Isaca Updated CGEIT Exam Questions and Answers by aj

The best way to ensure new systems can be adequately supported once in production is to require operational management be identified in the business case. This means that the business case should include the costs, benefits, risks and resources associated with the operation and maintenance of the new system, as well as the roles and responsibilities of the operational staff. By doing so, the business case can ensure that the new system is aligned with the business objectives and can deliver value to the stakeholders. Additionally, the business case can help to secure the commitment and support of the operational management for the new system. References := CGEIT Exam Content Outline, Domain 3: Benefits Realization1; COBIT 5: Enabling Processes, chapter 4, section 4.2.22; Building A Governance System: A Review of Information Flow and Items Component

 The main governance focus when implementing a newly approved BYOD policy is to educate employees on the increased IT security risk to the enterprise. BYOD introduces various challenges and threats to the enterprise’s data and network security, such as device loss or theft, unauthorized access, malware infection, data leakage, and compliance violations. Therefore, it is essential to raise the awareness and understanding of employees on the potential risks and their responsibilities in protecting the enterprise’s assets and information. Educating employees on the IT security risk can also help to foster a culture of security and compliance, and to promote best practices for BYOD usage, such as following the acceptable use policy, installing security software, and reporting incidents. References := The Ultimate Guide to BYOD Security: Definition & More - Digital Guardian; Enterprise mobility and security: How to build a BYOD policy; Bring Your Own Device for Executives | Cyber.gov.au

An exception management process is a method for documenting and approving an exception to compliance with established IT governance policies, standards, and practices. An exception management process can accommodate the need for autonomy over technology choices by allowing a functional group to request and justify a deviation from the IT governance requirements, based on the business needs, risks, costs, and benefits. An exception management process can also help to ensure that the exceptions are reviewed and approved by the appropriate authorities, that the exceptions are monitored and reported, and that the exceptions are aligned with the IT strategy and objectives123. References: Exception Management Process Flow. IT/Information Security Exception Request Process. Strategies, Governance, Policies, Standards and Resources.

 Objectives and metrics are the most critical for the successful implementation of an IT process, as they define the purpose, scope, and expected outcomes of the process. Objectives and metrics also help to measure and monitor the performance, efficiency, and effectiveness of the process,and to identify and implement improvement opportunities12. References := CGEIT Exam Content Outline, Domain 1, Subtopic C: Technology Governance, Task 2: Ensure that IT processes are defined, implemented, monitored and continually improved in alignment with the enterprise governance framework.