COBIT-2019 Exam Dumps - COBIT 2019 Foundation

 The number of confidentiality incidents causing financial loss, business disruption or public embarrassment would be the best metric to enable an enterprise to evaluate an alignment goal specifically related to security of information and privacy. A metric is a quantifiable measure that is used to track and assess the status of a specific process or activity. An alignment goal is an intermediate goal that links the enterprise goals with the governance and management objectives. Security of information and privacy is one of the 17 generic alignment goals defined by COBIT that describes how information and technology can support the protection of sensitive information and personal data. The number of confidentiality incidents causing financial loss, business disruption or public embarrassment is a metric that reflects how well this alignment goal is achieved.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

The high involvement of IT-related roles in organizational structures is a critical requirement when the IT function is strategic and crucial to the success of the business. The IT function is the part of the enterprise that is responsible for planning, delivering, operating, and supporting information and technology services. The IT function can have different levels of strategic importance for the business, depending on the nature, scope, and objectives of the enterprise. When the IT function is strategic and crucial to the success of the business, it means that information and technology are essential for creating value, achieving competitive advantage, enabling innovation, etc. In this case, it is critical to have high involvement of IT-related roles in organizational structures, such as having IT representation at the board level, having clear IT leadership roles and responsibilities, having effective IT governance committees or forums, etc.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

The performance measurements are the indicators that measure the progress and outcomes of the EGIT implementation program plan against the predefined success criteria such as key performance indicators (KPIs), key goal indicators (KGIs), key risk indicators (KRIs), etc. The performance measurements help to evaluate the effectiveness, efficiency, and value of the EGIT implementation program plan, as well as to identify and address any issues, risks, or gaps that may arise during the execution of the program. The projects that should be included when reporting on performance measurements related to an EGIT implementation program plan are all projects deemed appropriate by IT management. IT management is the function that is responsible for planning, organizing, directing, controlling, and monitoring the information and technology activities in an enterprise. IT management is also responsible for selecting, prioritizing, balancing, monitoring, evaluating, and optimizing information and technology investments and initiatives that support business strategy and objectives. IT management has the authority and discretion to decide which projects are relevant and important for reporting on performance measurements related to an EGIT implementation program plan, based on factors such as project scope, size, complexity, duration, cost, risk, interdependencies, alignment, value, etc. By including all projects deemed appropriate by IT management when reporting on performance measurements related to an EGIT implementation program plan, the enterprise can ensure that the report covers the most significant and critical aspects of the program, and that it provides a comprehensive and accurate picture of the program status and performance12 References: 1: COBIT 2019 Implementation Guide: page 51-52 2: COBIT 2019 Framework: Governance and Management Objectives: page 20-21

 According to the COBIT 2019 Design Guide, when designing an IT governance system, the next step after considering the enterprise’s strategic business objectives is to assess the enterprise’s risk profile. The enterprise’s risk profile reflects the level of risk exposure and appetite that the organization is willing to accept in pursuit of its objectives. The risk profile also influences the selection of governance objectives, components and practices that are appropriate for managing IT-related risks.1, p. 18-19 References: 1: COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

The CIO and the program steering committee are responsible for performing a stakeholder satisfaction survey and gathering feedback on lessons learned from the implementation of an EGIT program plan. According to the COBIT 2019 Implementation Guide, the CIO is the executive sponsor of the EGIT program, who provides strategic direction, leadership, and oversight for the program. The program steering committee is a group of senior stakeholders who support the CIO in governing and monitoring the program. One of their responsibilities is to conduct regular reviews of the program performance and outcomes, including stakeholder satisfaction and lessons learned. These reviews help to evaluate the effectiveness and efficiency of the EGIT program plan and identify areas for improvement. References: : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 23 1 : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 45 1

The process practices that include inputs and outputs comprise the information flow component of a governance system. A governance system is a set of components that provide direction, oversight, evaluation, monitoring, assurance, etc., for an enterprise’s information and technology. A governance system consists of seven components: governance components (such as structures, processes, principles, policies, etc.), governance enablers (such as people, skills, culture, information, services, etc.), governance outcomes (such as value creation, risk optimization, resource optimization, etc.), information flow (the exchange of information among components), culture (the shared values, beliefs, norms, and attitudes), ethical behavior (the conduct that conforms to moral principles), stakeholder needs (the requirements or expectations of internal or external stakeholders). The information flow component comprises the process practices that include inputs and outputs thatenable the exchange of information among components.14 References: COBIT 2019Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 The COBIT performance model is integrated into the COBIT core model. The COBIT core model consists of two main elements: the governance and management objectives (which define what needs to be achieved) and the performance model (which defines how well it needs to be achieved). The performance model is based on existing maturity and capability models (such as ISO/IEC 15504) and provides a common language to measure and communicate performance. The performance model consists of six levels (from 0 to 5) that describe the increasing degree of capability for each governance or management objective.15 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

The number of business processing hours lost due to unplanned service interruptions would be an appropriate metric associated with an enterprise goal of business service continuity and availability. A metric is a quantifiable measure that is used to track and assess the status of a specific process or activity. Business service continuity and availability is one of the 17 generic enterprise goals defined by COBIT that describes the desired outcome of ensuring that critical business services are delivered at agreed levels and are resilient to disruptions. The number of business processing hours lost due to unplanned service interruptions is a metric that reflects how well this outcome is achieved.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives