Overview
Governance of Enterprise IT is 40% of the CGEIT exam and has three parts in ISACA's outline. Part A, Governance Framework, covers framework components, structures and accountabilities, strategy development, compliance, culture and ethics. Part B, Technology Governance, covers alignment with enterprise objectives, strategic planning, stakeholders, communication, enterprise architecture and policies. Part C, Information Governance, covers information architecture, lifecycle, ownership and classification.
The outline in force has carried the 2020 effective date, and ISACA had not announced a replacement CGEIT job practice as of October 2026, so this page follows that outline. The domain is written from the board and executive viewpoint. You are expected to choose answers that set direction, assign accountability and create oversight, leaving detailed execution to management.
How it's tested
Questions in this domain are usually framed around a senior role: a board member, the CIO, a governance committee chair or a consultant reporting to the executive team. The scenario describes a symptom such as duplicated systems or ignored policies, and you must pick the governance action that addresses the underlying cause.
-
Root cause over symptom
A visible problem such as overspending or inconsistent data is described, and the best answer fixes missing decision rights, ownership or alignment rather than the surface issue.
-
Who decides
You must identify the body or role that should approve, be accountable for or arbitrate a decision, usually separating business accountability from IT responsibility.
-
First step sequencing
Several reasonable actions are listed; the correct one is the step that must logically come first, such as understanding enterprise goals or classifying information.
A board learns that three business units bought separate customer platforms. One option asks IT to consolidate them, another buys an integration tool, and a third sets up an architecture review and investment approval process tied to enterprise objectives. Consolidation and integration treat the result. The missing control is a governance mechanism that would have stopped the duplication, so the review and approval process is the strongest answer.
Subtopics 16
Official subtopics from the ISACA outline, in outline order.
1.A.1 Components of a Governance FrameworkThe parts that make up an EGIT framework: principles, structures, processes, information and enablers.
- What it means
- A governance framework is the set of principles, policies, decision structures, processes, information flows and enablers that let a board direct and oversee IT. COBIT 2019 is the reference ISACA expects you to know, with its governance and management objectives and seven components.
- What to understand
- Know the difference between governance (evaluate, direct, monitor) and management (plan, build, run, monitor). A framework is tailored to the enterprise using design factors such as strategy, risk profile, size and sourcing model. Components work together: a policy without a process, owner or skilled people does not govern anything.
- How it shows up
- Expect a scenario where governance fails despite a framework on paper, and you must identify the missing component or the step that tailors it to the enterprise.
- Common confusion
- Adopting COBIT wholesale is not the same as having a governance system designed for the enterprise's own design factors.
1.A.2 Organizational Structures, Roles and ResponsibilitiesWho decides, who is accountable and how committees connect board intent to IT management.
- What it means
- Governance needs named bodies and people: the board, an IT strategy or steering committee, an architecture board, risk and audit committees, the CIO and business process owners. Each holds defined decision rights and accountabilities.
- What to understand
- A RACI chart is the usual tool for recording who is responsible, accountable, consulted and informed. Accountability for business outcomes stays with business executives, not with IT. Steering committees prioritize and arbitrate; they do not run projects. Unclear decision rights are a root cause behind many governance failures in exam scenarios.
- How it shows up
- Questions ask who should approve, who is accountable, or which body should resolve a conflict between business units competing for IT funding.
- Common confusion
- Treating the CIO as accountable for the value of every IT-enabled investment instead of the sponsoring business owner.
1.A.3 Strategy DevelopmentBuilding an IT strategy that derives from and supports enterprise strategy.
- What it means
- IT strategy development turns enterprise goals into a direction for technology, information and the capabilities the business will need. It covers current-state assessment, target state, gap analysis and a roadmap of initiatives.
- What to understand
- The strategy must start from enterprise goals and stakeholder needs, not from technology trends. It is approved at a governance level and revisited when the business strategy changes. A good strategy states priorities and trade-offs so investment decisions can be made consistently later.
- How it shows up
- Look for answers that start with understanding enterprise objectives before choosing platforms, vendors or projects.
- Common confusion
- Confusing a list of planned projects with a strategy that explains why those projects matter.
1.A.4 Legal and Regulatory ComplianceMaking sure governance identifies and meets laws, regulations and contractual obligations affecting IT.
- What it means
- Enterprises must identify the external requirements that apply to their information and technology, such as privacy laws, sector rules, financial reporting rules and contracts, and build them into policies and controls.
- What to understand
- Governance owns the process of identifying requirements, assigning owners, monitoring compliance and reporting status to the board. Compliance is a constraint on strategy, not the strategy itself. When requirements conflict across jurisdictions, the board decides the approach with legal counsel input.
- How it shows up
- A new regulation appears in the scenario. The best first step is usually to assess applicability and impact, then assign ownership, before buying tools.
- Common confusion
- Assuming the IT department alone carries compliance responsibility for laws that affect business processes.
1.A.5 Organizational CultureHow shared values and behaviors help or block governance adoption.
- What it means
- Culture is the set of beliefs and habits that shape how people actually behave around IT decisions, risk and information. Governance that clashes with culture tends to be bypassed.
- What to understand
- Tone at the top, incentives and visible leadership behavior shape culture more than policy documents. Cultural change is gradual and needs sponsorship, communication and reinforcement. Exam scenarios often show resistance to a new governance process; the answer usually addresses sponsorship and engagement rather than enforcement alone.
- How it shows up
- When a governance initiative stalls because people work around it, look for answers about leadership sponsorship and behavioral change.
- Common confusion
- Believing that issuing a mandatory policy changes behavior on its own.
1.A.6 Business EthicsEthical principles that guide decisions about information and technology use.
- What it means
- Business ethics covers the standards of conduct the enterprise expects in its use of information and technology, including fair data use, conflicts of interest and honest reporting.
- What to understand
- Ethics sits above legal minimums: something legal can still breach the enterprise's values or code of conduct. Governance sets the ethical expectations, provides channels to raise concerns and makes sure decisions such as data use or AI deployment are reviewed against them. ISACA's own Code of Professional Ethics is a useful anchor.
- How it shows up
- Scenarios may describe a profitable but questionable data use. The governance answer checks it against the code of conduct and escalates for a decision.
- Common confusion
- Equating ethical with legally compliant.
1.B.1 Governance Strategy Alignment with Enterprise ObjectivesKeeping IT governance focused on the enterprise's goals rather than on IT's own goals.
- What it means
- Alignment means the governance system, IT objectives and investment priorities trace back to enterprise goals. COBIT's goals cascade links stakeholder drivers to enterprise goals, alignment goals and governance and management objectives.
- What to understand
- Alignment is continuous: when enterprise strategy shifts, IT priorities and governance arrangements must be reviewed. Evidence of alignment includes portfolio decisions that reflect business priorities and metrics that report business outcomes. Misalignment shows up as IT pursuing initiatives the business does not value.
- How it shows up
- The best answer frequently asks how an initiative supports enterprise objectives before anything else is approved.
- Common confusion
- Treating IT and business alignment as a one-time planning exercise instead of an ongoing governance activity.
1.B.2 Strategic Planning ProcessThe repeatable process for producing, approving and updating IT strategic plans.
- What it means
- Strategic planning is the cycle of assessing the environment, setting direction, prioritizing initiatives, allocating resources and reviewing results. It produces a multi-year IT strategic plan and shorter tactical plans.
- What to understand
- Inputs include enterprise strategy, risk appetite, current capabilities and external trends. Outputs must be approved by the right governance body and communicated. Plans need review points and triggers, such as a merger or new regulation, that prompt an update.
- How it shows up
- Questions test sequencing: what must happen before a roadmap is approved, or what input is missing from a planning cycle.
- Common confusion
- Skipping the current-state assessment and jumping straight to the target architecture.
1.B.3 Stakeholder Analysis and EngagementIdentifying stakeholders, their needs and influence, and involving them in governance.
- What it means
- Stakeholder analysis identifies who is affected by or can influence IT decisions: board members, executives, business units, regulators, customers and staff. It maps their interests, power and expectations.
- What to understand
- Governance exists to meet stakeholder needs, so engagement is not optional. Different stakeholders need different involvement: some decide, some are consulted, some are informed. Early engagement reduces resistance and surfaces requirements that would otherwise appear late and cost more.
- How it shows up
- Look for answers that bring key stakeholders in early, especially when a scenario describes late objections to a governance change.
- Common confusion
- Engaging only senior executives and ignoring operational stakeholders who will carry out the change.
1.B.4 Communication and Awareness StrategyPlanning how governance decisions, policies and expectations reach the people who must act on them.
- What it means
- A communication and awareness strategy defines audiences, messages, channels and timing for governance information such as new policies, decision rights and performance results.
- What to understand
- Messages must be tailored: the board needs outcomes and risk, managers need responsibilities and deadlines, staff need practical expectations. Awareness is measured by behavior and feedback, not by email open rates. Communication is two-way and should collect concerns.
- How it shows up
- When staff do not follow a new policy, consider whether awareness and communication were planned before choosing disciplinary or technical answers.
- Common confusion
- Treating publication on the intranet as successful communication.
1.B.5 Enterprise ArchitectureUsing EA to describe current and target business, information, application and technology states.
- What it means
- Enterprise architecture models how business processes, information, applications and technology fit together, now and in the target state. Frameworks such as TOGAF provide methods and viewpoints.
- What to understand
- For governance, EA is a decision aid: it shows dependencies, duplication and the gap between current and target states, and it guides investment and standards. An architecture review board checks that projects conform to principles or obtain approved exceptions. EA must follow strategy, not drive it.
- How it shows up
- Scenarios about duplicated systems, integration problems or projects ignoring standards usually point to EA governance and architecture review.
- Common confusion
- Seeing EA as a technical diagramming exercise owned only by IT.
1.B.6 Policies and StandardsThe hierarchy of policies, standards and procedures that express governance direction.
- What it means
- Policies state management intent at a high level and are approved by senior governance bodies. Standards set mandatory specific requirements. Procedures and guidelines describe how to comply.
- What to understand
- Policies should be few, stable and approved by the board or executive committee; standards change more often. Every policy needs an owner, review cycle and exception process. Compliance monitoring closes the loop. Exceptions should be documented, risk-assessed and time-limited.
- How it shows up
- Expect questions about who approves a policy, what belongs in a policy versus a standard, and how exceptions are handled.
- Common confusion
- Putting detailed technical settings in a policy so it needs constant board re-approval.
1.C.1 Information ArchitectureHow information is structured, integrated and shared across the enterprise.
- What it means
- Information architecture defines the enterprise's data models, data flows, master and reference data, and how information moves between systems and business units.
- What to understand
- Good information architecture reduces duplicate and inconsistent data and supports reporting, analytics and compliance. It is part of EA and must be governed with principles such as a single authoritative source per data domain. Big data and analytics initiatives depend on it.
- How it shows up
- Inconsistent reports from different systems usually indicate a gap in information architecture or master data governance.
- Common confusion
- Assuming a new data warehouse fixes inconsistency without agreeing authoritative sources and definitions.
1.C.2 Information Asset LifecycleGoverning information from creation and collection through use, retention and disposal.
- What it means
- Information has a lifecycle: create or acquire, store, use, share, archive and dispose. Each stage carries value and risk.
- What to understand
- Retention schedules must reflect legal, regulatory and business needs, and disposal must be secure and documented. Keeping information too long raises cost and exposure; deleting it too early breaks legal obligations. Lifecycle rules are set by governance and carried out by management.
- How it shows up
- Questions on storage cost or legal holds test whether you apply retention rules rather than deleting or keeping everything.
- Common confusion
- Treating backup copies as an archive that satisfies retention requirements.
1.C.3 Information Ownership and StewardshipAssigning business owners and stewards who are accountable for information assets.
- What it means
- Information owners are business leaders accountable for a data domain: they decide classification, access and acceptable use. Stewards manage quality and definitions day to day. Custodians, often IT, store and protect the data.
- What to understand
- Ownership sits with the business because the business bears the consequences of data misuse or poor quality. Clear ownership is a precondition for classification, access reviews and quality improvement. Unowned data is a common governance gap.
- How it shows up
- When nobody acts on data quality or access issues, the expected fix is assigning a business owner, not handing the problem to IT.
- Common confusion
- Mixing up the custodian who operates the system with the owner who is accountable for the data.
1.C.4 Information Classification and HandlingCategorizing information by sensitivity and value and defining how each category is handled.
- What it means
- Classification assigns labels such as public, internal, confidential and restricted based on sensitivity, criticality and legal requirements. Handling rules then set how each class is stored, shared, transmitted and destroyed.
- What to understand
- The owner classifies; controls follow the classification. Too many levels confuse users, too few under-protect sensitive data. Classification must be reviewed when data or its use changes, and it drives proportional, cost-effective protection.
- How it shows up
- Expect questions asking what must happen before selecting controls for a new data set: the answer is usually classification by the owner.
- Common confusion
- Classifying systems instead of the information they hold.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Governance versus management
Governing bodies set direction and oversee results, while management carries out the work within that direction.
- Remember
- In COBIT 2019 the governance objectives sit in the EDM domain; management objectives sit in APO, BAI, DSS and MEA.
- Tested as
- Many answers are wrong simply because they describe a management task when a governance action is asked for.
- Trap
- Choosing a detailed operational fix for a board-level question.
-
COBIT 2019 design factors
Factors such as enterprise strategy, goals, risk profile, threat landscape, compliance needs, sourcing model and size used to tailor the governance system.
- Remember
- A governance system is designed for the enterprise, not copied from the framework.
- Tested as
- Explains why the same framework looks different in two organizations.
- Trap
- Assuming full adoption of every COBIT objective is best practice.
-
Goals cascade
Translates stakeholder drivers into enterprise goals, then alignment goals, then governance and management objectives.
- Remember
- It is the main tool for demonstrating that IT objectives trace to business objectives.
- Tested as
- Appears in alignment and prioritization scenarios.
- Trap
- Starting the cascade from IT goals instead of stakeholder needs.
-
Decision rights
The documented authority to make particular IT decisions, such as principles, architecture, infrastructure, applications and investment.
- Remember
- Unclear decision rights are a common root cause in governance failure scenarios.
- Tested as
- Drives answers about committees and approvals.
- Trap
- Assuming the most senior person should make every decision.
-
RACI matrix
Records who is responsible, accountable, consulted and informed for each activity.
- Remember
- Only one party should be accountable for a given activity.
- Tested as
- Used to resolve overlapping or missing responsibilities.
- Trap
- Assigning accountability to several roles at once.
-
IT strategy committee and IT steering committee
The strategy committee advises the board on strategic IT direction; the steering committee prioritizes and oversees investments and projects for management.
- Remember
- Strategy committee works at board level; steering committee works at executive management level.
- Tested as
- Questions ask which body should handle a given issue.
- Trap
- Sending portfolio prioritization disputes to the board strategy committee.
-
Enterprise architecture review board
A body that checks initiatives against architecture principles and standards and approves exceptions.
- Remember
- It enforces the target architecture through review, not by building systems.
- Tested as
- Answers to duplication and integration failures.
- Trap
- Treating architecture as optional guidance teams can ignore.
-
Policy hierarchy
Policies, then standards, then procedures and guidelines, each more specific and changing more often.
- Remember
- Policies are approved at senior level and reviewed periodically; exceptions are risk-assessed and time-limited.
- Tested as
- Tested in approval and exception questions.
- Trap
- Granting open-ended exceptions without risk acceptance by the owner.
-
Information owner
The business leader accountable for a data domain, its classification and access.
- Remember
- Owners decide, stewards maintain quality, custodians protect and operate.
- Tested as
- Central to Part C questions.
- Trap
- Naming the database administrator as owner.
-
Information classification
Labeling information by sensitivity and criticality so controls are proportional.
- Remember
- Classification comes before control selection.
- Tested as
- Appears as the right first step for new data sets.
- Trap
- Applying the strongest controls to everything.
-
Tone at the top
The behavior and messages of senior leaders that set expectations for everyone else.
- Remember
- Culture changes through leadership behavior and incentives, not documents alone.
- Tested as
- Explains why governance adoption fails or succeeds.
- Trap
- Expecting enforcement to replace sponsorship.
-
Retention schedule
Rules for how long each information type is kept and how it is disposed of.
- Remember
- Driven by legal, regulatory and business requirements, approved by owners.
- Tested as
- Tested in lifecycle and legal hold scenarios.
- Trap
- Keeping everything forever to be safe.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Governance bodies and roles
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Board of directors | Ultimately accountable for enterprise governance, including IT | Sets direction and risk appetite, monitors outcomes | Expecting the board to approve individual projects |
| IT strategy committee | Board-level advisory body on IT strategy | Advises on strategic direction and value, not operations | Confusing it with the steering committee |
| IT steering committee | Executive body that prioritizes and oversees IT investments | Arbitrates portfolio and resource conflicts | Letting it run project tasks |
| Business process owner | Executive owning a business process and its outcomes | Accountable for benefits from IT-enabled change | Shifting benefit accountability to IT |
Owner, steward and custodian
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Information owner | Business leader accountable for a data domain | Decides classification, access and use | Assigning ownership to IT |
| Data steward | Role managing definitions and quality day to day | Maintains the data on the owner's behalf | Treating the steward as final approver |
| Custodian | Function that stores, processes and protects data | Implements controls the owner specifies | Letting the custodian set access rules |
Policy, standard and procedure
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Policy | High-level statement of management intent | Approved at senior level, changes rarely | Filling it with technical detail |
| Standard | Mandatory specific requirement supporting a policy | More detailed, updated more often | Treating standards as optional |
| Procedure | Step-by-step instructions to comply | Operational and owned by management | Asking the board to approve procedures |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Framework as the answer
- What candidates pick
- Adopt COBIT across the enterprise.
- Why it looks right
- COBIT is ISACA's own framework and sounds authoritative.
- Why it's wrong
- Adopting a framework without tailoring it to enterprise goals and design factors does not fix the specific gap in the scenario.
Clue to watch for If the question names a specific weakness, pick the answer that targets it.
-
IT owns the data
- What candidates pick
- Make the IT department responsible for data quality.
- Why it looks right
- IT runs the systems where the data lives.
- Why it's wrong
- Quality and classification decisions belong to the business owner who understands the data and bears the consequences.
Clue to watch for Look for wording about who is accountable rather than who operates.
-
Policy fixes culture
- What candidates pick
- Issue a mandatory policy and monitor violations.
- Why it looks right
- It is quick and enforceable.
- Why it's wrong
- When resistance is cultural, sponsorship, communication and incentives are needed for lasting adoption.
Clue to watch for Phrases such as workarounds or low adoption point to culture and engagement.
-
Build the roadmap first
- What candidates pick
- Draft a technology roadmap for the next three years.
- Why it looks right
- It shows visible progress on strategy.
- Why it's wrong
- A roadmap without an assessment of enterprise objectives and current state cannot be aligned.
Clue to watch for FIRST or BEFORE in the stem usually signals an understanding step.
-
Escalate everything to the board
- What candidates pick
- Ask the board to decide between two competing project requests.
- Why it looks right
- The board has ultimate authority.
- Why it's wrong
- Portfolio prioritization belongs to the executive steering committee within board-approved strategy and appetite.
Clue to watch for Decide whether the issue is strategic direction or investment prioritization.
-
Permanent exception
- What candidates pick
- Grant the business unit an exemption from the standard.
- Why it looks right
- It removes friction quickly.
- Why it's wrong
- Exceptions must be risk-assessed, accepted by the accountable owner and time-limited, not granted indefinitely.
Clue to watch for Watch for missing expiry dates or missing risk acceptance.
Answer framework
Apply this sequence to Domain 1 scenarios to separate governance answers from management ones.
- Identify the enterprise objective or stakeholder need at stake, and confirm whether the question is asking for direction, oversight or execution.
- Find the missing governance element behind the symptom, such as unclear decision rights, absent ownership, no approved strategy or a missing policy that would have prevented it.
- Determine which body or role holds accountability, keeping business ownership separate from IT responsibility for operation.
- Prefer answers that create a lasting mechanism, such as a review board, policy, RACI or approval gate, over one-time fixes that leave the same gap open next time.
- Check the answer fits the enterprise's culture, legal obligations and ethics, and that it will be communicated and monitored.
Practice question
Want more like this? The CGEIT practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Give this domain the largest share of your plan, because it is 40% of the exam and its reasoning style carries into the other domains. Start with COBIT 2019 fundamentals: governance versus management, the components of a governance system, design factors and the goals cascade. Then work through Part A by mapping a real or fictional enterprise's decision bodies into a RACI and naming who decides each class of IT decision.
For Part B, read about strategic planning and enterprise architecture with a governance lens: what the board approves, what the steering committee prioritizes and how an architecture review board enforces standards. Practice writing one-line policies and separating them from standards and procedures.
Do not skip Part C. Information architecture, lifecycle, ownership and classification are four subtopics and frequently appear in scenarios about inconsistent reporting or data misuse. Finish each study block with timed questions and review every wrong answer by asking whether you chose a management action when a governance action was required. Track that error type separately; reducing it improves your score across all four domains.
FAQ
How much of the CGEIT exam is Governance of Enterprise IT?
Governance of Enterprise IT is 40% of the CGEIT exam under ISACA's current outline, which works out to about 60 of the 150 questions. It is the largest of the four domains.
Is a new CGEIT exam outline coming in 2026 or 2027?
As of October 2026, ISACA had not announced a new CGEIT job practice. The outline effective since 2020 remains current. ISACA updated the CISM outline in November 2026, but that change does not apply to CGEIT. Check ISACA's CGEIT page before booking.
Do I need to memorize COBIT 2019 for this domain?
You need a working understanding of COBIT 2019 concepts such as governance versus management, components, design factors and the goals cascade. You do not need to memorize every objective code, but you should recognize the EDM governance domain.
What are the three parts of Domain 1?
Part A Governance Framework, Part B Technology Governance and Part C Information Governance. Together they contain 16 subtopics in ISACA's outline.
Why is information governance in a governance domain rather than a security domain?
CGEIT treats information as an enterprise asset. Ownership, architecture, lifecycle and classification are business decisions that the governance system must assign and oversee, with security controls following from those decisions.
How should I approach 'who should approve' questions?
Identify whether the decision is strategic direction, investment prioritization or operational execution. The board or strategy committee handles direction, the steering committee handles prioritization and management handles execution.
Is TOGAF tested on the CGEIT exam?
The outline lists enterprise architecture, not a specific framework. Knowing TOGAF concepts such as current state, target state, gap analysis and architecture governance helps, but questions focus on how EA supports governance decisions.
Other Enterprise Architecture & IT Governance certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have covered framework design, decision rights, architecture, policy and information ownership. Test whether you can pick the governance response over the management fix under timed conditions.