Free CGEIT Practice Test Questions and Answers (2026)

The foundational step in aligning resource management with the IT strategic plan is to understand the disparity between the current resource capabilities and the future resource requirements dictated by that plan. This process is known as a gap analysis. It systematically identifies shortfalls or surpluses in skills, infrastructure, and applications needed to achieve strategic objectives. The output of this analysis provides the essential data to formulate a resource plan, which will then guide subsequent actions such as assigning roles, defining responsibilities, and evaluating sourcing strategies. Without first identifying the "gap," any resource management activities would lack strategic direction.

A. A RACI chart is a detailed implementation tool used to clarify roles, which is premature before the required resources and tasks are identified through a gap analysis.

B. Assigning roles and responsibilities is a component of executing a resource plan, which can only be developed after understanding the resource gaps.

D. Identifying outsourcing opportunities is a potential strategy to address a resource gap; the gap must be identified first before solutions can be considered.

1. ISACA. (2020). CGEIT Review Manual

8th Edition. Domain 2: IT Resources Optimization

Section 2.2

IT Resource Planning. The manual states that after understanding the strategic direction

"A gap analysis can then be performed to identify the differences between the current and desired future states. This analysis helps in creating a roadmap for acquiring

developing

and managing the necessary IT resources."

2. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. APO07 Managed Human Resources. The process description for APO07.01 includes "Identify the skills and competencies required to meet the enterprise’s objectives." This implies a comparison (gap analysis) between required and existing skills as a primary step.

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value

Featuring COBIT 5. Springer International Publishing. Chapter 3

"IT Governance Mechanisms

" discusses strategic alignment

noting that a crucial early activity is assessing the current state of IT resources against strategic requirements to identify gaps that need to be addressed. (DOI: 10.1007/978-3-319-14547-1)

The most appropriate first step for the Chief Governance Officer (CGO) is to conduct a formal assessment of the proposed change. Before modifying a long-standing governance framework, it is crucial to understand the full implications. This impact assessment will evaluate the potential benefits, such as increased business agility and reduced administrative overhead, against the potential risks, such as architectural misalignment or increased security vulnerabilities from a less rigorous review. This data-driven approach provides a sound basis for decision-making, ensures the change aligns with enterprise objectives and risk appetite, and demonstrates a structured, responsible response to the business units' concerns.

A. Create a central repository for the business to submit requests.

This addresses the mechanics of submitting requests but fails to address the substance of the current, escalated issue, which is the lack of response to a specific process improvement.

B. Explain the importance of the IT governance framework.

This is a defensive action that dismisses the valid business concern about inefficiency. Effective governance requires listening to and addressing stakeholder needs, not justifying the status quo.

D. Assign a project team to implement necessary changes.

This action is premature. A project team cannot be tasked with implementation until the scope, risks, and benefits of the change have been assessed and a decision has been made.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 1

Task Statement 1.5

"Ensure that the GEIT framework is periodically reviewed

updated

and relevant

" emphasizes the need to evaluate proposed changes based on shifts in business needs. The first step in this evaluation is to understand the impact of any potential update to the framework.

2. ISACA

COBIT 2019 Framework: Introduction and Methodology (2018). Section 4.2

"Goals Cascade

" explains how stakeholder needs must be translated into enterprise goals. The business unit's request is a stakeholder need

and before acting

governance must assess how a change would impact the achievement of enterprise goals.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). The governance objective EDM01

"Ensured Governance Framework Setting and Maintenance

" includes the practice EDM01.03

"Monitor the system of internal control." This involves evaluating the effectiveness and efficiency of controls

which is precisely what the business units are questioning. Assessing their proposal is a key part of this monitoring and maintenance activity.

The foundational and primary step in planning any IT governance implementation is to identify and understand the business drivers. These drivers—such as market pressures, regulatory requirements, or strategic objectives—dictate the "why" behind the initiative. A clear understanding of business drivers ensures that the governance framework is directly aligned with the enterprise's strategic goals and addresses its most critical needs. All subsequent planning activities, including defining performance indicators, securing funding, and assigning responsibilities, are contingent upon this initial alignment with the business's core purpose and direction.

A. Assigning decision-making responsibilities is a critical component of a governance framework, but it can only be done effectively after the goals and scope, which are derived from business drivers, have been established.

B. Obtaining necessary business funding requires a compelling business case. This case must demonstrate how the governance initiative will support and add value to the business, which is articulated by first identifying the business drivers.

C. Defining key business performance indicators (KPIs) is essential for measuring success, but these metrics must be linked to business goals, which are formulated in response to the identified business drivers.

1. ISACA. (2020). CGEIT Review Manual

8th Edition. Section 1.3

Governance Implementation

Phase 1: What Are the Drivers? This section explicitly states that the first phase of the implementation life cycle is to "Identify current business and IT-related issues

or 'pain points

' and triggers

and create a desire to change at executive management levels." This is synonymous with identifying business drivers.

2. ISACA. (2018). COBIT 2019 Framework: Introduction and Methodology. Page 29

Figure 3.1

"COBIT Goals Cascade." The cascade

which is the mechanism for aligning IT with enterprise goals

begins with "Stakeholder Drivers and Needs

" reinforcing that understanding these drivers is the starting point for governance.

3. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. Page 19

Section 3.1

"Governance and Management Objectives." The entire framework is designed to help enterprises achieve their objectives

which are derived from stakeholder needs and business drivers. The process starts with understanding these drivers to set appropriate goals.

The IT steering committee's primary function is to ensure the alignment of IT with business strategy and to provide oversight of IT-related risk. Migrating services to an external cloud provider fundamentally alters the enterprise's risk landscape. This strategic shift introduces new risks (e.g., vendor viability, data security in a multi-tenant environment, regulatory compliance, exit strategies) and modifies existing ones. Therefore, the committee's foremost concern is to ensure the business risk profile is comprehensively updated to reflect this new operational model. This allows for proper risk assessment, mitigation, and alignment with the enterprise's risk appetite, which is a core governance responsibility.

A. Revising the business balanced scorecard: Revising performance metrics is a consequence of the strategic shift and updated risk profile, not the primary, initial concern for the governance body.

C. Changing the IT steering committee charter: The committee's fundamental purpose and authority do not change; only the IT delivery model they oversee changes. The charter would not typically require revision for this.

D. Calculating the cost of the current solution: This calculation is part of the due diligence and business case development that precedes the strategic decision. The question states the decision has already been made.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4: Risk Optimization

Task Statement R1

"Ensure that IT risk management is aligned with the enterprise risk management (ERM) framework." The manual emphasizes that a key governance role is to ensure IT-related risks are continuously identified

assessed

and managed. A move to the cloud is a significant event that necessitates a reassessment of the enterprise's risk profile.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Governance Objective EDM03: Ensured Risk Optimization. The purpose of this objective is to "Ensure that IT-related enterprise risk does not exceed risk appetite and risk tolerance." Key practices involve evaluating and directing risk management

which requires an up-to-date and accurate understanding of the business risk profile

especially after a major sourcing change.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO12: Managed Risk. This objective details the processes for managing risk

including APO12.02 "Analyze Risk

" which involves identifying the "potential for business impacts" from changes in the IT environment. The IT steering committee would oversee this process to ensure the overall business risk profile is updated and accurate.

Determining optimal IT service levels is fundamentally an economic decision that balances business needs against the cost of service delivery. A cost-benefit analysis is the primary method for this, as it systematically evaluates the value (benefit) a specific service level provides to the business versus the resources and financial investment (cost) required to achieve and maintain it. Higher service levels (e.g., 99.999% uptime) are progressively more expensive. The "optimal" level is the point where the business value derived justifies the expenditure, ensuring that IT resources are aligned with enterprise objectives and not over-provisioned at an unjustifiable cost.

A. Internal rate of return: This is a specific capital budgeting metric to evaluate the profitability of an investment, not the primary framework for setting ongoing operational service levels.

B. Recovery time objective (RTO): RTO is a critical component of a service level agreement (SLA) related to business continuity, but it does not encompass all aspects needed to determine the overall optimal service level.

D. Resource utilization analysis: This analysis measures operational efficiency. While it informs the cost side of the equation, it does not determine the required service level from a business value perspective.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 2: IT Resources Optimization

Task Statement 2.4: "Ensure that IT services and service levels are defined

managed and monitored." The manual emphasizes that service levels must be based on business requirements and that a cost-benefit analysis is essential to ensure the cost of providing a service does not exceed the value it delivers to the business.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). Management Objective APO09: Managed Service Agreements. Practice APO09.01

"Identify IT services and service level options

" involves defining a service catalog and establishing service levels based on business requirements

capabilities

and a cost-benefit analysis for different service level options. This directly links the determination of service levels to a cost-benefit trade-off.

An information retention policy's primary purpose is to ensure that information assets are managed throughout their life cycle in a way that supports business objectives while adhering to external obligations. Business requirements dictate how long data is needed for operational, analytical, or historical purposes to generate value. Simultaneously, compliance requirements, which include laws (e.g., GDPR, SOX), regulations, and contractual agreements, mandate specific minimum and sometimes maximum retention periods. These two drivers—business need and compliance—form the foundational basis for determining appropriate retention schedules, balancing utility, risk, and cost.

B. Business storage and processing needs: These are operational and technical constraints that influence how a policy is implemented (e.g., storage costs), not the fundamental rules of what to retain and for how long.

C. Backup and restoration capabilities: These are technical mechanisms for data protection and recovery. The retention policy dictates the backup strategy, not the other way around.

D. External customer data retention requirements: This is too narrow. While a component of compliance, it ignores internal business needs and other legal requirements for non-customer data like employee, financial, or intellectual property records.

1. ISACA

CGEIT Review Manual

8th Edition (2020): Domain 2: IT Resource Optimization

Section 2.3

Information/Data. The manual explains that the information life cycle

including retention and disposal

must be managed according to business

legal

and regulatory requirements. Knowledge statement K2.4.2

"Knowledge of data/information life cycle management

" directly supports that retention periods are based on these criteria.

2. ISACA

COBIT® 2019 Framework: Governance and Management Objectives (2018): The management objective APO14 Managed Data includes the practice APO14.07 Manage data storage and archiving. This practice explicitly states the need to "Define and implement policies and procedures for data storage and archiving to meet business and compliance requirements." (p. 139).

3. ISACA

COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution (2018): Design Factor 3

"Compliance requirements

" is identified as a key factor in designing a governance system. This guide emphasizes that legal and regulatory requirements are primary inputs for I&T-related policies

including those for data retention (p. 23).

A data classification policy is the foundational element required to consistently assess data protection needs. This policy establishes a framework for categorizing data based on its sensitivity, criticality, and value to the enterprise (e.g., Public, Confidential, Restricted). By creating a standardized set of criteria, the policy enables data owners to make uniform and objective decisions about the appropriate level of security controls, such as access rights and encryption, that must be applied. All other data protection activities, including risk management and the implementation of specific controls, are dependent on this initial classification.

A. Data encryption program: This is a specific security control. The decision on what data to encrypt and the strength of encryption required is determined after the data has been classified.

B. Data risk management program: A risk management program assesses threats and vulnerabilities, but it requires data classification as a primary input to determine the business impact of a potential data compromise.

C. Data retention policy: This policy defines how long data is kept. While important for governance, it is typically informed by the data's classification, not the other way around.

1. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 2: IT Resources

Task Statement 2.3

"Ensure that IT resources are identified and classified based on their criticality and importance to the enterprise." The supporting text explains that classification is a prerequisite for applying appropriate controls and protection measures.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. Management Objective APO14: Managed Data

Practice APO14.02

"Define and maintain data and information architecture." This practice includes activities for establishing a data classification scheme to ensure data is managed according to its value and sensitivity.

3. ISACA

CGEIT Review

Questions

Answers & Explanations Manual

5th Edition

2020. The rationale for similar questions emphasizes that data classification is the first step in a data management program

as it provides the basis for determining handling requirements

controls

and protection levels.

The primary achievement of performance measurement within an IT governance framework is to create transparency. By systematically collecting, analyzing, and reporting on performance metrics (e.g., KPIs), an organization provides stakeholders with clear, factual, and understandable information about the performance of IT against agreed-upon goals. This transparency is the foundational element that enables accountability and supports informed decision-making. While this information is subsequently used to drive process improvement, ensure benefit realization, and manage cost efficiency, these are secondary outcomes that depend on the initial transparency provided by the measurement process itself.

A. Process improvement: This is a corrective action or strategic initiative undertaken as a result of analyzing performance data; it is not the primary achievement of the measurement act itself.

C. Cost efficiency: This is a specific performance goal or a category of metrics that can be measured, not the overarching outcome of the entire performance measurement process.

D. Benefit realization: This is a strategic objective that performance measurement helps to track and validate. The measurement provides the data, but realizing benefits is a separate, subsequent activity.

1. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. The management objective MEA01 Managed Performance and Conformance Monitoring explicitly states its purpose is to "Collect

validate and evaluate... performance and conformance metrics... to ensure that they are sufficient to drive the achievement of goals and provide transparency of performance and conformance..." (p. 195). This directly links performance monitoring with creating transparency as a primary purpose.

2. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 4

Task 4.4 (Monitor and Report on IT Performance) emphasizes that reporting performance to stakeholders provides them with the necessary visibility to take appropriate action. This visibility is synonymous with transparency

which is described as a key outcome of the monitoring and reporting process

enabling other governance activities. (Chapter 4

Section: "IT Performance Monitoring and Reporting").

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value

Featuring COBIT 5. Springer International Publishing. In Chapter 3

the authors discuss the IT balanced scorecard as a performance measurement system. They state

"The communication of the measures through the scorecard... ensures that the strategy is transparent and translated into comprehensible and actionable measures for the whole organization." (p. 67). This highlights transparency as a direct result of performance measurement and communication. (DOI: 10.1007/978-3-319-14547-1)

A capability maturity model (CMM) is the most suitable tool for this purpose. It provides a structured framework and a standardized scale (e.g., levels 0-5) to assess the current state ("as-is") of IT processes. This allows for a direct comparison against industry best practices and benchmarks, which are often mapped to these maturity levels. By identifying the gap between the current and desired maturity levels, the CIO can effectively pinpoint weaknesses and strategically prioritize improvement initiatives to enhance process consistency and performance. This approach offers a holistic and comparative view that is essential for strategic planning.

B. Evaluating the current balanced scorecard is incorrect because a BSC primarily measures performance against an organization's internal strategic objectives, not external industry process benchmarks.

C. Reviewing key performance measures is insufficient as KPMs/KPIs are specific metrics that may lack the comprehensive, structured framework needed for a holistic process capability assessment against industry standards.

D. Reviewing IT process audit results is incorrect because audits focus on compliance with policies and the effectiveness of controls, rather than benchmarking process maturity for strategic improvement.

1. ISACA

COBIT 2019 Framework: Introduction and Methodology

2018. Chapter 6

"COBIT Performance Management (CPM)

" details the process capability levels based on CMMI

which are used to "support process improvement by identifying strengths and weaknesses and the implications thereof." This model is explicitly designed for benchmarking.

2. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 4: IT Resource Optimization

Task 4.4

"Monitor and report on IT resource performance

" discusses the use of maturity and capability models to assess processes and identify opportunities for improvement against established benchmarks.

3. De Haes

S.

& Van Grembergen

W. (2009). An exploratory study into IT governance implementations and its impact on business/IT alignment. Information Systems Management

26(2)

123-137. This academic paper discusses the use of COBIT's maturity models as a key tool for organizations to assess their IT governance processes and benchmark them

forming a basis for improvement initiatives (p. 126). DOI: https://doi.org/10.1080/10580530902794786

The most effective way to improve disaster recovery (DR) capabilities, especially after a demonstrated failure like poor recovery times, is through a cycle of testing and refinement. Continuous testing validates the disaster recovery plan (DRP) against real-world conditions, identifies specific points of failure or bottlenecks, and measures performance. The critical second step, implementing "lessons learned," ensures that weaknesses discovered during testing (or a real event) are systematically addressed. This iterative process transforms the DRP from a static document into a dynamic and proven capability, directly targeting the root causes of the poor performance.

B. Increased training and monitoring for disaster recovery personnel who perform below expectations

This is too narrow. It assumes the failure was solely due to human error, ignoring potential flaws in the plan, technology, or resource allocation.

C. Annual review and updates to the disaster recovery plan (DRP)

An annual review is a necessary but insufficient activity. It is often a theoretical exercise and lacks the practical validation needed to uncover the specific issues that caused poor recovery times in an actual event.

D. Increased outsourcing of disaster recovery capabilities to ensure reliability

Outsourcing shifts responsibility but does not inherently guarantee improvement. The enterprise remains accountable, and the outsourced solution would still require rigorous testing and management to be proven effective.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4: IT Resource Optimization. The manual emphasizes that business continuity and disaster recovery plans must be regularly tested to ensure they are effective and that the enterprise can recover within the defined recovery time objectives (RTOs). The process of reviewing test results and post-incident reports to identify and implement improvements ("lessons learned") is a fundamental principle of a mature governance program. (Specifically

see concepts within Task 4.6: Ensure that IT-enabled business continuity plans are integrated with the enterprise business continuity plan).

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective DSS04 Managed Continuity directly supports the correct answer. Practice DSS04.05 Plan and test managed continuity states the need to "Test the continuity plans on a regular basis to exercise the plans and identify deficiencies... Update the plans based on the results of the tests

reviews and changes in the business and IT environment." This highlights the essential link between testing and implementing corrective actions.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Practice DSS04.08 Conduct post-resumption review further reinforces the concept of learning from events. It advises to "Assess the effectiveness of the response to an incident or disaster after the enterprise has returned to a business-as-usual state. Identify lessons learned and required improvements to the business continuity plan..." This directly aligns with the scenario of improving capabilities after a catastrophic event.

Established enterprise architecture (EA) practices provide the most comprehensive framework for ensuring IT standards are consistently applied. EA defines the principles, policies, models, and standards that govern the use of technology across the entire organization. It creates a blueprint for IT infrastructure, applications, and data, guiding technology decisions and implementations to ensure they are aligned, interoperable, and standardized. This holistic approach is specifically designed to enforce consistency and prevent the creation of disparate, non-compliant technology silos, thereby directly addressing the consistent application of IT standards enterprise-wide.

A. Enterprise risk management (ERM) reviews. ERM focuses on identifying and mitigating risks. While this may influence certain IT security or operational standards, its primary purpose is not the consistent application of all IT standards.

B. Mandatory systems development training. This is too narrow in scope. It only addresses standards within the systems development lifecycle and does not ensure consistency across other areas like infrastructure, operations, or data management.

C. Business case reviews by the steering committee. The steering committee's role is primarily strategic alignment, prioritization, and funding approval for new initiatives, not the detailed, ongoing enforcement of technical standards across the enterprise.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 2: IT Resources

Section 2.3

Enterprise Architecture. The manual states that EA provides a "holistic view of the current and future state of the enterprise" and includes "principles

policies and standards" that guide the design and implementation of IT solutions

thereby facilitating the enforcement of standards and ensuring consistency.

2. Ross

J. W.

Weill

P.

& Robertson

D. C. (2006). Enterprise Architecture as Strategy: Creating a Foundation for Business Execution. Harvard Business Review Press. Chapter 2

"The IT Engagement Model

" explains how EA defines the standards and integration requirements that ensure technology is implemented consistently to support the business's operating model.

3. Tamm

T.

Seddon

P. B.

Shanks

G.

& Reynolds

P. (2011). How does enterprise architecture add value to organisations? Communications of the Association for Information Systems

28(1)

10. This article discusses the benefits of EA

including "IT-related cost savings and avoidance" and "IT-related risk reduction

" which are achieved through standardization and consistent application of architectural principles. (DOI: https://doi.org/10.17705/1CAIS.02810)

The foundational and primary step in ensuring IT resources are aligned with enterprise objectives is to first determine the specific skills and competencies required to achieve those objectives. This strategic activity defines the "what" is needed. All subsequent actions, such as assessing current skills, developing training plans, or monitoring performance, are dependent on this initial definition. Without a clear understanding of the required competencies, any effort to manage or develop human resources would lack strategic direction and would be unlikely to effectively support the enterprise's goals.

B. Providing training to IT personnel is a reactive or corrective measure taken only after a gap between required and existing skills has been identified.

C. Developing an IT skills matrix is a tool used to assess and map current skills against the required competencies; therefore, the competencies must be defined first.

D. Monitoring resource performance is an ongoing evaluation activity that occurs after resources have been assigned roles, trained, and are executing their duties.

1. ISACA

COBIT® 2019 Framework: Governance and Management Objectives

2018.

Reference: Management Objective APO07

Managed Human Resources. Specifically

practice APO07.03

Maintain the skills and competencies of personnel

which includes the activity: "Define and manage skills and competencies required." This establishes that defining requirements is a core practice.

2. ISACA

CGEIT Review Manual

8th Edition

2020.

Reference: Domain 3: Resource Optimization

Task Statement 3.2

"Ensure that IT has sufficient

competent

and capable resources to support enterprise objectives." The underlying knowledge for this task (K3.2.2) includes "methods to identify IT resource requirements to support enterprise objectives

" reinforcing that identification of requirements is the initial step.

Change management is the structured approach to transitioning individuals, teams, and organizations from a current state to a desired future state. When deploying a new enterprise-wide tool, the primary challenge is not just the technical implementation but ensuring user adoption, minimizing resistance, and integrating the tool into business processes to realize its intended value. Change management directly addresses this "organizational impact" by focusing on communication, stakeholder engagement, training, and managing the human elements of the transition. This ensures the technology is not only deployed but also effectively embraced, which is a key responsibility of a CIO in delivering value.

B. project management: Project management focuses on the technical execution of the deployment—delivering the tool on time, within budget, and to scope—but does not primarily address the human and cultural adoption aspects.

C. risk management: While poor user adoption is a risk, risk management is a broader discipline. Change management is the specific set of practices used to mitigate the particular risks associated with organizational impact.

D. resource management: This discipline is concerned with the allocation and scheduling of assets (e.g., personnel, budget, equipment) for the project, not with managing the behavioral and procedural shifts across the organization.

1. ISACA

COBIT® 2019 Framework: Governance and Management Objectives

2018. The process BAI05 Managed Organizational Change is defined with the purpose to "Prepare and commit stakeholders for business change and reduce the risk of failure." It emphasizes activities such as communicating the desired vision

empowering role players

and embedding new approaches

which are all core to managing organizational impact. (Ref: COBIT 2019

BAI05

p. 135).

2. ISACA

CGEIT Review Manual

8th Edition. The manual emphasizes that for IT-enabled investments to deliver value

the resulting changes to business processes and employee roles must be managed effectively. Domain 4

"Value Optimization

" highlights that benefit realization is contingent on successful business change

which is the primary goal of change management. (Ref: CGEIT Review Manual

8th Ed.

Domain 4: Value Optimization).

3. Aladwani

A. M. (2001). Change management strategies for successful information system implementation. Business Process Management Journal

7(3)

266-275. This academic paper argues that overlooking the human and organizational aspects of IT implementation is a primary cause of failure. It posits that a systematic change management strategy is essential to manage resistance and ensure user acceptance

directly addressing the "organizational impact." (DOI: https://doi.org/10.1108/14637150110392764).

The primary purpose of implementing performance metrics for key IT assets is to quantify and demonstrate their contribution to achieving strategic objectives. In the context of IT governance, IT goals are designed to be in direct alignment with broader enterprise goals. Therefore, by measuring how an IT asset performs against metrics linked to IT goals, the organization can directly assess the asset's value and its role in fulfilling the business strategy. This linkage is the cornerstone of value optimization, a core domain of CGEIT, making it the greatest benefit.

A. Span of control is an organizational management principle concerning reporting structures, which is not the primary purpose or benefit of implementing asset performance metrics.

B. While metrics can help determine the cost of controls, this is a narrow financial aspect and does not represent the overall strategic value or contribution of the asset.

C. Comparing performance against industry best practices (benchmarking) is a useful activity, but it is secondary to ensuring that assets are contributing to the organization's own specific goals.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4

"Value Optimization

" Task Statement 4.2

emphasizes the need to "Monitor the value

outcomes

and benefits of IT investments... to ensure that the contribution of IT to the business is optimized." This directly supports that the greatest benefit is determining the contribution of IT assets (part of IT investments) to achieving goals.

2. ISACA

COBIT 2019 Framework: Introduction and Methodology. Page 31 introduces the "COBIT Goals Cascade." This core concept illustrates how enterprise goals cascade down to IT-related "Alignment Goals

" which are then supported by governance and management objectives. Metrics are used at each level to measure achievement

directly linking the performance of IT components (assets) to goal attainment.

3. De Haes

S.

& Van Grembergen

W. (2009). An Exploratory Study into IT Governance Implementations and its Impact on Business/IT Alignment. Information Systems Management

26(2)

123-137. This academic publication discusses the use of frameworks like COBIT to achieve business/IT alignment. It highlights that performance measurement systems

such as the balanced scorecard

are critical for translating strategy into action and measuring the contribution of IT to business objectives (p. 126). DOI: https://doi.org/10.1080/10580530902794786

The primary and most foundational step in implementing IT governance, particularly in a small and newly established organization, is to assign clear roles and responsibilities. This establishes the organizational structure, accountability, and authority necessary for all other governance activities. Without a defined structure of who is responsible for making decisions, providing oversight, and executing tasks, any subsequent efforts such as budgeting, defining methodologies, or approving standards will lack direction and authority. This initial step ensures that there is a clear framework for accountability, which is the cornerstone of effective governance.

A. Assigning a budget for IT governance applications.

This is a supporting activity. A budget can only be effectively assigned after the governance structure, needs, and responsible parties have been identified.

B. Defining IT project management methodology.

This is a specific IT management process. Establishing the overarching governance roles that will oversee and approve such methodologies must come first.

C. Approving enterprise architecture (EA) and standards.

Approval of EA requires an established governance body or individuals with the designated authority, which is defined by assigning roles and responsibilities.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 1: Governance Framework

Task 1.3

"Establish roles

responsibilities and accountabilities for information and technology

" is listed as a key task in establishing the governance framework. This task is foundational to ensuring that the governance system is operational and that accountability is clear.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The governance objective EDM01

"Ensured Governance Framework Setting and Maintenance

" explicitly includes the key activity of defining and implementing organizational structures

roles

and responsibilities. This is presented as a fundamental component for directing and monitoring the enterprise's governance system for I&T. (p. 36).

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value

Featuring COBIT 5. Springer International Publishing. Chapter 3

"Implementing Enterprise Governance of IT

" emphasizes that the first phase of implementation involves creating the right environment

which includes defining principles

structures

and roles and responsibilities to get buy-in and establish a foundation for the program. (pp. 85-87). DOI: 10.1007/978-3-319-14547-1.

An information classification framework is the most effective tool for standardizing how sensitive corporate data is handled. This framework establishes categories for data based on its level of sensitivity, criticality, and value to the enterprise (e.g., Public, Internal, Confidential, Restricted). For each category, it defines specific, mandatory handling procedures for creation, storage, transmission, and destruction. This ensures that data is protected consistently and appropriately across the enterprise, directly fulfilling the objective of standardization. The framework provides the granular, actionable rules needed to implement the high-level goals of security and risk policies.

B. Enterprise risk policy: This is a high-level document that states the organization's overall intent and direction for managing risk; it does not provide specific, standardized data handling procedures.

C. Enterprise risk management (ERM) framework: An ERM framework provides a broad structure to identify and manage all types of enterprise risks, but it is not the specific tool for standardizing data handling rules.

D. Information security policy: While this policy mandates the protection of information, the classification framework is the specific component within it that operationalizes and standardizes how different types of data are handled.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 4: Information Resources Optimization

Task Statement 4.02

states the need to "Ensure that information/data is classified in terms of criticality and sensitivity." The supporting text explains that this classification is essential to determine the required level of protection and appropriate handling procedures.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). Management Objective APO14

Managed Data

Practice APO14.02

"Define and implement a data classification scheme." The description states that this practice is necessary to "ensure that data is handled (e.g.

stored

archived

destroyed

accessed) according to its classification." This directly links classification to standardized handling.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). Management Objective APO14

Managed Data

Practice APO14.03

"Manage the data life cycle." This practice explicitly requires enterprises to "Define and implement procedures for data handling

including labeling

handling

storage

retention

retrieval and secure disposal

according to classification."

The "Three Lines of Defense" model is a fundamental concept in enterprise governance and risk management. The second line of defense consists of functions that oversee risk, such as risk management and compliance. Its primary role is to provide independent oversight of the first line (operational management) by establishing risk management frameworks and monitoring the adequacy and effectiveness of the first line's risk management activities and controls. This monitoring ensures that risks are being managed in accordance with the organization's risk appetite and policies.

A. Conducting internal and external audits: This is the primary responsibility of the third line of defense (internal audit) and external auditors, who provide independent and objective assurance on the overall effectiveness of governance, risk management, and controls.

B. Implementing controls to manage risk: This is a core function of the first line of defense. Operational management owns the risks and is directly responsible for implementing and maintaining controls to mitigate them.

D. Identifying and assessing risk: This is primarily a first-line-of-defense activity. Those who own the processes and systems are best positioned to identify and assess the associated risks on a day-to-day basis.

1. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 2: IT Risk Management

Section 2.4

discusses roles and responsibilities

aligning with the three lines model where the second line provides oversight and monitoring of risk management practices implemented by the first line.

2. The Institute of Internal Auditors (IIA)

The Three Lines of Defense in Effective Risk Management and Control

January 2013

Page 4. "The second line of defense...functions that oversee or specialize in risk management

compliance...These functions...monitor and facilitate the implementation of effective risk management practices by operational management and assist the risk owners in reporting relevant risk information up and down the organization."

3. COSO

Enterprise Risk Management—Integrating with Strategy and Performance

June 2017

Page 87. The framework discusses governance and culture

noting that risk management functions (a second line) "assist management in developing and monitoring risk management processes."

The board's primary role in the governance of enterprise IT (GEIT) is to provide direction and oversight, not to perform operational risk analysis. Upon being informed of potential cyberthreats, the board's immediate and most appropriate next action is to direct executive management to assess the situation. Engaging the Chief Information Officer (CIO) to evaluate the risk ensures that the threats are properly analyzed by the accountable party. This evaluation will provide the board with the necessary information to make informed strategic decisions regarding risk appetite, tolerance, and the adequacy of response plans.

A. Evaluate the security incident response process: This is a reactive measure. The board first needs to understand the nature and potential impact of the specific threats before evaluating the process designed to handle them.

B. Reevaluate the risk tolerance of the organization: Reevaluating risk tolerance is a significant strategic activity that should be based on a formal risk assessment, not just the initial notification of possible threats.

C. Ask the CIO to report on a risk response: A risk response can only be formulated after the risk has been properly identified and evaluated. Asking for a response plan is premature.

1. ISACA

CGEIT Review Manual

8th Edition (2020): Domain 4

Risk Optimization

Task 4.2

states the board's role is to "Ensure that IT risk is identified

analyzed

mitigated

managed

monitored and communicated." The board fulfills this by directing management (such as the CIO) to perform the analysis (evaluation) as the initial step in the process.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018): The governance objective EDM03

Ensure Risk Optimization

outlines the board's role. Practice EDM03.02

"Direct risk management

" involves directing the establishment of key risk indicators and risk profiles. This directive function begins by tasking management with evaluating new

potential risks to inform the board.

3. ISACA

COBIT 2019 Framework: Introduction and Methodology (2018): The COBIT Core Model distinguishes between governance and management. Governance bodies (the board) evaluate

direct

and monitor (EDM). Management plans

builds

runs

and monitors (PBRM). Therefore

the board directs management (the CIO) to perform the evaluation. (p. 31

Figure 4.1).

The primary purpose of IT governance is to ensure that the use of IT generates business value and that IT investments are aligned with business strategy. Effective IT governance is ultimately measured by its outcomes, not its components. Business value and customer satisfaction are direct measures of how well IT is meeting enterprise goals and stakeholder needs. They represent the successful realization of benefits, which is a core objective of any governance framework. The other options represent important enablers or processes within governance, but they are not the ultimate evidence of its effectiveness.

A. Cost savings and human resource optimization: These are measures of resource optimization and operational efficiency. While important, they are means to an end, not the ultimate goal of strategic value creation.

C. IT risk identification and mitigation: This represents the risk optimization domain of IT governance. It is a critical function that supports value creation but is not, by itself, the best evidence of overall effectiveness.

D. Comprehensive IT policies and procedures: These are foundational enablers of a governance system. Their existence indicates a framework is in place, but it does not prove the framework is effective in delivering business value.

1. ISACA

COBIT 2019 Framework: Introduction and Methodology. Chapter 4

"The COBIT Goals Cascade

" pp. 23-27. The framework explicitly states that governance begins with stakeholder needs (e.g.

customer satisfaction) and cascades to enterprise goals

which are centered on benefits realization and value creation.

2. ISACA

CGEIT Review Manual

8th Edition. Domain 1: Governance of Enterprise IT

Section A

"Governance Framework." This section emphasizes that the purpose of a governance framework is to ensure that stakeholder needs are evaluated to determine enterprise objectives

with the primary outcomes being value creation through benefits realization

risk optimization

and resource optimization. Business value is the paramount objective.

3. De Haes

S.

& Van Grembergen

W. (2009). An exploratory study into IT governance implementations and its impact on business/IT alignment. Information Systems Management

26(2)

123-137. This academic study reinforces that the impact of IT governance is measured through improved business/IT alignment

which is directly linked to the creation of business value and meeting strategic objectives. (DOI: https://doi.org/10.1080/10580530902794786)

The problem identified is a systemic failure—a "declining" quality of code and the introduction of security flaws through "updates." This points to a breakdown in the process that governs how software changes are developed, tested, and deployed. The change management control framework is the overarching governance structure that defines these processes. Therefore, the most appropriate and logical first governance action is to review this entire framework to identify the specific control weaknesses that allowed the flawed code to be released. This top-down review will help determine if the issue lies in development standards, security testing requirements, code review mandates, or approval processes.

A. compliance with the user testing process.

This is too narrow. The security flaws may originate in development or be of a nature that user acceptance testing (UAT) is not designed to detect, making this an incomplete first step.

C. the qualifications of developers to write secure code.

While developer skill is a factor, a systemic decline suggests a process failure rather than a sudden, universal drop in competency. This is a management-level concern, secondary to the governance framework review.

D. the incident response plan.

This plan is for reacting to incidents, not preventing their root cause. The incident has already occurred and been analyzed; the focus now must shift to prevention and correction of the underlying process failure.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4: Risk Optimization

Task Statement R1.4

emphasizes the need to "Evaluate the enterprise's IT risk management policies

standards and processes for effectiveness and recommend improvements." The scenario describes a risk (security flaws) materializing due to process failure. Reviewing the change management framework is a direct evaluation of a key process to manage this risk.

2. ISACA

COBIT® 2019 Framework: Governance and Management Objectives. The management objective BAI06 Managed Changes states its purpose is to "enable fast and reliable delivery of change to the business... while mitigating the risk of negatively impacting the stability or integrity of the changed environment." The described security breach is a direct failure of this objective

making a review of the associated controls and framework the primary corrective action.

3. ISACA

COBIT® 2019 Framework: Governance and Management Objectives. The governance objective EDM03 Ensured Risk Optimization includes the practice EDM03.02 "Direct Risk Management

" which involves directing the establishment of risk management practices. When these practices fail

as in the scenario

the governing body's first action is to review and direct improvement of the failed process framework (i.e.

change management).