Domain 2 Task Statements

Question 1

Domain 2— Governance and Management of IT (16%)

Answer 1

Provide assurance that the necessary leadership and organizational structures and processes are in place to achieve objectives and to support the organization’s strategy.

Question 2

T2.1

Answer 2

Evaluate the IT strategy, including the IT direction, and the processes for the strategy’s development, approval, implementation and maintenance for alignment with the organization’s strategies and objectives.

Question 3

T2.2

Answer 3

Evaluate the effectiveness of the IT governance structure to determine whether IT decisions, directions and performance support the organization’s strategies and objectives.

Question 4

T2.3

Answer 4

Evaluate IT organizational structure and human resources (personnel) management to determine whether they support the organization’s strategies and objectives.

Question 5

T2.4

Answer 5

Evaluate the organization’s IT policies, standards, and procedures, and the processes for their development, approval, release/publishing, implementation, and maintenance to determine whether they support the IT strategy and comply with regulatory and legal requirements.

Question 6

T2.5

Answer 6

Evaluate IT resource management, including investment, prioritization, allocation and use for alignment with the organization’s strategies and objectives.

Question 7

T2.6

Answer 7

Evaluate IT portfolio management, including investment, prioritization and allocation, for alignment with the organization’s strategies and objectives.

Question 8

T2.7

Answer 8

Evaluate risk management practices to determine whether the organization’s IT‐related risks are identified, assessed, monitored, reported and managed.

Question 9

T2.8

Answer 9

Evaluate IT management and monitoring of controls (e.g., continuous monitoring, quality assurance [QA]) for compliance with the organization’s policies, standards and procedures.

Question 10

T2.9

Answer 10

Evaluate monitoring and reporting of IT key performance indicators (KPIs) to determine whether management receives sufficient and timely information.

Question 11

T2.10

Answer 11

Evaluate the organization’s business continuity plan (BCP), including alignment of the IT disaster recovery plan (DRP) with the BCP, to determine the organization’s ability to continue essential business operations during the period of an IT disruption.