CITM key terms

The system of decision rights and accountability that determines how IT is directed, evaluated, and monitored so that technology investment supports organizational objectives and stays within agreed constraints.

The process of ensuring that technology priorities, spending, and capability building map directly to business goals, and that business plans in turn account for what technology makes feasible.

A cross-functional oversight body of senior leaders that sets priorities, resolves escalated conflicts, approves funding gates, and monitors delivery of a program or service portfolio.

A stated outcome that a control must achieve, such as ensuring only authorized users can change production data; it is written before specific controls are designed or tested.

A documented commitment between a provider and a customer that defines services, measurable targets such as availability or response time, responsibilities of each party, and remedies for missed targets.

An internal agreement between teams within the same provider organization that specifies the support each team supplies so that externally promised service targets can be met.

A structured list of services offered to users, describing what each service delivers, who may request it, expected cost, and the request or fulfillment path.

The practice of restoring normal service as quickly as possible after disruption, prioritizing impact and urgency, communicating status, and separating rapid restoration from deeper root-cause work.

The practice of finding and eliminating underlying causes of recurring incidents, using trend analysis and known-error records to reduce future disruption rather than only restoring service.

A repository holding records of configuration items such as servers, applications, and dependencies, along with their attributes and relationships, used to assess change impact and support incident diagnosis.

The controlled process for assessing, approving, scheduling, and reviewing modifications to production environments so that risk is understood and service stability is protected.

A decision checkpoint in a delivery lifecycle where sponsors review evidence, such as a business case or test results, and choose to continue, pause, redirect, or cancel the effort.

The longest sequence of dependent activities in a schedule, which determines the earliest possible completion date; delay on any activity in that chain delays the whole project.

A hierarchical decomposition of project scope into manageable deliverables and work packages, forming the basis for estimating cost, assigning ownership, and tracking progress.

A technique comparing planned value, earned value, and actual cost to express schedule and cost performance as indices and variances, enabling early corrective action.

Uncontrolled expansion of project deliverables through small, unapproved additions that consume budget and time without corresponding changes to the plan or business case.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively or as tolerance thresholds that guide decisions and escalation.

A living record of identified risks, each with owner, likelihood, impact, rating, planned response, and status, used to prioritize attention and evidence due diligence.

The chosen response to a risk: avoid the activity, reduce likelihood or impact through controls, transfer it contractually or through insurance, or knowingly accept it.

The risk that remains after controls and other responses are applied; it must be compared with the stated tolerance to decide whether further action is required.

A forward-looking metric that signals rising exposure before losses occur, such as count of unpatched critical systems or percentage of access reviews completed on time.

The principle that each user, service, or process receives only the access needed for its defined task, for only as long as needed, limiting damage from error or compromise.

Splitting sensitive tasks, such as requesting, approving, and executing a payment or code change, among different people so no single individual can complete a transaction unobserved.

Layering independent preventive, detective, and corrective safeguards so that failure or bypass of one control does not by itself expose critical assets.

The organized process of preparing for, detecting, containing, eradicating, and recovering from security events, followed by lessons learned and evidence preservation.

The continuous cycle of discovering technical weaknesses, assessing their severity and exploitability in context, prioritizing remediation, and verifying that fixes were applied.

The assignment of decision rights and responsibilities for data quality, definitions, access, and usage, so that data is trusted, protected, and usable across the organization.

The operational role of named individuals who maintain definitions, resolve quality issues, and approve access for a specific data domain on behalf of the business.

The discipline of creating and maintaining a single trusted version of core entities such as customers, products, and suppliers, with clear ownership and reconciliation rules.

Assigning labels such as public, internal, confidential, or restricted to information so that handling, retention, and protection requirements are proportionate and consistently applied.

Measurable characteristics used to judge fitness of data, typically including completeness, accuracy, consistency, timeliness, uniqueness, and validity, each with defined acceptance thresholds.

The practice of describing business capabilities, processes, applications, data, and infrastructure, plus their relationships, to guide coherent change and reduce duplication.

A reusable, standardized blueprint of components and interaction patterns that projects can adopt, speeding design and enforcing consistency with enterprise standards.

The accumulated future cost of shortcuts in design or code that speed short-term delivery but make later change slower, riskier, or more expensive unless deliberately repaid.

The full lifecycle cost of an asset or service, including acquisition, implementation, licensing, support, training, downtime, and retirement, used to compare options fairly.

The practice of billing internal consumers for the IT services they use, based on a defined rate or consumption metric, to make demand and cost visible.

Oversight of third parties across selection, contracting, performance monitoring, risk review, and exit planning, so that dependencies are understood and obligations are met.

The study that identifies critical business functions, their dependencies, and the tolerable outage and data-loss limits that recovery plans must satisfy.

The maximum acceptable elapsed time to restore a function or system after disruption, derived from business impact analysis and used to size recovery capability.

The maximum acceptable amount of data loss measured in time before a disruption, which determines backup frequency and replication design.

Exercising recovery plans and technology failover under controlled conditions, then documenting gaps, so that stated objectives are proven rather than assumed.

A situation where personal, financial, or other interests could improperly influence professional judgment; it must be disclosed and managed even when no wrongdoing has occurred.

A published set of behavioral expectations covering integrity, confidentiality, acceptable use, and reporting obligations, which staff acknowledge and which guides disciplinary decisions.