Isaca Updated CGEIT Exam Questions and Answers by august

The first course of action for the CIO of an enterprise to help plan for the possibility of ransomed corporate data should be to request a targeted risk assessment. This is because a targeted risk assessment can help to identify and evaluate the specific threats, vulnerabilities, and impacts of ransomware attacks on the enterprise’s data and systems. A targeted risk assessment can also help to determine the likelihood and severity of ransomware incidents, as well as the appropriate controls and mitigation strategies to reduce the risk to an acceptable level.

Requiring development of key risk indicators (KRIs) is not the first course of action, as it is a monitoring tool for measuring the risk exposure and performance. KRIs are metrics that provide information on the current level and trend of risk in relation to the risk appetite and tolerance of the enterprise. KRIs can help to track and report the progress and effectiveness of the risk management activities, as well as alert the management of any potential issues or changes that may affect the risk profile. However, requiring development of KRIs does not provide a comprehensive analysis or improvement plan for ransomed corporate data.

Developing a policy to address ransomware is not the first course of action, as it is a result of conducting a targeted risk assessment. A policy to address ransomware is a document that defines the rules, guidelines, and responsibilities for preventing, detecting, responding to, and recovering from ransomware attacks. Developing a policy to address ransomware can help to communicate the expectations and requirements for ransomware protection and compliance, as well as enforce accountability and governance for ransomware incidents. However, developing a policy to address ransomware does not provide a detailed assessment or guidance for ransomed corporate data.

Backing up corporate data to a secure location is not the first course of action, as it is an implementation step after conducting a targeted risk assessment and developing a policy to address ransomware. Backing up corporate data to a secure location can help to preserve the availability, integrity, and confidentiality of the data in case of a ransomware attack. Backing up corporate data to a secure location can also help to restore the data and resume normal operations after a ransomware attack. However, backing up corporate data to a secure location does not provide a thorough risk analysis or governance framework for ransomed corporate data.

References := Ransomware Risk Management: NISTIR 8374, 3 Risk Management Process section. Managing the Risks of Ransomware - SEI Blog, Assess Your Risk section. Ransomware Risk Management - NIST, 4 Ransomware Risk Management Profile section. NIST Releases Tips and Tactics for Dealing With Ransomware, Back Up Your Data section.

 Communicating the program to stakeholders to gain consensus is the first step after developing the scope of the IT governance program, as it helps to ensure that the program is aligned with the enterprise goals and objectives, and that it has the support and commitment of the key parties who have an interest or influence in the IT governance. Communication also helps to overcome resistance, address concerns, and foster collaboration among the stakeholders12. References := CGEIT Exam Content Outline, Domain 1, Subtopic A: Governance Framework, Task 3: Ensure that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives.

The best way for the IT director to address the concern of other departments about the outsourced services is to develop a comprehensive vendor management plan. A vendor management plan is a document that details how the IT director and the vendor will work together to achieve the objectives and expectations of the contract. A vendor management plan can include the following elements1:

Scope of work: This defines the services, deliverables, and outcomes that the vendor will provide, as well as the roles and responsibilities of both parties.

Service level agreements (SLAs): These specify the performance standards, metrics, and targets that the vendor will adhere to, as well as the penalties or rewards for meeting or exceeding them.

Operational level agreements (OLAs): These describe the internal processes and procedures that the IT director and the vendor will follow to support the SLAs, such as communication, escalation, reporting, and issue resolution.

Risk management: This identifies and assesses the potential risks that may affect the delivery of the outsourced services, such as security, compliance, quality, or continuity, and defines the mitigation strategies and contingency plans to address them.

Governance: This establishes the governance structure and mechanisms that will oversee and monitor the vendor relationship, such as steering committees, audits, reviews, and feedback.

A comprehensive vendor management plan can help to ensure that the outsourced services are delivered successfully by providing clarity, transparency, accountability, and alignment between the IT director and the vendor. It can also help to address the concerns of other departments by demonstrating that the IT director has taken adequate measures to manage and control the vendor performance and risk. Additionally, a vendor management plan can help to foster a collaborative and trusting relationship between the IT director and the vendor, which can lead to improved service quality, efficiency, and innovation.

1: 3 Steps to Improve Strategic Vendor Management

The most important consideration when defining an information architecture is access to and exchange of information. Information architecture (IA) is the process of guiding users through the site by organising and arranging all the relevant content in a clear, intuitive way1. The main purpose of IA is to help users find information and complete tasks2. To do this, IA needs to consider how users access and exchange information within the digital product or service, and how to make it easy, fast, and satisfying for them. Access to and exchange of information involves aspects such as:

Navigation systems: How users browse or move through information2. Navigation systems should be consistent, predictable, and visible, and should provide feedback and orientation cues to the users3.

Search systems: How users look for information2. Search systems should be accurate, relevant, and comprehensive, and should support different types of queries and filters4.

Labelling systems: How information is represented and classified2. Labelling systems should use clear, concise, and meaningful words that match the users’ expectations and vocabulary.

Information structure: How information is organised into categories, hierarchies, and relationships2. Information structure should reflect the users’ mental models and tasks, and should avoid unnecessary complexity or ambiguity.

By considering access to and exchange of information when defining an IA, the organization can ensure that the information assets are usable, findable, and accessible to the users, and that they support the user experience and the business goals. References: Information Architecture Basics | Usability.gov1, What is information architecture? - UX Design Institute2, Navigation Design Basics: Tips & Best Practices - Adobe XD Ideas3, Search System Design: Best Practices & Tips- Adobe XD Ideas4, Labeling Systems: An Introduction to Information Architecture - Boxes …, Information Architecture 101: Techniques and Best Practices - Adobe …