Certified Information Systems Auditor (CISA) Information Systems Operations and Business Resilience Syllabus

Information Systems Operations and Business Resilience syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Information Systems Operations and Business Resilience in Certified Information Systems Auditor (CISA), not a summary of it.

1. 1

   IT Service Management and Operations

   5 topics

   • Service management frameworks (ITIL) and processes
   • Incident, problem, and request management
     • Escalation procedures and root cause analysis
   • Change, release, and configuration management
     • Emergency change handling and CMDB
   • Service level and capacity management
   • IT asset and license management
2. 2

   Systems and Infrastructure Operations

   5 topics

   • Hardware and computer operations management
   • Operating systems and utility software controls
   • Job scheduling and batch processing controls
   • End-user computing and shadow IT risks
   • Monitoring, logging, and performance management
3. 3

   Database and Data Management

   4 topics

   • Database management system controls
   • Data governance, classification, and quality
   • Data lifecycle and retention management
   • Backup, restoration, and storage management
     • Backup schemes and offsite storage
4. 4

   Business Continuity Planning

   4 topics

   • Business impact analysis (BIA)
     • RTO, RPO, and MTD determination
     • Criticality and dependency analysis
   • BCP strategy development and documentation
   • Plan testing and maintenance
     • Tabletop, walkthrough, and full-interruption tests
   • Crisis management and communications
5. 5

   Disaster Recovery Planning

   4 topics

   • Disaster recovery strategy and objectives
   • Alternate processing sites
     • Hot, warm, cold, and mobile sites
     • Reciprocal and cloud-based recovery
   • Data replication and recovery techniques
   • DR plan testing, invocation, and maintenance

Information Systems Operations and Business Resilience flashcards for Certified Information Systems Auditor (CISA)

24 of 51 cards from the Information Systems Operations and Business Resilience deck — real questions with worked answers.

1. What is ITIL and what is its primary purpose in IT service management?

   ITIL (Information Technology Infrastructure Library) is a globally adopted framework of best practices for IT service management (ITSM). Its purpose is to align IT services with business needs through a structured service lifecycle, improving service quality, efficiency, and value delivery.

2. What are the five core stages of the ITIL (v3) service lifecycle?

   Service Strategy, Service Design, Service Transition, Service Operation, and Continual Service Improvement (CSI).

3. In ITSM, what is the difference between an incident and a problem?

   An incident is an unplanned interruption or reduction in quality of a service requiring restoration as fast as possible. A problem is the underlying root cause of one or more incidents; problem management seeks to permanently eliminate that cause.

4. What is the primary goal of incident management?

   To restore normal service operation as quickly as possible while minimizing adverse impact on business operations, ensuring agreed service levels are maintained. It focuses on restoration, not root-cause elimination.

5. What is a 'known error' in problem management?

   A problem that has a documented root cause and a workaround. Known errors are stored in a Known Error Database (KEDB) to speed resolution of future related incidents.

6. What is a service (or request) fulfillment process used for, and how does a service request differ from an incident?

   Request fulfillment handles standard, pre-approved, low-risk service requests (e.g., password resets, access, equipment). Unlike an incident, a request is not caused by a service disruption—it is a routine, planned user need.

7. What is the primary objective of change management?

   To control the lifecycle of all changes so that beneficial changes are made with minimum disruption to IT services, ensuring changes are assessed, approved, tested, documented, and reversible (have a back-out plan).

8. What is the role of a Change Advisory Board (CAB)?

   The CAB is a group that evaluates, prioritizes, authorizes, and schedules significant changes, assessing risk and impact before approval. Emergency changes may be handled by an ECAB (Emergency CAB).

9. Differentiate standard, normal, and emergency changes in change management.

   Standard: pre-authorized, low-risk, repeatable (no CAB needed). Normal: must go through full assessment and CAB approval. Emergency: needed to resolve a major incident urgently, approved by an ECAB with documentation completed afterward.

10. What is the purpose of release and deployment management?

    To plan, schedule, build, test, and control the movement of releases into production so that the integrity of the live environment is protected and the correct, tested components are deployed.

11. What is a Configuration Management Database (CMDB) and what does it store?

    A CMDB is a repository that stores information about Configuration Items (CIs)—hardware, software, documentation, and their relationships and dependencies. It supports change, incident, and problem management by providing accurate configuration data.

12. What is a Service Level Agreement (SLA) and what does it typically define?

    An SLA is a documented agreement between an IT service provider and a customer defining service expectations—availability, performance, response/resolution times, and responsibilities. It is the basis for measuring service delivery.

13. Distinguish an SLA, an OLA, and a UC (underpinning contract).

    SLA: agreement between provider and the business customer. OLA (Operational Level Agreement): internal agreement between IT teams supporting the SLA. UC (Underpinning Contract): agreement with an external third-party supplier supporting service delivery.

14. What is the goal of capacity management?

    To ensure IT capacity (processing, storage, network, staff) meets current and future business demand cost-effectively and at agreed service levels, avoiding both shortages and wasteful over-provisioning.

15. What is the purpose of IT asset management (ITAM)?

    To track and manage IT assets (hardware and software) throughout their lifecycle—procurement, deployment, maintenance, and disposal—to optimize costs, ensure accountability, support security, and maintain accurate inventory.

16. Why is software license management important from an audit perspective?

    It ensures the organization uses software in compliance with license terms, avoiding legal/financial penalties for under-licensing (piracy) and wasted spend from over-licensing. Auditors verify deployed installations match owned licenses.

17. In computer operations, what is the principle of segregation of duties for operators vs. programmers?

    Operators should run production jobs but not modify program code or have access to source code; programmers develop code but should not have access to production data or the ability to run/modify production jobs. This prevents unauthorized changes and fraud.

18. What is the function of a console log in computer operations, and what control concern does it raise?

    The console log records operator activities and system messages. The control concern is that operators could alter or suppress log entries; therefore logs should be protected, reviewed independently, and retained for accountability.

19. What is supervisor (privileged/kernel) mode in an operating system and why is it a key control point?

    Supervisor mode allows execution of privileged instructions with full access to hardware and memory. It is a critical control point because programs running in this mode bypass normal access controls; privileged accounts must be tightly restricted and monitored.

20. What are utility programs (system utilities) and why are they a security risk?

    Utility programs are powerful system tools (e.g., for editing data, bypassing controls, or accessing memory directly) that can override normal application and security controls. Their use must be restricted, logged, and reviewed to prevent unauthorized data manipulation.

21. What is job scheduling and what is the main control objective for automated job scheduling software?

    Job scheduling automates the execution of batch jobs in proper sequence and timing. The control objective is to ensure jobs run completely, accurately, in correct order, with proper dependencies, and that failures/reruns are detected, authorized, and logged.

22. In batch processing, what is a run-to-run control total?

    A control total (record counts or dollar amounts) carried forward from the output of one processing run to be reconciled with the input of the next, ensuring no records were lost, added, or altered between processing stages.

23. What is end-user computing (EUC) and what is its primary risk?

    EUC is the development and use of applications (e.g., spreadsheets, databases, macros) by non-IT business users outside formal IT controls. The primary risk is data integrity and reliability issues due to lack of change control, testing, documentation, and security.

24. What is 'shadow IT' and why is it a concern for auditors?

    Shadow IT is hardware, software, or cloud services used within an organization without the knowledge or approval of the IT department. It is a concern because it bypasses security, data governance, licensing, and compliance controls, creating unmanaged risk.

See more Information Systems Operations and Business Resilience flashcards →

Planning Information Systems Operations and Business Resilience for Certified Information Systems Auditor (CISA)

Information Systems Operations and Business Resilience (Certified Information Systems Auditor (CISA)) FAQ