Certified Information Systems Auditor (CISA) | Domain 2 Resources, Data and Third Parties 02

Portfolio management optimises the investments as a whole, rather than individual proposals, in line with enterprise strategy.

A decision needs the value of the investment, its total cost, its risks and how the benefits will be realised.

The data owner understands the business value and decides the classification, use and protection requirements.

The steward manages data quality and metadata in practice, following the owner's policy.

Assess capabilities such as financial standing, security, continuity and legal compliance before outsourcing.

An SLA sets out the agreed service levels for availability, response time, reporting and so on.

Passing control requirements down the whole supply chain secures visibility of and accountability for further subcontracting.

Documenting knowledge and enabling several people to do the work reduces dependence on a single individual.

Understanding the legal obligations and the data life cycle lets you design controls over collection, use, retention and deletion.