Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Domain 1—The Process of Auditing Information Systems (14%)
Deliver audit services in compliance with IT audit standards to help the organisation protect and manage information systems effectively.
- 1.1 Develop and execute a risk-based IT audit strategy aligned with IT audit standards to ensure coverage of critical areas.
- 1.1 Plan targeted audits to assess whether information systems are adequately protected, controlled, and delivering value to the organisation.
- 1.3 Perform audits according to IT audit standards to meet planned objectives.
- 1.4 Communicate audit findings and recommendations to key stakeholders to drive necessary changes.
- 1.5 Conduct follow-up reviews or prepare status reports to verify that management has taken timely and appropriate action.
Domain 2—Governance and Management of IT (14%)
Assure that the necessary leadership, organisational structures, and processes are established to achieve objectives and support the organisation’s strategic goals.
- 2.1 Assess the effectiveness of the IT governance structure to ensure IT decisions, directions, and performance align with the organisation’s strategies.
- 2.2 Review the IT organisational structure and human resources management to confirm alignment with strategic objectives.
- 2.3 Assess the IT strategy, including its development, approval, implementation, and maintenance, to ensure alignment with organisational goals.
- 2.4 Evaluate IT policies, standards, and procedures, including their development and monitoring processes, to ensure they support the IT strategy and comply with legal and regulatory requirements.
- 2.5 Assess the quality management system to determine if it supports strategic objectives cost-effectively.
- 2.6 Review IT management and control monitoring practices (e.g., continuous monitoring, QA) for compliance with organisational policies.
- 2.7 Evaluate IT resource investment, usage, and allocation practices, including prioritisation criteria, for strategic alignment.
- 2.8 Assess IT contracting strategies and contract management practices to ensure support for organisational objectives.
- 2.9 Evaluate risk management practices to confirm that IT-related risks are appropriately managed.
- 2.10 Assess monitoring and assurance practices to ensure the board and executive management receive sufficient and timely IT performance information.
- 2.11 Review the business continuity plan to evaluate the organisation’s ability to maintain essential operations during an IT disruption.
Domain 3—Information Systems Acquisition, Development, and Implementation (19%)
Assure that practices for acquiring, developing, testing, and implementing information systems align with the organisation’s strategies and objectives.
- 3.1 Assess the business case for proposed IT investments, including acquisition, development, maintenance, and retirement, to verify alignment with business objectives.
- 3.2 Evaluate project management practices and controls to ensure business requirements are met cost-effectively while managing organisational risks.
- 3.3 Conduct project reviews to confirm progress against plans, adequate documentation, and accurate status reporting.
- 3.4 Assess controls during the requirements, acquisition, development, and testing phases for compliance with organisational policies and external requirements.
- 3.5 Evaluate system readiness for implementation and migration to production to ensure deliverables, controls, and requirements are satisfied.
- 3.6 Conduct post-implementation reviews to verify that deliverables, controls, and organisational requirements have been met.
Domain 4—Information Systems Operations, Maintenance and Support (23%)
Assure that processes for the operation, maintenance, and support of information systems align with the organisation’s strategies and objectives.
- 4.1 Perform periodic reviews to ensure information systems continue to meet organisational objectives.
- 4.2 Assess service level management practices to confirm that service levels from internal and external providers are defined and managed.
- 4.3 Evaluate third-party management practices to ensure providers adhere to the expected levels of control.
- 4.4 Review operations and end-user procedures to ensure both scheduled and unscheduled processes are managed to completion.
- 4.5 Assess information systems maintenance processes to ensure they are effectively controlled and continue to support organisational objectives.
- 4.6 Evaluate data administration practices to ensure database integrity and optimisation.
- 4.7 Assess the use of capacity and performance monitoring tools to confirm IT services meet organisational objectives.
- 4.8 Review problem and incident management practices to ensure incidents and errors are recorded, analysed, and resolved promptly.
- 4.9 Evaluate change, configuration, and release management practices to ensure production environment changes are adequately controlled and documented.
- 4.10 Assess backup and restore provisions to ensure the availability of information needed to resume processing.
- 4.11 Review the disaster recovery plan to ensure it enables the recovery of IT processing capabilities in the event of a disaster.
Domain 5—Protection of Information Assets (30%)
Assure that the organisation’s security policies, standards, procedures, and controls ensure the confidentiality, integrity, and availability of information assets.
- 5.1 Review information security policies, standards, and procedures for completeness and alignment with industry best practices.
- 5.2 Assess the design, implementation, and monitoring of system and logical security controls to verify information confidentiality, integrity, and availability.
- 5.3 Evaluate the design, implementation, and monitoring of data classification processes to ensure alignment with organisational policies and external requirements.
- 5.4 Assess the design, implementation, and monitoring of physical access and environmental controls to ensure information assets are adequately protected.
- 5.5 Review processes for storing, retrieving, transporting, and disposing of information assets (e.g., backup media, offsite storage, hard copy/soft copy data) to ensure adequate safeguarding.
Requirements
No specific prerequisites are required for this non-certification course.
35 Hours
Testimonials (2)
Being approachable and pushing us into interaction
Daniel - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - CISSP - Certified Information Systems Security Professional
Overview of Risk topics and preparing for exam
