CITO cheat sheet
CITO · Keep the key ideas within reach.
Daily IT operation, handover and service restoration
Handovers transfer actual context, ownership and pending work.
Events, incidents, problems, requests and changes differ.
Follow current approved target-specific procedures and escalation.
Verify the service outcome, not only a command or ticket result.
Facility maintenance, condition evidence and service verification
Preventive, corrective, condition-based and predictive approaches differ.
An alarm needs context and correlated service evidence.
Maintenance can reduce redundancy despite continued operation.
Verify the actual restored state and unresolved temporary conditions.
Hazard recognition, safe authority and emergency escalation
Study does not confer a permit or practical safety qualification.
Software-off and verified energy isolation are different.
EPO effects are site-specific, not universal all-source disconnection.
Qualified local processes determine permits, PPE and emergency response.
Data-centre procedures, coordination and operational records
IT and facility roles have different authority and qualifications.
Current as-built records and approved local instructions matter.
Separate changes can combine into an unrecognized shared risk.
Work-order closure is not proof of restored service and resilience.
Capacity, airflow, energy and constrained infrastructure
Usable capacity depends on combined local constraints and reserves.
Power and energy need consistent units and measurement boundaries.
PUE is one scoped ratio, not complete service or environmental proof.
Airflow and new loads require qualified actual-installation evidence.
Risk options, shared failures and accountable facility resilience
Risk scores require explicit evidence and assumptions.
Treatment categories are a useful taxonomy, not every standard’s exhaustive wording.
Shared dependencies can defeat nominal redundancy.
Residual risk needs actual authorized ownership and continuing review.
Cyber-risk identification and analysis
Risk assessment cycles through identification, analysis, and evaluation, producing a maintained risk register
Single loss expectancy = asset value x exposure factor; annualized loss expectancy = SLE x annualized rate of occurrence
Risk requires a threat, a vulnerability, and an impact; none alone is sufficient
Inherent risk is before controls, residual risk after them - always state which is being scored
Control effectiveness and uncertainty affect any expected-loss comparison.
Identity, access and cryptographic protection
Identification, authentication, authorisation and accounting are four distinct steps.
MFA needs two different factor categories, not two instances of one.
RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.
Kerberos uses a KDC with TGT and service tickets for SSO.
Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.
Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.
ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.
Network boundaries and protected communication
Internet-facing services belong in a DMZ; data stores sit in a filtered internal zone.
VLANs alone are not a trust boundary - add DAI, private VLANs and 802.1 X.
IPsec AH gives integrity only; ESP adds confidentiality.
IDS is passive and alerts; IPS is inline and blocks.
NAT is not a security control and temporary rules must be removed.
Continuity, backup and technical recovery
Distinguish tolerated data loss from tolerated interruption.
A recovery point and restore time must both meet the stated targets.
A same-failure-domain snapshot alone does not cover loss of that domain.
Verify complete restore procedures and actual dependency behavior.