Overview
Governance and Management of IT covers how an organization decides what IT should achieve and then makes sure it happens. Its 11 sub-topics span the governance side (laws and industry standards, organizational structure and IT strategy, policies and procedures, enterprise architecture, enterprise risk management, the privacy program, data governance and classification) and the management side (IT resources, vendors, performance monitoring, and quality management).
Candidates must separate governance, which sets direction and holds people accountable, from management, which plans and runs the work. The auditor's questions are whether IT strategy follows business strategy, whether risk is owned and treated within appetite, whether outsourced services remain under control, and whether performance is measured in business terms. These governance artifacts become the criteria for audits in Domains 3 to 5, so weaknesses here usually explain the control failures found there.
How it's tested
Questions describe an organization's structure, plans, metrics or contracts and ask for the GREATEST concern, the BEST recommendation or who is responsible. Several options are reasonable management practices; the correct one addresses the root governance gap, such as missing alignment, missing ownership or missing oversight, rather than a symptom.
-
Who owns it
Options assign the same decision to the board, senior management, the CIO, the data owner or IT staff. Choose the role that holds accountability for that decision in a well-governed organization.
-
Alignment gap
The scenario shows IT performing well on its own metrics while the business is unhappy. The answer links IT objectives or measures back to business goals.
-
Outsourced but accountable
A third party runs a service and something goes wrong. The answer keeps accountability with the organization and uses contract terms, monitoring or independent assurance reports.
An auditor finds that IT projects are approved by the CIO alone, budgets are met, but business units say the portfolio misses their priorities. Options include adding project managers, a new budgeting tool, or a steering committee with business representation. Reasoning: the gap is in who decides priorities, not in delivery. A steering committee that ranks projects against business objectives fixes the root cause.
Sub-topics 11
Official sub-topics from the ISACA outline, in outline order.
2.1 Laws, Regulations, and Industry StandardsIdentifying the legal, regulatory and contractual requirements IT must meet.
- What it means
- Organizations face laws (such as data protection and financial reporting rules), regulations from sector supervisors, and industry standards that become binding through contracts, such as card payment security standards.
- What to understand
- Management is responsible for compliance; the auditor checks that a process exists to identify applicable requirements, assign owners, track changes and monitor adherence. Requirements differ by jurisdiction where data is stored or processed, which matters for cloud and outsourced services.
- How it shows up
- A scenario asks what the auditor should verify FIRST when reviewing regulatory compliance; the answer is that management has identified the requirements that apply, before testing individual controls.
- Common confusion
- Assuming the auditor or legal team decides which laws apply; the auditor evaluates whether management's identification process is complete and current.
2.2 Organizational Structure, IT Governance, and IT StrategyBoard oversight, committees, IT reporting lines and aligning IT strategy with the business.
- What it means
- IT governance is the board's responsibility for ensuring IT supports enterprise objectives, manages risk and uses resources responsibly. An IT strategy committee advises the board on strategic direction, while an IT steering committee of senior business and IT managers prioritizes and oversees investments and projects.
- What to understand
- IT strategy must be derived from business strategy and reviewed when the business changes. Structure matters: segregation of duties inside IT (development, operations, security administration) and a CIO reporting line senior enough to influence decisions. Frameworks such as COBIT separate governance (evaluate, direct, monitor) from management (plan, build, run, monitor).
- How it shows up
- Questions ask the BEST indicator of effective IT governance or the greatest concern in a structure; a steering committee without business representation or an IT strategy not linked to business goals is the usual target.
- Common confusion
- Mixing up the board-level IT strategy committee, which advises on direction, with the management-level steering committee, which oversees projects and resource allocation.
2.3 IT Policies, Standards, Procedures and PracticesThe document hierarchy that turns governance intent into required behavior.
- What it means
- Policies state management intent and are approved at senior level; standards set mandatory specific requirements; procedures give step-by-step instructions; practices and guidelines describe how work is actually done or recommended.
- What to understand
- Policies should be top-down, aligned with business objectives, communicated, periodically reviewed and supported by an exception process with documented risk acceptance. Bottom-up policies built from existing procedures may be operationally accurate but risk missing strategic intent.
- How it shows up
- A scenario shows staff following an undocumented practice or a policy last reviewed years ago and asks for the greatest concern or best recommendation.
- Common confusion
- Treating an approved policy as proof that controls operate; the auditor still tests whether procedures implement it and staff follow them.
2.4 Enterprise Architecture and ConsiderationsDocumenting current and target IT architecture so investments fit together.
- What it means
- Enterprise architecture (EA) describes the organization's business processes, data, applications and technology in a current state and a target state, using frameworks such as Zachman or TOGAF, and plans the transition between them.
- What to understand
- EA reduces duplicate systems, incompatible technologies and unmanaged technical debt by giving each new investment a place in the target design. Considerations include cloud adoption, integration with legacy systems and emerging technologies, each assessed for risk and fit before adoption.
- How it shows up
- A question describes several business units buying overlapping, incompatible systems and asks what governance mechanism would have prevented it; an enterprise architecture with review of new investments is the answer.
- Common confusion
- Treating EA as a network diagram; it spans business, data, application and technology layers and exists to guide decisions, not just document infrastructure.
2.5 Enterprise Risk ManagementIdentifying, assessing, treating and monitoring IT risk within the organization's risk appetite.
- What it means
- Enterprise risk management (ERM) applies a consistent process, such as those in COSO ERM or ISO 31000, to identify risks, analyze likelihood and impact, choose a treatment and monitor residual risk against the appetite set by the board.
- What to understand
- Treatment options are mitigate, transfer, avoid or accept, and acceptance must be made by a risk owner with the authority to do so. Each risk needs a named owner in the business, and the risk register should be updated when the environment changes. Residual risk is what remains after treatment and must fall within appetite.
- How it shows up
- A scenario shows IT accepting a significant risk on behalf of the business, or a risk register with no owners, and asks for the greatest concern.
- Common confusion
- Thinking insurance removes risk; transfer shifts financial impact, but reputational and regulatory consequences stay with the organization.
2.6 Privacy Program and PrinciplesGoverning how personal data is collected, used, shared and retained.
- What it means
- A privacy program assigns responsibility, often to a privacy officer, sets policy, and applies principles such as lawful basis and consent, purpose limitation, data minimization, accuracy, storage limitation, security and individual rights of access and correction.
- What to understand
- Privacy and security overlap but differ: security protects data from unauthorized access, while privacy governs whether the organization should collect and use it at all. Privacy impact assessments are performed before new processing begins so privacy can be designed in.
- How it shows up
- A scenario describes a new analytics project using customer data and asks what should happen FIRST; a privacy impact assessment before launch is the usual answer.
- Common confusion
- Assuming encryption satisfies privacy; data collected without a valid purpose is a privacy failure even when it is perfectly protected.
2.7 Data Governance and ClassificationOwnership, classification and lifecycle rules for organizational data.
- What it means
- Data governance defines who owns each data set, how it is classified by sensitivity and criticality, what quality standards apply, and how it is retained and disposed of. Classification drives the protection each data set receives.
- What to understand
- The data owner, a business manager, classifies data and approves access; the custodian, usually IT, implements the protections. A small number of classification levels is easier to apply consistently than many. Classification must precede control selection, because you cannot size protection without knowing the value of the asset.
- How it shows up
- A question asks who should decide a data set's classification or approve access to it; the answer is the data owner, not the security administrator or the database administrator.
- Common confusion
- Treating the custodian who manages the database as the owner because they control it technically.
2.8 IT Resource ManagementManaging IT people, budgets and investment portfolios.
- What it means
- IT resource management covers human resources (hiring, screening, training, rotation, termination), financial management (budgets, cost allocation and chargeback) and the investment portfolio that decides which initiatives get funded.
- What to understand
- Personnel controls such as background checks, mandatory leave and job rotation reduce fraud risk, while timely removal of access at termination is a key control. Portfolio management compares investments against strategy and value so resources go to the initiatives with the greatest business benefit.
- How it shows up
- A scenario shows a key administrator who never takes leave and is the only person who knows a critical system; the concern is key-person dependency and undetected fraud.
- Common confusion
- Treating mandatory vacation as an employee-welfare measure; in audit terms it is a detective control that lets someone else see the work.
2.9 IT Vendor ManagementSelecting, contracting, monitoring and exiting third-party IT providers.
- What it means
- Vendor management runs from due diligence and selection through contract terms, ongoing performance and risk monitoring, to termination and transition. Contracts should address service levels, security and privacy requirements, data ownership and return, subcontracting, right to audit or independent assurance reports, and exit arrangements.
- What to understand
- Outsourcing transfers the work, not the accountability. The organization must still monitor the provider, review independent assurance reports such as service organization control reports, and confirm that the scope of those reports covers the services it uses.
- How it shows up
- A scenario describes a provider that will not allow on-site audits and asks for the best alternative; obtaining and reviewing an independent assurance report covering the relevant controls is the answer.
- Common confusion
- Assuming a provider's certification or assurance report covers everything; candidates miss checking its scope, period and any noted exceptions or complementary user controls.
2.10 IT Performance Monitoring and ReportingMeasuring whether IT delivers value and meets goals, and reporting it to the right audience.
- What it means
- Performance monitoring uses key goal indicators to show whether objectives were achieved, key performance indicators to show how well processes run, and key risk indicators to warn of rising exposure. An IT balanced scorecard groups measures across business contribution, user orientation, operational excellence and future orientation.
- What to understand
- Good metrics are linked to business objectives, owned, reliably sourced and reported to people who act on them. Benefits realization checks after delivery whether an investment produced the value promised in its business case.
- How it shows up
- A scenario shows IT meeting all its technical targets while business satisfaction falls, and asks for the best recommendation; the answer adds measures tied to business outcomes.
- Common confusion
- Treating a KPI as proof a goal was met; a process can run efficiently and still fail to deliver the intended business result.
2.11 Quality Assurance and Quality Management of ITMaking sure IT processes and products meet defined quality requirements.
- What it means
- Quality management defines quality requirements and the processes to meet them, often aligned to standards such as ISO 9001. Quality assurance reviews processes to give confidence they will produce quality outcomes; quality control inspects outputs to find defects.
- What to understand
- The quality assurance function should be independent of the teams whose work it reviews, and quality should be built into processes rather than inspected in at the end. Capability or maturity assessments show where processes need improvement.
- How it shows up
- A question describes developers performing quality assurance on their own code and asks for the greatest concern; the lack of independence is the issue.
- Common confusion
- Using quality assurance and quality control interchangeably; assurance is process-focused and preventive, control is product-focused and detective.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Governance vs. management
Governance, led by the board, evaluates options, sets direction and monitors results; management, led by executives, plans, builds, runs and monitors activities within that direction.
- Remember
- The board is accountable for IT governance; management is responsible for executing it.
- Tested as
- Many questions ask who should approve or decide something, and the answer depends on whether it is a governance or management decision.
- Trap
- Assigning strategic approval to the CIO alone because IT strategy sounds technical.
-
IT strategy committee vs. IT steering committee
The IT strategy committee operates at board level and advises on strategic direction and IT's contribution; the steering committee is a management body that prioritizes projects, allocates resources and monitors delivery.
- Remember
- Steering committee membership should include senior business representatives, not only IT.
- Tested as
- Scenarios test which body should resolve a project-priority conflict or review the IT strategy.
- Trap
- Choosing the strategy committee for project-level oversight.
-
Risk appetite, tolerance and residual risk
Risk appetite is the amount of risk the organization is willing to pursue, tolerance is the acceptable variation around it, and residual risk is what remains after treatment.
- Remember
- Residual risk must be within appetite, and only an authorized risk owner can accept it.
- Tested as
- ERM questions ask whether a treatment decision was appropriate or who should accept the remaining risk.
- Trap
- Believing the goal of risk management is to eliminate risk rather than bring it within appetite.
-
Risk treatment options
Mitigate reduces likelihood or impact with controls, transfer shifts financial impact to another party, avoid stops the risky activity, and accept tolerates the risk with documented approval.
- Remember
- Transfer does not move accountability or reputational impact.
- Tested as
- Scenarios describe a response and ask which treatment it represents or whether it was appropriate.
- Trap
- Labeling outsourcing as risk avoidance; the activity still happens, so it is closer to transfer or shared risk.
-
Data owner vs. data custodian
The data owner is the business manager accountable for a data set who classifies it and approves access; the custodian implements and operates the protections the owner requires.
- Remember
- Owners decide; custodians execute.
- Tested as
- Who approves access or sets classification is a frequent question.
- Trap
- Selecting the database administrator because they have technical control.
-
KGI vs. KPI vs. KRI
Key goal indicators measure whether an outcome was achieved, key performance indicators measure how well a process performs toward it, and key risk indicators signal changes in exposure.
- Remember
- KGIs are lagging outcome measures; KPIs and KRIs give earlier signals.
- Tested as
- Performance monitoring questions ask which measure fits a stated purpose.
- Trap
- Using a KPI such as help desk response time to claim business value was delivered.
-
IT balanced scorecard
A management tool that measures IT across business contribution, user orientation, operational excellence and future orientation so financial and technical metrics are balanced with value and capability.
- Remember
- Its purpose is to link IT performance to business objectives.
- Tested as
- Appears as the best recommendation when IT reports only technical metrics.
- Trap
- Treating it as a financial reporting tool only.
-
Right to audit and independent assurance
Contracts should let the organization audit the provider or receive independent assurance reports on the provider's controls, since the organization remains accountable for outsourced processing.
- Remember
- Check the report's scope, period, opinion, exceptions and the complementary controls the customer must operate.
- Tested as
- Vendor management questions often turn on how to obtain assurance over a provider.
- Trap
- Accepting any certificate without checking whether it covers the services and period in question.
-
Segregation of duties within IT
Incompatible IT functions, such as developing code, migrating it to production, administering security and operating the system, should be held by different people.
- Remember
- When segregation is impossible in a small team, use compensating controls such as independent review of logs and changes.
- Tested as
- Organizational structure questions ask which combination of duties is the greatest concern.
- Trap
- Overlooking that a developer with production access can bypass change control.
-
Privacy by design and privacy impact assessment
Privacy by design builds privacy protections into systems from the start, and a privacy impact assessment evaluates a planned processing activity's privacy risks before it begins.
- Remember
- The assessment comes before collection or launch, not after a complaint.
- Tested as
- Privacy program questions ask what should happen first for a new use of personal data.
- Trap
- Choosing encryption or access control as the first step when the question is whether the processing should occur.
-
Policy exception management
A formal process for approving deviations from policy, recording the business reason, the risk accepted, the approver and an expiry or review date.
- Remember
- Exceptions need an authorized approver and periodic review, or they become permanent unmanaged risk.
- Tested as
- Auditors test whether deviations are approved and tracked.
- Trap
- Treating an undocumented long-standing deviation as acceptable because nothing has gone wrong.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Board vs. IT strategy committee vs. IT steering committee
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Board of directors | Ultimately accountable for enterprise governance, including IT | Sets direction and risk appetite and holds management accountable | Expecting the board to approve individual projects |
| IT strategy committee | Board-level body advising on IT's strategic direction and contribution | Strategic advice to the board, not operational oversight | Assigning it day-to-day project prioritization |
| IT steering committee | Management-level body of senior business and IT leaders | Prioritizes investments, allocates resources, monitors projects | Accepting an IT-only membership as adequate |
Data owner vs. data custodian vs. data user
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Data owner | Business manager accountable for a data set | Classifies data and approves access | Delegating classification decisions to IT |
| Data custodian | Function that stores, backs up and secures data | Implements the owner's requirements | Treating technical control as ownership |
| Data user | Person who uses data to do their job | Follows policy and uses only authorized access | Assuming users may share data they can see |
Risk mitigation vs. transfer vs. avoidance vs. acceptance
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Mitigation | Apply controls to reduce likelihood or impact | Risk remains but is smaller | Assuming any control brings risk within appetite |
| Transfer | Shift financial impact through insurance or contract | Accountability and reputation stay with the organization | Thinking the risk has left the organization |
| Avoidance | Stop or do not start the activity that creates the risk | Eliminates the risk along with the opportunity | Calling outsourcing avoidance |
| Acceptance | Tolerate the risk with informed approval | Requires an authorized owner and documentation | Treating doing nothing as formal acceptance |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Technical fix for a governance gap
- What candidates pick
- A new tool or configuration change to solve a problem of misaligned priorities.
- Why it looks right
- It is concrete and quick, and technical staff are used to solving problems with tools.
- Why it's wrong
- If the root cause is who decides or how priorities are set, a tool leaves the decision process broken.
Clue to watch for Look for complaints from business units, missing approvals or unclear ownership; those signal a governance answer.
-
IT accepts the business's risk
- What candidates pick
- Approve the IT manager's decision to accept a risk because IT understands it best.
- Why it looks right
- IT staff often have the deepest technical understanding of the exposure.
- Why it's wrong
- Risk acceptance belongs to the business risk owner with authority over the affected process and within the board's appetite.
Clue to watch for If the risk affects a business process or customer data, the owner is a business manager.
-
Certificate equals assurance
- What candidates pick
- Rely on a provider's assurance report or certification without further review.
- Why it looks right
- It comes from an independent party and is widely accepted.
- Why it's wrong
- The report may cover a different service, an outdated period, or contain exceptions and complementary user controls the customer must operate.
Clue to watch for Watch for details about scope, dates or carve-outs in the scenario.
-
Encrypt first for privacy
- What candidates pick
- Encrypt the personal data before launching a new data use.
- Why it looks right
- Encryption is a strong, familiar safeguard.
- Why it's wrong
- Privacy first asks whether the organization has a valid purpose and basis to process the data, which an impact assessment addresses before controls are chosen.
Clue to watch for New project or new use of personal data with the word FIRST points to a privacy impact assessment.
-
Bottom-up policy is enough
- What candidates pick
- Accept policies written by summarizing current procedures.
- Why it looks right
- They reflect how work is really done and are easy to follow.
- Why it's wrong
- Without top-down direction they may not reflect business objectives, risk appetite or regulatory requirements.
Clue to watch for Policies that lack senior management approval or link to strategy signal a governance gap.
-
Classify after protecting
- What candidates pick
- Apply strong controls to all data uniformly before a classification exercise.
- Why it looks right
- Maximum protection everywhere sounds safe.
- Why it's wrong
- Without classification, protection is either wasteful or inadequate, and owners cannot make informed access decisions.
Clue to watch for If no classification scheme exists, establishing it with data owners comes before choosing controls.
Answer framework
For a governance question, find the missing link between business direction and IT action before choosing a remedy.
- Identify whether the scenario describes a governance problem, such as direction, accountability or oversight, or a management problem, such as planning or delivery.
- Name the role that should own the decision: board, steering committee, risk owner, data owner or IT management.
- Check alignment: trace the IT objective, project or metric back to a business objective and note where the chain breaks.
- For risk and vendor scenarios, confirm that accountability stays with the organization and that risk is accepted only by an authorized owner within appetite.
- Choose the recommendation that repairs the root cause, such as a policy, a committee, a measure or a contract term, rather than one that patches a single symptom.
Practice question
Want more like this? The CISA practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with structure and strategy, because the rest of the domain hangs on knowing who decides what. Learn the board, committee and owner roles until you can assign any decision in a scenario to the right level. Then study enterprise risk management and data governance together, since both turn on ownership: the risk owner accepts risk, the data owner classifies data.
Next cover the management side: resources, vendors, performance monitoring and quality. Vendor management is commonly underestimated. Practice reading a scenario about an outsourced service and listing what the contract should contain, what assurance report you would ask for, and what you would check in that report.
Privacy and laws need a principles-based approach rather than memorizing specific statutes. Know the principles well enough to spot when a plan collects data it does not need or uses it for a new purpose without assessment.
After this domain, practice questions that ask for the GREATEST concern or BEST recommendation, and for each wrong answer ask whether you chose a symptom fix instead of the governance root cause. Then move to Domain 3, which applies these portfolio and business-case decisions to individual projects.
FAQ
Is Domain 2 more about frameworks or judgment?
Mostly judgment. Frameworks such as COBIT help you understand the vocabulary, but questions ask you to decide who is accountable, what the greatest concern is, or which recommendation fixes the root cause.
How many questions come from this domain?
ISACA weights it at 18% but does not publish a per-domain count. As a planning estimate, 18% of 150 questions is about 27.
Do I need to know specific privacy laws?
The outline lists privacy program and principles, so focus on principles such as purpose limitation, minimization and individual rights, and on when to perform a privacy impact assessment. Questions are written to apply across jurisdictions.
What is the difference between the IT strategy committee and the steering committee?
The strategy committee works at board level and advises on IT's strategic direction. The steering committee is a management group that prioritizes projects, allocates resources and monitors delivery.
How does this domain relate to Domain 1?
Domain 1 teaches how to audit; Domain 2 supplies much of what you audit against, such as policies, risk appetite, SLAs and performance measures. A missing governance criterion is often the root cause behind a Domain 1 finding.
Why is vendor management tested so often?
Outsourcing and cloud services are common, and the exam stresses that accountability stays with the organization. Questions test contracts, monitoring and the use of independent assurance reports.
How long should I study Domain 2?
A planning estimate is 30 to 40 hours within a roughly 200-hour plan. Candidates from technical roles may need more time to adopt the governance perspective.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Certified in Risk and Information Systems Control Same subject: Domain 1: Governance (26%)
- CISM (Certified Information Security Manager) Same subject: Domain 1: Information Security Governance (17%)
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 2 knowledge
Test whether you can assign decisions to the right owner, trace IT metrics back to business goals, and keep outsourced services under control.