CGEIT Leak Questions

 Storing customer data in an offshore cloud service provider may pose legal and regulatory risks for the enterprise, such as data protection, privacy, and sovereignty issues. The CIO should consider the compliance requirements of the applicable legislation in both the home and host countries before making this decision. References :=

CGEIT Review Manual (Digital Version), Chapter 5: Risk Optimization, Section 5.2: IT Risk Management, Subsection 5.2.3: IT Risk Identification, Page 163

CGEIT Review Manual (Print Version), Chapter 5: Risk Optimization, Section 5.2: IT Risk Management, Subsection 5.2.3: IT Risk Identification, Page 163

 The FIRST step when defining responsibilities for ownership of information and systems is to require an inventory of information assets. An information asset is any data, device, or other component of the environment that supports information-related activities1. An inventory of information assets is a comprehensive list of all the information assets that an organization owns, controls, or uses2. By creating an inventory of information assets, an organization can:

Identify the types, locations, formats, and volumes of information assets3

Determine the value, sensitivity, and criticality of information assets4

Assign ownership and accountability for information assets5

Establish appropriate security controls and protection measures for information assets6

Monitor and audit the usage and lifecycle of information assets7

The other options are not as important as option D. While it is important to require an information risk assessment, identify systems that are outsourced, and ensure information is classified, these are subsequent steps that depend on the availability and accuracy of the inventory of information assets. Without an inventory of information assets, it would be difficult to perform a risk assessment, identify outsourced systems, or classify information according to its value and sensitivity. References :=

Information Asset - an overview | ScienceDirect Topics1

Information Asset Inventory - NIST CSRC2

How to Create an Information Asset Inventory - Infosec Resources3

Information Asset Valuation: A Methodology - ISACA4

Data Ownership: Considerations for Risk Management - ISACA5

Information Asset Protection - NIST CSRC6

Information Asset Management - NIST CSRC7

According to the web search results, projects where management has a choice in implementing them are called discretionary projects. Projects where no choice exists are called nondiscretionary projects1. Compliance with statutory regulations is a nondiscretionary project, as it is required by law and cannot be avoided or postponed. The other options are discretionary projects, as they are based on the management’s decision and preference, and can be prioritized or delayed according to the business needs and goals. References: CGEIT Certification, CIO Dashboard, Answers

Business ethics is the study of appropriate business policies and practices regarding potentially controversial subjects, such as corporate governance, insider trading, bribery, discrimination, corporate social responsibility, fiduciary responsibilities, and much more1. The most important aspect of business ethics is to protect the interests of the stakeholders, who are the individuals or groups that have a stake in the success or failure of a business. Stakeholders include shareholders, customers, employees, suppliers, regulators, and the society at large. By protecting stakeholders’ interests, a business can ensure its long-term viability, reputation, and profitability. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 1: Governance of Enterprise IT, Section 1.1: IT Governance Frameworks and Principles, Subsection 1.1.2: IT Governance Principles, Page 14-15. Business Ethics: Definition, Principles, Why They’re Important.