Principles and Application of the Standard in an Organization
Domain focus
This domain tests application: how the six principles are translated into policies, decision rights, and evidence in a specific organization. The standard expects proportionality to size, complexity, risk, and sector, not a copied template.
Core rules
- Apply principles through governance instruments: policy, delegated authority, business cases, performance reporting, compliance mapping, and assurance.
- Responsibility requires named accountable owners, not committee names alone.
- Strategy requires a traceable line from organizational objectives to IT investment and service decisions.
- Acquisition requires options analysis, due diligence, and total cost and risk consideration, including exit and lock-in.
- Performance requires measures that reflect business outcomes and service quality, not only uptime.
- Conformance requires a compliance universe and clear escalation for exceptions.
- Human behaviour requires considering incentives, workload, and usability, because controls that ignore behavior fail.
Worked example
A public agency replaces a records system. The board evaluates legal retention obligations, service disruption risk, and benefits. It directs that procurement include data-portability clauses and that the records manager owns migration acceptance. It monitors through milestone reviews, user-readiness metrics, and an internal audit of access controls. Because the agency is small, it uses a lightweight one-page business case and quarterly assurance rather than a large portfolio office.
Traps
Copying a maturity model without tailoring is a common failure. So is treating Responsibility as task allocation rather than accountability. Conformance is often narrowed to legal compliance while policy exceptions go unmanaged. Finally, Human behaviour is not "soft"; it is a design requirement for controls and adoption.