Information Management and Technology
Information management and technology covers how data and systems are governed, secured, and used to support decisions. Candidates should understand data governance (ownership, stewardship, quality, and definitions), the information lifecycle from creation to disposal, and the difference between data, information, and knowledge. Know the basics of cybersecurity: confidentiality, integrity, and availability; access control; authentication and authorization; and incident response.
Key concepts include privacy obligations, records retention, backup and recovery, business continuity for systems, and the risks of shadow IT. Understand the distinction between a data owner (accountable for a domain) and a data custodian (operates the controls). Know that system change control and testing protect integrity, and that access should follow least privilege and need to know.
Traps: assuming encryption alone satisfies privacy obligations; confusing authentication (who you are) with authorization (what you may do); and treating a data breach as purely a technical event rather than one requiring notification, legal, and reputational response. Questions may also test whether a cloud provider removes the organization's accountability; it does not.
Rule of thumb: accountability for data never outsources, even when processing does.
Worked example: A team wants a new analytics tool. Before approval, the data owner confirms the data classification, the custodian confirms access controls and retention, privacy reviews the personal information involved, and security assesses the vendor. Approval is documented, with a review date and an exit plan for data return and deletion.