ISACA CGEIT Exam Questions 2025

The foundational step in aligning resource management with the IT strategic plan is to understand the disparity between the current resource capabilities and the future resource requirements dictated by that plan. This process is known as a gap analysis. It systematically identifies shortfalls or surpluses in skills, infrastructure, and applications needed to achieve strategic objectives. The output of this analysis provides the essential data to formulate a resource plan, which will then guide subsequent actions such as assigning roles, defining responsibilities, and evaluating sourcing strategies. Without first identifying the "gap," any resource management activities would lack strategic direction.

A. A RACI chart is a detailed implementation tool used to clarify roles, which is premature before the required resources and tasks are identified through a gap analysis.

B. Assigning roles and responsibilities is a component of executing a resource plan, which can only be developed after understanding the resource gaps.

D. Identifying outsourcing opportunities is a potential strategy to address a resource gap; the gap must be identified first before solutions can be considered.

1. ISACA. (2020). CGEIT Review Manual, 8th Edition. Domain 2: IT Resources Optimization, Section 2.2, IT Resource Planning. The manual states that after understanding the strategic direction, "A gap analysis can then be performed to identify the differences between the current and desired future states. This analysis helps in creating a roadmap for acquiring, developing, and managing the necessary IT resources."

2. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. APO07 Managed Human Resources. The process description for APO07.01 includes "Identify the skills and competencies required to meet the enterprise’s objectives." This implies a comparison (gap analysis) between required and existing skills as a primary step.

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer International Publishing. Chapter 3, "IT Governance Mechanisms," discusses strategic alignment, noting that a crucial early activity is assessing the current state of IT resources against strategic requirements to identify gaps that need to be addressed. (DOI: 10.1007/978-3-319-14547-1)

A new CIO's first priority in establishing effective information governance is to understand the current state of information assets and processes relative to the enterprise's strategic requirements. Performing an information gap analysis is the most comprehensive initial step. This analysis compares the current capabilities ("where we are now") with the business's needs and desired future state ("where we want to be"). The results of this analysis provide a strategic baseline, identify key deficiencies, and form the basis for a roadmap to prioritize all subsequent governance activities, such as valuing assets or reviewing specific procedures.

A. Quantify the business value of information assets: While essential for risk management and investment decisions, this action is more effective once a baseline understanding of business needs and current information capabilities is established through a gap analysis.

C. Review information classification procedures: This is a specific, tactical activity. A new CIO should first perform a broader strategic assessment (a gap analysis) to determine if classification procedures are a priority area for review.

D. Evaluate information access methods: This is a detailed security and operational task. It is a component of an overall governance framework, not the strategic starting point for a new executive leader.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 1: Governance Framework, Task T1.5, "Identify the gaps between current and future states of the GEIT." The associated knowledge statement, K1.5.1, is "Knowledge of gap analysis." This places gap analysis as a fundamental, early-stage task in establishing and maintaining the governance framework.

2. ISACA, COBIT 2019 Framework: Introduction and Methodology. Chapter 5, "The COBIT Implementation Guide," describes a seven-phase implementation life cycle. Phase 2 is "Where are we now?" and Phase 3 is "Where do we want to be?". The process of comparing these two phases to identify shortfalls is a gap analysis, which is foundational before moving to Phase 4, "What needs to be done?".

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer. In Chapter 4, "Implementing Enterprise Governance of IT," the authors describe the implementation life cycle, which begins with recognizing the need to act and assessing the current situation to identify problems and opportunities. This assessment is a precursor to, and a core component of, a gap analysis. (DOI: 10.1007/978-3-319-14547-1)

A business impact analysis (BIA) is the most appropriate tool for this purpose. A BIA systematically identifies critical business processes and quantifies the financial and operational impacts of their disruption over time. This analysis provides a clear monetary value for the risk associated with downtime. By understanding the potential financial loss per hour, day, or week, the IT steering committee can directly compare this quantified risk against the costs of different disaster recovery site options (e.g., hot, warm, cold). This enables a direct, data-driven mapping of cost to risk, facilitating an informed investment decision that aligns recovery expenditure with business criticality.

A. Key risk indicators (KRIs): KRIs are metrics used to monitor current risk levels against predefined thresholds; they do not quantify the overall financial impact of a potential disaster.

B. Scenario-based assessment: While useful for exploring specific threats, it is often a component of a larger risk assessment and may not provide the comprehensive, business-wide financial quantification that a BIA delivers.

D. Qualitative forecasting: This method relies on subjective expert opinion and lacks the objective, quantifiable financial data required for a robust cost-benefit analysis of a DR site investment.

1. ISACA, CGEIT Review Manual, 8th Edition (2020), Domain 4: Risk Optimization, Section 4.4, Business Impact Analysis and Business Continuity Plan. The manual states, "The BIA is a key part of the BCP process that identifies the critical business processes... and determines the effect of a disruption on them... This provides the data from which the appropriate recovery strategies can be determined." This directly links the BIA's output to the selection of recovery strategies, which is a cost-versus-risk decision.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives (2018), Management Objective DSS04 Manage Continuity, Practice DSS04.02 Define business continuity policy, objectives and scope. A key activity listed is to "Perform a business impact analysis (BIA) to identify critical business processes... and the impact of a disruption." The outputs of the BIA are foundational for selecting cost-effective recovery strategies in subsequent practices (e.g., DSS04.03).

3. Tipton, H. F., & Krause, M. (Eds.). (2007). Information Security Management Handbook. Auerbach Publications. Chapter 35, "Business Impact Analysis," explains that the BIA's primary goal is to "correlate specific system components with the critical services they provide, and based on that, to estimate the consequences of a loss of these components." This estimation of consequences (risk) is essential for justifying the cost of recovery solutions. (This is a widely cited academic and professional text in the domain).

The most important step to ensure appropriate ownership of access controls after a compliance failure is to link them to a foundational governance structure. An information architecture provides this structure by defining and classifying information assets and, crucially, assigning data owners. By granting access based on this architecture, the enterprise ensures that decisions about who can access sensitive data are made by the designated owners who are accountable for its protection. This directly addresses the root cause of the compliance failure—a lack of clear accountability and ownership—by embedding these principles into the access control process.

B. Engaging an audit of logical access controls and related security policies

An audit is a reactive measure that identifies existing weaknesses. While valuable for assessment, it does not proactively establish or ensure ownership, which is a core governance function.

C. Implementing multi-factor authentication controls

This is a specific, tactical security control. While it strengthens authentication, it does not address the fundamental governance issue of who is responsible for defining and approving access rights.

D. Authenticating access to information assets based on roles or business rules

This describes an implementation method (e.g., RBAC). For this method to be effective, the roles and rules must be defined and approved by accountable owners, a step which this option omits.

1. ISACA, CGEIT Review Manual, 7th Edition. Domain 4: Information Optimization, Section 2.1 (Information Architecture). The manual explains that a key purpose of an information architecture is to define data ownership and stewardship. This establishes the foundation upon which access controls and other security measures are built, ensuring accountability is clearly assigned.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. APO14, Managed Data. Practice APO14.01, "Define and maintain a data dictionary and data governance business glossary," emphasizes establishing roles and responsibilities for data, including data owners. Access controls are then based on the policies set by these owners.

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives. DSS05, Managed Security Services. Practice DSS05.04, "Manage user identity and logical access," notes that access rights should be granted based on business need, which is determined and approved by the designated information asset owner. This confirms that ownership precedes the granting of access.

An enterprise code of ethics is the foundational document that formally defines the principles, values, and desired behaviors for the entire organization. To effectively incorporate these behaviors into the IT governance framework, the framework must align with and be guided by this code. The code of ethics sets the "tone at the top" and provides the overarching principles that should permeate all IT processes, decisions, and activities. This ensures that IT culture is a direct extension of the desired enterprise culture, which is a critical success factor for effective Enterprise Governance of IT (EGIT).

B. Risk mitigation strategies and action plans are tactical responses to specific identified risks, not a comprehensive guide for all desired organizational behaviors.

C. Documented consequences for noncompliance are an enforcement mechanism; they address what happens when desired behaviors are not followed, but do not define the desired behaviors themselves.

D. An enterprise RACI matrix defines roles and responsibilities within processes. It clarifies who does what, but does not specify the ethical or behavioral standards for performing those duties.

1. ISACA, COBIT 2019 Framework: Introduction and Methodology, 2018, p. 31. The framework identifies "Culture, ethics and behavior" as one of the seven core components of a governance system, stating it is a critical success factor. An enterprise code of ethics is the primary instrument for defining this component.

2. ISACA, CGEIT Review Manual, 8th Edition, 2020, Domain 1, Section 1.6, "Organizational Structures, Roles, and Responsibilities." This section emphasizes the board's responsibility for establishing an ethical culture and notes that a code of ethics is a key tool for communicating and embedding these values throughout the enterprise, including its IT functions.

3. ISACA, CGEIT Review Manual, 8th Edition, 2020, Domain 1, Section 1.9, "Policies and Procedures." This section clarifies that policies, which are core to any governance framework, should be derived from the enterprise's guiding principles and ethical stance, as articulated in documents like a code of ethics.

For performance measures to be effective in improving organizational performance, they must be relevant and accepted by the stakeholders who will use them. If stakeholders do not find the measures meaningful or do not agree with their validity, the measures will fail to drive the desired behaviors or inform strategic decisions. Acceptance ensures buy-in and accountability, while meaningfulness ensures the measures are directly linked to strategic objectives and actionable insights, which is the ultimate purpose of performance measurement in enterprise governance.

A. Benchmarking is a valuable technique for setting targets and providing context, but it is not a mandatory prerequisite for developing appropriate, internally focused performance measures.

C. While measures should be based on reliable data, the definition of an appropriate measure comes first. This may necessitate the creation of new data sources, not just reliance on existing ones.

D. Approval by the IT steering committee is a governance formality, often limited to IT-related measures. It does not inherently make a measure appropriate or meaningful for broader organizational performance.

1. ISACA. (2020). CGEIT Review Manual, 8th Edition. Domain 4: Value Optimization, Section 2.3, Value Delivery Monitoring. The manual emphasizes that performance metrics must be linked to business objectives and be meaningful to the business to ensure value is being delivered and monitored effectively.

2. ISACA. (2018). COBIT 2019 Framework: Introduction and Methodology. Section 3.2, The COBIT Goals Cascade. The framework illustrates that the entire governance system, including performance metrics, is derived from stakeholder needs and enterprise goals, reinforcing that measures must be meaningful to those stakeholders.

3. Kaplan, R. S., & Norton, D. P. (1992). The Balanced Scorecard—Measures That Drive Performance. Harvard Business Review, 70(1), 71–79. This foundational academic work on performance measurement argues that for measures to be effective, they must translate high-level strategy into terms that are understandable and actionable for the organization's employees (stakeholders).

The first strategic step for IT governance when considering a major initiative, such as a new line of business, is to ensure all stakeholders agree on a vision for the future state. This shared vision establishes the high-level direction, purpose, and desired outcome of the change. It serves as the foundational element upon which all subsequent strategic activities, such as defining goals, objectives, and metrics, are built. Without a unified vision, efforts to align IT with business strategy will be fragmented and ineffective, jeopardizing the success of the new venture. This initial alignment is a core principle of enterprise governance of IT.

A. Objectives are specific, measurable actions derived from broader goals and the overall vision. They are defined after the vision is established, not before.

B. Metrics are developed to measure the achievement of objectives. This is a subsequent step in the planning and performance management process, not the initial strategic one.

D. A change response plan is a tactical component of change management, addressing the implementation phase. It is created much later, after the strategic direction is set.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 1: Governance of Enterprise IT, Section 1.4, Strategic Planning. The manual emphasizes that strategic planning begins with defining the enterprise's mission and vision, which then drives the formulation of goals and objectives. The vision provides the "what" before the "how."

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. APO02 Manage Strategy. The description for practice APO02.01, "Understand enterprise context and direction," states the need to "Consider the current and future business environment... to help formulate the enterprise’s long-term vision and mission." This understanding of the future state is a prerequisite for developing the IT strategy.

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer International Publishing. Chapter 3, "IT Governance Mechanisms," discusses how strategic alignment starts with a shared understanding between business and IT executives about the future direction, which is encapsulated in the vision. (DOI: 10.1007/978-3-319-14547-1).

The fundamental principle of the governance of enterprise IT (GEIT) is to ensure that IT investments align with and support the enterprise's strategic objectives to create business value. Therefore, the primary consideration when prioritizing IT projects must be the impact they will have on the business. This holistic view encompasses strategic alignment, potential return on investment, risk mitigation, and contribution to overall enterprise goals. Prioritizing based on business impact ensures that resources are allocated to the initiatives that will deliver the most significant value, rather than focusing on narrower criteria.

A. Technical capability is a critical feasibility and risk assessment factor, but it is secondary to the project's potential business value.

B. Process owner expectations are a valuable input for assessing operational benefits, but prioritization must consider the entire enterprise's strategic objectives, not just one area.

C. IT performance benchmarks against competitors provide context and can identify opportunities, but they are not the primary driver for prioritization, which must be based on internal strategic goals.

1. ISACA, CGEIT Review Manual, 8th Edition, 2020. Domain 3: Benefits Realization, Section 3.2, "IT Portfolio Management," emphasizes that the investment portfolio must be aligned with the enterprise's strategic objectives and that prioritization is based on the potential to add value to the business.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018. Governance Objective EDM02, "Ensured Benefits Delivery," Practice EDM02.02, states the need to "Direct value optimization by prioritizing investment programs based on their potential contribution to strategic objectives and the enterprise value." (p. 43).

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018. Management Objective APO05, "Managed Portfolio," Practice APO05.03, states, "Prioritize, select and defer programs and other investments based on evaluation of their alignment with enterprise strategy, their business value and risk." (p. 78).

The question highlights a critical risk factor: the enterprise has no experience with cloud technology. The most immediate and effective first step to mitigate the risk of service disruption is to address this knowledge gap. Engaging an experienced IT consultant provides the necessary expertise to guide the organization through the entire migration process. This expert guidance is foundational, ensuring that subsequent steps like evaluating sourcing options, updating the enterprise architecture, and defining performance indicators are performed correctly and based on informed decisions, thereby minimizing the risk of failure or disruption.

A. Implementing key performance indicators (KPIs) is a step to measure success and manage performance, which occurs after a strategy and solution have been selected, not as the initial risk mitigation action.

B. Reflecting the change in the enterprise architecture (EA) is a necessary step, but attempting it without the required expertise is itself a risk. The expertise must be acquired first to inform the EA changes.

C. Evaluating sourcing options (e.g., cloud vendors, service models) requires deep technical and commercial knowledge. Making this critical decision without experience would be a high-risk endeavor.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 3: Resource Optimization, Task Statement 3.3, emphasizes ensuring sufficient and appropriate resources to support objectives. When internal skills are absent for a strategic initiative, sourcing external expertise is a primary method for resource optimization and risk reduction.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. The management objective APO07 Managed Human Resources includes practice APO07.02, "Sustain a skilled and motivated workforce," which states that organizations should "Provide for the acquisition of new skills as required by enterprise goals," including sourcing them externally. For a major technology shift like cloud migration, this is a prerequisite for success.

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives. The management objective BAI05 Managed Organizational Change highlights the need to prepare stakeholders for change. A key component is ensuring the organization is equipped with the necessary skills and knowledge, which often involves bringing in external experts to guide the transition and mitigate risks associated with inexperience.

The role of a data steward is to manage and oversee an organization's data assets on behalf of business stakeholders. This includes responsibility for data quality, data definition, and resolving data issues. Data normalization is a process to improve data integrity and minimize redundancy. When duplicate data items are found, it signifies a data quality issue. The data steward is the designated role responsible for investigating such issues, defining the correct data structure, and overseeing the remediation process, which includes normalization.

A. Business system owner: This role is accountable for the system's overall business value and functionality, but typically delegates the operational responsibility for data quality and definition to data stewards.

C. Database administrator (DBA): The DBA is a technical role focused on the database's performance, security, and availability. They would implement the technical changes for normalization but are not responsible for defining the data rules.

D. Application manager: This role is responsible for the day-to-day operation of the application, not the governance and quality of the underlying data assets, which is the purview of data stewardship.

---

1. ISACA, CGEIT Review Manual, 8th Edition (2020). Domain 2: IT Resources, Section B: Information/Data. The manual describes the data steward as being "responsible for the quality of defined data elements," which directly encompasses the task of resolving duplicates through normalization. The distinction is made between the data owner (accountable) and the data steward (responsible).

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives (2018). APO14 Managed Data, APO14.03: "Define and maintain data and information architecture." This practice includes establishing roles and responsibilities for data management. The framework's supporting guidance consistently assigns the responsibility for data quality and definition to a stewardship function.

3. Soares, S. (2015). Data Governance: How to Design, Deploy and Sustain an Effective Data Governance Program. MC Press. Chapter 4, "Data Governance Roles and Responsibilities," clearly defines the Data Steward as the individual with day-to-day responsibility for managing the quality, integrity, and definitions of specific data assets. This includes activities like identifying and resolving data redundancy. (Note: While a book, this is a foundational text in the field, often referenced in academic and professional contexts related to ISACA's body of knowledge).