CGEIT Exam Results

A data governance framework is a set of policies, standards, roles, and processes that define how data is collected, stored, accessed, and used within an enterprise. A data governance framework can help address data protection and least privilege issues by establishing clear rules and responsibilities for data owners, custodians, and users. A data governance framework can also enable data encryption as a key control to protect sensitive data from unauthorized access or disclosure. Therefore, mandating the creation of a data governance framework is the best approach to ensure all business units work toward remediating these issues. References: : CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3: IT Risk Management, Subsection 4.3.2: IT Risk Management Process, Page 156 : CGEIT Review Manual (Digital Version), Chapter 5: Resource Optimization, Section 5.2: Information Resource Management, Subsection 5.2.1: Information Resource Management Overview, Page 183 : A Guide to Selecting and Adopting a Privacy Framework1

Identifying gaps in information asset protection should be the first high-level initiative for a newly created IT strategy committee in order to support the business goal of making IT security a priority. This initiative would help to assess the current state of IT security, identify the risks and vulnerabilities that may compromise the confidentiality, integrity, and availability of information assets, and determine the actions and resources needed to address them. The other options are not as high-level, as they are more related to the implementation or execution of IT security, rather than the planning or direction of it. References: : CGEIT Review Manual (Digital Version), Chapter 1: Governance of Enterprise IT, Section 1.3: Strategic Management, Subsection 1.3.2: Strategic Management Process, Page 23 : CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3: IT Risk Management, Subsection 4.3.2: IT Risk Management Process, Page 156 : CGEIT Review Manual (Digital Version), Chapter 5: Resource Optimization, Section 5.3: Security Resource Management, Subsection 5.3.1: Security Resource Management Overview, Page 192 : What is CGEIT? A certification for seasoned IT governance professionals1

 A process maturity framework and documented procedures are primary factors in ensuring the success of an enterprise quality assurance program because they provide a clear and consistent way of measuring, monitoring, and improving the quality of the processes and products. A process maturity framework, such as the Capability Maturity Model Integration (CMMI), defines the levels of maturity and the best practices for each level. Documented procedures, such as standard operating procedures (SOPs), define the steps, roles, responsibilities, and tools for each process. These factors help to ensure that the quality assurance program is aligned with the business objectives, customer expectations, and industry standards. 

 The best way to demonstrate that IT strategy supports a new enterprise strategy is to map IT programs to business goals. This will show how IT initiatives are aligned with and contribute to the achievement of the enterprise vision, mission, and objectives. Mapping IT programs to business goals will also help to prioritize, monitor, and evaluate the performance and value of IT investments