Isaca COBIT-Design-and-Implementation Online Access

In COBIT® 2019, the threat landscape design factor evaluates the severity and likelihood of external and internal threats that could materially impact enterprise objectives. A high threat landscape is characterized by factors that increase uncertainty, instability, or exposure to disruptive events beyond normal operational risks.

Geopolitical situations—such as regional conflicts, sanctions, trade restrictions, political instability, or cross-border regulatory changes—are explicitly recognized as high-impact external threats. These conditions can affect data sovereignty, supply chains, system availability, and regulatory compliance simultaneously, making them a strong indicator of a high threat landscape.

By contrast, IT trends represent opportunities, not threats. New competitors reflect market dynamics rather than direct threat exposure. Service delivery problems from outsourcers are operational issues already captured under I&T-related issues, not threat landscape classification.

The Design Guide stresses that when the threat landscape is high, enterprises should emphasize resilience, security, assurance, and risk-focused governance design. Geopolitical risk is therefore a clear and valid reason to classify the threat landscape as high.

For a traditional brick-and-mortar company planning to fast-track its growth by implementing an information and technology governance system to achieve enterprise goals, establishing applicable governance and management objectives is the key enabler of success.

References in COBIT 2019 Design and Implementation:

COBIT 2019 Framework: Governance and Management Objectives, EDM01 (Ensure Governance Framework Setting and Maintenance):This objective underscores the importance of defining clear governance and management objectives to guide the implementation and achieve enterprise goals.

COBIT 2019 Implementation Guide, Chapter 4:This chapter discusses the importance of setting relevant and applicable governance and management objectives to align IT governance with business strategy and goals.

By establishing clear governance and management objectives, the company can ensure that its IT governance efforts are aligned with its strategic goals, driving growth and achieving desired outcomes.

COBIT® 2019 explicitly recognizes compliance requirements as a core design factor that significantly influences governance system design. Enterprises operating in highly regulated environments must place stronger emphasis on compliance-related governance and management objectives, controls, and assurance mechanisms.

The Design Guide consistently uses the financial sector as a canonical example of a high-compliance environment due to stringent regulatory oversight related to data protection, financial reporting, risk management, anti-money laundering, and operational resilience. Banks, insurance companies, and investment firms are subject to continuous regulatory scrutiny and mandatory audits, making compliance a dominant governance driver.

While public sector organizations also face regulatory requirements, the level, consistency, and enforcement intensity vary widely by jurisdiction. Educational and nonprofit sectors typically operate under fewer mandatory compliance regimes and therefore are not categorized as high-compliance by default.

COBIT emphasizes that in high-compliance environments, governance design must prioritize objectives related to compliance monitoring, internal control, assurance, and risk optimization. This directly aligns with the characteristics of the financial sector, making it the correct answer.

“Phase 1 identifies current change drivers … A change driver is an internal or external event, condition or key issue that serves as stimulus for change.”

==========