CGEIT Dumps with Practice Exam Questions Answers

An enterprise code of ethics is a set of principles and values that guide the behavior and decision-making of the organization and its members. It can help to incorporate desired organizational behaviors into the IT governance framework by establishing a common understanding and expectation of what is acceptable and unacceptable, and by promoting a culture of integrity, accountability, and responsibility. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 17.

Enterprise architecture (EA) is the best option to support the planning of IT investments required for the enterprise, because EA is a practice and a discipline that describes and documents the current and future state of the enterprise’s business processes, applications, data, infrastructure, and security, and how they align with the enterprise’s vision, mission, goals, and objectives. EA can help the enterprise to plan IT investments by providing a holistic view of the enterprise’s IT architecture, identifying the gaps, needs, and opportunities for improvement, innovation, or transformation, and prioritizing and selecting the IT projects, programs, and portfolios that deliver the most value to the stakeholders and customers. According to ISACA’s CGEIT Domain 2: IT Resources1, “EA is a key enabler for IT investment planning and decision making. EA helps to ensure that IT investments are aligned with business strategy and support business outcomes.” Furthermore, according to ISACA’s article on EA2, “EA can help to optimize IT spending by reducing complexity, duplication, and waste, and by increasing efficiency, agility, and interoperability.” Therefore, EA is the best way to support the planning of IT investments required for the enterprise.

 This should be the committee’s first recommendation, as it will help to identify and evaluate the potential threats, vulnerabilities, and impacts of using personal smartphones to conduct corporate business1. A risk assessment will also help to determine the appropriate controls and mitigation strategies to protect the corporate information and assets, as well as comply with the relevant regulations and standards1. The other options are not as important as performing a risk assessment, as they are dependent on the outcome of this step. Documenting procedures for securing personal devices, improving training courses on securing corporate information, and updating the corporate security policy to include personal devices are possible actions that may be taken after performing a risk assessment, based on the identified risks and their levels2.

 A RACI chart is a matrix that defines the roles and responsibilities of different stakeholders in a project or process. RACI stands for Responsible, Accountable, Consulted and Informed. A RACI chart can help ensure that key activities are performed by appropriate resources by clarifying who is responsible for doing the work, who is accountable for the outcome, who needs to be consulted for input or feedback, and who needs to be informed of the progress or results. References: ISACA, Reporting Cybersecurity Risk to the Board of Directors, page 8.

To develop appropriate measures to improve organizational performance, the measures must be accepted by and meaningful to the stakeholders, because they are the ones who will use the measures to monitor and evaluate the achievement of the enterprise’s objectives and goals. Themeasures should be relevant, reliable, valid, and understandable for the stakeholders, and aligned with their expectations and needs . References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 43-44.