CTO cheat sheet

Strategy hierarchy: business strategy → IT strategy → IT tactics → operations; each level must trace upward to a stated business objective.

Portfolio classification (McFarlan grid): strategic, turnaround, factory, support - determined by current and future dependence on IT.

Governance archetypes (Weill & Ross): business monarchy, IT monarchy, federal, IT duopoly, feudal, anarchy; decision rights cover principles, architecture, infrastructure, investment, prioritization.

Investment categories: run (keep-the-lights-on), grow (scale existing), transform (new capability); typical mature targets approximate 50/30/20 but vary by industry.

IT chargeback models: cost center (no recharge), allocation by headcount/revenue, and consumption-based showback/chargeback; each shifts behavior differently.

Business case test: NPV > 0, IRR above hurdle rate, payback within policy window; include total cost of ownership over full lifecycle, not just build cost.

COBIT separates governance (EDM: evaluate, direct, monitor) from management (APO, BAI, DSS, MEA domains).

Balanced scorecard perspectives: financial, customer, internal process, learning and growth; IT scorecards map metrics to each.

Architecture domains (TOGAF): business, data, application, technology; ADM phases are Preliminary, A, B, C, D, E, F, G, H, Requirements Management.

Zachman framework classifies artifacts by perspective (planner, owner, designer, builder, subcontractor, functioning enterprise) against interrogatives (what, how, where, who, when, why).

Integration styles: point-to-point, hub-and-spoke, enterprise service bus, and event-driven publish/subscribe; coupling decreases as you move toward events.

SOA principles: loose coupling, service abstraction, reusability, autonomy, statelessness, discoverability, composability.

API gateway responsibilities: authentication, rate limiting, routing, protocol translation, logging; it does not own business logic.

Microservices trade-offs: independent deployability and scaling versus distributed-system complexity (network latency, eventual consistency, operational overhead).

Architecture review boards gate exceptions to standards; reference architectures define approved building blocks and integration patterns.

Technical debt taxonomy (Kruchten): reckless/prudent crossed with deliberate/inadvertent; track debt items in a register with remediation cost.

Data governance roles: data owner (accountable), data steward (quality execution), data custodian (technical storage controls).

DAMA-DMBOK knowledge areas include data quality, metadata, master data, data warehousing/BI, and data security.

Normalization: 1NF atomic values; 2NF no partial dependency on composite key; 3NF no transitive dependency on non-key attributes.

CAP theorem: under network partition a distributed store chooses consistency or availability; BASE trades consistency for availability.

Analytics maturity ladder: descriptive → diagnostic → predictive → prescriptive.

CIA triad: confidentiality, integrity, availability; AAA adds authentication, authorization, accounting.

Defense in depth layers controls across perimeter, network, host, application, and data; least privilege and separation of duties limit blast radius.

Risk formula: risk = likelihood × impact; treatment options are mitigate, transfer, avoid, accept.

Encryption: symmetric (AES) for bulk data, asymmetric (RSA/ECC) for key exchange and signatures, hashing (SHA-256) for integrity, not confidentiality.

Tuckman stages: forming, storming, norming, performing, adjourning; conflict peaks in storming and is resolved by clear norms.

Situational leadership (Hersey-Blanchard): directing, coaching, supporting, delegating, matched to follower readiness.

Span of control widens with standardized work and narrower with complex, interdependent work; excessive span degrades coaching quality.

Maslow and Herzberg: hygiene factors (pay, policy, conditions) prevent dissatisfaction but do not motivate; motivators (achievement, recognition, growth) do.

Change curve (Kübler-Ross adapted): denial, resistance, exploration, commitment; communication cadence should increase during resistance.

Skill-will matrix: high skill/high will delegate; high skill/low will coach; low skill/high will direct; low skill/low will guide closely.

RACI: exactly one accountable per activity; responsible does the work; consulted before; informed after.

Turnover cost heuristic: 50-200% of annual salary depending on role; retention levers include growth paths, recognition, and workload balance.

Diffusion of innovations (Rogers): innovators, early adopters, early majority, late majority, laggards; the chasm sits between early adopters and early majority.

Technology adoption lifecycle S-curve: slow initial progress, rapid growth past inflection, plateau at maturity.

Disruptive innovation (Christensen): starts at low end or new market, improves until it displaces incumbents; sustaining innovation improves existing products.

Three horizons model: H1 core (0-12 months), H2 adjacent (1-3 years), H3 transformational (3+ years); fund each explicitly.

Gartner Hype Cycle phases: innovation trigger, peak of inflated expectations, trough of disillusionment, slope of enlightenment, plateau of productivity.

Digital transformation pillars: business model, customer experience, operational processes, technology foundation, culture and skills.

Innovation funnel: idea generation → screening → business case → development → test → launch; kill criteria should be defined at each gate.

Emerging tech evaluation criteria: maturity (TRL), fit to strategy, integration cost, vendor viability, regulatory exposure.

Risk register fields: ID, description, category, likelihood, impact, score, owner, response, residual risk, review date.

Business impact analysis outputs: RTO (max tolerable downtime), RPO (max tolerable data loss), MTD (max tolerable disruption), and criticality tiers.

Recovery strategy tiers: backup/restore, pilot light, warm standby, multi-site active-active; cost rises with reduced RTO.

BCP vs DR: business continuity covers people, process, and facilities; disaster recovery focuses on IT systems restoration.

Compliance frameworks: ISO 27001 (ISMS), SOC 2 (trust services criteria), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Control types: preventive, detective, corrective; and administrative, technical, physical.

Segregation of duties prevents one person from initiating, approving, and recording a transaction; compensating controls apply when unavoidable.

Audit trail requirements: immutable logs, retention per regulation, time synchronization, and access restricted to authorized reviewers.

TCO includes acquisition, implementation, licensing, operations, support, training, and decommissioning over the asset lifecycle.

CapEx vs OpEx: capitalized purchases depreciate over useful life; cloud subscriptions are typically operating expense, affecting EBITDA treatment.

Depreciation methods: straight-line (cost minus salvage, divided by useful life) and accelerated (declining balance, MACRS).

NPV discounts future cash flows at the hurdle rate; IRR is the discount rate making NPV zero; accept projects with IRR above hurdle.

Payback period ignores cash flows after breakeven and the time value of money; use alongside NPV, not alone.

Cloud economics: reserved/committed use discounts for steady load, spot for fault-tolerant batch, on-demand for variable; rightsizing and auto-scaling control spend.

Vendor selection: RFP scoring with weighted criteria, reference checks, financial viability, SLA definitions, and exit/transition clauses.

SLA metrics: uptime percentage, MTTR, MTBF, and service credits; define measurement method and exclusions explicitly.

Contract protections: escrow for source code, audit rights, most-favored-customer pricing, data portability, and termination assistance.