セクション: 巻 B

Total cost of ownership (TCO) is the purchase price of an asset plus the costs of operation over its lifespan1. TCO includes hardware and software acquisition, management and support, communications, end-user expenses and the opportunity cost of downtime, training and other productivity losses2. By considering TCO in investment decisions, an enterprise can avoid unexpected costs and optimize the value of its IT assets3. A policy to consider TCO in investment decisions can help the enterprise to plan ahead for the lease or purchase of IT infrastructure and software licenses, and avoid cost overruns due to lease extensions or other factors. References :
* CGEIT Review Manual (Digital Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123
* CGEIT Review Manual (Print Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123
* How to Calculate Total Cost of Ownership for Software - GetApp4
* Total Cost of Ownership: How It's Calculated With Example - Investopedia1

セクション: 巻 B

The first thing that the enterprise should do after learning of a new regulation that may impact delivery of one of its core technology services is to assess the risk associated with the new regulation. A risk assessment is a process of identifying, analyzing, and evaluating the potential threats and impacts of a risk event on the enterprise's objectives, processes, and resources1. A risk assessment can help the enterprise understand the nature, scope, and severity of the new regulation, as well as its compliance requirements, costs, and benefits. A risk assessment can also help the enterprise prioritize and implement the appropriate risk responses, such as avoiding, reducing, transferring, or accepting the risk2. According to COBIT 5, one of the seven enablers of IT governance is risk management, which includes assessing IT-related risks and aligning them with enterprise risks3. The risk assessment is also part of the IT governance domain 3: Risk Management4.
The other options are not the first things that the enterprise should do after learning of a new regulation. Updating the risk management framework is a step that may be done after assessing the risk associated with the new regulation, as it involves reviewing and improving the policies, procedures, and practices for managing IT risks in the enterprise. Determining whether the board wants to comply with the regulation is a step that may be done after assessing the risk associated with the new regulation, as it involves consulting with the board and other stakeholders on the strategic and ethical implications of complying or not complying with the regulation. Requesting an action plan from the risk team is a step that may be done after assessing the risk associated with the new regulation, as it involves defining and executing the tasks and activities for achieving compliance and mitigating risk.

データ スチュワードシップとは、企業内のデータの品質、セキュリティ、プライバシー、使用に関するポリシー、標準、役割、責任を定義、実装、および強制するプロセスです1。データ スチュワードシップは、データが正確で、完全で、一貫性があり、タイムリーで、意図された目的に適合していることを保証するため、データ品質保証に最も大きな影響を与えます1。また、データ スチュワードシップは、データ品質の問題を特定して解決し、データ品質のパフォーマンスを監視および測定し、時間の経過とともにデータ品質を向上させるのに役立ちます1。その他のオプションは、データ管理の特定の側面または手法であり、包括的なプロセスではないため、データ スチュワードシップほど影響力はありません。データ暗号化は、データを読み取り不可能な形式に変換して、不正なアクセスや変更から保護するプロセスです2。データ暗号化は、データのセキュリティとプライバシーを強化できますが、データ品質保証に直接影響することはありません。データ分類は、データの価値、機密性、および企業に対するリスクに基づいてデータを分類するプロセスです。データ分類は、データ保護とコンプライアンスのための適切な制御とポリシーを適用するのに役立ちますが、データ品質保証に直接影響することはありません。
データ モデリングとは、特定のドメインまたはコンテキスト内のデータの構造、関係、および意味の表現を作成するプロセスです。データ モデリングは、データを使用するデータベースやアプリケーションの設計と最適化に役立ちますが、データ品質の保証に直接影響することはありません。