Which of the following is an example of a specific focus area to which COBIT could be customized?

COBIT 2019 introduces focus areas as a way to tailor a governance system for a specific topic, domain, or issue. These are collections of governance and management objectives and components that address a particular area of interest. Cybersecurity is explicitly cited by ISACA as a prime example of a focus area, alongside others like risk, privacy, and DevOps. This allows an enterprise to use the COBIT framework to build a governance system specifically targeted at its cybersecurity needs, selecting relevant objectives and components.

A. Information items are a component of the COBIT governance system, not a focus area to which the framework is customized.
C. Capability levels are used within the COBIT Performance Management (CPM) model to assess process maturity, not a focus area.
D. Enterprise goals are part of the goals cascade used to determine which governance and management objectives are most important for the enterprise.

1. ISACA, COBIT 2019 Framework: Introduction and Methodology, 2018, p. 23, Section 3.3. This section defines focus areas and states, "Examples of focus areas are cybersecurity, digital transformation, cloud computing, privacy, and DevOps."

2. ISACA, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution, 2018, p. 16. The guide mentions that focus area variants can influence the design of a governance system.

3. ISACA, COBIT 2019 Framework: Introduction and Methodology, 2018, p. 23, Figure 3.7. This figure visually depicts how a focus area, such as cybersecurity, is a specific topic addressed by a selection of objectives and components.