CITP study plan
CITP · Give each week a clear focus.
8 weeks · About 6 hours per week
Information Technology Governance
Map the IT governance domain's four sub-areas (strategic alignment, value delivery, risk management, resource management) to concrete exam-style scenarios
Define and contrast governance vs. management using at least three original examples
Identify the roles of board, audit committee, CIO, and steering committee in IT decision rights
Explain how COBIT-style control objectives link to performance measurement without naming proprietary frameworks as memorized lists
Your checkpoint
A one-page governance concept map with 10 original scenario questions and answer rationales scored at 80% or better
Information Technology Governance
Analyze IT investment prioritization and portfolio decision criteria in written cases
Evaluate outsourcing and vendor governance risks, including exit and service-level provisions
Interpret IT performance metrics and explain how they feed board-level reporting
Distinguish compliance-driven governance from value-driven governance in audit findings
Your checkpoint
A 600-word written analysis of a fictional IT steering committee decision, with a 5-item rubric self-score
Information Systems and Infrastructure
Diagram a reference enterprise architecture covering network, compute, storage, and end-user layers
Compare on-premises, IaaS, PaaS, and SaaS models on control, cost, and resilience trade-offs
Explain virtualization, containers, and orchestration at a level sufficient to answer infrastructure questions
Identify single points of failure and propose redundancy for each layer in the diagram
Your checkpoint
An annotated architecture diagram plus a 400-word resilience gap list with mitigations
Information Systems and Infrastructure
Describe database models, normalization basics, and transaction integrity concepts
Explain availability, recovery point objective, and recovery time objective in operational terms
Evaluate capacity planning and monitoring approaches for a mid-size organization
Assess cloud shared-responsibility boundaries for a given workload
Your checkpoint
A 20-question original infrastructure quiz with answer key, achieving 85% or higher
Information Security, Confidentiality, and Privacy
Classify assets and apply confidentiality, integrity, and availability criteria to each class
Compare authentication factors and access control models with concrete use cases
Explain encryption at rest, in transit, and key management lifecycle controls
Map common threats to preventive, detective, and corrective controls
Your checkpoint
A threat-control matrix covering 12 threats and 3 control types, with a 300-word rationale
Information Security, Confidentiality, and Privacy
Apply privacy principles to data collection, retention, and cross-border transfer scenarios
Distinguish incident response phases and the evidence-handling requirements at each
Evaluate business continuity and disaster recovery plans against stated objectives
Interpret security awareness and third-party risk program requirements
Your checkpoint
A 500-word incident response tabletop write-up with findings and three corrective actions
Systems Development, Acquisition, and Project Management
Compare waterfall, iterative, and agile delivery models on control and documentation needs
Explain requirements elicitation, traceability, and acceptance criteria development
Evaluate build-versus-buy and acquisition due-diligence criteria
Identify project risk, scope, and change-control mechanisms
Your checkpoint
A one-page project charter for a fictional system acquisition, including risk register with five entries
Information Technology Governance & Information Systems and Infrastructure & Information Security, Confidentiality, and Privacy & Systems Development, Acquisition, and Project Management
Synthesize cross-domain scenarios that combine governance, infrastructure, security, and delivery decisions
Diagnose weak answer choices by identifying the distractor pattern used
Time-box practice sets to exam pace and review every missed item
Produce a personal weak-area list with a remediation action per item
Your checkpoint
A full 100-question mixed practice exam scored at 80% or higher, with a written remediation plan
Milestones
Week 2: Score 80% or higher on a self-authored 15-question governance set and explain each wrong answer in writing
Week 4: Complete the infrastructure diagram and quiz with 85% accuracy, and list three residual single points of failure
Week 6: Pass a 20-question security and privacy set at 85%, including at least four privacy-scenario items
Week 8: Achieve 80% or higher on the 100-question mixed exam and submit the remediation plan with dated actions