The Chief Information Officer (CIO) is focused on improving IT governance within the organization to reduce system downtime. The CIO has mandated that the following improvements be implemented:

All business units must now identify IT risks and include them in

their business risk profiles.

Key controls must be identified and monitored.

Incidents and events must be recorded and reported with management

oversight.

Exemptions to the information security policy must be formally

recorded, approved, and managed.

IT strategy will be reviewed to ensure it is aligned with the

businesses strategy and objectives. In addition to the above, which of the following would BEST help the CIO meet the requirements?

Question

The Chief Information Officer (CIO) is focused on improving IT governance within the organization to reduce system downtime. The CIO has mandated that the following improvements be implemented:

All business units must now identify IT risks and include them in

their business risk profiles.

Key controls must be identified and monitored.
Incidents and events must be recorded and reported with management

oversight.

Exemptions to the information security policy must be formally

recorded, approved, and managed.

IT strategy will be reviewed to ensure it is aligned with the

businesses strategy and objectives. In addition to the above, which of the following would BEST help the CIO meet the requirements?

Accepted Answer

B. Establish a formal change management process Uncontrolled changes are a leading cause of system outages; a formal change management process requires documentation, impact analysis, testing, approval gates, and rollback plans before any change is applied to production systems. This directly supports the CIO's downtime reduction goal and reinforces the broader governance mandates by adding structured oversight and management visibility to change activity across all business units.

Answer

A. Establish a register of core systems and identify technical service owners Establishing a register of core systems and technical service owners improves accountability and ownership clarity but does not directly control the risk of outages caused by poorly managed changes.

Answer

C. Develop a security requirement traceability matrix A security requirements traceability matrix tracks security controls against compliance requirements and is primarily a compliance assurance tool, not an operational governance mechanism for reducing downtime.

Answer

D. Document legacy systems to be decommissioned and the disposal process Documenting legacy systems for decommissioning is a bounded, one-time planning activity that does not provide the ongoing governance controls the CIO needs to address continuous operational risks.

The Chief Information Officer (CIO) is focused on improving IT governance within the organization to reduce system downtime. The CIO has mandated that the following improvements be implemented…

Question

Options

How the community answered

Why each option

Topics

Community Discussion