CISSP Practice полностью

174. a. The IT strategic plan sets the broad direction and goals for managing information within the organization and supporting the delivery of services to customers. It should be derived from and relate to the organization’s strategic plan. The plan typically contains an IT mission statement, a vision describing the target IT environment of the future, an assessment of the current environment, and broad strategies for moving into the future. The IT strategic plan is a somewhat stable document. It does not require annual updates. However, an organization should periodically review and update the IT strategic plan as necessary to reflect significant changes in the IT mission or direction. The strategies presented in the IT strategic plan provide the basis for the IT operational plan, which includes security and training plans.

The IT operational plan describes how the organization will implement the strategic plan. The operational plan identifies logical steps for achieving the IT strategic vision. It may present an implementation schedule, identify key milestones, define project initiatives, and include resources (e.g., funding and personnel) estimates. The operational plan should identify dependencies among the IT strategies and present a logical sequence of project initiatives to assure smooth implementation.

The IT security plans and training plans are incorrect because they are components of the IT operational plan. Security plans should be developed for an organization or an individual system. These plans document the controls and safeguards for maintaining information integrity and preventing malicious/accidental use, destruction, or modification of information resources within the organization. Training plans document the types of training the IT staff will require to effectively perform their duties. The IT operational plans, security plans, and training plans are in a constant state of flux.

175. An information technology operational plan answers all the following questions except:

a. How do we get there?

b. When will it be done?

c. What is our goal?

d. Who will do it?

175. c. The IT operational plan describes how the organization will implement the strategic plan. Usually, the operational plan answers the following questions: How do we get there? When will it be done? Who will do it? The strategic plan answers the question: What is our goal?

176. Which of the following meets the criteria for an IT strategic plan?

a. Developing enterprise information technology models

b. Initiating work process redesign

c. Conducting business systems planning

d. Assessing internal and external environment

176. d. The IT strategic planning is long-range thinking. Planners apply analytic techniques, creativity, and sound judgment to anticipate the requirements of the future. The strategic planning approach provides a framework for bounding the scope and presenting the results of long-range thinking. A strategic planning approach should foster strategic thinking and innovation, assess the organization’s mission, vision, and strategies, define the IT mission, vision, and goals, and assess the internal and external environment. Internal influences are those that have implications for managing the organization such as customers, competitors, contractors, vendors, and user organizations (i.e., internal environment). External influences are broad in scope, often imposed from the outside environment, and uncontrollable by the organization. An organization derives its challenges and opportunities from external influences such as financial community, governments, and industry (i.e., external environment).

The other three choices are examples of IT approaches to augment the development of strategic plans and include enterprise IT models, work process redesign, and business systems planning. Enterprise models provide a means for examining the current environment. They do not foster the development of an organizational direction (i.e., mission and vision). Hence, they do not meet the criteria for strategic planning.

Work process redesign is synonymous with the following concepts: business re-engineering, business process improvement, and business process design. This approach helps managers to define relationships and activities within the organization. Business systems–planning is used to identify information requirements but does not consider strategic methodologies. Information planning approaches do not study organizational cultural issues or provide a strategic work focus.

177. Which of the following is not an example of IT mission statements?

a. Streamlining work processes through automation

b. Maintaining reliability and timeliness of information