ABOUT THE AUTHORS PETER H. GREGORY, CISA, CISSP, is a career technologist and cybersecurity leader. He is the Senior Director of GRC at GCI Communications, where he leads security policy, control frameworks, business continuity, third-party risk management, privacy, information and AI governance, and law enforcement wiretaps. MIKE CHAPPLE, PhD, CISA, CISSP, is a teaching professor of IT, analytics, and operations at the University of Notre Dame. He is a cybersecurity professional and educator with over 25 years experience including as chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. Mike is the author of more than 200 books and video courses and provides cybersecurity certification resources at CertMike.com.

• Introduction xxiiiAssessment Test xxxvChapter 1 IT Governance and Management 1IT Governance Practices for Executives and Boards of Directors 3IT Strategic Planning 10Policies, Processes, Procedures, and Standards 12Risk Management 23IT Management Practices 39Organization Structure and Responsibilities 62Maintaining an Existing Program 72Auditing IT Governance 75Summary 80Exam Essentials 81Review Questions 83Chapter 2 The Audit Process 87Audit Management 89ISACA Auditing Standards 99Risk Analysis 108Controls 115Performing an Audit 121Control Self-Assessment 144Implementation of Audit Recommendations 147Audit Quality Assurance 148Summary 148Exam Essentials 150Review Questions 152Chapter 3 IT Life Cycle Management 157Benefits Realization 159Project Management 165Systems Development Methodologies 191Infrastructure Development and Deployment 230Maintaining Information Systems 234Business Processes 237Managing Third Parties 244Application Controls 247Auditing the Systems Development Life Cycle 253Auditing Business Controls 258Auditing Application Controls 258Auditing Third-Party Risk Management 261Summary 262Exam Essentials 264Review Questions 266Chapter 4 IT Service Management 271Information Systems Operations 273Systems Performance Management 274Problem and Incident Management 277Change, Configuration, Release, and Patch Management 279Operational Log Management 286IT Service Level Management 288Database Management Systems 290Data Management and Governance 294Other IT Service Management Topics 295Auditing IT Service Management and Operations 297Summary 301Exam Essentials 302Review Questions 304Chapter 5 IT Infrastructure 309Information Systems Hardware 310Information Systems Architecture and Software 324Network Infrastructure 330Asset Inventory and Classification 386Job Scheduling and Production Process Automation 390System Interfaces 391End-User Computing 392Auditing IT Infrastructure 393Summary 398Exam Essentials 399Review Questions 401Chapter 6 Business Continuity and Disaster Recovery 405Business Resilience 406Incident Response Communications 473Auditing Business Continuity Planning 475Auditing Disaster Recovery Planning 479Summary 484Exam Essentials 485Review Questions 487Chapter 7 Information Security Management 491Information Security 493Role of the Information Security Manager 494Information Security Risks 497Building an Information Security Strategy 501Implementing Security Controls 505Endpoint Security 507Network Security Controls 511Cloud Computing Security 519Cryptography 528Exploring Cybersecurity Threats 539Privacy 545Security Awareness and Training 548Security Incident Response 550Auditing Information Security Controls 554Summary 559Exam Essentials 560Review Questions 563Chapter 8 Identity and Access Management 567Logical Access Controls 568Third-party Access Management 587Environmental Controls 592Physical Security Controls 599Human Resources Security 602Auditing Access Controls 606Summary 616Exam Essentials 617Review Questions 619Chapter 9 Conducting a Professional Audit 623Understanding the Audit Cycle 624How the IS Audit Cycle Is Discussed 625Overview of the IS Audit Cycle 627Summary 699Appendix A Popular Methodologies, Frameworks, and Guidance 701Common Terms and Concepts 702Frameworks, Methodologies, and Guidance 710Notes 738References 738Appendix B Answers to Review Questions 741Chapter 1: IT Governance and Management 742Chapter 2: The Audit Process 744Chapter 3: IT Life Cycle Management 746Chapter 4: IT Service Management 748Chapter 5: IT Infrastructure 749Chapter 6: Business Continuity and Disaster Recovery 750Chapter 7: Information Security Management 752Chapter 8: Identity and Access Management 754Index 759

ABOUT THE AUTHORS PETER H. GREGORY, CISA, CISSP, is a career technologist and cybersecurity leader. He is the Senior Director of GRC at GCI Communications, where he leads security policy, control frameworks, business continuity, third-party risk management, privacy, information and AI governance, and law enforcement wiretaps. MIKE CHAPPLE, PhD, CISA, CISSP, is a teaching professor of IT, analytics, and operations at the University of Notre Dame. He is a cybersecurity professional and educator with over 25 years experience including as chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. Mike is the author of more than 200 books and video courses and provides cybersecurity certification resources at CertMike.com.

• Introduction xxiiiAssessment Test xxxvChapter 1 IT Governance and Management 1IT Governance Practices for Executives and Boards of Directors 3IT Strategic Planning 10Policies, Processes, Procedures, and Standards 12Risk Management 23IT Management Practices 39Organization Structure and Responsibilities 62Maintaining an Existing Program 72Auditing IT Governance 75Summary 80Exam Essentials 81Review Questions 83Chapter 2 The Audit Process 87Audit Management 89ISACA Auditing Standards 99Risk Analysis 108Controls 115Performing an Audit 121Control Self-Assessment 144Implementation of Audit Recommendations 147Audit Quality Assurance 148Summary 148Exam Essentials 150Review Questions 152Chapter 3 IT Life Cycle Management 157Benefits Realization 159Project Management 165Systems Development Methodologies 191Infrastructure Development and Deployment 230Maintaining Information Systems 234Business Processes 237Managing Third Parties 244Application Controls 247Auditing the Systems Development Life Cycle 253Auditing Business Controls 258Auditing Application Controls 258Auditing Third-Party Risk Management 261Summary 262Exam Essentials 264Review Questions 266Chapter 4 IT Service Management 271Information Systems Operations 273Systems Performance Management 274Problem and Incident Management 277Change, Configuration, Release, and Patch Management 279Operational Log Management 286IT Service Level Management 288Database Management Systems 290Data Management and Governance 294Other IT Service Management Topics 295Auditing IT Service Management and Operations 297Summary 301Exam Essentials 302Review Questions 304Chapter 5 IT Infrastructure 309Information Systems Hardware 310Information Systems Architecture and Software 324Network Infrastructure 330Asset Inventory and Classification 386Job Scheduling and Production Process Automation 390System Interfaces 391End-User Computing 392Auditing IT Infrastructure 393Summary 398Exam Essentials 399Review Questions 401Chapter 6 Business Continuity and Disaster Recovery 405Business Resilience 406Incident Response Communications 473Auditing Business Continuity Planning 475Auditing Disaster Recovery Planning 479Summary 484Exam Essentials 485Review Questions 487Chapter 7 Information Security Management 491Information Security 493Role of the Information Security Manager 494Information Security Risks 497Building an Information Security Strategy 501Implementing Security Controls 505Endpoint Security 507Network Security Controls 511Cloud Computing Security 519Cryptography 528Exploring Cybersecurity Threats 539Privacy 545Security Awareness and Training 548Security Incident Response 550Auditing Information Security Controls 554Summary 559Exam Essentials 560Review Questions 563Chapter 8 Identity and Access Management 567Logical Access Controls 568Third-party Access Management 587Environmental Controls 592Physical Security Controls 599Human Resources Security 602Auditing Access Controls 606Summary 616Exam Essentials 617Review Questions 619Chapter 9 Conducting a Professional Audit 623Understanding the Audit Cycle 624How the IS Audit Cycle Is Discussed 625Overview of the IS Audit Cycle 627Summary 699Appendix A Popular Methodologies, Frameworks, and Guidance 701Common Terms and Concepts 702Frameworks, Methodologies, and Guidance 710Notes 738References 738Appendix B Answers to Review Questions 741Chapter 1: IT Governance and Management 742Chapter 2: The Audit Process 744Chapter 3: IT Life Cycle Management 746Chapter 4: IT Service Management 748Chapter 5: IT Infrastructure 749Chapter 6: Business Continuity and Disaster Recovery 750Chapter 7: Information Security Management 752Chapter 8: Identity and Access Management 754Index 759