CISSE Intermediate Level

Information Systems Strategy, Governance and Ethics flashcards

Read the question, say the answer to yourself, then turn the card to check. The first 10 of 46 cards are free; the rest come with the subject.

Card 1 of 46

Jump to a card

Complete Flashcard Reference

Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 36 come with the subject.

How does governance differ from management of information systems?

Governance sets direction and holds the organisation accountable. Management executes within that direction day to day. A question about who sets policy is testing governance; one about who carries it out is testing management.

What are the three corners of the Information Systems Strategy Triangle?

Business strategy, organisational strategy and information strategy. Each shapes and is constrained by the other two, and business strategy is the apex the other two exist to serve.

What are the five pillars of IT governance?

Strategic alignment, value delivery, risk management, resource management and performance measurement. A described governance failure usually names exactly one pillar missing.

What are the four steps of the risk management process applied to IS?

1. Identify what could go wrong. 2. Assess the likelihood and impact of each risk. 3. Respond: avoid, reduce (mitigate), transfer (for example, insurance) or accept. 4. Monitor risk exposure and control effectiveness on an ongoing basis.

Name the four intellectual property protections relevant to an IS function and what each protects.

Copyright: original creative and software works. Patent: a novel invention or process, with exclusive rights for a defined period. Trademark: a distinctive brand identity, such as a name or logo. Trade secret: confidential business information, protected by secrecy rather than registration.

What is a disruptive innovation?

One that first underperforms an incumbent technology on the dimensions established customers value most, but improves rapidly and eventually displaces the incumbent entirely. It catches incumbents unprepared because their strategy and processes were optimised for the old technology.

What is the productivity paradox, and why does it occur?

Heavy IS investment does not always show up cleanly in measured output. Benefits are diffuse (better decisions, not just faster ones), and organisations often fail to redesign processes to exploit the new system, so a tool bolted onto an unchanged process captures little of its value.

How are single loss expectancy and annualised loss expectancy worked out, and when is a control worth buying?

Single loss expectancy = asset value x exposure factor. Annualised loss expectancy = single loss expectancy x expected incidents a year. A control is worth buying when the reduction in annualised loss exceeds the control's annual cost.

Which Kenyan Act sets the legal floor for data privacy, who enforces it, and how does ethical practice go further?

The Data Protection Act, 2019, enforced by the Office of the Data Protection Commissioner (ODPC). It requires a lawful basis for collecting personal data and adequate protection of it. Ethical practice goes further: collecting only the data a stated purpose genuinely needs, and being transparent with data subjects about how it is used.

What is the best way to revise the named technology-and-client pairings in the industry case studies?

By the category of tool each product represents (analytics, SEO, lead generation, link tracking, content discovery, experimentation) and the business problem that category solves. The syllabus supplies no outcome figures for the cases.

Define strategy as this paper uses it.