COBIT 2019 Foundation cheat sheet

Governance sets and monitors direction; management operates within it.

Value considers benefits, risk and resources together.

Processes interact with roles, information, skills and culture.

Tailoring needs actual enterprise context rather than a universal template.

Domain classification supports actual coordinated objectives.

Responsibility charts and capability ratings need explicit scope.

A business case tracks assumptions and realized outcomes over time.

Activity completion and intended value are different evidence.

Risk assessment cycles through identification, analysis, and evaluation, producing a maintained risk register

Single loss expectancy = asset value x exposure factor; annualized loss expectancy = SLE x annualized rate of occurrence

Risk requires a threat, a vulnerability, and an impact; none alone is sufficient

Inherent risk is before controls, residual risk after them - always state which is being scored

Control effectiveness and uncertainty affect any expected-loss comparison.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Distinguish tolerated data loss from tolerated interruption.

A recovery point and restore time must both meet the stated targets.

A same-failure-domain snapshot alone does not cover loss of that domain.

Verify complete restore procedures and actual dependency behavior.