ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
COBIT 7 is the first version change to ISACA’s IT governance framework since COBIT 2019 arrived in 2018, and the first hard date attached to it is now weeks away. On 27 October 2026 the COBIT 7 Foundations Certificate replaces the 2019 edition, the 2019 program is sunset on 26 April 2027, and the last day to buy the current exam or exam prep is 26 October 2026.
That is the part everyone will repeat. The part worth your attention is what ISACA has not said about COBIT 7, because the framework content itself is not published yet — and how you handle the next four weeks depends entirely on telling those two things apart.
Free gap assessment
How much of your service management system could you evidence?
Score every clause of ISO/IEC 20000-1, free, including the service management plan, service reporting and knowledge requirements generic checklists miss.
Run the free ISO 20000 gap assessment → or View premium report sample
Everything below is read off ISACA’s own credentialing pages and its September 2026 anniversary newsletter. Nothing here is a training provider’s guess.
| Item | Confirmed position (read 30 September 2026) |
|---|---|
| Foundations certificate changeover | COBIT 7 Foundations replaces COBIT 2019 Foundations on 27 October 2026 |
| Last day to buy the 2019 exam or prep | 26 October 2026 |
| COBIT 2019 Foundations program sunset | 26 April 2027 |
| Design & Implementation certificate | The 2027 version lands “in 2027”; the 2019 D&I program is also sunset 26 April 2027, last purchase 26 October 2026 |
| Framework content | Not published. ISACA’s COBIT resource hub still describes COBIT 2019 only |
| Framework update timing | ISACA states an update to COBIT is “planned for later this year” (2026) |
| Current exam fees | Foundations US$175, Design & Implementation US$275 — member and non-member prices are identical |
| Exam format (2019 editions) | Foundations: 2 hours, 75 multiple-choice, 65% to pass. D&I: 3 hours, 60 multiple-choice, 60% to pass |
Two things are missing from that table on purpose. There is no announced publication date for the new framework documents, and there is no announced price or syllabus for the new exam. Anyone quoting either is guessing. The certificate changeover date and the framework release date are related but they are not the same commitment, and only the first one is in writing.
ISACA’s 30th-anniversary piece on COBIT, published in its @ISACA newsletter in 2026, is currently the most substantive public description of the update. It says two concrete things about the update: much of the content will be delivered digitally rather than as PDF publications, and a flexible, customizable assessment module is being added to help practitioners find gaps in their governance and management practices and target the areas that need the most work.
Read that second point again, because it is the one that matters commercially. COBIT 2019 already has a capability scheme, but assessment has always been the weak joint in the framework — it is the reason most COBIT programs stall after the design workshop. If COBIT 7 ships a maintained assessment module, the framework stops being a reference library you map against and starts being something you can run a repeatable review cycle on.
What ISACA has not said is anything about the structure. There is no statement that the 40 governance and management objectives are being renumbered, that the five domains are changing, or that the 11 design factors are being replaced. Treat every claim you see about the new model as unverified until the documents publish. The lesson from every other framework revision this year is that renumbering is the expensive part, and nobody outside the working group knows yet whether it is happening.
Two further anchors are worth holding on to. COBIT turned 30 in 2026 — the original CobiT shipped in 1996 on diskette, aimed squarely at IT auditors, consolidating 18 other sources. And ISACA has already published a free white paper on applying COBIT to AI system governance, which is the clearest signal available about the subject matter the update is likely to absorb.
Because the framework content is unpublished, the honest comparison is a comparison of status, not of models. Here is what is settled and what is open.
| Dimension | COBIT 2019 (today) | COBIT 7 (announced) |
|---|---|---|
| Framework documents | Published; Introduction & Methodology, Governance and Management Objectives, Design Guide, Implementation Guide | Not published; the COBIT 7 update is “planned for later this year”, much of it digital |
| Core model | 40 governance and management objectives across five domains — EDM, APO, BAI, DSS, MEA | Not announced. No published change to the objectives or domains |
| Tailoring | 11 design factors, each with defined values (for example DF6 Compliance Requirements: High / Normal / Low) | Not announced |
| Assessment | Capability and performance management built into the core guidance | A flexible, customizable assessment module is being added |
| Individual certificates | Foundations and Design & Implementation, available until 26 October 2026 | Foundations from 27 October 2026; D&I in 2027 |
| Organizational certification | None. COBIT has never been a certifiable management system | Nothing announced to change this |
That last row is the one buyers most often get wrong, and the new version does nothing to change it. There is no COBIT certificate for a company, no accredited certification body, no three-year cycle and no surveillance audit. The certificates ISACA sunsets in April 2027 are held by people. Your enterprise governance system does not expire, get withdrawn, or become non-compliant on 27 October 2026 — which is exactly why the transition is far less frightening than an ISO edition change. For the full picture of how the framework is built, see our guide to COBIT 2019 and its 40 objectives.
This is the only genuinely time-boxed decision in the whole transition, and there is a piece of arithmetic in it that most write-ups miss. ISACA establishes exam eligibility at the point of registration and it is good for six months. Buy on the last available day, 26 October 2026, and your six months runs out around 26 April 2027 — the exact sunset date. There is no slack in that window. You can also only schedule a testing appointment 90 days in advance and no earlier than 48 hours after payment, so a late buyer is booking into a compressed, crowded quarter.
| Your situation | Verdict | Why |
|---|---|---|
| You already hold the 2019 certificate | Do nothing | The sunset is announced for the exam program, not for the credential you already earned |
| You are mid-study, exam not booked | Buy before 26 October 2026 | US$175 for a syllabus you already know beats waiting for an unpublished one at an unannounced price |
| A client or tender asks specifically for COBIT 2019 | Buy before 26 October 2026 | Contract language takes years to catch up with framework versions |
| You are starting from scratch, no deadline | Wait for the new version | Studying a syllabus that is withdrawn six months later is money spent twice |
| You want Design & Implementation | Judgement call | The 2019 D&I exam stops selling 26 October 2026 but its replacement is not due until 2027, so there may be a gap with no current exam at all |
That D&I gap is the sharpest point on the page. Foundations gets a same-day COBIT 7 handover on 27 October 2026. Design & Implementation does not: sales of the 2019 exam stop in October 2026, and ISACA only commits to “2027” for the replacement. If that certificate is on someone’s development plan for this financial year, the window closes in four weeks and may not reopen for months. Our breakdown of COBIT certification cost covers what the full training-plus-exam route actually runs to.
Here is the practical reassurance: nothing in the announcement invalidates a governance system you have already documented. No regulator, registrar or auditor reads COBIT version numbers off your policy set the way a certification body reads ISO edition numbers off a Statement of Applicability. COBIT is a reference model you tailor from, so your documents cite your own decisions, not ISACA’s edition.
What will age is the scaffolding around those decisions — the design-factor worksheets, the objective-selection rationale and the capability targets that name COBIT 2019 explicitly. Three habits make the eventual re-mapping cheap rather than painful:
The one area where a genuine gap already exists is assessment. If ISACA is adding an assessment module because practitioners struggle to measure their own governance, that struggle is happening in your organisation now, before the new module ships. A documented self-assessment against the 40 objectives, run once against today’s model, gives you both a baseline and a structure that maps forward into whatever COBIT 7 ships.
Four weeks, four decisions:
If COBIT sits alongside a service management framework in your environment, our comparison of COBIT vs ITIL is worth reading before you decide which one owns which decision.
The only date ISACA has published is the certificate changeover: 27 October 2026 for the Foundations certificate. For the framework itself, ISACA says an update is “planned for later this year” without naming a publication date. Nobody outside ISACA can be more precise than that, and be sceptical of any source that is.
ISACA’s announcement sunsets the COBIT 2019 certificate programs on 26 April 2027 — that is the exam and its prep material. It says nothing about withdrawing credentials already earned. If in doubt, confirm your own certificate status through your MyISACA account rather than relying on a third-party summary.
Yes. COBIT has never offered organizational certification, so there is nothing to lapse. You tailored a governance system from a reference model; that system stands or falls on its own evidence, not on which COBIT edition inspired it.
Unknown, and nobody should tell you otherwise. ISACA has published nothing about the new structure. The 40 governance and management objectives across EDM, APO, BAI, DSS and MEA remain the current model, and the 11 design factors remain the current tailoring mechanism.
Train now if there is a named deadline — a tender, a client requirement, a development plan closing this financial year. Wait if there is not. A syllabus that is withdrawn in April 2027 is a poor investment for someone with no deadline, but it is a perfectly good one for someone who needs the credential this quarter.
US$175 for Foundations and US$275 for Design & Implementation, with member and non-member prices identical, as published on ISACA’s credentialing pages in September 2026. No new exam price has been announced.
The COBIT 7 announcement is a reason to finish your baseline, not to start a rebuild. If you want the underlying governance documentation — objective mappings, design-factor worksheets, capability assessment templates and the committee and reporting artefacts that make a COBIT program auditable — our Comprehensive COBIT 2019 IT Governance Toolkit is a 31-template pack for $99, built on the current model so the work you do this quarter is work you can carry forward.
The primary sources for everything dated in this article are ISACA’s own pages: the COBIT Foundation Certificate page carries the 27 October 2026 changeover, the 26 April 2027 sunset and the current exam fees. Re-read it in late October 2026 — the dates on this page were verified on 30 September 2026, and ISACA has been revising this copy as the release approaches.
September 30, 2026
September 30, 2026
