CITM study guide
CITM · Work through your exam, one topic at a time.
The Certified Information Technology Manager (CITM) is a vendor-neutral credential aimed at people who manage technology rather than only operate it: IT managers, team leads, senior engineers moving into management, and business managers with technology oversight. It tests whether you can connect IT work to organisational strategy, run services and projects predictably, and govern security, risk, data, and money in a defensible way. The CITM study guide has 10 sections and about 4,061 words.
01IT Strategy and Governance
The IT Strategy and Governance domain tests whether you can connect business direction to technology choices and distinguish governing IT from managing it. Questions target strategy formulation, operating models, decision rights, portfolio value, and benefits realization.
436 words, about 2 min02IT Service Management and Operations
This domain tests whether you can run IT as a service system rather than a set of silos. Expect questions on ITIL 4 concepts, incident and problem management, change enablement, service levels, and continual improvement.
423 words, about 2 min03Project and Program Management
This domain tests whether you can select the right delivery approach, plan and control work, and connect projects to program benefits. Expect questions on lifecycles, scope, scheduling, earned value, stakeholders, and benefits realization.
426 words, about 2 min04Information Security Management
This domain tests whether you can manage security as risk-based governance, not as a product checklist. Expect questions on the CIA triad, ISMS controls, security frameworks, identity, incident response, and third-party risk.
386 words, about 2 min05Risk Management and Compliance
This domain tests whether you can run risk as a continuous, owned process and map obligations into controls. Expect questions on risk terminology, ISO 31000, COSO ERM, treatment options, heat maps, and compliance testing.
413 words, about 2 min06Data Management and Analytics
This domain tests whether you can treat data as an asset with ownership, quality rules, and lifecycle controls. Expect questions on DAMA-DMBOK knowledge areas, data quality dimensions, master data, metadata, analytics maturity, and privacy.
381 words, about 2 min07Enterprise Architecture and Emerging Technology
This domain tests whether you can use architecture to connect business capabilities to technology standards and evaluate emerging technology without hype. Expect questions on TOGAF, architecture domains, capability mapping, cloud responsibility, and AI governance.
403 words, about 2 min08IT Financial Management and Vendor Management
This domain tests whether you can budget, cost, and justify IT services and manage suppliers across the lifecycle. Expect questions on capex versus opex, TCO, chargeback, investment appraisal, sourcing, SLAs, and exit planning.
386 words, about 2 min09Business Continuity and Disaster Recovery
This domain tests whether you can keep critical services running through disruption and recover technology within agreed limits. Expect questions on business impact analysis, recovery objectives, strategies, exercises, and plan maintenance.
403 words, about 2 min10Leadership, Ethics, and Professional Development
This domain tests whether you can lead teams, make defensible ethical decisions, and maintain professional competence. Expect questions on leadership styles, team development, conflict, codes of ethics, conflicts of interest, and continuing development.
404 words, about 2 min