PDF CGEIT Study Guide

A balanced scorecard is a tool that helps to measure and communicate the value of IT initiatives to the board of directors. It aligns IT objectives with business goals, tracks performance indicators, and shows the contribution of IT to the enterprise value. A balanced scorecard can also help to identify gaps and areas for improvement in IT governance. References := CGEIT Review Manual, 7th Edition, Chapter 3: Benefits Realization, Section 3.3: Value Delivery Frameworks and Mechanisms, pp. 103-105.

The best way to ensure that security risk is properly addressed when implementing an information security policy exception process is to confirm process owners’ acceptance of residual risk. Residual risk is the risk that remains after applying controls or mitigating measures to reduce the original risk1. Process owners are the individuals or groups that are responsible for the design, execution, and performance of a business process2. By confirming process owners’ acceptance of residual risk, the enterprise can ensure that the security risk associated with the policy exception is understood, acknowledged, and agreed upon by the relevant stakeholders. This can also help to assign accountability and liability for the potential consequences of the policy exception, as well as to monitor and review the risk level and the effectiveness of the controls or mitigating measures. The other options are not as effective as confirming process owners’ acceptance of residual risk for ensuring that security risk is properly addressed when implementing an information security policy exception process. Performing an internal and external network penetration test is a useful technique for identifying and exploiting vulnerabilities in the network infrastructure, but it does not address the specific security risk related to the policy exception. Obtaining IT security approval on security policy exceptions is a necessary step for validating and authorizing the policy exception, but it does not ensure that the process owners are aware of and accept the residual risk. Benchmarking policy against industry best practice is a good practice for comparing and improving the policy quality and performance, but it does not address the security risk associated with the policy exception.

The first thing that a new CIO should do to set the strategic direction for IT is to review the existing enterprise strategic objectives. The enterprise strategic objectives are the high-level goals and priorities that guide the organization’s vision, mission, and value creation. The CIO should understand the current state and desired state of the enterprise, as well as the opportunities, challenges, and risks that it faces. The CIO should also assess how IT supports and enables the enterprise strategic objectives, and identify any gaps, issues, or areas for improvement.

The other options are not the first thing that a new CIO should do to set the strategic direction for IT. Developing well-defined business cases that include strategic outcomes is part of the IT investment management process, which involves selecting, prioritizing, approving, and funding IT projects and initiatives that deliver value to the enterprise. Remapping stakeholder analysis and desired expectations is part of the stakeholder engagement process, which involves identifying, communicating, and managing the needs and expectations of the internal and external stakeholders of IT. Redesigning detailed RACI charts of the IT function is part of the IT organizational design process, which involves defining and assigning the roles, responsibilities, authorities, and accountabilities of the IT staff and units.

References:

• According to the CGEIT Review Manual 2022, "The first step in developing an IT strategy is to understand the enterprise strategy. This involves analyzing the enterprise vision, mission, goals, objectives, value drivers, critical success factors, and SWOT (strengths, weaknesses, opportunities and threats)."1
• According to the ISACA article on How to Develop an Effective IT Strategy2, “The first step in developing an effective IT strategy is to understand your organization’s business strategy. This will help you align your IT goals with your business goals and ensure that your IT investments support your business objectives.”
• According to the CIO article on How to create an effective IT strategy3, “The first step in creating an effective IT strategy is to understand what your business is trying to achieve. This means reviewing your business strategy and identifying the key drivers of value and competitive advantage for your organization.”

Integrating IT security policies into individual performance objectives is the best way to support the objective of driving a cultural shift to enhance compliance with IT security policies. This is because performance objectives are specific, measurable, achievable, relevant, and time-bound (SMART) goals that define what each employee is expected to accomplish and how they will be evaluated1. By integrating IT security policies into performance objectives, the enterprise can:

• Communicate the importance and value of IT security policies to each employee2
• Motivate and incentivize employees to comply with IT security policies2
• Monitor and measure employees’ compliance with IT security policies2
• Provide feedback and recognition to employees who comply with IT security policies2
• Identify and address any gaps or issues in employees’ compliance with IT security policies2

Integrating IT security policies into performance objectives can help to create a culture of accountability, responsibility, and awareness for IT security within the enterprise. It can also help to align the individual goals of employees with the organizational goals of IT governance.

The other options, communicating IT security policies on a regular basis, acknowledging and signing IT security policies by each employee, and centrally posting IT security policies with detailed instructions are not as effective as integrating IT security policies into performance objectives for supporting the objective of driving a cultural shift to enhance compliance with IT security policies. They are more related to the dissemination and implementation of IT security policies, rather than their integration and evaluation. They may not have a significant impact on the behavior and attitude of employees towards IT security policies, as they may not provide sufficient motivation, feedback, or recognition for compliance. They may also be perceived as passive, formal, or coercive methods of enforcing IT security policies, rather than active, informal, or collaborative methods of engaging employees in IT security policies. References := Performance Objectives - SMART Goals - BusinessBalls, How to Integrate Security Into Employee Performance Objectives, IT Security Policy: Key Components & Best Practices for Every Business …