CITO study guide
CITO · Work through your exam, one topic at a time.
This independent study page provides practice for CITO. Its editorial learning areas include Daily IT operation, handover and service restoration; Facility maintenance, condition evidence and service verification; Hazard recognition, safe authority and emergency escalation; Data-centre procedures, coordination and operational records; Capacity, airflow, energy and constrained infrastructure; Risk options, shared failures and accountable facility resilience; Cyber-risk identification and analysis; Identity, access and cryptographic protection; Network boundaries and protected communication; Continuity, backup and technical recovery. The CITO study guide has 10 sections and about 4,961 words.
01Daily IT operation, handover and service restoration
An IT operator needs a current view of service state, scheduled work, open incidents, important alerts and ownership. A shift handover transfers relevant context and pending actions, not just a list of closed tickets.
364 words, about 2 min02Facility maintenance, condition evidence and service verification
Preventive maintenance uses justified planned work to reduce relevant failure risk, while corrective maintenance addresses observed faults or degradation. Condition-based approaches use relevant state evidence to guide work, and predictive methods estimate future conditions under their actual model.
369 words, about 2 min03Hazard recognition, safe authority and emergency escalation
Data-centre environments can include electrical, mechanical, thermal, battery, stored-energy, lifting and environmental hazards. A certification study page is not a work permit or qualification to intervene.
368 words, about 2 min04Data-centre procedures, coordination and operational records
A data-centre facility supports IT services through physical space, power, cooling, connectivity, security and operational processes. A facility operator and an IT operator have related but different authorities and qualifications.
359 words, about 2 min05Capacity, airflow, energy and constrained infrastructure
Power, cooling, physical space, structural loading, network and service requirements constrain a data-centre design together. A spare electrical rating is not usable IT capacity if cooling or another local limit prevents placing the load.
373 words, about 2 min06Risk options, shared failures and accountable facility resilience
A facility risk assessment considers the intended service, people, assets, dependencies and consequences under relevant uncertain events. Technical failure, human error, malicious activity, organizational gaps and environmental events have different mechanisms.
364 words, about 2 min07Cyber-risk identification and analysis
IT risk assessment has three phases. Identification builds the inventory: assets, processes, data flows, threats, vulnerabilities, and existing controls, often through risk scenarios ("who or what could exploit which vulnerability, and with what consequence?").
747 words, about 4 min08Identity, access and cryptographic protection
This domain tests the identity lifecycle and the mechanisms that turn an identity into an authorised action. Expect questions that separate authentication from authorisation and that ask which access control model fits a scenario.
857 words, about 4 min09Network boundaries and protected communication
This domain tests perimeter architecture and the device behaviour that makes segmentation real. Questions tend to be scenario-based: where a host belongs, which rule is needed, and what a given protocol actually protects.
430 words, about 2 min10Continuity, backup and technical recovery
This domain tests continuity planning: how an organisation keeps critical services running during disruption and how it recovers afterwards. Distinguish the continuity plan from the disaster recovery plan and know the time-based metrics precisely.
730 words, about 4 min