Cisa: It Governance And Management

Front 1

IT Governance

Back 1

a collection of top-down activities intended to control the IT organization from a strategic perspective to ensure that the IT organization supports the business.
- policy, priorities, standards, vendor management, program and project management

Front 2

COBIT

Back 2

Control Objectives for Information and related Technoloy

Front 3

ISO 27001

Back 3

well-known international standard for top-down information security management

Front 4

ITIL

Back 4

IT Infrastructure Library.
ITIL is a framework process for IT service delivery

Front 5

ISO 38500

Back 5

an international standard on corporate governance of information technology, suitable for small and large organizations in the public or private sector

Front 6

The Balanced Scorecard (BSC)

Back 6

management tool that is used to measure the performance and effectiveness of an organization.
key measurements: financial, customer, internal process, innovation and learning

Front 7

The Standard IT Balanced Scorecard (IT-BSC)

Back 7

can be used to specifically measure IT organization performance and results.
key measurements: business contribution, user, operational excellence, innovation

Front 8

Security governance

Back 8

The collection of management activities that establishes key roles and responsibilities, identifies and treats risks to key assets, and measures key security processes.
May be included on its own, or can be included into IT governance.
main roles: board of directors, steering committee, Chief information security officer (CISO), management, all employees.

Front 9

Enterprise Architecture (EA)

Back 9

Both a business function and technical model.
- Business function: the establishment of an EA consists of activities that ensure that important business needs are met by IT systems.
- Construction of a model that is used to map business functions into the IT environment and IT systems in increasing levels of detail so that IT professionals can more easily understand the organization's technology architecture at any level.

Front 10

The Zachman Model

Back 10

- Dominant Enterprise Architecture (EA) standard today
- IT systems and environments are described at a high, functional level, and then in increasing detail, encompassing systems, databases, applications, networks, and so on.
- The model allows an organization to peer into cross-sections on an IT environment that supports business processes, but it does not convey the relationship between IT systems.

Front 11

Data Flow Diagrams (DFDs)

Back 11

- Frequently used to illustrate the flow of information between IT applications
- Can begin as a high-level diagram, where the labels of information flows are expressed in business terms.
- DFDs permit nontechnical business executives to easily understand the various IT applications and relations between them

Front 12

Strategic planning

Back 12

Activities used to develop and refine long term plans and objectives.
- The ability to provide the capability and capacity for IT services that will match the levels on and the types of business activities that the organization expects to achieve at certain points in the future.

Front 13

IT steering committee

Back 13

A body of senior managers or executives that discusses high level and long-term issues in the organization.
- The committee's mission objectives, roles, and responsibilities should be formally defined in a written charter.

Front 14

Policy

Back 14

A statement that specifies what must be done (or not to be done) in an organization. They should not state how something must be done (or not done). It usually defines who is responsible for monitoring and enforcing it.

Front 15

Policies, processes, procedures, and standards

Back 15

- Define IT organizational behavior and uses of technology.
- They are part of the written record that defines how the IT organization performs the services that support the organization.

Front 16

Information security policy

Back 16

A statement that defines how an organization will classify and protect its important assets.

Front 17

Privacy policy

Back 17

A policy statement that defines how an organization will protect, manage, and handle private information.

Front 18

Data classification policy

Back 18

A policy that defines sensitivity levels and handling procedures for information.

Front 19

System classification policy

Back 19

A policy that specifies specific levels of security for systems storing classified information

Front 20

Site classification policy

Back 20

A policy that defines sensitivity levels, security controls, and security procedures for information processing sites and work centers.

Front 21

Access control policy

Back 21

A statement that defines the policy for the granting, review, and revocation of access to systems and work areas.

Front 22

process/procedure

Back 22

- A collection of one or more procedures used to perform a business function
- A written sequence of instructions to complete a task.

Front 23

Standard

Back 23

A statement that defines the technologies, protocols, suppliers, and methods used by an IT organization

Front 24

Risk management

Back 24

The management activities used to identify, analyze, and treat risks

Front 25

Charter

Back 25

a formal document that defines and describes a business program, and becomes part of the organization's record

Front 26

Risk analysis

Back 26

- The process of identifying and studying risks in an organization
- A risk consists of the intersection of threats, vulnerabilities, and impact
Risk is described by the formula;
Risk = Probability x Impact

Front 27

Threat

Back 27

an event, if realized, would bring harm to an asset

Front 28

Vulnerability

Back 28

a weakness or absence of a protective control that makes the probability of one or more threats more likely

Front 29

Vulnerability Analysis

Back 29

an examination of an asset in order to discover weaknesses that could lead to a higher-than-normal rate of occurrence or potency of a threat.

Front 30

Qualitative Risk Analysis

Back 30

An in-depth examination of in-scope assets with a detailed study of threats (and their probability of occurrence), vulnerabilities (and their severity), and statements of impact.

Front 31

Quantitative Risk Analysis

Back 31

A risk analysis approach that uses numeric methods to measure risk

Front 32

Asset value (AV)

Back 32

the value of the asset, which is usually (but not necessarily) the asset's replacement value

Front 33

Exposure factor (EF)

Back 33

This is the financial loss that results from the realization of a threat, expressed as a percentage of the assets total value. It will vary by threat.

Front 34

Single loss expectancy (SLE)

Back 34

This value represents the financial loss when a threat is realized one time.
It will vary by threat.
Defined as AV x EF

Front 35

Annualized rate of occurrence (ARO)

Back 35

This is an estimate of the number of times that a threat will occur per year. It will vary by threat.

Front 36

baselined

Back 36

the existing asset, threats, and controls have been analyzed to understand the threats as they exist right now

Front 37

Disaster Recovery Planning (DRP) and Business Continuity Planning (BCP)

Back 37

Both utilize risk analysis to identify risks that are related to application resilience and the impact of disasters

Front 38

High-impact events

Back 38

These events, which may be significant enough to threaten the very viability of the organization, require risk treatment that belongs in the categories of business continuity planning and disaster recovery planning.

Front 39

Risk treatment

Back 39

The decision to manage an identified risk. The available choices are mitigate risk, avoid risk, transfer the risk, or accept the risk

Front 40

Risk mitigation

Back 40

the risk treatment option involving implementation of a solution that will reduce an identified risk

Front 41

Risk trasnfer

Back 41

The risk treatment option involving the act of transferring risk to an other party, such as an insurance company

Front 42

Risk avoidance

Back 42

The risk treatment option involving a cessation of the activity that introduces identified risk

Front 43

Risk acceptance

Back 43

The risk treatment option where management chooses to accept the risk as-is

Front 44

Residual risk

Back 44

the risk that remains after being reduced through other risk treatment options

Front 45

Insourcing

Back 45

the practice of hiring employees for long-term work