CITP cheat sheet

IT governance is the set of structures (decision rights, accountability) and processes that direct and control IT so it aligns with enterprise objectives and delivers value while managing risk.

COSO ERM components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting. Risk appetite is set before strategy selection.

COBIT 2019 separates governance objectives (EDM: Evaluate, Direct, Monitor) from management objectives (APO, BAI, DSS, MEA). Governance owns value delivery; management executes it.

ITIL 4 service value chain activities: Plan, Improve, Engage, Design and Transition, Obtain/Build, Deliver and Support. The four dimensions are organizations and people, information and technology, partners and suppliers, value streams and processes.

Three lines model: first line owns and manages risk; second line provides oversight, guidance, and challenge; third line (internal audit) gives independent assurance to the governing body.

Segregation of duties rule: no single person should hold authority to initiate, approve, execute, and record the same transaction. Incompatible pairs include create vendor vs. approve payment and develop code vs. promote to production.

Balanced Scorecard IT perspectives: financial, customer, internal process, and learning and growth. IT value is measured by outcomes and benefit realization, not by spend alone.

Governance decision archetypes (Weill & Ross): business monarchy, IT monarchy, federal, IT duopoly, and anarchy, applied across input, IT principles, architecture, infrastructure, and investment decisions.

Maturity models rate capability on an ordinal scale (for example 0 nonexistent to 5 optimized); a rating is a gap statement, not a compliance certification by itself.

Availability in nines: 99% = 3.65 days downtime/year; 99.9% = 8.76 hours; 99.99% = 52.6 minutes; 99.999% = 5.26 minutes. Availability = MTBF / (MTBF + MTTR).

RAID: RAID 1 mirrors; RAID 5 stripes with single parity (tolerates one disk failure); RAID 6 uses dual parity (tolerates two); RAID 10 mirrors then stripes. RAID is not a backup.

RPO is the maximum tolerable data loss measured in time; RTO is the maximum tolerable time to restore service. Backup frequency is driven by RPO; recovery infrastructure by RTO.

OSI layers 1-7: physical, data link, network, transport, session, presentation, application. TCP operates at transport; IP at network; TLS sits between transport and application.

Cloud service models: IaaS gives infrastructure control (customer patches the OS); PaaS gives runtime and middleware; SaaS gives the application only. Shared responsibility shifts with the model.

Virtualization type 1 (bare metal) runs the hypervisor on hardware; type 2 runs on a host OS. Containers share the host kernel and isolate at the process level, so they are lighter but weaker isolation boundaries.

CAP theorem: a distributed system under a network partition must choose consistency or availability. BASE (basically available, soft state, eventual consistency) trades immediate consistency for availability.

Database normalization: 1NF removes repeating groups; 2NF removes partial dependencies on part of a composite key; 3NF removes transitive dependencies on non-key attributes.

Encryption for data at rest uses symmetric ciphers (AES) for bulk data; asymmetric keys (RSA, ECC) distribute keys or sign. Hashing (SHA-256) provides integrity, not confidentiality.

CIA triad: confidentiality (authorized disclosure only), integrity (accurate and unaltered), availability (timely access). Non-repudiation proves an action occurred; authentication proves identity; authorization grants rights.

Risk = likelihood x impact. Risk treatment options: mitigate, transfer, avoid, accept. Residual risk is what remains after controls and must be accepted by an accountable owner.

Access control models: DAC (owner grants), MAC (classification labels), RBAC (role-based), ABAC (attributes and policy). Least privilege and need-to-know constrain every model.

Defense in depth layers controls: preventive, detective, corrective, deterrent, compensating. Encryption is preventive; logging and IDS are detective; backups and IR playbooks are corrective.

Symmetric key sizes: AES-128, AES-192, AES-256. Asymmetric RSA commonly 2048-4096 bits; ECC 256-bit gives roughly 128-bit symmetric strength. SHA-1 and MD5 are deprecated for signatures.

Incident response phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Evidence must preserve chain of custody and order of volatility.

Privacy principles (OECD/GDPR-aligned): purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability. GDPR requires breach notification within 72 hours where required.

Data roles: controller determines purpose and means; processor acts on the controller's instructions; data subject is the individual. Cross-border transfer needs a lawful mechanism such as adequacy or standard contractual clauses.

BCP vs. DRP: business continuity focuses on keeping critical business functions running; disaster recovery focuses on restoring IT infrastructure and data after a disruption.

SDLC phases: planning, analysis, design, build, test, deploy, maintain. Waterfall is sequential with phase gates; iterative and agile deliver increments with continuous feedback.

Agile/Scrum: product backlog, sprint backlog, increments. Roles are product owner (value and priority), Scrum Master (process), and developers. Sprint length is fixed; scope may change only between sprints.

Earned value: EV = % complete x BAC; PV = planned value; AC = actual cost. CV = EV - AC; SV = EV - PV; CPI = EV/AC; SPI = EV/PV. CPI or SPI below 1.0 indicates over budget or behind schedule.

Estimate at completion: EAC = BAC/CPI when current performance continues; EAC = AC + ETC when a fresh bottom-up estimate is used. ETC = EAC - AC; VAC = BAC - EAC.

Critical path is the longest duration path through the network; it determines minimum project duration, and its float (slack) is zero. Float = late start - early start.

Change control: request, impact assessment, approval by change authority, implementation, verification, and documentation. Uncontrolled scope change is scope creep; a CCB governs baseline changes.

Testing levels: unit (component), integration (interfaces), system (end-to-end), UAT (business acceptance), regression (no new breakage). Black-box tests behavior; white-box tests internal logic.

Separation of environments: development, test, and production. A developer must not promote their own code to production; peer review plus a separate release authority enforces this.

Procurement: RFP solicits proposals when requirements are known; RFQ for price on defined goods; RFI gathers capability information. Contract types: fixed-price (seller bears cost risk), cost-reimbursable (buyer bears it), time and materials (shared).