Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COBIT 2019 > Design Guide Chapter 1 - 3 > Flashcards

Design Guide Chapter 1 - 3 Flashcards

1
Q

A Governance or management objective

A

Always relates to one objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A governance objetive relates to a

A

Governance process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A management objective relates to a

A

Management process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Boards and executive management are typically accountable for

A

Governance Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Management processes are the domain of

A

Senior and Middle Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Governance Objectives are grouped in

A

Evaluate, Direct and Monitor (EDM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

EDM - Evaluate, Direct and Monitor

A

Governing body evaluates strategic options, directs senior management and monitors the achievement of the strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Management objectives are

A

APO - Align, Plan, and Organize
BAI - Build Acquire, and Implement
DSS - Deliver, Service, and Support
MEA - Monitor, Evaluate and Assess

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

APO

A

Align, Plan, and Organize - Addresses the overall organization, Strategy, and supporting activities for I&T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

BAI

A

Build, Acquire, and Implement - treats the definition, acquisition, and implementation of I&T solutions and their integration in the business process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

DSS

A

Deliver, Service, and Support - Addresses operational delivery and support of I&T services, including security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

MEA

A

Monitor, Evaluate, and Assess - Addresses performance monitoring and conformance of I&T with internal performance targets, internal control objectives and external requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

EDM01

A

Ensured governance framework setting and maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

EDM02

A

Ensured benefits delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

EDM03

A

Ensured risk optimization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

EDM04

A

Ensured resource optimization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

EDM05

A

Ensured stakeholder engagement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

APO01

A

Managed I&T Management Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

APO02

A

Managed Strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

APO3

A

Managed Enterprise Arquitecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

APO04

A

Managed Innovation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

APO05

A

Managed Portfolio

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

APO06

A

Managed Budget and Costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

APO07

A

Managed Human Resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

APO08

A

Managed Relationships

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

APO09

A

Managed Service Agreements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

APO10

A

Managed Vendors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

APO11

A

Managed Quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

APO12

A

Managed Risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

APO13

A

Managed Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

APO14

A

Managed Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

BAI01

A

Managed Programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

BAI02

A

Managed Requirement Definitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

BAI03

A

Managed Solution Identification and build

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

BAI04

A

Managed Availability and Capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

BAI05

A

Managed Organization Change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

BAI06

A

Managed IT Changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

BAI07

A

Managed IT Change Acceptance and Transitioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

BAI08

A

Managed Knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

BAI09

A

Managed Assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

BAI10

A

Managed Configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

BAI11

A

Management Projects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

DSS01

A

Managed Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

DSS02

A

Managed Service Requests and Incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

DSS03

A

Managed Problems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

DSS04

A

Managed Continuity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

DSS05

A

Managed Security Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

DSS06

A

Managed Business Process Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

MEA01

A

Managed Performance and Conforming Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

MEA02

A

Managed System and Internal Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

MEA03

A

Managed Compliance with External Requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

MEA04

A

Managed Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Components are factors that

A

Individually and collectively, contribute to the good operations of the enterprises governance system over I&T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Components interact with each other

A

resulting in a holistic governance system for I&T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Components can be of different types:

A

Processes; Organizational Structures; Policies and Procedures; Information items; Culture and behavior; Skills and Competencies; and services, infrastructure, and applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Generic Component are

A

the described in the COBIT Core Model; apply in any situation, but need to be customized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Variant Components are

A

based on generic components but tailored for a specific context or purpose within a focus area.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Focus Area

A

Describe a certain governance topic, domain or issue that can be addressed by a collection of governance and management objectives and their governance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Examples of Focus Areas

A

Small and Middle Enterprises;
Cybersecurity;
Digital Transformation;
Cloud Computing;
Privacy;
DevOps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Capability Levels (CMMI - Capability Mature Model Integration)

A

Measure for how well a process is implemented and performing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Capability Level - 0

A

*Lack of any basic capability;
*Incomplete approach to addressing governance and management purpose;
*May or may not be meeting the intent of any process practice.

62
Q

Capability Level - 1

A

The process more or less achieves its purpose through the application of an incomplete set of activities that can be characterized initial or intuitive - not very organized

63
Q

Capability Level - 2

A

The process achieves its purpose through the application of a basic, yet complete, set of activities that can be characterized as performed.

64
Q

Capability Level - 3

A

The process achieves its purpose in a much more organized way using organizational assets. Processes are typically well-defined.

65
Q

Capability Level - 4

A

The process achieves its purpose, as well defined, and its performance is (quantitatively) measured.

66
Q

Capability Level - 5

A

The process achieves its purpose, is well defined, performance is measured to improve performance and continuous improvement is pursued.

67
Q

Capability Level - Any level at 3 or up is called …

A

Higher

68
Q

Capability Level - Anything below 3 is called …

A

Lower

69
Q

Design Factors are

A

Factors that can influence the design of an enterprise’s governance system and position it for success in the use of I&T.

70
Q

The Design Factors are:

A

Enterprise Strategy
Enterprise Goal
Risk Profile
I&T Related Issues
Threat Landscape
Compliance Requirements
Role of IT
Sourcing Model for IT
IT implementation Methods
Technology Adoption Strategy
Enterprise Size

71
Q

Enterprise Strategy

A

Enterprises can have different strategies, which can be expressed as one or more of the archetypes.

Organizations typically have a primary strategy and, at most, one secondary strategy.

72
Q

Example of Enterprise Strategies

A

**Growth/Acquisition - The enterprise has a focus on growing revenues.
**Innovation/Differentiation - The enterprise has a focus on offering different and/or innovative products and services to their clients.
**Cost Leadership - The enterprise has a focus on short-term cost minimization
**Client Service/Stability - The enterprise has a focus on providing a stable and client-oriented service.

73
Q

Enterprise goals

A

Supporting the enterprise strategy - Enterprise strategy is realized by the achievement of (a set of) enterprise goals. These goals are defined in the COBIT framework, and structured along the balanced scorecard (BSC) dimensions:
Financial
Customer
Internal
Growth

74
Q

Enterprise Goal - Financial

A

EG01 - Portfolio of competitive products and services
EG02 - Managed business risk
EG03 - Compliance with external laws and regulations
EG04 - Quality of financial information

75
Q

Enterprise Goal - Customer

A

EG05 - Customer-oriented service culture
EG06 - Business service continuity and availability
EG07 - Quality of management information

76
Q

Enterprise Goal - Internal

A

EG08 - Optimization of internal business process functionality
EG09 - Optimization of business process costs
EG10 - Staff skills, motivation and productivity
EG11 - Compliance with internal policies

77
Q

Enterprise Goal - Growth

A

EG12 - Managed digital transformation programs
EG13 - Product and business innovation

78
Q

Risk Profile

A

The enterprise and current issues in relation to I&T—The risk profile identifies the sort of IT related risk to which the enterprise is currently exposed and indicates which areas of risk are exceeding the risk appetite.

79
Q

Risk Category

1.-IT-investment decision making, portfolio definition, and maintenance

A

Risk Scenarios
A. Programs selected for implementation misaligned with corporate strategy and priorities
B. Failure of IT-related Investments to support digital strategy of the enterprise
C. Selection of wrong software (in terms of cost, performance, features, compatibility,
redundancy, etc.) for acquisition and implementation
D. Selection of wrong infrastructure (in terms of cost, performance, features,
compatibility, etc.) for implementation
E. Duplication or important overlaps between different investment initiatives
F. Long-term incompatibility between new investment programs and enterprise
architecture
G. Misallocation, inefficient manage

80
Q

Risk Category

2.-Program and projects lifecycle management

A

A. Failure of senior management to terminate failing projects (due to cost explosion, excessive delays, scope creep, and changed business priorities)
B. Budget overruns for I&T projects
C. Lack of quality of I&T projects
D. Late delivery of I&T projects
E. Failure of third-party outsourcers to deliver projects as per contractual agreements
(any combination of exceeded budgets, quality problems, missing functionality,
late delivery)

81
Q

Risk Category

3.-IT cost and oversight

A

A. Extensive dependency on, and use of, user-created, user-defined, user-maintained
applications and ad hoc solutions
B. Excess cost and/or ineffectiveness of I&T-related purchases outside of the I&T
procurement process
C. Inadequate requirements leading to ineffective Service Level Agreements (SLAs)
D. Lack of funds for I&T related investments

82
Q

Risk Category

4.-IT expertise, skills and behavior

A

A. Lack or mismatch of IT-related skills within IT (e.g., due to new technologies or
working methods)
B. Lack of business understanding by IT staff that affects service delivery/project quality
C. Inability to recruit and retain IT staff
D. Recruitment of unsuitable profiles because of lack of due diligence in the recruitment
process
E. Lack of I&T training
F. Overreliance for I&T services on key staff

83
Q

Risk Category

5.-Enterprise/IT architecture

A

A. Complex, inflexible enterprise architecture (EA), obstructing further evolution and
expansion, and leading to missed business opportunities
B. Failure to timely adopt and exploit new infrastructure or abandon obsolete
infrastructure
C. Failure to timely adopt and exploit new software (functionality, optimization, etc.)
or to abandon obsolete applications
D. Undocumented EA leading to inefficiencies and duplications
E. Excessive number of exceptions on enterprise architecture standards

84
Q

Risk category

6.-IT operational infrastructure incidents

A

A. Accidental damaging of IT equipment
B. Errors by IT staff (during backup, during upgrades of systems, during maintenance
of systems, etc.)
C. Incorrect information input by IT staff or system users
D. Destruction of data center (sabotage, etc.) by staff
E. Theft of device with sensitive data
F. Theft of a key infrastructure component
G. Erroneous configuration of hardware components
H. Intentional tampering with hardware (security devices, etc.)
I. Abuse of access rights from prior roles to access IT infrastructure
J. Loss of backup media or backups not checked for effectiveness
K. Loss of data by cloud provider
L. Operational-service interruption by cloud providers

85
Q

Risk Category

7.-Unauthorized actions

A

A. Tampering with software
B. Intentional modification or manipulation of software leading to incorrect data
C. Intentional modification or manipulation of software leading to fraudulent actions
D. Unintentional modification of software leading to inaccurate results
E. Unintentional configuration and change-management errors

86
Q

Risk Category

8.- Software adoption/usage problems

A

A. Nonadoption of new application software by users
B. Inefficient use of new software by users

87
Q

Risk Categoty

9.-Hardware incidents

A

A. System instability in wake of installing new infrastructure, leading to operational
incidents (e.g., BYOD program)
B. Inability of systems to handle transaction volumes when user volumes increase
C. Inability of systems to handle load when new applications or initiatives are deployed
D. Utilities failure (telecom, electricity)
E. Hardware failure due to overheating and/or other environmental conditions like
humidity
F. Damaging of hardware components leading to destruction of data by internal staff
G. Loss/disclosure of portable media containing sensitive data (CD, USB-drives,
portable disks, etc.)
H. Extended resolution time or support delays in case of hardware incidents

88
Q

Risk Category

10.-Software failures

A

A. Inability to use the software to realize desired outcomes (e.g., failure to make
required business model or organizational changes)
B. Implementation of immature software (early adopters, bugs, etc.)
C. Operational glitches when new software is made operational
D. Regular software malfunctioning of critical application software
E. Obsolete application software (outdated, poorly documented, expensive to
maintain, difficult to extend, not integrated in current architecture, etc.)
F. Inability to revert back to former versions in case of operational issues with a new
version
G. Software-induced corrupted data(base) leading to inaccessible data

89
Q

Risk Category

11.-Logical attacks (hacking, malware,etc.)

A

A. Unauthorized (internal) users trying to break into systems
B. Service interruption due to denial-of-service (DoS) attack
C. Website defacement
D. Malware attack
E. Industrial espionage
F. Hacktivism
G. Disgruntled employee implements a time bomb which leads to data loss
H. Company data stolen through unauthorized access gained by a phishing attack
I. Foreign government attacks on critical systems

90
Q

Risk Category

12.-Third-party/supplier incidents

A

A. Inadequate performance of outsourcer in large-scale, long-term outsourcing
arrangement (e.g., through lack of supplier due diligence regarding financial
viability, delivery capability and sustainability of supplier’s service)
B. Accepting unreasonable terms of business from IT suppliers
C. Inadequate support and services delivered by vendors, not in line with SLA
D. Noncompliance with software license agreements (use and/or distribution of
unlicensed software)
E. Inability to transfer to alternative suppliers due to overreliance or overdependence
on current supplier
F. Purchase of IT services (especially cloud services) by the business without
consultation /involvement of IT, resulting in inability to integrate the service with inhouse
services.
G. Inadequate or unenforced SLA to obtain agreed services and penalties in case of
noncompliance

91
Q

Risk Category

13.-Noncompliance

A

A. Noncompliance with national or international regulations (e.g., privacy, accounting,
manufacturing, environmental, etc.)
B. Lack of awareness of potential regulatory changes that may have a business
impact
C. Operational obstacles caused by regulations
D. Failure to comply with internal procedures

92
Q

Risk Category

14.-Geopolitical issues

A

A. Lack of access due to disruptive incident in other premises
B. Government interference and national policies impacting the business
C. Targeted action from government-sponsored groups or agencies

93
Q

Risk Category

15.-Industrial action

A

A. Facilities and building inaccessible because of labor union strike
B. Third-party providers unable to provide services because of strike
C. Key staff unavailable through industrial action (e.g., transportation or utilities strike)

94
Q

Risk Category

16.-Acts of nature

A

A. Earthquake destroying or damaging important IT infrastructure
B. Tsunami destroying critical premises
C. Major storms and tropical cyclone or tornado damaging critical infrastructure
D. Major wildfire
E. Flooding
F. Rising water table leaving critical location unusable
G. Rising temperature rendering critical locations uneconomical to operate

95
Q

Risk Category

17.-Technology-based innovation

A

A. Failure to identify new and important technology trends
B. Failure to appreciate the value and potential of new technologies
C. Failure to adopt and exploit new technologies in a timely manner (functionality,
process optimization, etc.)
D. Failure to provide technology support new business models

96
Q

Risk Category

18.-Environmental

A

A. Environmentally unfriendly equipment (e.g., power consumption, packaging)

97
Q

Risk Category

19.-Data and information management

A

A. Discovery of sensitive information by unauthorized persons due to inefficient
retaining/archiving/disposing of information
B. Intentional illicit or malicious modification of data
C. Unauthorized disclosure of sensitive information through email or social media
D. Loss of IP and/or leakage of competitive information

98
Q

I&T-related issues

A

A related method for an I&T risk assessment for the enterprise is to consider which I&Trelated issues it currently faces, or, in other words, what I&T-related risk has materialized.

99
Q

I&T-related issues A

A

Frustration between different IT entities across the organization because of a perception of low contribution to business value

100
Q

I&T-related issues B

A

Frustration between business departments (i.e., the IT customer) and the IT department because of failed initiatives or a perception of low contribution to business value

101
Q

I&T-related issues C

A

Significant IT related incidents, such as data loss, security breaches, project failure, application errors, etc. linked to IT

102
Q

I&T-related issues D

A

Service delivery problems by the IT outsourcer(s)

103
Q

I&T-related issues E

A

Failures to meet IT related regulatory or contractual requirements

104
Q

I&T-related issues F

A

Regular audit findings or other assessment reports about poor IT performance or reported IT quality or service problems

105
Q

I&T-related issues G

A

Substantial hidden and rogue IT spending, that is, IT spending by user departments outside the control of the normal IT investment decision mechanisms and approved budgets

106
Q

I&T-related issues H

A

Duplications or overlaps between various initiatives or other forms of wasting resources

107
Q

I&T-related issues I

A

Insufficient IT resources, staff with inadequate skills or staff burnout/dissatisfaction

108
Q

I&T-related issues J

A

IT-enabled changes or projects frequently failing to meet business needs and delivered late or over budget

109
Q

I&T-related issues K

A

Reluctance by board members, executives or senior management to engage with IT, or lack of committed business sponsors for IT

110
Q

I&T-related issues L

A

Complex IT operating model and/or unclear decision mechanisms for IT-related decisions

111
Q

I&T-related issues M

A

Excessively high cost of IT

112
Q

I&T-related issues N

A

Obstructed or failed implementations of new initiatives or innovations caused by the current IT architecture and system

113
Q

I&T-related issues O

A

Gap between business and technical knowledge which leads to business users and IT and/or technology specialists speaking different languages

114
Q

I&T-related issues P

A

Regular issues with data quality and integration of data across various sources

115
Q

I&T-related issues Q

A

High level of end-user computing, creating (among other problems) a lack of oversight and quality control over the applications that are being developed and put in operation

115
Q

I&T-related issues Q

A

High level of end-user computing, creating (among other problems) a lack of oversight and quality control over the applications that are being developed and put in operation

116
Q

I&T-related issues R

A

Business departments implementing their own information solutions with little or no involvement of the enterprise IT department

117
Q

I&T-related issues S

A

Ignorance and/or noncompliance with security and privacy regulations

118
Q

I&T-related issues T

A

Inability to exploit new technologies or to innovate using I&T

119
Q

Threat landscape

A

The threat landscape under which the enterprise operates can be classified

120
Q

Threat landscape - Normal

A

The enterprise is operating under what are considered normal threat levels

121
Q

Threat landscape - High

A

Due to its geopolitical situation, industry sector or particular profile, the enterprise is
operating in a high-threat environment.

122
Q

Compliance requirements

A

The compliance requirements to which the enterprise is subject to and can be classified
according to the categories:
**Low compliance requirements
**Normal compliance requirements
**High compliance requirements

123
Q

Low compliance requirements

A

The enterprise is subject to a minimal set of regular compliance requirements that
are lower than average.

124
Q

Low compliance requirements

A

The enterprise is subject to a minimal set of regular compliance requirements that
are lower than average.

125
Q

Normal compliance requirements

A

The enterprise is subject to a set of regular compliance requirements that are
common across different industries.

126
Q

High compliance requirements

A

The enterprise is subject to higher than average compliance requirements, most
often related to industry sector or geopolitical conditions.

127
Q

Role of IT

A

The role of IT for the enterprise can be classified as Support, Factory, Turnaround and Strategic.

128
Q

Role of IT - Support

A

IT is not crucial for the running and continuity of the business process and services, nor for their innovation.

129
Q

Role of IT - Factory

A

When IT fails, there is an immediate impact on the running and continuity of the business processes and services. However, IT is not seen as a driver for innovating business processes and services.

130
Q

Role of IT - Turnaround

A

IT is seen as a driver for innovating business processes and services. At this moment, however, there is not a critical dependency of IT for the current running and continuity of the business processes and services.

131
Q

Role of IT - Strategic

A

IT is critical for both running and innovating the organization’s business processes and services.

132
Q

Sourcing model for IT

A

The sourcing model the enterprise adopts can be classified as:
**Outsourcing
**Cloud
**Insourced
**Hybrid

133
Q

Sourcing model for IT - Outsourcing

A

The enterprise calls upon the services of a third party to provide IT services.

134
Q

Sourcing model for IT - Cloud

A

The enterprise maximizes the use of the cloud for providing IT services to its users.

135
Q

Sourcing model for IT - Insourced

A

The enterprise provides for their own IT staff and services.

136
Q

Sourcing model for IT - Hybrid

A

A mixed model is applied, combining the three models above in varying degrees.

137
Q

IT implementation methods

A

The methods the enterprise adopts can be classified as noted:
**Agile
**DevOps
**Traditional
**Hybrid

138
Q

IT implementation methods - Agile

A

The enterprise uses Agile development working methods for its software development.

139
Q

IT implementation methods - DevOps

A

The enterprise uses DevOps working methods for software building, deployment and operations.

140
Q

IT implementation methods - Traditional

A

The enterprise uses a more classic approach towards software development (waterfall) and separates software development and operations.

141
Q

IT implementation methods - Hybrid

A

The enterprise uses a mix of traditional and modern IT implementation, often referred to as “bimodal IT.”

142
Q

Technology adoption strategy

A

The technology adoption strategy can be classified as listed:
**First mover
**Follower
**Slow adopter

143
Q

Technology adoption strategy - First mover

A

The enterprise generally adopts new technologies as early as possible and tries to
gain first-mover advantage.

144
Q

Technology adoption strategy - Follower

A

The enterprise typically waits for new technology to become mainstream and proven
before adopting them.

145
Q

Technology adoption strategy - Slow adopter

A

The enterprise is very late with their adoption of new technologies.

146
Q

Enterprise size

A

Two categories:
**Large enterprise (default) - Enterprises with more than 250 full-time employees (FTEs)
**Small and medium enterprise - Enterprise with 50 to 250 FTEs

147
Q

Why is There no Industry Sector Design Factor?

A

Every industry sector has its own unique set of requirements regarding expectations from the use of I&T. However, it is possible to capture the key characteristics of an industry sector by a combination of the design factors listed in the preceding tables.

148
Q

Impact of Design Factors

A

Design factors influence in different ways the tailoring of the governance system of an enterprise. This publication distinguishes three different types of impact:

1.-Management Objective Priority and Target Capability Levels
2.-Component Variations
3.-Specific Focus Areas

149
Q

Impact of Design Factors - Management objective priority/selection

A

The COBIT core model contains 40 governance. and management
objectives, each consisting of the process and a number of related components. They are intrinsically equivalent; there is no natural order of priority among them. However, design factors can influence this equivalence and make some governance and management objectives more important than others.

Example: When an enterprise identifies the most relevant enterprise goal(s) from the enterprise goal list and applies the goals cascade, this will lead to a selection of priority management objectives. For example, when EG01 Portfolio of competitive products and services is ranked as very high by an enterprise, this will make management objective APO05 Managed portfolio an important part of this enterprise’s governance system.

Example: An enterprise that is very risk averse will give more priority to management objectives that aspire to govern and manage risk and security. Governance and management objectives EDM03 Ensured risk optimization,
APO12 Managed risk, APO13 Managed security and DSS05 Managed security services will become important parts of that enterprise’s governance system and will have higher target capability levels defined for them.

Example: An enterprise in which the role of IT is strategic and crucial to the success of the business will requirehigh involvement of IT-related roles in organizational structures, a thorough understanding of business by IT professionals (and vice versa), and a focus on strategic processes such as APO02 Managed strategy and APO08 Managed relationships.

150
Q

Impact of Design Factors - Component Variation

A

Components are required to achieve governance and management objectives. Design
factors can mandate specific variations of components or can influence the importance of components.

Example: Small and medium enterprises might not need the full set of roles and organizational structures as laid out in the COBIT core model, but may use a reduced set instead. This reduced set of governance and management objectives and the included components is defined in the small and medium enterprise focus area.

Example: An enterprise which operates in a highly regulated environment will attribute more importance to documented work products and policies and procedures and to some roles, e.g., the compliance officer function.

Example: An enterprise that uses DevOps in solution development and operations will require specific activities, organizational structures, culture, etc., focused on BAI03 Managed solutions identification and build and DSS01 Managed operations.

151
Q

Impact of Design Factors - Need for specific focus area guidance

A

Some design factors, such as threat landscape, specific risk, target development methods, infrastructure set-up, will drive the need for variation of the core COBIT model content to a specific context.

Example: Enterprises adopting a DevOps approach will require a governance system that has a variant of several generic COBIT processes, described in the DevOps focus area guidance for COBIT.

Example: Small and medium enterprises have less staff, fewer IT resources, and shorter and more direct reporting lines, and differ in many more aspects from large enterprises. For that reason, their governance system for I&T will have to be less onerous, compared to large enterprises. This is described in the SME focus area guidance of COBIT.

COBIT 2019 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions