Isaca Updated CGEIT Exam Questions and Answers by koda

Information ownership is the assignment of roles and responsibilities for data protection to individuals or groups within the organization. Information owners are accountable for ensuring that data is properly classified, secured, and used in accordance with the organization’s policies and standards. Information ownership facilitates governance oversight of data protection measures by providing clear lines of authority and accountability for data assets. References:

ISACA CGEIT Review Manual 2021, page 86: “Information ownership is the assignment of roles and responsibilities for the protection of information to individuals or groups within the enterprise.”

ISACA CGEIT Review Questions, Answers & Explanations Manual 2021, page 11, question 14: “The correct answer is A. Information ownership is the assignment of roles and responsibilitiesfor the protection of information to individuals or groups within the enterprise. Information owners are accountable for ensuring that information is properly classified, secured, and used in accordance with the enterprise’s policies and standards. Information ownership facilitates governance oversight of data protection measures by providing clear lines of authority and accountability for information assets.”

The best approach to assist an enterprise in planning for IT-enabled investments is enterprise architecture (EA). EA is a holistic and integrated view of the current and future state of the business, IT, and their alignment1. EA helps to identify and prioritize the business needs andobjectives, and to design and deliver the IT solutions that support them2. EA also helps to optimize the IT resources and processes, and to ensure that they are aligned with the business strategy and goals3. EA also helps to measure and monitor the IT performance and outcomes, and to evaluate the value and benefits of the IT investments4. EA also helps to manage the risks, costs, and complexity of the IT investments, and to ensure that they comply with the legal and regulatory requirements5.

IT process mapping, task management, and service level management are not as comprehensive or effective as EA in assisting an enterprise in planning for IT-enabled investments. IT process mapping is a visual representation of a process that shows the steps and their relationships6. It can help to understand how a process works, but it does not provide a strategic or architectural view of the business or IT. Task management is a process of managing individual or group tasks to achieve goals7. It can help to track and delegate work, but it does not address the alignment or optimization of IT with the business. Service level management is a process of defining, documenting, and agreeing on service levels within an IT service management system8. It can help to ensure that services are delivered at an agreed level, but it does not cover the design or delivery of IT solutions that meet the business needs. Therefore, EA is the best approach to assist an enterprise in planning for IT-enabled investments.

One of the primary responsibilities of a data steward is to classify and label organizational data assets, which means to assign categories and tags to the data based on its characteristics, such as type, source, sensitivity, quality, or purpose. Classifying and labeling data helps to organize, manage, and protect the data assets, as well as to facilitate their discovery, access, and usage. Data stewards are also responsible for defining and maintaining the data classification and labeling standards and policies, and ensuring their compliance across the organization. References: What Is a Data Steward? Roles & Responsibilities | Zuar1, Data Stewards: Who They Are & Why Data Stewardship Matters - HubSpot Blog2, Data Steward: Roles, Responsibilities, and Certification3

 Privacy requirements should be the most important consideration for a hospital planning to use cloud services and mobile applications, because they involve the protection of sensitive and personal health information (PHI) of the patients and staff. PHI is a type of data that is subject to strict regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) in the US1, the General Data Protection Regulation (GDPR) in the EU2, and the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada3. These regulations and standards require the hospital to ensure that PHI is collected, stored, processed, and transmitted in a secure and compliant manner, and that the rights and consent of the data subjects are respected. Using cloud services and mobile applications can pose significant challenges and risks to privacy, such as data breaches, unauthorized access, data loss, data residency, third-party liability, etc. Therefore, the hospital should carefully evaluate the privacy requirements and implications of using cloud services and mobile applications, and adoptappropriate governance, policies, controls, and measures to safeguard PHI in the cloud environment.