CITM cheat sheet

Strategy hierarchy: business strategy → IT strategy → IT operating plan; every IT initiative must trace upward to a business objective or it is a candidate for elimination.

Governance vs. management: governance sets decision rights and accountability (who decides, who is consulted); management executes within those rights.

Common IT governance archetypes: business monarchy, IT monarchy, federal, IT duopoly, feudal, anarchy - chosen per decision domain (principles, architecture, infrastructure, investment prioritization).

Portfolio classification (McFarlan): strategic, high-potential, key operational, support - drives differing funding and oversight intensity.

Value delivery metrics: IT spend as % of revenue, % of budget on run vs. change, % of projects delivering stated benefits, business satisfaction score.

IT steering committee composition rule: business-majority membership with CIO as secretary; decisions logged with owner and date.

Maturity models (e.g., CMMI-style levels 1–5) are diagnostic, not targets; the level is set by the weakest practice in the value stream.

Strategy-to-execution gap check: each objective needs an owner, a measure, a baseline, and a review cadence; missing any one predicts non-delivery.

Incident vs. problem: an incident restores service fast (workaround acceptable); a problem removes the root cause. Never let problem analysis delay incident restoration.

Priority = Impact × Urgency; severity describes business effect, priority describes queue order - they are not synonyms.

Change types: standard (pre-authorized, low risk), normal (CAB review), emergency (ECAB, retro-reviewed). A change without a rollback plan is not approvable.

SLA vs. OLA vs. UC: SLA is customer-facing, OLA is internal support-to-support, underpinning contract is with an external supplier; all three must be consistent.

Service level targets must be measurable: availability % measured over a defined window, with agreed exclusions (planned maintenance) and measurement points.

CSI register holds improvement opportunities with owner, benefit, and status; it is the input to continual improvement, not a complaint log.

Known error = problem with a documented root cause and workaround; it belongs in the KEDB and should drive proactive incident matching.

Major incident review must be blameless and produce dated actions; repeat major incidents on the same CI indicate unresolved problem management.

Iron triangle: scope, time, cost are constrained; quality sits inside. A change to any one requires an approved change to at least one other.

Critical path = longest duration path through the network; it has zero float. Crashing adds resources to the critical path; fast tracking overlaps activities and adds risk.

Earned value: CV = EV − AC; SV = EV − PV; CPI = EV/AC; SPI = EV/PV; EAC = BAC/CPI when the current cost performance is expected to continue.

A program delivers outcomes and benefits across related projects; a portfolio is the prioritized collection of programs and projects aligned to strategy.

RAID log (Risks, Assumptions, Issues, Dependencies) is reviewed at every status meeting; issues have owners and due dates, risks have owners and triggers.

Stage-gate/phase-gate control: each gate has entry criteria and a decision (go, no-go, conditional); funding is released per stage, not all upfront.

Scope creep is uncontrolled addition without change control; gold plating is the team adding unrequested features - both erode the baseline.

Benefit realization is measured after project closure against the business case; a project is not successful merely because it delivered on time.

CIA triad is the evaluation lens: Confidentiality (disclosure), Integrity (alteration), Availability (access when needed). Every control maps to at least one.

Defense in depth layers preventive, detective, and corrective controls; no single control is assumed sufficient.

Authentication factors: something you know, have, are (plus location/time as contextual). MFA requires factors from different categories.

Least privilege and segregation of duties are the two structural controls against insider misuse; both are audited via access reviews.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, lessons learned. Containment precedes eradication.

Vulnerability vs. threat vs. risk: a vulnerability is a weakness, a threat is an actor or event that could exploit it, risk is the combination with likelihood and impact.

Encryption at rest protects stored data; in transit protects the channel (TLS). Key management failure voids both - protect keys separately from data.

Security awareness metrics that matter: phishing simulation click and report rates over time, not completion percentages of training modules.

Risk = likelihood × impact (qualitative matrix) or probability × monetary loss (quantitative). Inherent risk is before controls; residual risk is after controls.

Risk treatment options: avoid, mitigate, transfer (insurance, contract), accept. Acceptance must be documented with an owner and a review date.

Risk appetite is the amount of risk the organization is willing to pursue; risk tolerance is the acceptable deviation around a specific objective.

Compliance is evidence-based: a control that cannot be evidenced is treated as not operating by most auditors.

Three lines model: operations own risk (first), risk/compliance functions oversee (second), internal audit provides independent assurance (third).

Control testing samples must be representative; a single passing sample does not demonstrate operating effectiveness across a period.

Regulatory mapping: one control can satisfy multiple obligations - maintain a control-to-requirement matrix to avoid duplicate work.

Key risk indicators (KRIs) are leading, threshold-based, and owned; a KRI breaching its threshold triggers a defined escalation path.

Data quality dimensions: accuracy, completeness, consistency, timeliness, uniqueness, validity. Measure each per critical data element.

Metadata types: technical (schema, format), business (definitions, ownership), operational (lineage, job logs). Business metadata resolves most reporting disputes.

Master data management creates a single trusted version of core entities (customer, product, supplier); it requires a data owner per domain.

Data lifecycle: create/acquire, store, use, share, archive, dispose. Retention schedules must reflect legal and regulatory minimums.

Analytics maturity: descriptive (what happened) → diagnostic (why) → predictive (what will happen) → prescriptive (what to do).

Lineage answers 'where did this number come from'; without it, reconciliation between reports becomes manual and slow.

Data governance bodies: a steering council sets policy; data owners are accountable; data stewards execute quality and definitions day to day.

Privacy by design principles include data minimization and purpose limitation - collect only what the stated purpose requires.

Architecture domains: business, data, application, technology. A target-state architecture must be paired with a transition roadmap of sequenced states.

TOGAF ADM cycle phases: Preliminary, A (Vision), B (Business), C (Information Systems), D (Technology), E (Opportunities/Solutions), F (Migration Planning), G (Implementation Governance), H (Change Management).

Architecture principles are decision rules stated as rationale + implications; they constrain solutions and must be enforced at design review.

Integration patterns: point-to-point scales poorly; hub-and-spoke (ESB) centralizes; event-driven decouples producers and consumers but complicates tracing.

Cloud service models: IaaS (infrastructure), PaaS (platform/runtime), SaaS (application). Responsibility for patching shifts toward the provider as you move up.

Build vs. buy decision factors: differentiation value, total cost of ownership over 5 years, integration effort, exit/portability risk.

Emerging tech evaluation should separate hype from fit: assess business value, maturity, skills availability, and regulatory constraints before piloting.

Technical debt is a deliberate or accidental trade-off; it must be recorded in a register with interest (cost of delay) and a remediation plan.

TCO includes acquisition, implementation, licensing, support, training, operations, and decommissioning - not just purchase price.

Cost allocation models: direct, indirect, and chargeback/showback. Showback informs; chargeback creates accountability but needs a defensible driver.

CapEx vs. OpEx: capital purchases are depreciated over useful life; subscription spend is operating expense. Cloud shifts CapEx toward OpEx.

Budget variance analysis: report absolute variance and percentage; investigate variances beyond an agreed threshold, both over and under.

Unit cost metrics (cost per transaction, per user, per ticket) enable benchmarking and trend detection better than absolute totals.

Vendor selection scoring must weight criteria before evaluation and be documented; price-only selection ignores lock-in and service risk.

Contract must-haves: SLAs with credits, termination for convenience, data ownership and return, audit rights, price escalation caps, exit assistance.

Vendor risk tiering drives due diligence depth: data access, criticality to operations, and subcontractor use determine the tier.

RTO = maximum tolerable downtime; RPO = maximum tolerable data loss measured in time. Both are set by the business, not by IT.

Recovery strategies ladder: backup and restore, pilot light, warm standby, hot standby/active-active - cost rises as RTO and RPO tighten.

BIA (business impact analysis) identifies critical processes, dependencies, and the financial/regulatory impact of downtime over time.

MTD (maximum tolerable downtime) is the outer limit from the BIA; RTO must be less than or equal to MTD.

Backups are not DR until restore is tested; an untested backup has unknown RPO and unknown integrity.

DR tiers: cold site (space and power), warm site (partial equipment), hot site (fully equipped, near-instant).

Crisis communication plan names spokespeople, channels, and cadence; the first statement often matters more than the technical fix.

Exercise types escalate in rigor: tabletop, walkthrough, simulation, full failover. Findings must feed a dated remediation plan.

Situational leadership: directing, coaching, supporting, delegating - matched to follower competence and commitment, not to leader preference.

Decision rights clarity (RACI/RAPID) reduces escalation; ambiguity about who decides is a more common failure than wrong decisions.

Ethical tests: legality, policy alignment, stakeholder impact, disclosure test (would you be comfortable if it were public).

Conflict of interest must be disclosed and managed, not merely avoided; recusal is the standard remedy in procurement decisions.

Blameless post-incident review separates individual accountability for willful violation from systemic causes; both are recorded.

Mentoring vs. coaching: mentoring shares experience and guidance; coaching draws the answer from the individual through questioning.

Professional development plan links a skill gap to a business need, with a target date and evidence of application.

Whistleblowing protections require a channel independent of the line management chain; retaliation is itself a policy violation.