Overview
IT Resources is the smallest CGEIT domain at 15%, with six subtopics split across two parts. Part A, IT Resource Planning, covers sourcing strategies, capacity planning and acquisition of resources. Part B, IT Resource Optimization, covers asset lifecycle management, staff competency assessment and development, and management of contracted services and relationships.
The domain treats resources broadly: people, infrastructure, applications, information, cloud subscriptions and the external providers that deliver services. Questions take the governance view. They ask whether resource decisions follow strategy, whether accountability is retained after outsourcing and whether the enterprise knows what it owns and what it depends on.
How it's tested
Domain 2 questions usually describe a resource decision already under way, such as a planned outsourcing deal, a cloud migration or a provider missing its targets. You must spot what governance has missed: an exit plan, a capacity forecast, a skills assessment, an audit right or a business relationship owner.
-
Accountability stays home
A service is outsourced and something goes wrong; the answer reflects that the enterprise remains accountable and must act through contract and oversight.
-
Before you sign
A contract or acquisition is pending and you must choose what should be defined or checked first, such as requirements, exit terms or provider viability.
-
People as a resource
A strategic initiative is threatened by missing skills or key person dependency, and the answer is a planned competency response rather than a quick hire.
A provider has missed availability targets for three months while reporting green dashboards. Options include terminating the contract, accepting the provider's improvement plan, or verifying performance independently and invoking the contract's remedy and review clauses. Termination without verification risks service disruption, and accepting the plan relies on the same unreliable reporting. Independent verification followed by contractual action is the governance answer.
Subtopics 6
Official subtopics from the ISACA outline, in outline order.
2.A.1 Sourcing StrategiesDeciding whether capabilities are built in house, outsourced, provided by cloud services or shared.
- What it means
- A sourcing strategy sets how the enterprise obtains IT capabilities: insourcing, outsourcing, offshoring, cloud services, managed services, partnerships or a mix. It is a governance decision because it shifts cost, control, risk and dependency.
- What to understand
- Sourcing choices should follow from strategy and an analysis of which capabilities are core or differentiating. Outsourcing transfers execution, never accountability. Each option changes the risk profile, including vendor lock-in, concentration risk and exit difficulty, so exit strategies belong in the decision from the start.
- How it shows up
- Questions ask what must be considered before outsourcing a function, or which risk remains with the enterprise after moving to a provider.
- Common confusion
- Believing that outsourcing a service also transfers accountability for its outcomes.
2.A.2 Resource Capacity PlanningForecasting the people, infrastructure and service capacity needed to meet business demand.
- What it means
- Capacity planning matches future demand for IT resources, including staff skills, compute, storage, network and supplier capacity, with what is available, so services and projects are not starved or overprovisioned.
- What to understand
- Demand forecasts come from the business plan and portfolio, not only from usage trends. Planning should consider peak periods, growth, new initiatives and the time needed to acquire capacity. Governance looks at whether capacity constraints threaten strategic priorities and escalates trade-offs.
- How it shows up
- When projects slip because shared specialists are overbooked, look for answers about enterprise-level resource and capacity planning across the portfolio.
- Common confusion
- Treating capacity planning as only a technical infrastructure activity, ignoring people.
2.A.3 Acquisition of ResourcesGoverning how hardware, software, services and people are obtained.
- What it means
- Acquisition covers the processes for buying or hiring resources: requirements, market analysis, vendor selection, contracting, recruitment and approval, consistent with policy and the sourcing strategy.
- What to understand
- Good acquisition practice ties requirements to the business case, uses fair and documented selection criteria, checks vendor viability and security, and includes contract terms for service levels, audit rights and exit. Governance sets approval thresholds and makes sure acquisitions follow architecture standards.
- How it shows up
- Expect questions on what should be defined before vendor selection, or which contract clause protects the enterprise best.
- Common confusion
- Selecting a vendor on price before requirements and evaluation criteria are agreed.
2.B.1 IT Resource Lifecycle and Asset ManagementManaging IT assets from planning and acquisition through operation, maintenance and disposal.
- What it means
- IT asset management keeps an accurate inventory of hardware, software, licenses, cloud subscriptions and other resources, along with their owners, costs, contracts and lifecycle stage.
- What to understand
- An accurate inventory supports cost control, license compliance, security and planning for replacement. Lifecycle management plans refresh and retirement before assets become unsupported. Disposal must protect data and meet environmental and contractual rules. Unknown or unmanaged assets, including shadow cloud services, weaken every other governance process.
- How it shows up
- Scenarios about license penalties, unsupported systems or unknown cloud spending usually point to asset lifecycle management.
- Common confusion
- Thinking asset management is only about hardware, overlooking licenses, subscriptions and data on retired equipment.
2.B.2 Human Resource Competency Assessment and DevelopmentMaking sure IT staff have the skills the strategy needs, now and in the future.
- What it means
- Competency assessment compares the skills the enterprise needs with those its people have. Development closes gaps through training, hiring, rotation, mentoring and succession planning.
- What to understand
- Skills planning should follow the strategy and architecture: a move to cloud or analytics changes required competencies. Frameworks such as SFIA can describe skills consistently. Key person dependency is a resource risk that governance should monitor. Retaining knowledge matters as much as acquiring it.
- How it shows up
- Questions often present a strategic initiative at risk because staff lack skills, and ask for the best long-term response.
- Common confusion
- Assuming hiring contractors solves a strategic skills gap without knowledge transfer.
2.B.3 Management of Contracted Services and RelationshipsOverseeing suppliers and service providers so they deliver agreed value and manage risk.
- What it means
- Vendor and relationship management covers monitoring service levels, performance reviews, risk assessments, contract compliance, relationship governance and renewal or exit decisions for external providers.
- What to understand
- Service level agreements must have measurable targets tied to business needs and remedies for failure. The enterprise keeps the right to audit, receives independent assurance reports such as SOC 2, and reviews provider risk regularly. A relationship owner on the business side should be named. Exit and transition plans should be tested, not just written.
- How it shows up
- Look for answers that monitor provider performance against the contract and SLAs, and that use audit rights or assurance reports.
- Common confusion
- Relying on the provider's own performance reports with no independent verification.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Accountability cannot be outsourced
The enterprise remains answerable for outcomes and compliance even when a provider performs the work.
- Remember
- Responsibility for execution can move; accountability does not.
- Tested as
- The anchor for most outsourcing questions.
- Trap
- Blaming the provider and stopping there.
-
Exit strategy
A planned way to move a service back in house or to another provider.
- Remember
- Define it before signing and include data return, transition support and timelines in the contract.
- Tested as
- Commonly the missing element in sourcing scenarios.
- Trap
- Writing an exit plan only when the relationship fails.
-
Right to audit
A contract clause allowing the enterprise or its auditors to examine the provider's controls.
- Remember
- Independent assurance reports such as SOC 2 Type II can supplement or substitute for direct audits.
- Tested as
- Tested in vendor oversight questions.
- Trap
- Accepting a SOC report without checking its scope and period.
-
Service level agreement
Contracted, measurable service targets and remedies.
- Remember
- Targets must reflect business requirements, and measurement should be independently verifiable.
- Tested as
- Basis for evaluating provider performance.
- Trap
- Accepting technical metrics that do not reflect business impact.
-
Core versus non-core capability
Core capabilities differentiate the enterprise; non-core ones can often be sourced externally.
- Remember
- Sourcing decisions start with this analysis.
- Tested as
- Explains why some functions are kept in house.
- Trap
- Outsourcing a differentiating capability purely on cost.
-
Vendor lock-in
Dependence on one provider that makes switching costly or impractical.
- Remember
- Mitigated by open standards, data portability terms and exit planning.
- Tested as
- A risk to weigh in cloud and outsourcing decisions.
- Trap
- Ignoring it because the initial price is attractive.
-
IT asset inventory
The authoritative record of hardware, software, licenses and subscriptions with owners and lifecycle status.
- Remember
- Without it, cost, license, security and refresh decisions are guesswork.
- Tested as
- The first step in many asset management scenarios.
- Trap
- Assuming procurement records are a complete inventory.
-
Total cost of ownership
All costs of a resource over its life, including acquisition, operation, support, training and disposal.
- Remember
- Compare options on TCO, not purchase price.
- Tested as
- Used to judge sourcing and acquisition options.
- Trap
- Comparing a cloud subscription with hardware purchase price only.
-
Key person dependency
Reliance on one individual for critical knowledge or skills.
- Remember
- Address through documentation, cross-training and succession planning.
- Tested as
- Appears as a hidden resource risk.
- Trap
- Treating retention bonuses as the full answer.
-
Competency framework
A structured description of skills and proficiency levels, such as SFIA.
- Remember
- Used to compare required and current skills consistently.
- Tested as
- Supports skills gap analysis answers.
- Trap
- Assessing skills informally by job title.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Sourcing options
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Insourcing | Capability built and run by internal staff | Highest control, needs internal skills and capacity | Assuming it is always cheaper or safer |
| Outsourcing | A provider runs the function under contract | Transfers execution, keeps accountability in house | Dropping oversight once the contract starts |
| Cloud services | Provider-run infrastructure, platform or software on subscription | Shared responsibility model and elastic capacity | Misreading which controls the customer still owns |
| Multisourcing | Several providers each handling part of the service | Reduces dependency but adds integration overhead | No one owning end-to-end service performance |
Contract oversight tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SLA | Service targets and remedies agreed with an external provider | Legally enforceable through the contract | Targets not tied to business needs |
| OLA | Internal agreement between support groups | Supports SLAs but is not a contract with a customer | Treating it as enforceable against a provider |
| Assurance report (SOC 2) | Independent auditor's report on a provider's controls | Evidence without performing your own audit | Ignoring carve-outs and complementary user controls |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Terminate the contract
- What candidates pick
- End the contract with an underperforming provider immediately.
- Why it looks right
- It looks decisive and protects the business.
- Why it's wrong
- Without verification and an executable exit plan, termination can cause greater disruption than the underperformance itself.
Clue to watch for Look for answers that verify facts and use contract mechanisms first.
-
Cheapest bid wins
- What candidates pick
- Select the provider with the lowest price.
- Why it looks right
- Cost savings are a common sourcing goal.
- Why it's wrong
- Price ignores capability, viability, risk, exit cost and fit with requirements, which drive total value.
Clue to watch for Mentions of strategic or critical services mean price is only one factor.
-
Provider dashboards are enough
- What candidates pick
- Rely on monthly reports from the provider.
- Why it looks right
- They are detailed and contractually required.
- Why it's wrong
- Self-reported data needs independent checks, such as audits, assurance reports or internal measurement.
Clue to watch for Any mismatch between user complaints and green reports signals verification.
-
Hire contractors
- What candidates pick
- Bring in contractors to cover a skills gap for a strategic platform.
- Why it looks right
- It fills the gap quickly.
- Why it's wrong
- Long-term strategic capability needs internal development or knowledge transfer, otherwise dependency simply moves.
Clue to watch for Words such as long term or strategic point to competency development.
-
Buy more capacity
- What candidates pick
- Purchase additional infrastructure when performance degrades.
- Why it looks right
- It addresses the immediate symptom.
- Why it's wrong
- Without demand forecasting linked to business plans, extra capacity may be wasted or still insufficient.
Clue to watch for Recurring shortfalls indicate a planning gap, not a purchasing gap.
Answer framework
Use this sequence for any Domain 2 resource, sourcing or supplier scenario.
- Start from the business requirement and strategy the resource must support, and decide whether the capability is core or non-core to the enterprise.
- Compare options on total cost of ownership, risk, dependency and exit difficulty, not on price or speed alone, and record the assumptions behind each estimate.
- Confirm accountability stays with a named business owner even when a provider performs the work under contract.
- Make sure contracts and plans include measurable service levels, audit or assurance rights, and a tested exit strategy with data return and transition support.
- Monitor performance, capacity, assets and skills against the plan, verifying data independently before taking contractual or staffing action.
Practice question
Want more like this? The CGEIT practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Plan 20 to 30 hours for this domain. Begin with sourcing: build a simple table comparing insourcing, outsourcing, cloud and multisourcing on control, cost, risk, skills and exit difficulty. Add the shared responsibility model for cloud, because exam scenarios often hinge on which controls the customer still owns. Note how each option changes dependency on a single provider and what leaving would cost.
Next, study vendor and contract management. Know what belongs in a sound contract: measurable SLAs, audit rights, assurance reports, data handling, termination and transition clauses. Practice reading a provider scenario and asking what independent evidence you have before trusting a dashboard or status report.
Finish with asset lifecycle and people. Review license compliance, cloud subscription sprawl, refresh planning and secure disposal, then competency assessment, succession and knowledge transfer. When you review practice questions, flag any answer you chose because it was fast or cheap; Domain 2 often penalizes those instincts in favor of planned, accountable decisions.
FAQ
How much of the CGEIT exam is IT Resources?
IT Resources is 15% of the CGEIT exam, about 22 of 150 questions. It is the smallest of the four domains but still enough to affect the result.
Does Domain 2 test cloud computing?
Cloud is tested as a sourcing option. Expect questions on shared responsibility, dependency, exit planning and contract oversight rather than on technical cloud services.
Is vendor management in CGEIT the same as in CISA?
The topics overlap, but CGEIT asks from the governance view: whether sourcing fits strategy, who remains accountable and how the board gets assurance. CISA focuses more on auditing the controls.
Are people really considered IT resources?
Yes. The outline includes human resource competency assessment and development as a subtopic. Skills, capacity and key person dependency are all resource governance concerns.
What is the single most tested idea in this domain?
That outsourcing transfers execution but not accountability. Many sourcing and supplier questions turn on recognizing that the enterprise must still oversee and act.
How many subtopics does Domain 2 have?
Six: three under IT Resource Planning and three under IT Resource Optimization.
Other Enterprise Architecture & IT Governance certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered sourcing, capacity, acquisition, assets, skills and supplier oversight. Test whether you keep accountability and exit planning in view when the options look cheap and quick.