Anyone learning COBIT, auditors and GRC staff | CIOs, IT governance and strategy leaders | IT service and product teams | IT auditors and assurance pros |
Prices are as of October 2026 and vary by region and membership status. COBIT 2019 Foundation is on sale through October 26, 2026, and the COBIT 7 Foundations exam that replaces it may carry a different format and fee. ITIL 4 runs alongside Version 5 until PeopleCert sunsets the ITIL 4 modules on December 31, 2027. See our ITIL Foundation guide for that transition.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our official ISACA COBIT 2019 Foundation boot camp runs two days, live online or in person, on ISACA's authorized courseware. Your exam voucher, practice exam questions and a free retake (a second exam voucher plus a full course retake) are included, and you keep 180 days of one-on-one coaching after class. With COBIT 7 Foundations arriving on October 27, 2026, ask us which exam version your class date prepares you for.
The ISACA credential family, GRC careers, the CISA audit domains, AI governance, the ITIL version change, banking demand and another framework credential choice, for COBIT candidates.
COBIT Foundation is a certificate, and ISACA's five main certifications are where many holders go next. CISA, CISM, CRISC, CGEIT and CDPSE side by side: who each one is for, the key areas it covers, and what it asks of you.
GRC employers want people who can put frameworks like COBIT, NIST CSF and ISO 27001 into practice. Which certifications those roles ask for, and how to stack them by career stage.
COBIT shows up in the first CISA domain alongside ISACA's audit standards. A domain-by-domain look at what a CISA boot camp covers for auditors moving up from framework knowledge to certification.
Enterprise risk teams need AI credentials built on frameworks like COBIT, NIST AI RMF and ISO 42001. Five questions to answer before you commit to one.
ITIL went through its own version change in 2026. What moved between ITIL 4 and Version 5, and what it means for anyone holding or planning a Foundation certification in the framework COBIT is most often paired with.
Banks care about IT governance more than most industries. Which ISACA credentials show up in financial services hiring, and which ones are situational, for COBIT holders deciding what to earn next.
Another framework, another choice between building the system and auditing it. How the two ISO 27001 credentials differ and how they compare to CISA, CISM and CISSP.
The COBIT 2019 Foundation exam covers eight topics, each carrying its own weight. Governance System and Components and Governance and Management Objectives together make up more than half the exam. Click any topic for what it covers.
The ground floor of the exam. It covers what enterprise governance of information and technology (EGIT) means and why boards and executives care about it, the value it is meant to produce through benefits realization, risk optimization and resource optimization, what COBIT is and what it is not, and how the core COBIT 2019 publications fit together.
The nine principles the rest of the framework hangs on. Six describe a governance system: provide stakeholder value, holistic approach, dynamic governance system, governance distinct from management, tailored to enterprise needs, and end-to-end governance system. Three describe a governance framework: it should be based on a conceptual model, open and flexible, and aligned to major standards, frameworks and regulations. Expect questions that turn on the line between governance and management.
The heaviest topic, close to a third of the exam. It covers the seven component types a governance system is built from (processes, organizational structures, principles, policies and procedures, information, culture, ethics and behavior, people, skills and competencies, and services, infrastructure and applications), focus areas such as cybersecurity or small and medium enterprises, the design factors that shape a governance system, and the goals cascade that runs from stakeholder needs through 13 enterprise goals and alignment goals down to the objectives.
The COBIT core model: 40 objectives in five domains. Evaluate, Direct and Monitor (EDM) holds the five governance objectives, and the 35 management objectives sit in Align, Plan and Organize (APO), Build, Acquire and Implement (BAI), Deliver, Service and Support (DSS), and Monitor, Evaluate and Assess (MEA). You are expected to know what each domain is for, recognize objectives such as APO12 Managed Risk or DSS05 Managed Security Services, and understand that each objective links to one process and a set of related components.
How COBIT measures whether the governance system is working. COBIT performance management is based on CMMI, rates processes on capability levels from 0 to 5, and rates focus areas on maturity levels from 0 to 5. A small slice of the exam, and one that rewards knowing the level definitions cold.
How the 11 design factors, from enterprise strategy, risk profile and threat landscape to the sourcing model for IT and enterprise size, decide which objectives get priority. The design workflow runs in four steps: understand the enterprise context and strategy, determine the initial scope of the governance system, refine that scope, and conclude the design. The COBIT 2019 Design Guide is the deeper reference for this topic.
The smallest topic. It covers why a governance improvement program needs a business case, what that case should set out (the problem, the proposed approach, the expected costs and benefits, and the risks), and who it has to convince before any money is spent.
How an enterprise puts COBIT to work. The implementation guidance uses a seven-phase life cycle that opens with what the drivers are and where the enterprise is now, moves through where it wants to be, what needs to be done and how to get there, and closes with whether it got there and how to keep the momentum going. Each phase runs on three tracks: program management, change enablement and the continual improvement life cycle.
Topics and weights reflect the COBIT 2019 Foundation exam as published on ISACA's COBIT Foundation page and in the ISACA Certificate Program Exam Guide (February 2026). The COBIT 7 Foundations exam that replaces it on October 27, 2026 will have its own outline, which ISACA had not published as of October 21, 2026.
The questions candidates ask most often when researching the COBIT Foundation certificate and the move to COBIT 7.
COBIT Foundation is ISACA's entry-level certificate for the COBIT framework. Passing the exam shows you understand the concepts, principles and methods COBIT uses to establish, enhance and maintain a system for governing and managing enterprise information and technology. The current exam tests COBIT 2019, and ISACA replaces it with the COBIT 7 Foundations Certificate on October 27, 2026.
ISACA aims it at senior IT and business managers, risk, GRC and program managers, regulators and consultants, and students and recent graduates. In practice it suits IT auditors, GRC analysts, IT risk staff and IT managers who need a shared vocabulary for how IT is governed. It isn't a technical certificate, and it doesn't prove years of experience the way CISA or CGEIT does.
As of October 2026 the COBIT 2019 Foundation exam costs US$175, and ISACA charges members and non-members the same price. You pay the full fee again for each retake. October 26, 2026 is the last day to buy the 2019 exam. ISACA had not published a fee for the COBIT 7 Foundations exam as of October 21, 2026.
The COBIT 2019 Foundation exam has 75 multiple-choice questions in two hours (120 minutes), and you need 65% or higher to pass. It's closed book and taken online with a PSI remote proctor, and your result appears as soon as you submit. It's offered in English, Chinese Simplified, Japanese and Spanish.
No. ISACA sets no prerequisites and no experience requirement. You can register at any time, schedule an appointment as early as 48 hours after paying, and you have six months from purchase to take the exam.
ISACA allows four attempts in a rolling 12-month period. You wait 30 days after your first attempt and 90 days after each attempt after that, and you pay the full exam fee every time. With the 2019 program ending on April 26, 2027, leave room for a retake if you plan to test late.
The COBIT 2019 Foundation exam covers eight topics: Governance System and Components (30%), Governance and Management Objectives (23%), Principles (13%), Framework Introduction (12%), Implementation (8%), Designing a Tailored Governance System (7%), Performance Management (4%) and Business Case (3%). The first two make up more than half the exam.
Yes. ISACA is publishing COBIT 7 in October 2026, and the COBIT 7 Foundations Certificate replaces COBIT 2019 Foundation on October 27, 2026. The last day to buy the 2019 exam or its exam prep is October 26, 2026, and ISACA sunsets the 2019 program on April 26, 2027. ISACA had not published the new exam's format, fee or topic weights as of October 21, 2026.
If you've already studied COBIT 2019, buy the exam by October 26, 2026 and sit it inside your six-month eligibility window, before the April 26, 2027 sunset. If you're starting from zero, aim for COBIT 7 Foundations instead. The 2019 exam can't be bought after October 26, and your study time is better spent on the current version of the framework.
COBIT is ISACA's framework for governing and managing enterprise information and technology as a whole. It sets out what needs to be governed and managed through 40 objectives, from strategy and risk to security and compliance. ITIL, owned by PeopleCert, is a service management framework that goes deeper on how IT services and digital products are delivered and supported. Many organizations use both, and COBIT 2019 is designed to align with other major standards and frameworks.
ISACA says the knowledge gained through COBIT prepares you for the CGEIT certification exam. They are very different credentials, though. COBIT Foundation is a 75-question certificate exam with no prerequisites. CGEIT is a 150-question, four-hour certification exam that requires five years of IT governance experience, and ISACA describes it as framework agnostic rather than a COBIT test.
For US$175 and no experience requirement, it's a low-cost way to show you understand the framework audit, risk and governance teams work with, and it lays groundwork for CGEIT. It helps most as a supporting credential next to real experience or an ISACA certification. Timing matters this year: buy the 2019 exam by October 26 only if you can sit it by April 26, 2027, and otherwise plan for COBIT 7 Foundations.
Tell us where you are, from deciding between COBIT 2019 and COBIT 7 to planning COBIT training for an audit, risk or IT management team, and we'll help you map out the right path.