A key input to be considered when defining drivers for a COBIT implementation is the stakeholder map.
Understanding the stakeholders involved and their expectations is crucial for identifying the drivers that will shape the governance system.
References in COBIT 2019 Design and Implementation:
* COBIT 2019 Implementation Guide, Chapter 3:This chapter emphasizes the importance of stakeholder identification and mapping in understanding their needs and expectations, which in turn define the drivers for the COBIT implementation.
* COBIT 2019 Framework: Governance and Management Objectives, MEA04 (Managed Stakeholder Engagement):This objective highlights the role of stakeholder engagement in shaping governance and management priorities.
The stakeholder map provides a clear view of who the stakeholders are and what their interests and expectations are, ensuring that the drivers for the COBIT implementation are aligned with the needs of the enterprise.

In COBIT 2019 Implementation guidance:
"The Chief Information Officer (CIO) holds responsibility for ensuring the business case is aligned with enterprise objectives and that the program plan is both realistic and achievable, factoring in available resources and capabilities." The CIO plays a strategic leadership role and has the oversight to balance technology, business needs, risks, and resources. Business process owners and implementation teams contribute, but they do not hold the final accountability for overall feasibility and alignment.
Reference:COBIT 2019 Implementation Guide, Phase 3

COBIT 2019 identifies the Threat Landscape as a design factor that determines how exposed an enterprise is to internal and external threats such as cyberattacks, fraud, geopolitical instability, or operational disruption.
When the threat landscape is assessed as high, COBIT does not merely recommend increasing generic controls; instead, it emphasizes the need for specialized and focused guidance.
The Design Guide explicitly links elevated threats to the application of focus area variants, such as information security, risk, privacy, or resilience. These focus areas provide deeper, context-specific guidance beyond the core governance model. While management objective priority and capability levels may also be influenced indirectly, the primary and direct impact of a high threat landscape is the requirement for specific focus area guidance tailored to the nature of the threats faced.
Component variation refers to tailoring governance components, and capability levels describe performance expectations, but neither addresses the necessity for specialized governance content. COBIT's design philosophy recognizes that high-risk environments require more than generic controls-they require targeted governance practices aligned with recognized risk domains. Therefore, the correct and primary impact is the need for specific focus area guidance.

According to the COBIT 2019 Design Guide:
"In the final stage of the design workflow, design factors are used to determine the relative importance of governance and management objectives, which helps prioritize implementation efforts." This occurs during theconclusion of the governance system design.
Reference:COBIT 2019 Design Guide, Section 5.4

When assessing the current state of I&T, a continual improvement task includes identifying potential process improvements. This task is essential for ensuring that IT processes remain efficient, effective, and aligned with business goals.
References in COBIT 2019 Design and Implementation:
* COBIT 2019 Framework: Governance and Management Objectives, BAI10 (Managed Continuous Improvement):This objective focuses on the importance of continually assessing and improving IT processes to enhance performance and value delivery.
* COBIT 2019 Implementation Guide, Chapter 5:This chapter discusses the need for continuous improvement initiatives, including the identification of potential process improvements to optimize IT performance.
By continually identifying and implementing process improvements, enterprises can ensure that their IT functions remain competitive and capable of supporting evolving business needs.