DM2: IT Management Flashcards
What are the five steps of a the risk management process?
1) Asset Identification
2) Evaluation of threats and vulnerabilities
3) Evaluation of impact
4) Calculation of risk
5) Evaluation/Response to Risk
any circumstance or event with potential to cause harm to an information resource (e.g., disclosure, modification of data, denial of service)
Threat
What are examples of typical IT assets?
Information/Data;
hardware;
software;
documents;
personnel
What are common classes of threats?
errors, malicious attacks, fraud, theft, equipment/software failure
What are some common types of vulnerabilities when examining IT risk?
Lack of user knowledge;
Lack of security functionality;
inadequate user awareness/education;
untested technology;
unprotected transmission of information
The controls implemented to reduce the vulnerabilities identified during the risk management process
Countermeasures or safeguards
The remaining level of risk after controls have been applied
residual risk
The acceptable level of risk defined by management
risk appetite
Level of IT risk management most concerned with the effectiveness and efficiency of IT systems and supporting infrastructure, the ability to bypass controls, loss/unavailability of key resources, and compliance
operational risk management
Level of IT risk management most concerned with project complexities and project risks
project risk management
Level of IT risk management most concerned with IT alignment with business strategy, competitors, and threats of evolving technology
strategic risk management
risk analysis method that uses words or descriptive rankings to describe risk impact and likelihood; most often used when risk level is low
qualitative risk analysis
risk analysis method where words/descriptive scales are directly associated with numeric values; used to reduce subjectivity of descriptive risks
semiquantitative risk analysis
risk analysis method using numeric values to describe the likelihood and impacts of risks; uses data from historical data, past experience, theories, testing and experiments
quantitative risk analysis
these help facilitate and foster the quality of enterprise IT policies and procedures and are part of governance maturity framework
tools, techniques, and processes (TTP)
how IT strategies, policies, and procedures and standards are maintained, used and improved over time as the organization changes
quality management
maturity model created to combine the five levels of maturity and best aligns with new software development practices (e.g., iterative development, early definition, model-based design, scalable processes, etc.)
capability maturity model integration (CMMI)
maturity model that forms an infrastructure to guide enterprises in planning and implementing an effective software process. Consists of five phases: initiating, diagnosing, establishing, acting, and learning
IDEAL model
what are the five phases of the IDEAL maturity model?
initiating, diagnosing, establishing, acting, and learning
an enterprises approach to integrating multiple assurance processes that may include internal audit, compliance, operational risk management, and incident risk management.
Governance, risk, and compliance (GRC)
process of pre-planning, scheduling, and allocating the limited IT resources to maximize efficiency in achieving enterprise objectives
IT resource management
what are some of the financial benefits of IT investment?
cost reductions and revenue increases
what are some of the NON-financial benefits of IT investment?
operations and mission performance (e.g., improved customer satisfaction, better information, shorter cycle times)
Process for determining if the organization is pursuing the best IT-related projects to achieve enterprise goals
IT Portfolio management
