CGEIT: Certified in the Governance of Enterprise IT

Portfolio management selects, prioritizes, and governs investments to align them with enterprise strategy and maximize the benefits delivered, thereby enabling value creation.

Executive sponsorship is best secured by showing how an IT-enabled initiative advances business objectives and delivers measurable business value. This aligns the initiative with the priorities for which executives are accountable.

Compliance with applicable local regulations can require operating conditions or constrain available risk treatments. Such a legal obligation is a stronger basis for a formally governed exception to the enterprise’s normal risk appetite than local practices, framework alignment, or technical differences. ISACA identifies laws and regulations as externally imposed requirements and distinguishes them from controls used to manage risk within appetite and tolerance.

Enterprise risk appetite is the primary basis for a risk management policy because it defines the level and types of risk the organization is prepared to accept while pursuing its objectives. The policy, framework selection, controls, and investment risk decisions should align to that boundary.

A BYOD initiative must begin with a risk assessment to identify the security, privacy, compliance, and data-protection exposures created by allowing personal devices to access enterprise e-mail. The resulting risk profile informs appropriate policy, architecture, and infrastructure changes.