CHTP cheat sheet

Strategy hierarchy flows mission → vision → goals → objectives → initiatives; every IT initiative traces to at least one enterprise objective.

SWOT analyzes internal strengths and weaknesses plus external opportunities and threats; TOWS converts pairs into SO, ST, WO, and WT strategies.

Porter's five forces are rivalry, new entrants, substitutes, supplier power, and buyer power; they assess industry attractiveness.

Balanced scorecard perspectives are financial, customer, internal process, and learning and growth; lagging outcome measures are paired with leading drivers.

Capability maturity model levels are 1 initial, 2 managed, 3 defined, 4 quantitatively managed, and 5 optimizing.

Build-buy-partner rule: build when the capability is core and differentiating; buy when commodity; partner when speed or specialized expertise dominates.

Roadmap horizons are now (0–12 months), next (12–36 months), and later (36+ months); each item states outcome, owner, dependency, and funding.

Portfolio categories are run, grow, and transform; funding ratios across the three categories are governed explicitly.

ROI = (total benefits − total costs) / total costs; payback period = initial investment / annual net cash inflow.

Governance sets direction, oversight, and decision rights; management plans and executes within those constraints.

COBIT governance domain EDM is Evaluate, Direct, Monitor; management domains are APO, BAI, DSS, and MEA.

Three lines model: first line owns and manages risk; second line provides oversight and compliance; third line is independent internal audit.

RACI assigns responsible, accountable, consulted, and informed; each activity has exactly one accountable owner.

IT operating model archetypes are centralized, decentralized, federal, and hybrid; decision rights follow the chosen archetype.

Board committees commonly include audit, risk, finance, and technology or steering; charters define membership, quorum, and authority.

ADKAR change model elements are awareness, desire, knowledge, ability, and reinforcement; a missing element blocks adoption.

Succession planning identifies critical roles and candidate readiness as ready now, ready in 1–2 years, or ready in 3+ years.

Conflict-of-interest rule: disclose the interest, recuse from the decision, and document the recusal in minutes.

SDLC phases are planning, analysis, design, build, test, deploy, and maintain; agile delivers increments through repeated sprints.

Testing levels are unit, integration, system, and user acceptance; each level has distinct entry and exit criteria.

Availability = MTBF / (MTBF + MTTR); 99.9% availability permits about 8.77 hours of downtime per year.

Little's Law: average work in process L = arrival rate λ × average time in system W.

Vertical scaling adds resources to one node; horizontal scaling adds nodes and requires statelessness or shared-state design.

REST uses stateless HTTP verbs and resources; SOAP uses XML envelopes and WSDL contracts.

Idempotent operations can be retried without changing the result beyond the first application; GET, PUT, and DELETE are idempotent, POST is not.

Type 1 hypervisors run directly on hardware; type 2 hypervisors run on a host operating system.

Technical debt is the future cost of shortcuts; track principal, interest, and the remediation backlog.

OSI layers are physical, data link, network, transport, session, presentation, and application; TCP/IP collapses to link, internet, transport, and application.

Usable IPv4 hosts = 2^(32 − prefix) − 2; a /24 subnet has 256 addresses and 254 usable hosts.

RAID 0 stripes without redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 mirrors and stripes.

RTO is maximum acceptable downtime; RPO is maximum acceptable data loss measured in time.

Backup 3-2-1 rule: three copies, two different media, one off-site; restore tests validate recoverability.

PUE = total facility energy / IT equipment energy; values closer to 1.0 indicate greater efficiency.

Incident restores service; problem finds root cause; change modifies configuration under change control; the CAB reviews risk.

SLA defines service commitments; SLO is an internal target; SLI is the measured indicator.

UPS sizing: total load in watts is summed across devices; VA rating = watts / power factor, and runtime falls as load rises.

Data lifecycle stages are create or acquire, store, use, share, archive, and destroy; retention rules apply at each stage.

Data quality dimensions are accuracy, completeness, consistency, timeliness, validity, and uniqueness.

Normalization: 1NF removes repeating groups; 2NF removes partial dependencies; 3NF removes transitive dependencies.

ACID means atomicity, consistency, isolation, durability; BASE means basically available, soft state, eventual consistency.

Data governance roles: owner is accountable for the domain; steward defines standards; custodian operates storage and enforces controls.

Metadata types are technical, business, and operational; lineage records source-to-target movement.

A data warehouse stores structured modeled data for analytics; a data lake stores raw varied data; a lakehouse combines both.

ETL transforms before loading; ELT loads raw data and transforms inside the target platform.

Classification tiers commonly are public, internal, confidential, and restricted; controls increase with tier.

CIA triad: confidentiality, integrity, and availability; each control is mapped to one or more objectives.

Authentication factors are knowledge, possession, and inherence; MFA requires two or more different factor types.

Risk = likelihood × impact; treatment options are avoid, mitigate, transfer, and accept.

Symmetric encryption uses one shared key and is fast, such as AES; asymmetric encryption uses public/private key pairs for exchange and signatures.

HIPAA Security Rule safeguards are administrative, physical, and technical; the Privacy Rule governs use and disclosure of PHI.

GDPR principles include lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Incident response phases are preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

A vulnerability is a weakness; a threat is an actor or event; an exploit is the technique; risk is the potential loss.

BCP maintains business functions; DRP restores technology services; both depend on BIA-defined RTO and RPO.

Procurement sequence is need definition, requisition, solicitation, evaluation, award, contract, receipt, and payment.

RFI gathers market capability; RFP requests a solution and pricing; RFQ requests price for a defined specification.

Weighted scoring matrix: total score = Σ (criterion weight × vendor score); weights sum to 100%.

TCO includes acquisition, implementation, licensing, support, operations, training, transition, and disposal costs.

Fixed-price contracts assign cost risk to the seller; time-and-materials assigns hours risk to the buyer; cost-plus reimburses allowable costs plus a fee.

SLA remedies commonly include service credits, escalation, cure periods, and termination rights.

Named-user licenses are assigned to individuals; concurrent licenses are shared up to a maximum simultaneous count.

Source-code escrow releases code on trigger events such as insolvency or failure to support.

Due diligence checks financial stability, security posture, references, insurance, and legal standing.

Project constraints are scope, schedule, cost, and quality; changing one affects the others.

Process groups are initiating, planning, executing, monitoring and controlling, and closing.

Critical path is the longest dependent path; its float is zero, and delaying it delays the project end date.

EVM formulas: CV = EV − AC; SV = EV − PV; CPI = EV / AC; SPI = EV / PV; CPI or SPI below 1.0 is unfavorable.

EAC = BAC / CPI when current cost performance continues; ETC = EAC − AC.

Threat responses are avoid, mitigate, transfer, and accept; opportunity responses are exploit, enhance, share, and accept.

Change control steps are request, impact analysis, approval by the change authority, implementation, verification, and baseline update.

Stakeholder power/interest grid: high power and high interest are managed closely; high power and low interest are kept satisfied.

Vendor scorecards measure SLA attainment, defect rates, response time, cost variance, and satisfaction.

CapEx is capitalized and depreciated over useful life; OpEx is expensed in the period incurred.

NPV = Σ [CFt / (1 + r)^t] − initial investment; independent projects with NPV > 0 are accepted.

IRR is the discount rate where NPV = 0; a project is accepted when IRR exceeds the hurdle rate.

Payback = years before full recovery + unrecovered cost / cash flow in the recovery year.

Straight-line depreciation = (cost − salvage value) / useful life.

Budget variance = actual − budget; favorable revenue variance is actual above budget, and favorable cost variance is actual below budget.

Zero-based budgeting justifies every cost from zero; incremental budgeting adjusts the prior base.

Showback reports consumption costs; chargeback transfers costs to consuming business units.

Break-even units = fixed costs / (price per unit − variable cost per unit).

Integration styles are point-to-point, hub-and-spoke or ESB, API-led, and event-driven publish/subscribe.

iPaaS provides cloud-based connectors, orchestration, and governance between SaaS and on-premises systems.

HL7 v2 uses segment and field messages; FHIR uses RESTful resources; DICOM handles medical images.

Cloud service models: IaaS provides infrastructure; PaaS provides runtime and middleware; SaaS provides applications.

Deployment models are public, private, hybrid, and community; the shared responsibility model splits security duties.

An API gateway enforces authentication, rate limits, routing, and logging for service APIs.

Microservices are independently deployable around business capabilities; a monolith deploys as one unit.

ML lifecycle stages are data preparation, training, validation, deployment, and monitoring; drift triggers retraining.

Blockchain is an append-only distributed ledger secured by consensus and cryptographic hashing.