Which of the following performance measures is used to assess a specific focus area?

In the COBIT 2019 Performance Management (CPM) model, maturity levels are specifically used to measure the performance of a focus area. A focus area is a governance topic, such as cybersecurity or cloud computing, addressed by a collection of governance and management objectives. The maturity level of a focus area is determined by the achieved capability levels of a defined set of processes and other governance components that are relevant to that specific area. This allows an enterprise to assess its performance on a particular topic rather than just on individual processes.

B. Key goal indicator: This measures the outcome of a process or the extent to which an alignment goal has been achieved, not the performance of a focus area construct.
C. Process capability rating: This measures the performance and implementation level of an individual governance or management process, not the broader collection of components within a focus area.

1. ISACA, COBIT® 2019 Framework: Introduction and Methodology, 2018, Chapter 6: Performance Management in COBIT, Section 6.4, p. 49. "Maturity levels can be used for other purposes as well, such as performance management of focus areas."

2. ISACA, COBIT® 2019 Framework: Introduction and Methodology, 2018, Chapter 6: Performance Management in COBIT, Section 6.4, p. 50. "A maturity level is a performance measure of a focus area. It is determined by the capability levels achieved for a defined set of processes."

3. ISACA, COBIT® 2019 Framework: Introduction and Methodology, 2018, Chapter 6: Performance Management in COBIT, Figure 6.1—COBIT Performance Management (CPM) Overview, p. 48. This figure visually depicts that capability levels apply to processes, while maturity levels apply to focus areas.

4. ISACA, COBIT® 2019 Framework: Governance and Management Objectives, 2018, p. 31. This reference illustrates that Key Goal Indicators (KGIs) are example metrics for Alignment Goals, linking them to stakeholder value, not the assessment of a focus area.