Isaca CISA Exam Questions

The first step to successfully implement a corporate data classification program is to approve a data classification policy. A data classification policy is a document that defines the objectives, scope, principles, roles, responsibilities, and procedures for classifying data based on its sensitivity and value to the organization. A data classification policy is essential for establishing a common understanding and a consistent approach for data classification across the organization, as well as for ensuring compliance with relevant regulatory and contractual requirements.

Selecting a data loss prevention (DLP) product (option B) is not the first step to implement a data classification program, as it is a technical solution that supports the enforcement of the data classification policy, not the definition of it. A DLP product can help prevent unauthorized access, use, or disclosure of sensitive data by monitoring, detecting, and blocking data flows that violate the data classification policy. However, before selecting a DLP product, the organization needs to have a clear and approved data classification policy that specifies the criteria and rules for data classification.

Confirming that adequate resources are available for the project (option C) is also not the first step to implement a data classification program, as it is a project management activity that ensures the feasibility and sustainability of the project, not the design of it. Confirming that adequate resources are available for the project involves estimating and securing the necessary budget, staff, time, and tools for implementing and maintaining the data classification program. However, before confirming that adequate resources are available for the project, the organization needs to have a clear and approved data classification policy that defines the scope and objectives of the project.

Checking for the required regulatory requirements (option D) is also not the first step to implement a data classification program, as it is an input to the development of the data classification policy, not an output of it. Checking for the required regulatory requirements involves identifying and analyzing the applicable laws, regulations, standards, and contracts that govern the protection and handling of sensitive data. However, checking for the required regulatory requirements is not enough to implement a data classification program; the organization also needs to have a clear and approved data classification policy that incorporates and complies with those requirements.

Therefore, option A is the correct answer.

Data Classification: What It Is and How to Implement It

Create a well-designed data classification framework

7 Steps to Effective Data Classification | CDW

Data Classification: The Basics and a 6-Step Checklist - NetApp

Private and confidential February 2021 - Deloitte US

A differential backup scheme is the best option when storage media is limited, as it only backs up the data that has changed since the last full backup. This reduces the amount of storage space required and also simplifies the restoration process, as only the last full backup and the last differential backup are needed. A real-time backup scheme would require continuous replication of data, which would consume a lot of storage space and network bandwidth. A virtual backup scheme would create a snapshot of the data at a point in time, but it would not reduce the storage space required, as it would still need to store the changes made to the data. A full backup scheme would back up all the data every time, which would require the most storage space and also take longer to complete.Reference:ISACA, CISA Review Manual, 27th Edition, 2018, page 405

The best answer is B. Senior management.

The culture that supports an effective internal control system is set from the top. ISACA's governance and culture guidance consistently treats culture as a management and leadership responsibility. Senior leadership establishes tone, values, expectations, accountability, and behavioral norms that shape how controls are designed, followed, and enforced across the enterprise. A strong control culture depends on visible commitment from leadership, not just procedural ownership by operational teams.

Option A. HR supports the culture through hiring, training, and policy reinforcement, but HR does not have primary accountability for the overall control environment.

Option C. Line management plays an important role in day-to-day control execution, but enterprise culture is primarily driven by senior leadership.

Option D. Internal audit evaluates and provides assurance over the control system; it does not own or establish the control culture because doing so would impair independence.

Therefore, B is the correct answer because senior management is primarily accountable for establishing the tone and culture that enable an effective and efficient internal control system.

References (Official ISACA):

ISACA Journal, Auditing Your Organizational Culture.

ISACA Now Blog, Culture as a Corporate Asset.

ISACA Digital Video/Podcast, Understanding and Assessing Organization Culture.

ISACA Journal, Auditing Culture.

The answer B is correct because the most important thing for an IS auditor to review when determining whether IT investments are providing value to the business is the business strategy. The business strategy is the plan or direction that guides the organization's decisions and actions to achieve its goals and objectives. The business strategy defines the organization's vision, mission, values, competitive advantage, target market, value proposition, and key performance indicators (KPIs).

IT investments are the expenditures or costs incurred by the organization to acquire, develop, maintain, or improve its IT assets, such as hardware, software, network, data, or services. IT investments can help the organization to support its business processes, operations, functions, and capabilities. IT investments can also help the organization to create or enhance its products, services, or solutions for its customers or stakeholders.

To determine whether IT investments are providing value to the business, an IS auditor needs to review how well the IT investments align with and contribute to the business strategy. Alignment means that the IT investments are consistent and compatible with the business strategy, and that they support and enable the achievement of the strategic goals and objectives. Contribution meansthat the IT investments are effective and efficient in delivering the expected outcomes and benefits for the business, and that they generate a positive return on investment (ROI) or value for money.

An IS auditor can use various methods or frameworks to review the alignment and contribution of IT investments to the business strategy, such as:

Balanced scorecard: A balanced scorecard is a tool that measures and monitors the performance of an organization across four perspectives: financial, customer, internal process, and learning and growth. A balanced scorecard can help an IS auditor to evaluate how well the IT investments support and improve each perspective of the organization's performance, and how they link to the organization's vision and strategy.

Value chain analysis: A value chain analysis is a tool that identifies and analyzes the primary and support activities that add value to an organization's products or services. A value chain analysis can help an IS auditor to assess how well the IT investments enhance or optimize each activity of the value chain, and how they create or sustain a competitive advantage for the organization.

Business case analysis: A business case analysis is a tool that evaluates the feasibility, viability, and desirability of a proposed project or initiative. A business case analysis can help an IS auditor to examine how well the IT investments address a business problem or opportunity, how they deliver the expected benefits and outcomes for the stakeholders, and how they compare with alternative options or solutions.

The other options are not as important as option B. Return on investment (ROI) (option A) is a metric that measures the profitability or efficiency of an investment by comparing its benefits or returns with its costs or expenses. ROI can help an IS auditor to quantify the value of IT investments for the business, but it does not capture all aspects of value, such as quality, satisfaction, or impact. ROI also depends on how well the IT investments align with the business strategy in the first place. Business cases (option C) are documents that justify and support a proposed project or initiative by describing its objectives, scope, benefits, costs, risks, and alternatives. Business cases can help an IS auditor to understand the rationale and expectations for IT investments, but they do not guarantee that the IT investments will actually deliver the desired value for the business. Business cases also need to be aligned with the business strategy to ensure their relevance and validity. Total cost of ownership (TCO) (option D) is a metric that measures the total costs incurred by an organization to acquire, operate, maintain, and dispose of an IT asset over its life cycle. TCO can help an IS auditor to estimate the financial impact of IT investments for the business, but it does not reflect the benefits or outcomes of IT investments, nor does it indicate how well the IT investments support or enable the business strategy.

IT Strategy: Aligning IT and Business Strategy

How To Measure The Value Of Your Technology Investments

IT Investment Management: A Framework for Assessing ... - GAO

How To Align Your Technology Investments With Your Business Strategy