Control objectives should be specific enough to provide the basis for this evaluation.

Each of COBIT's IT processes has a high-level control objective and a number of detailed control objectives.

However, as CobiT focuses mainly on control objectives, the model does not assess other governance measures and mechanisms.