Isaca Certification CGEIT Reddit Questions

The best way to provide the board with an indication of progress of the IT initiatives is to conduct a portfolio management review. A portfolio management review is a process that involves evaluating and reporting on the performance, status, and outcomes of the IT projects, programs, and services that are part of the IT portfolio. The IT portfolio is a collection of IT investments that are aligned with the enterprise’s strategic objectives and expected to produce substantial value. A portfolio management review can help the board to assess and communicate the progress of the IT initiatives, as well as to identify and address any issues or risks that may affect their success. A portfolio management review can also help the board to ensure that the IT portfolio is balanced, optimized, and aligned with the business needs and priorities. IT Portfolio Management: A Comprehensive Guide | Smartsheet provides an overview of IT portfolio management and its benefits.

 Change control procedures are a set of steps that ensure that any changes to a system, product, project, or document are authorized, documented, and tracked. Change control procedures help to maintain the quality, integrity, and security of the system or product, as well as to comply with relevant standards and regulations. By enforcing change control procedures, the enterprise can prevent unauthorized or undocumented updates that could compromise the functionality, performance, or reliability of the applications. References :=

What is a change control procedure? With benefits and steps

What is a change control process? Steps and template

Change Control | Risk Management & Audit Services - Harvard University

 IT governance is the process of ensuring that IT supports and enables the achievement of the enterprise’s goals and objectives, and delivers value to the stakeholders1. Stakeholders are the individuals or groups that have a stake in the success or failure of IT governance, such as board members, senior management, business units, IT function, customers, suppliers, regulators, and society1. By considering stakeholders’ support, an enterprise can ensure that the IT governance framework is aligned with and driven by the stakeholders’ needs, expectations, and interests1. Stakeholders’ support can also help to facilitate the communication, collaboration, and decision-making processes among the IT governance participants, and to gain their commitment and buy-in for the IT governance implementation and improvement1.

The other options are not as important as stakeholders’ support, as they are either specific aspects or outcomes of IT governance, but not comprehensive factors. Information technology risk is the potential for negative consequences due to the use or misuse of IT within an enterprise. Information technology risk can affect the IT governance framework, but it is not the most important factor to consider, as it is only one of the many elements that influence ITgovernance2. Framework development cost is the amount of money and resources required to design and implement the IT governance framework. Framework development cost can affect the IT governance framework, but it is not the most important factor to consider, as it is only one of the many criteria that evaluate IT governance3. Information technology strategy is the plan that defines how the IT function supports and enables the overall business strategy and objectives of an enterprise. Information technology strategy can affect the IT governance framework, but it is not the most important factor to consider, as it is only one of the many components that constitute IT governance

because this would help the enterprise to comply with privacy laws and regulations by identifying and labeling the data according to its sensitivity, confidentiality, and protection requirements. Data classification can help the enterprise to apply the appropriate security controls, access rights, retention policies, and disposal methods for the data, and to prevent unauthorized or unlawful use, disclosure, or breach of the data12. Data classification can also help the enterprise to demonstrate its accountability and transparency for the data processing activities, and to meet the expectations and rights of the data subjects12.