Isaca Updated CGEIT Exam Questions and Answers by dillon

Organizational responsibility for IT risk management is a critical factor for the success of the program. Without clear roles and responsibilities, the program may lack accountability, coordination, communication and alignment with the business objectives. The other options are not as concerning as option A, because they do not affect the core of the program. Having risk management-related certifications is desirable, but not mandatory, for the IT risk management team. Monitoring only a few key risk indicators (KRIs) is acceptable, as long as they are relevant and meaningful for the program. Retaining IT risk training records is important, but not essential, for the program effectiveness. References := ISACA, CGEIT Review Manual, 7th Edition, Chapter 3: Benefits Realization, Section 3.2: IT Risk Management, p. 113-114.

 The frequency of IT services risk profile updates is a metric that measures how often the IT organization assesses and updates the risks associated with its services. This metric is useful to ensure that IT services meet business requirements, as it helps to identify and mitigate potential threats and vulnerabilities that could affect the availability, performance, reliability, and security of the services. A high frequency of IT services risk profile updates indicates that the IT organization is proactive and responsive to changing business needs and expectations. A low frequency of IT services risk profile updates suggests that the IT organization is reactive and complacent, and may not be aware of or prepared for emerging risks that could impact the business. References := Performance Measurement Metrics for IT Governance - ISACA, The 8 IT service management metrics that matter most

An effective information governance model is best indicated when senior management ensures that quality goals are defined for information. This top-down approach demonstrates a commitment to managing information as a strategic asset, with clear quality objectives that align with business goals. It ensures accountability and sets the tone for information governance practices across the organization. While the roles of the CIO, enterprise architects, and process owners are important, the involvement of senior management in defining quality goals is a key indicator of an effective governance model.

To address concerns about staff saving sensitive corporate information on publicly available cloud file storage applications, the first step should be to require staff training on data classification policies. Educating employees about the types of data classified as sensitive and the associated handling requirements helps to raise awareness and change behavior. Training should emphasize the importance of protecting sensitive information and the proper use of approved storage solutions. While creating secure storage solutions, blocking access to certain applications, and revising policies are important measures, education and awareness are fundamental first steps to ensure compliance and mitigate risks.