CISA Domain 2 · Governance and Management of IT

Exam

CISA

Exam weight

18%

What it covers

IT governance and strategy, laws and standards, policies, enterprise architecture, enterprise risk management, privacy, data governance, resources, vendors, performance monitoring and quality.

What the exam rewards

Alignment of IT with business strategy
Clear ownership and accountability
Vendor assurance and contract rights
Metrics that drive decisions

Common traps

Choosing a technology fix for a governance gap
Forgetting that outsourcing keeps accountability in-house
Treating a policy's existence as proof of compliance

Official subtopics

IT Governance

Laws, Regulations, and Industry Standards
Organizational Structure, IT Governance, and IT Strategy
IT Policies, Standards, Procedures and Practices
Enterprise Architecture and Considerations
Enterprise Risk Management
Privacy Program and Principles
Data Governance and Classification

IT Management

IT Resource Management
IT Vendor Management
IT Performance Monitoring and Reporting
Quality Assurance and Quality Management of IT

How to study it

Study who is accountable for what: board, steering committee, data owners, custodians. Most questions turn on roles.