QUESTION 26
Which of the following is the BEST way to ensure all enterprise employees understand the corporate code of business conduct?
The best way to ensure all enterprise employees understand the corporate code of business conduct is to mandate annual ethics training that includes an exam. This will help employees to learn the content and principles of the code, as well as test their knowledge and comprehension. Ethics training can also reinforce the importance of ethical behavior and the consequences of violating the code. According to a Harvard Business Review article1, ethics training can help employees to develop ethical skills, such as moral awareness, moral reasoning, moral courage, and moral leadership1. A code of conduct is not effective if employees do not know or understand it, or if they do not apply it in their daily work. Therefore, ethics training is essential to ensure employees are aware of and adhere to the corporate code of business conduct. Reference: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 1: Governance of Enterprise IT, Section 1.1: IT Governance Frameworks and Principles, Subsection 1.1.2: IT Governance Principles, Page 14-15. Building an Ethical Company.
QUESTION 40
A business case indicates an enterprise would reduce costs by implementing a bring your own device (BYOD) program allowing employees to use personal devices for email. Which of the following should be the FIRST governance action?
The first governance action for implementing a BYOD program should be to assess the BYOD risk. This is because BYOD introduces various security, legal, and operational risks to the enterprise, such as data loss or leakage, unauthorized access, malware infection, compliance violation, device management, and user privacy.
Assessing the BYOD risk can help to identify and evaluate the potential threats, vulnerabilities, and impacts of allowing employees to use personal devices for email. Assessing the BYOD risk can also help to determine the appropriate controls and mitigation strategies to reduce the risk to an acceptable level.
Assessing the enterprise architecture (EA) is not the first governance action, as it is a subsequent step after assessing the BYOD risk. EA is a framework that defines the structure, components, relationships, and principles of the enterprise’s IT environment. Assessing the EA can help to ensure that the BYOD program aligns with the enterprise’s vision, strategy, goals, and standards. However, assessing the EA does not address the specific risks associated with BYOD.
Updating the network infrastructure is not the first governance action, as it is an implementation step after assessing the BYOD risk and EA. Updating the network infrastructure can help to enhance the performance, reliability, scalability, and security of the network that supports the BYOD program. However, updating the network infrastructure does not provide a comprehensive risk assessment or governance framework for BYOD.
Updating the BYOD policy is not the first governance action, as it is a result of assessing the BYOD risk and EA. A BYOD policy is a document that defines the rules, guidelines, and responsibilities for employees who use personal devices for email. Updating the BYOD policy can help to communicate the expectations and requirements for BYOD users and enforce compliance and accountability. However, updating the BYOD policy does not provide a thorough risk analysis or architectural alignment for BYOD.
References := BYOD Best Practices – JumpCloud, Assessing your needs section. End user device security for Bring-Your-Own-Device (BYOD) deployment models – ITSM.70.003 – Canadian Centre for Cyber Security, 1 Introduction section. BYOD Policy Best Practices: The Ultimate Checklist – Scalefusion, Introduction section. The Ultimate Guide to BYOD Security: Definition & More – Digital Guardian, The Challenges of BYOD Security section.
QUESTION 44
Which of the following will BEST enable an IT steering committee to monitor the achievement of overall IT objectives on a continuous basis?
Key performance indicators (KPIs) are the best way to enable an IT steering committee to monitor the achievement of overall IT objectives on a continuous basis, as they are metrics that measure the progress and outcomes of IT activities, processes, and projects in relation to the enterprise’s vision, strategy, and goals.
KPIs can help the IT steering committee to assess and communicate the effectiveness and efficiency of IT operations, services, and initiatives, as well as their contribution to customer satisfaction, business value, and innovation. KPIs can also help the IT steering committee to identify and address any issues or gaps in IT performance or alignment, as well as to evaluate and improve the IT governance and management practices. Performance Measurement Metrics for IT Governance provides an overview of KPIs and their benefits for IT governance.
Defined service level agreements (SLAs), project portfolio dashboards, and IT user survey results are also useful ways to monitor the achievement of overall IT objectives, but they are not the best way. Defined SLAs are contracts that specify the scope, standards, and expectations of IT service delivery, as well as the roles, responsibilities, and rights of both the service provider and the service recipient. Defined SLAs can help ensure that the IT services meet the quality and availability requirements of the business units, as well as monitor and measure the service performance and compliance. Project portfolio dashboards are tools that display the status, progress, and performance of IT projects in a graphical or visual way. Project portfolio dashboards can help track and communicate the key information and data about IT projects, such as scope, schedule, budget, risks, or issues. IT user survey results are feedback or opinions collected from the end users of IT systems or services through questionnaires or interviews. IT user survey results can help gauge and improve the user satisfaction and experience with IT systems or services, as well as identify and address any user needs or expectations.
