I85PREP
⌘ K
PMI CD-P study materials
PMI CD-P study resources

PMI CD-P: Governance, Risk and Collaboration with IT

PMI CD-P · Work through your exam, one topic at a time.

All guide sections

Governance, Risk and Collaboration with IT

Domain 5 - Governance, Risk and Collaboration with IT

This domain tests guardrails: how to let citizen developers move quickly without creating unmanaged risk. Expect questions on risk tiering, data classification, data loss prevention, app inventory, lifecycle ownership and working with IT as a partner rather than a gatekeeper.

Risk-proportionate governance

  • Tier applications by data sensitivity, user population, financial impact and criticality. A personal productivity tool needs light-touch registration; an app holding salary or health data needs formal review.
  • Match controls to tier: documentation, change control, security review, testing evidence and access recertification scale with risk.

Data and platform controls

  • Classify data before build. Personal, financial and regulated data trigger stricter handling.
  • Apply DLP policies that block risky connectors, such as consumer file storage or personal email, and limit external sharing.
  • Restrict guest access and set sharing limits; require named owners rather than shared generic accounts.

Lifecycle and roles

  • Maintain an inventory of apps, owners, data sources and business purpose.
  • Define who supports the app, who approves changes and how it is retired.
  • Clarify roles: citizen developer, business sponsor, process owner, IT platform team, security, data owner and center of excellence.
  • Engage IT early on identity, integration and data access. A fusion team beats a late handoff.

Worked example

An HR skills app initially looks low risk, but it stores salary bands, which reclassifies it as confidential. Controls escalate: an IT-provisioned environment with row-level security, DLP blocking personal-email connectors, a security review, quarterly access recertification and a named support owner. The build is still fast, but guardrails are proportionate to the data.

Traps that cost marks

  • Treating governance as a one-time approval gate rather than a continuous process.
  • Unregistered apps that become business-critical and are then orphaned when the maker changes roles.
  • Over-blocking everything, which pushes makers into shadow IT.
  • Ignoring data residency, retention or personal-data obligations.
  • Assuming IT will support an app it has never seen.