CITM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IT governance

The set of decision rights and accountability structures that determine how IT is planned, funded, and controlled, ensuring IT investment aligns with business objectives and risk appetite.

IT steering committee

A cross-functional body, usually business-majority, that prioritizes IT investments, resolves escalations, and monitors value delivery. Decisions are logged with owners and dates.

Business case

A documented justification for an investment stating expected benefits, costs, risks, and alternatives. It is the baseline against which benefit realization is later measured.

Service level agreement

A contract between a service provider and a customer defining measurable service targets, measurement windows, exclusions, and remedies. It must be consistent with internal OLAs and supplier contracts.

Known error

A problem with a documented root cause and workaround, recorded in the known error database so service desk staff can resolve matching incidents quickly.

Emergency change

A change implemented urgently to restore or protect service, reviewed by an emergency CAB or authorized individual, and formally reviewed retrospectively for risk and recurrence.

Critical path

The longest-duration sequence of dependent activities in a project network. It has zero float, so any delay on it delays the whole project.

Cost performance index

Earned value divided by actual cost (CPI = EV/AC). A value below 1.0 means work is costing more than planned; it is used to forecast estimate at completion.

RAID log

A register of risks, assumptions, issues, and dependencies with owners and due dates, reviewed at each status meeting to keep project control current.

Defense in depth

Layering preventive, detective, and corrective controls so that failure of any single control does not expose the asset. No one control is assumed sufficient.

Multi-factor authentication

Authentication requiring factors from at least two different categories: something you know, something you have, something you are. Two passwords do not qualify.

Incident response containment

The phase that stops the spread of a security incident before eradication and recovery. Isolating affected systems precedes removing malware or restoring services.

Residual risk

The risk remaining after existing controls are applied. It is compared against risk tolerance and either accepted with documented ownership or treated further.

Three lines model

A governance structure where operations own and manage risk, risk and compliance functions provide oversight, and internal audit gives independent assurance to the board.

Key risk indicator

A leading, measurable metric with a defined threshold that signals rising risk exposure, triggering a pre-agreed escalation path when breached.

Data lineage

The documented path of data from source through transformations to report, used to trace and reconcile figures and to assess the impact of upstream changes.

Master data management

A discipline creating one trusted version of core entities such as customer or product, governed by data owners and stewards across business units.

Data quality dimensions

Standard measures including accuracy, completeness, consistency, timeliness, uniqueness, and validity, assessed per critical data element to prioritize remediation.

TOGAF ADM

An iterative architecture development method with phases from preliminary through vision, business, information systems, technology, migration planning, implementation governance, and change management.

Technical debt

The accumulated cost of shortcuts in design or code that make future change harder. It is recorded with its interest cost and a remediation plan.

Cloud shared responsibility

The split of security duties between provider and customer. The provider secures the underlying infrastructure; the customer secures data, identities, and configuration.

Total cost of ownership

The full lifetime cost of an asset including acquisition, implementation, licensing, support, training, operations, and decommissioning, used to compare options fairly.

Showback

A reporting practice that informs business units of the cost of IT services they consume without charging their budget, building cost awareness ahead of chargeback.

Vendor lock-in

Dependence on a supplier's proprietary technology or terms that makes switching costly. It is mitigated by exit clauses, portability requirements, and standards adoption.

Recovery time objective

The maximum acceptable time to restore a service after disruption, set by the business from the impact analysis. It must be less than or equal to maximum tolerable downtime.

Recovery point objective

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design for a given service.

Business impact analysis

An assessment identifying critical processes, their dependencies, and the financial and regulatory impact of downtime over time, producing recovery objectives and priorities.

Tabletop exercise

A discussion-based continuity test where participants walk through a scenario and their response, revealing gaps in plans, roles, and communication without disrupting production.

Situational leadership

A model matching directing, coaching, supporting, or delegating style to a follower's competence and commitment for a specific task, rather than to leader preference.

Blameless post-incident review

A structured review focused on systemic causes and control gaps, distinguishing willful violations from process failure, and producing dated corrective actions.

Conflict of interest

A situation where personal interest could improperly influence professional judgment. It is managed through disclosure and recusal, not merely avoided.

Coaching versus mentoring

Coaching draws answers from the individual through structured questioning; mentoring shares the mentor's experience and guidance. Both support professional development differently.