Helping Hand Questions for CGEIT

This should be identified first when creating an inventory of information systems and data related to the mobile app, as they are the individuals or groups who have the authority and responsibility to define, classify, protect, and manage the data assets of the enterprise1. By identifying the application and data owners, the enterprise can ensure that the data is properly accounted for, categorized, and secured according to its value, sensitivity, and risk. Application and data owners can also establish data policies, standards, and procedures, as well as monitor and report on data quality, usage, and compliance1. Identifying the application and data owners is a prerequisite for identifying the other options, such as data maintained by vendors, vendors and outsourced systems, and information classification scheme, as these depend on the accurate identification and assignment of data ownership roles and responsibilities.

Communicating the objectives and responsibilities to staff is the BEST way to demonstrate senior management’s commitment to IT governance. IT governance is the process of ensuring that IT supports the achievement of the organization’s goals and objectives, and delivers value to its stakeholders1. IT governance involves aligning the IT strategy, policies, processes, and resources with the business strategy, needs, and expectations2. However, implementing and sustaining IT governance requires a significant amount of change in the organization, such as introducing new technologies, standards, roles, and responsibilities3. Therefore, communicating the objectives and responsibilities to staff is essential for demonstrating senior management’s commitment to IT governance, as it can:

• Provide the direction and mandate for the IT governance initiative on an ongoing basis
• Communicate the vision, mission, goals, and objectives of the IT function to all stakeholders
• Allocate the necessary resources and capabilities to enable the IT governance processes and activities
• Monitor and evaluate the performance and outcomes of the IT function and provide feedback and recognition
• Foster a positive and collaborative culture that values IT as a strategic partner and enabler of the business

The other options are not as good as option C. While it is important to communicate the legal and regulatory requirements, the approved IT investment opportunities, and the need for enterprise architecture (EA), these are not sufficient to demonstrate senior management’s commitment to IT governance. They are rather means to achieve the end goal of implementing and sustaining IT governance. They do not necessarily reflect the level of commitment, involvement, and support from the management toward IT governance. References :=

• What is IT Governance? Definition & Examples | ASQ2
• What is IT governance? A formal way to align IT & business strategy1
• How to Involve Senior Management in the Information Security Governance …3

 Senior management regularly reviewing the IT portfolio is the best IT governance practice to support IT and enterprise strategic alignment, because it helps to ensure that the IT investments are aligned with the business strategy and goals, and that they deliver value to the enterprise. An IT portfolio is a collection of IT projects, programs, services, and assets that support the business objectives and processes of an organization1. Senior management regularly reviewing the IT portfolio helps to prioritize, monitor, and evaluate the IT investments based on their performance, benefits, costs, and risks2. It also helps to identify and address any gaps, issues, or opportunities for improvement in the IT portfolio2. Senior management regularly reviewing the IT portfolio also helps to communicate and collaborate with the IT department and other stakeholders, and to provide guidance and direction for the IT strategy and governance2.

References := IT Portfolio Management: A Simplified Guide | Planview, IT Governance – How to align IT and business strategy?

Information ownership is the assignment of roles and responsibilities for data protection to individuals or groups within the organization. Information owners are accountable for ensuring that data is properly classified, secured, and used in accordance with the organization’s policies and standards. Information ownership facilitates governance oversight of data protection measures by providing clear lines of authority and accountability for data assets. References:

• ISACA CGEIT Review Manual 2021, page 86: “Information ownership is the assignment of roles and responsibilities for the protection of information to individuals or groups within the enterprise.”
• ISACA CGEIT Review Questions, Answers & Explanations Manual 2021, page 11, question 14: “The correct answer is A. Information ownership is the assignment of roles and responsibilities for the protection of information to individuals or groups within the enterprise. Information owners are accountable for ensuring that information is properly classified, secured, and used in accordance with the enterprise’s policies and standards. Information ownership facilitates governance oversight of data protection measures by providing clear lines of authority and accountability for information assets.”