Enhancing a NIST SP 800-53-Based Cybersecurity Risk Metamodel with COBIT 2019: A Governance-Centric Perspective

As cybersecurity threats continue to increase in complexity and impact, organizations face challenges in aligning technical security controls with enterprise governance objectives. This paper represents a continuation of prior work on cybersecurity metamodeling and ontological integration. An enhanced hybrid cybersecurity risk metamodel is proposed, which integrates the Control Objectives for Information and Related Technologies (COBIT) 2019 governance framework into an existing National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53–based structure. The proposed model combines governance objectives, organizational design factors, and performance indicators with technical security controls using Unified Modeling Language (UML) class diagrams, the Resource Description Framework (RDF), and Web Ontology Language (OWL) ontologies to ensure semantic consistency and end-to-end traceability. Design factors enable contextual adaptability by influencing the selection and prioritization of governance objectives and security controls according to organizational and regulatory environments. In addition, performance indicators establish monitoring and feedback loops that support continuous performance evaluation and dynamic risk management. Future work will focus on empirical validation and the integration of quantitative risk assessment approaches such as Factor Analysis of Information Risk (FAIR).