ICSAN MIS cheat sheet

An information system is a set of interrelated components (people, process, data, software, hardware, networks) that collect, process, store and distribute information to support decision making and control.

Data are raw unprocessed facts; information is data processed into meaningful form; knowledge is information combined with experience and context to enable action.

Characteristics of valuable information: accuracy, timeliness, completeness, relevance, economy, verifiability, accessibility and security.

The three levels of an organisation map to system types: operational (TPS), managerial (MIS, DSS) and strategic (EIS/ESS).

Transaction Processing Systems record routine daily transactions; they are the primary source of internal organisational data and require high reliability and audit trails.

Decision support systems combine data, models and a user interface; GDSS adds group support, while EIS provides executive dashboards with drill-down.

Anthony's framework: strategic planning, management control and operational control - each needs different aggregation, time horizon and information granularity.

A business process is a set of logically related activities producing a defined outcome; IS value arises primarily from process improvement and redesign, not from automation alone.

The value chain (Porter) separates primary activities (inbound logistics, operations, outbound logistics, marketing/sales, service) from support activities; IS can add value at each link.

IS strategy has three components: IS strategy (business demand for information), IT strategy (technology supply) and IM strategy (management of the IS function).

Strategic alignment means IS plans derive from and trace back to corporate objectives; a common failure mode is an IT plan built bottom-up with no business sponsor.

Porter's five forces and value chain inform competitive strategy; IS can lower costs, differentiate, focus on niche, create switching costs or lock in suppliers and customers.

A portfolio approach classifies IS investment by risk and return (high potential, strategic, key operational, support), each requiring different evaluation and management.

McFarlan's strategic grid positions applications by current and future strategic dependence on IT, guiding investment and contingency planning.

IT governance is the system by which IT is directed and controlled; it specifies decision rights and accountability for principles, architecture, infrastructure, investment and prioritisation.

Governance frameworks include COBIT (objectives and control), ITIL (service management), ISO/IEC 38500 (corporate governance of IT) and TOGAF (enterprise architecture).

Alignment maturity models (e.g. Luftman) assess communication, competency, governance, partnership, scope and skills; maturity is measured, not assumed.

Corporate governance allocates rights and responsibilities among board, management, shareholders and stakeholders and sets the rules for decision making and accountability.

COBIT separates governance (EDM: evaluate, direct, monitor) from management (APO, BAI, DSS, MEA domains); it aligns IT objectives to enterprise goals.

COSO internal control has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

The COSO ERM framework links strategy, risk appetite and performance; risk is treated as the effect of uncertainty on objectives, with inherent, residual and target risk distinguished.

Segregation of duties prevents one person controlling authorisation, custody, recording and reconciliation; compensating controls apply where segregation is impractical.

IT general controls cover access management, change management, IT operations and backup/recovery; application controls cover input, processing and output.

Risk treatment options are avoid, reduce (mitigate), transfer (share, e.g. insurance) and accept; risk = likelihood × impact, and residual risk must fall within risk appetite.

The three lines model: operational management owns risk, a risk/compliance function provides oversight, and internal audit provides independent assurance.

Audit trail requirements: every material transaction must be attributable to an authorised user, timestamped, and retained per legal and regulatory retention rules.

SDLC phases: planning, requirements analysis, design, build, test, implementation and maintenance; each phase has defined deliverables and review gates.

Waterfall suits stable, well-understood requirements; iterative/incremental and Agile suit evolving requirements and deliver working software in time-boxed sprints.

Requirements must be testable; functional requirements describe behaviour, non-functional requirements cover performance, availability, security, usability and compliance.

Build-versus-buy decision weighs total cost of ownership, strategic differentiation, time to market, integration risk and vendor lock-in.

Procurement controls: defined requirements and evaluation criteria, due diligence on vendor viability and security, contractual SLAs, exit and data-return clauses.

Project management constraints are scope, time, cost and quality (plus risk and resources); a change to one affects the others and must go through change control.

Critical path method identifies the longest dependent sequence; float (slack) is the amount a non-critical task can slip without delaying the project.

Earned value: CV = EV − AC; SV = EV − PV; CPI = EV/AC; SPI = EV/PV; CPI or SPI below 1.0 indicates cost or schedule overrun.

Testing levels: unit, integration, system, user acceptance; regression testing verifies changes did not break existing functionality, and UAT sign-off transfers ownership to the business.

ERP integrates core processes (finance, HR, procurement, manufacturing, inventory) on a single database with shared master data and standardised processes.

ERP success factors: executive sponsorship, process standardisation before configuration, data migration quality, user training and change management.

ERP failures commonly stem from scope creep, unrealistic timelines, poor data quality and resistance to process change rather than software defects.

CRM covers marketing, sales and service; operational CRM supports transactions, analytical CRM analyses customer data, and collaborative CRM manages interaction channels.

SCM coordinates planning, sourcing, manufacturing, delivery and returns; bullwhip effect is demand amplification upstream caused by poor information sharing.

Enterprise systems include ERP, SCM, CRM, SRM, PLM and HRMS; integration is achieved via middleware, APIs, EDI or service-oriented architecture.

Master data management establishes a single trusted source for customers, products, suppliers and chart of accounts; poor master data is a leading cause of ERP reconciliation failures.

Business process reengineering redesigns processes from scratch around outcomes; ERP implementation without BPR often automates existing inefficiency.

A relational database stores data in tables (relations) of rows and columns; a primary key uniquely identifies a row and a foreign key enforces referential integrity.

Normalisation reduces redundancy and update anomalies: 1NF removes repeating groups, 2NF removes partial dependencies, 3NF removes transitive dependencies.

ACID properties of transactions: atomicity, consistency, isolation, durability; these protect data integrity under concurrent access and failure.

SQL categories: DDL (CREATE, ALTER, DROP), DML (SELECT, INSERT, UPDATE, DELETE), DCL (GRANT, REVOKE) and TCL (COMMIT, ROLLBACK).

A data warehouse is subject-oriented, integrated, time-variant and non-volatile, supporting analysis; a data mart is a subset for a department.

OLTP supports high-volume transactional processing; OLAP supports multidimensional analysis using cube operations such as slice, dice, drill-down and roll-up.

ETL extracts, transforms and loads data; data quality dimensions include accuracy, completeness, consistency, timeliness, uniqueness and validity.

BI stack layers: data sources, ETL, warehouse, semantic layer, reporting/dashboards and analytics; data governance defines ownership, stewardship and quality standards.

Big data characteristics: volume, velocity, variety, veracity and value; NoSQL stores include key-value, document, column-family and graph databases.

E-business models: B2B, B2C, C2C, B2G/G2C and m-commerce; revenue models include subscription, transaction fee, advertising and freemium.

Digital transformation is the integration of digital technology into all areas of business, changing operating models and value delivery, not merely digitising documents.

Cloud service models: IaaS (infrastructure), PaaS (platform), SaaS (application); deployment models are public, private, community and hybrid.

Cloud risks: vendor lock-in, data residency, shared responsibility gaps, availability dependency and exit/data-portability constraints.

Blockchain provides a distributed, append-only ledger with cryptographic linking; consensus mechanisms include proof of work and proof of stake, and immutability has limits at the endpoints.

IoT combines sensors, connectivity and analytics; security exposure widens because devices are numerous, long-lived and often poorly patched.

AI and machine learning systems raise model risk, bias, explainability and data-provenance concerns; governance requires documented data, monitoring and human oversight.

RPA automates rule-based, repetitive tasks at the user interface layer; it is fast to deploy but brittle to interface changes.

Emerging technology evaluation criteria: business fit, maturity, integration effort, regulatory acceptability, total cost of ownership and exit strategy.

CIA triad: confidentiality, integrity and availability; supporting properties include authenticity, accountability and non-repudiation.

Authentication verifies identity (something you know, have or are); authorisation grants permissions; accounting/auditing records actions.

Defence in depth layers controls: perimeter, network segmentation, endpoint, application, data encryption and identity management, plus monitoring.

Threat categories include phishing, ransomware, malware, insider misuse, denial of service, supply chain compromise and social engineering.

Risk treatment for information security follows identification, assessment, treatment, monitoring; ISO/IEC 27001 specifies an ISMS with risk-based controls in Annex A.

Cryptography: symmetric (AES) uses one shared key; asymmetric (RSA, ECC) uses public/private key pairs for key exchange and digital signatures; hashing (SHA-256) provides integrity, not confidentiality.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Privacy principles: lawful basis, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability; GDPR adds data subject rights and breach notification.

Business continuity and disaster recovery: RTO is maximum acceptable downtime, RPO is maximum acceptable data loss; backups must be tested and stored offline or immutable.

ITIL service value chain activities: plan, engage, design and transition, obtain/build, deliver and support, improve.

An incident is an unplanned interruption or degradation; a problem is an unknown root cause of one or more incidents; a change is an addition or modification to any service component.

Incident priority is derived from impact and urgency; major incidents require dedicated coordination, communication and post-incident review.

Change management categorises changes as standard (pre-authorised), normal (assessed) and emergency; CAB reviews risk, impact and backout plans.

Service level agreement defines measurable commitments between provider and customer; OLA supports internal dependencies and underpinning contracts cover suppliers.

Service desk is the single point of contact; functions include incident logging, first-line resolution, escalation and knowledge management.

Capacity and availability management monitor performance against demand forecasts and agreed availability targets, expressed as a percentage of agreed service time.

Configuration management maintains the CMDB and configuration items; accurate CI relationships underpin impact analysis and problem diagnosis.

Continual improvement uses a plan-do-check-act cycle with metrics such as first-time fix rate, mean time to restore and SLA compliance.

Professional codes (e.g. BCS, ISACA, ACM) require competence, integrity, confidentiality, objectivity and avoidance of conflicts of interest.

Computer misuse offences typically cover unauthorised access, unauthorised modification and unauthorised impairment of computer operation.

Data protection principles require lawful processing, purpose limitation, minimisation, accuracy, retention limits, security and accountability.

Data subject rights include access, rectification, erasure, restriction, portability and objection; requests must be handled within statutory timeframes.

Intellectual property categories relevant to IS: copyright (software, content), patents (inventions), trade secrets (algorithms, source code), trademarks (brands).

Software licensing models include proprietary, open source (permissive vs copyleft), subscription and per-seat; licence compliance is auditable.

Contract law governs IS procurement and outsourcing: warranties, indemnities, limitation of liability, service credits, termination and data-return clauses.

Cross-border data transfer requires a lawful transfer mechanism such as adequacy decision, standard contractual clauses or binding corporate rules.

Audit and record retention obligations require systems to preserve records, ensure authenticity and produce them on regulatory request; e-discovery requires defensible data handling.