CISA Section 2

The system by which business corporations are directed and controlled. Set of responsibilities used by management to provide strategic direction.

Stewardship of IT resources on behalf of the stakeholders. Directs IT to ensure that IT performance meets the objectives of aligning IT with the enterprise's objectives.

• How enterprise governance and GEIT are aligned
• Alignment of the IS function w/ the org's mission, vision, values, obj and strategies
• Achievement of performance obj
• Legal, environmental, etc requirements
• Control environment of org
• IR w/in the IS env
• IT invest/expenditure

• Mission
• Strategies
• Measure
• Sources

• Strategic alignment
• Risk Management Compliance
• Value Delivery

Documenting an org's IT assets in a structured manner to facilitate understanding, management and planning for IT investments.

Ref for capability assessments of an organizations current IT processes. Defines the min set of requirements for conducting an assessment to ensure that outputs are consistent, repeatable and representative of the processes assessed.

Software process improvement (SPI) program model. Guide enterprises in planning and implementing effective software process improvement programs.

• Initiating 
• Diagnosing
• Establishing
• Acting
• Learning 
• (IDEAL)

• Evaluate value optimization
• Direct value opt
• Monitor value opt

Agility in adjusting investments. BSC doesn't have oversight and control of budgets in goal.

Process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives and deciding what countermeasures to take in reducing risk.

• Avoid
• Mitigate 
• Transfers
• Accept

• Establish the purpose of the risk management plan
• Assign responsibility for the risk management plan

• Collect data
• Analyze risk
• Maintain a risk profile
• Articulate risk
• Define a risk management action portfolio
• Respond to risk

The result of a threat agent exploiting a vulnerability

Probability of occurrence X Magnitude to impact

Use words or descriptive rankings to describe the impacts or likelihood (high, med, low)

The descriptive rankings are associated with a numeric scale

Use Numeric values to describe the likelihood and impacts of risk

Stipulate and commit a vendor to a required level of service and support options

• Legal, regulatory and tax issues
• Continuity of operations 
• Personnel
• Telecommunication issues
• Cross-border and cross-cultural issues

Focus on the controls at a service organization that are likely to be relevant to an audit of a user entity's financial statements.

Capability to provision processing, storage, networks, and other fundamental computing resources

Capability to deploy onto the cloud infrastructure customer-created or acquired applications created using programming languages and tools supported by the provider

Capability to use the provider's applications running on cloud infrastructure (web interface)

• Operated solely for an org
• Min risk, may not scale

• Shared by several orgs, specific community
• min risk, may not scale
• Data may be stored w/ competitor data

• Made available to the general public or large industry group
• Min risk, may not scale
• Data may be stored w/ competitor data
• Data may be stored in unknown location
• Data may be hard to retrieve

• Composition of two or more clouds that remain unique entities but are bound by technology 
• Aggregate risk of merging diff deployment models

• On-demand self-service
• Broad network access
• Resource pooling
• Rapid elasticity
• Measured service

• Plan - est object and processes
• Do - implement 
• Check - study results 
• Act - corrective action

• Measures:
• customer/user satisfaction
• Internal (operational) process
• Ability to innovate

Measure that determines how well the process is performing in enabling the goal to be reached

systematic approach to comparing enterprise performance against peers and competitors in an effort to learn the best ways of conducting business

Thorough analysis and significant redesign of business processes and management systems to establish a better performing structure

• Custody of assets
• Authorization 
• Recording transactions

• Audit trails
• Reconciliation
• Exception reporting
• Transaction logs
• Supervisory reviews
• Independent reviews

The IT Strategy Committee is more high level and the IT Steering Committee is focused on day to day operations and projects

Legal agreement btw a software vendor and a customer, to guarantee acess to source code. In the event the vendor goes out of business.