Isaca Certification CGEIT Exam Questions and Answers PDF

Security and privacyare paramount when implementing IoT on a global scale. IoT devices often introduce vulnerabilities and handle sensitive data across diverse jurisdictions, making security controls and privacy compliance essential from the outset.

While staffing, cost, and integration are important,security and privacyrepresent the greatest strategic and reputational risk if not addressed early in the strategy.

This is because enterprise architecture (EA) is a practice that helps organizations align their IT systems and processes with their business objectives. EA provides a holistic and integrated viewof the current and future state of the organization’s IT infrastructure, as well as the gaps, issues, and opportunities for improvement1. By using EA, the organization can:

Identify and prioritize the IT investments that support the business strategy, goals, and needs1

Optimize the IT spending and maximize the IT value1

Ensure the IT quality, security, and compliance1

Avoid IT duplication, waste, and inefficiency1

Define IT roles and responsibilities and assign accountability1

EA can help the organization plan for the necessary IT investments in a systematic and structured way, and ensure that they are aligned with the business vision and value.

The other options, risk assessment report, business user satisfaction metrics, and audit findings are not as useful as enterprise architecture (EA) for planning for the necessary IT investments. They are more related to the evaluation and monitoring of the IT performance, rather than the planning and alignment of the IT strategy. They may also provide limited or partial information about the IT infrastructure, rather than a comprehensive and integrated view. They may also depend on external factors or standards that may not be relevant or applicable to the organization’s specific context and needs.

Engaging stakeholders in scenario developmentis essential to identifying relevant and realistic crisis events that the business continuity plan should address. Stakeholders bring diverse perspectives on potential threats and operational priorities, which improves the completeness and effectiveness of the BCP.

Walk-throughs and communication reviews are important later stages, butscenario development is foundationalfor making the BCP comprehensive.

Comprehensive and Detailed Explanation:

The CGEIT Review Manual 8th Edition, in its Governance of Enterprise IT domain, defines roles and responsibilities for information security. The data owner is accountable for ensuring the confidentiality, integrity, and availability (CIA) of information, as they have authority over specific data sets and define security requirements. For example, a data owner for customer data ensures access controls and data protection measures are in place. The manual likely references COBIT 2019’s APO14-Managed Data, which assigns CIA accountability to data owners.

Option B: Lead legal counsel advises on legal compliance, not CIA.

Option C: Risk manager oversees risk but not specific data accountability.

Option D: Data custodian implements controls but is not accountable for CIA.

Double Verification: The answer aligns with COBIT’s APO14 and the CGEIT domain’s focus on data roles. Data owner accountability is a standard ISACA principle.

ISACA CGEIT Review Manual 8th Edition, Domain 1: Governance of Enterprise IT (focus on data roles).

COBIT 2019, APO14-Managed Data.

ISACA Glossary (for definitions of data owner), available at