CGEIT Exam Dumps - Certified in the Governance of Enterprise IT Exam

The first step to strengthen and enforce current data governance practices after a data leakage incident is to verify data owners. Data owners are the individuals or groups who have the authority and responsibility to define, classify, protect, and manage the data assets of an enterprise1. By verifying data owners, the enterprise can ensure that the data is properly accounted for, categorized, and secured according to its value, sensitivity, and risk. Data owners can also establish data policies, standards, and procedures, as well as monitor and report on data quality, usage, and compliance1. Verifying data owners is a prerequisite for assessing data security controls, reviewing data logs, and analyzing data quality, as these activities depend on the accurate identification and assignment of data ownership roles and responsibilities. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 4: Risk Optimization, Section 4.2: IT Risk Management Process, Subsection 4.2.1: IT Risk Identification, Page 163-164. Top 10 Effective Data Governance Tools.

Business ethics is the study of appropriate business policies and practices regarding potentially controversial subjects, such as corporate governance, insider trading, bribery, discrimination, corporate social responsibility, fiduciary responsibilities, and much more1. The most important aspect of business ethics is to protect the interests of the stakeholders, who are the individuals or groups that have a stake in the success or failure of a business. Stakeholders include shareholders, customers, employees, suppliers, regulators, and the society at large. By protecting stakeholders’ interests, a business can ensure its long-term viability, reputation, and profitability. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 1: Governance of Enterprise IT, Section 1.1: IT Governance Frameworks and Principles, Subsection 1.1.2: IT Governance Principles, Page 14-15. Business Ethics: Definition, Principles, Why They’re Important.

 Aligning EA and procurement strategies is the best way to ensure the success of the supplier policy that requires multiple technology suppliers. EA provides a holistic view of the current and future state of the enterprise’s IT architecture, including its business processes, applications, data, infrastructure, and security. Procurement strategies define how the enterprise will acquire the necessary IT resources, services, and solutions from external suppliers. By aligning EA and procurement strategies, the enterprise can ensure that the supplier selection and management are consistent with the enterprise’s vision, goals, and requirements, and that the suppliers can deliver value, quality, and innovation to the enterprise. References: CGEIT Domain 2: IT Resources

 The best way to prevent adverse effects to the enterprise resulting from the new technology is to develop key risk indicators (KRIs), because they are metrics that measure the potential impact and likelihood of the risks associated with the new technology, and provide early warning signals for taking corrective actions. KRIs can help the enterprise to monitor and manage the risks of integrating the new technology with the current IT infrastructure, and to ensure that the expected benefits and value are realized12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 75-76.

 The best way for the CIO to ensure that the IT objectives are delivered effectively by IT staff is to include the IT objectives in staff performance plans. Staff performance plans are documents that define the expectations, responsibilities, and goals for individual employees, as well as the criteria and methods for evaluating their performance1. By including the IT objectives in staff performance plans, the CIO can align the IT staff’s work with the business objectives, communicate the desired outcomes and behaviors, motivate and empower the IT staff, monitor and measure their progress and achievements, and provide feedback and recognition1. This will help to create a culture of accountability, excellence, and continuous improvement among the IT staff, and ensure that they contribute to the value creation and delivery of IT2. References: Performance Management. What is CGEIT? A certification for seasoned IT governance professionals.

 This should be the first thing that executive leadership does to address the concern of quality issues in their software products, as it helps to identify and understand the underlying factors and causes that led to the quality problems1. A root cause analysis is a systematic process of investigating a problem or incident by asking a series of questions, such as why, how, what, where, and when, until the root cause or causes are found1. By requiring a root cause analysis and reviewing the results, executive leadership can gain insight into the nature and extent of the quality issues, as well as their impact on the market reputation and customer satisfaction ratings. They can also use the results to devise and implement corrective and preventive actions to resolve the quality issues and prevent them from recurring1.

The other options are not as important or effective as requiring a root cause analysis and reviewing the results, as they are either specific solutions or outcomes of the root cause analysis, but not comprehensive steps. Allocating budget to hire more software and quality assurance specialists may help to improve the software development and testing process, but it may not address the root cause or causes of the quality issues, which could be related to other factors, such as requirements, design, tools, methods, or culture2. Implementing a software development life cycle (SDLC) framework may help to standardize and optimize the software development process, but it may not address the root cause or causes of the quality issues, which could be related to other factors, such as communication, collaboration, feedback, or training3. Mandating more robust software testing prior to release may help to detect and fix more defects before launching the software products, but it may not address the root cause or causes of the quality issues, which could be related to other factors, such as scope creep, change management, or quality assurance

Before developing an IT strategic plan, it is essential to review the enterprise business plan, which defines the enterprise’s structure, governance, and operations. The enterprise business plan describes the enterprise’s vision, mission, goals, objectives, strategies, and performance measures. It also outlines the enterprise’s value proposition, market position, competitive advantage, and customer segments. The IT strategic plan should align with and support the enterprise business plan by providing a roadmap for how IT will enable and enhance the business capabilities and outcomes. The IT strategic plan should also consider the enterprise’s risk appetite and tolerance, which are defined by the enterprise’s risk management framework.

The other options are not necessarily required before developing an IT strategic plan. Aligning the enterprise vision statement with business processes is part of the IT strategic planning process, but it does not have to be done before developing the IT strategic plan. Developing an enterprise architecture (EA) framework is a separate activity that can be done in parallel or after developing the IT strategic plan. The EA framework defines how to create and use an enterprise architecture, which provides a holistic view of the organization’s business, information, and technology. Reviewing the enterprise risk tolerance level is also part of the IT strategic planning process, but it does not have to be done before developing the IT strategic plan. The risk tolerance level reflects the acceptable level of variation around a particular set of risk-based objectives.

An IT steering committee is a group of senior executives and stakeholders who provide strategic direction, oversight, and guidance for IT initiatives and investments in an enterprise. An IT steering committee should be responsible for the implementation of an IT balanced scorecard, as it can ensure that the scorecard aligns with the enterprise’s vision, mission, goals, and strategies, and that it reflects the needs and expectations of the customers and other stakeholders. An IT steering committee can also monitor and evaluate the performance of the IT function based on the scorecard metrics, and provide feedback and recommendations for improvement. An IT steering committee can also facilitate communication and collaboration among the IT function and other business units, and promote a culture of accountability and transparency for IT performance. References: CGEIT Exam Content Outline | ISACA1, CGEIT Review Manual (Digital Version), How to implement the Balanced Scorecard: Best Practices & 10 Tips2, Who Should Manage Your Company’s Balanced Scorecard?3