Isaca Updated CGEIT Exam Questions and Answers by keyaan

Information security must approve the criteria for technology-enabled services to ensure that all security-related considerations, including compliance, risk mitigation, and data protection, are addressed. This step aligns the service design with the enterprise's security policies and regulatory requirements before it progresses to stakeholders. Other functions such as QA and PMO contribute to execution and oversight, but the responsibility for security approvals rests with information security. References: COBIT 2019, ISACA Security Guidance.

When an IT governance committee is reviewing its current risk management policy due to increased usage of social media within an enterprise, the first task should be to initiate an assessment of the impact on the business. This assessment will provide a comprehensive understanding of how social media usage affects various aspects of the business, including productivity, security, data privacy, and compliance with existing policies and regulations. Understanding the business impact will inform the committee's decisions on any necessary policy adjustments or controls to mitigate potential risks associated with social media usage. While reviewing current usage levels, blocking access, and reassessing BYOD policies are relevant considerations, they should be informed by an initial assessment of the business impact to ensure that any actions taken are aligned with the enterprise's strategic objectives and risk tolerance.

Demonstrating adequate strategic oversight of IT by the board involves providing transparent, formal, and authoritative evidence to stakeholders, particularly for a publicly traded enterprise. The CGEIT Review Manual 8th Edition highlights that IT governance reporting in official documents, such as the annual report, is a key mechanism to communicate the board’s oversight role to shareholders, regulators, and other stakeholders.

Extract from CGEIT Review Manual 8th Edition (Domain 1: Governance of Enterprise IT):"The board of directors is responsible for ensuring that IT governance is aligned with enterprise objectives and that oversight is transparent to stakeholders. Including IT governance reporting in the annual report provides a formal mechanism to demonstrate accountability, strategic alignment, and oversight to shareholders and regulatory bodies." (Approximate reference: Domain 1, Section on Governance Framework and Reporting)

Including IT governance reporting in the annual report (option C) directly addresses the need to demonstrate board oversight in a formal, public, and credible manner, as it reaches shareholders and regulators who expect such disclosures in official financial and governance documents.

Why not the other options?

A. Annual IT governance communication to all staff: Internal communication to staff is important for alignment but does not directly demonstrate board oversight to external stakeholders like investors or regulators.

B. Press releases targeted at large investors: Press releases are informal and may lack the credibility and permanence of an annual report. They are not a standard mechanism for governance reporting.

D. Annual presentation of IT performance metrics: While performance metrics are useful, a presentation is typically internal or limited in scope and does not provide the formal, public disclosure required to demonstrate board oversight.

Engaging stakeholders in scenario developmentis essential to identifying relevant and realistic crisis events that the business continuity plan should address. Stakeholders bring diverse perspectives on potential threats and operational priorities, which improves the completeness and effectiveness of the BCP.

Walk-throughs and communication reviews are important later stages, butscenario development is foundationalfor making the BCP comprehensive.