COBIT-NIST Synergy: A Proposed Architecture for Integrated IT Governance, Risk, and Compliance

Effective Information Technology (IT) Governance, Risk Management, and Compliance (IT GRC) is crucial for organizational success, yet achieving a holistic view remains challenging. Construction companies, particularly in dynamic environments like Indonesia, face unique IT risks related to distributed operations, project complexity, and increasing regulatory demands. Existing frameworks like COBIT 2019, focusing on governance and management objectives, and the NIST Cybersecurity Framework (CSF), emphasizing cybersecurity risk management, offer significant strengths but often operate in silos. This paper proposes a synergistic IT GRC architecture that integrates COBIT 2019 and the NIST CSF to provide a more comprehensive and unified approach. The architecture development involved analyzing both frameworks and identifying key integration points. Its applicability and potential benefits were explored through an illustrative case study conducted at a construction company in Indonesia. The proposed architecture facilitates a clearer mapping between governance processes and security controls, potentially enhancing risk visibility and streamlining compliance efforts. The case study provides initial insights into the practical relevance of the integrated approach within the construction sector context