Rapid Revision Cheat Sheet

Use in Week 12 only, and on the morning of the exam. Everything here is recall material — no explanation, no teaching. If a line doesn't immediately make sense, go back to the domain note.

0. The exam in numbers

D1 Auditing Process 18 · D2 Governance & Management of IT 18 · D3 Acquisition/Development/Implementation 12 · D4 Operations & Business Resilience 26 · D5 Protection of Information Assets 26

1. The auditor's role — the rules that decide questions

1. The auditor evaluates, advises, reports. Never designs, implements, approves or owns.
2. Risk assessment comes first on anything new or uncertain.
3. Business owns risk. IT owns systems. Audit owns assurance. The BIA owner is the business.
4. If something is wrong and confirmed → report, escalate to the audit committee if management accepts the risk.
5. Independence: in fact and in appearance. No self-review.
6. Preventive > detective > corrective, unless risk/cost makes a compensating or detective control the right answer.
7. Verify, don't assume. HR notifying IT of a leaver is not evidence that access was revoked.
8. Auditor reviews technical tests; does not perform them.

2. Domain 1 — Auditing Process (18%)

ITAF (4th edition)

Families: general standards · performance standards · reporting standards. External QAIP assessment at least every 5 years.

ITAF general standards — mnemonic CIO-CARD-Q

Charter · Independence & objectivity · Organisation & competence · Code of ethics · Audit planning (risk-based) · Risk & materiality · Due professional care · Quality assurance (QAIP)

The 7 ethics canons (condensed)

Standards & controls · objectivity/due diligence/professional care · serve stakeholder interest lawfully · confidentiality (no personal benefit, no inappropriate release) · competence (only take work you're qualified for) · disclose all significant facts · support professional education of stakeholders.

Audit risk

AR = IR × CR × DR. The auditor cannot change IR or CR — only DR, via Nature, Timing and Extent of testing. Lower acceptable AR → more testing → bigger sample. Residual risk = inherent risk − control effect.

Control classification

Nature: administrative · technical/logical · physical Origin: general controls (org-wide) vs application controls (specific app)

Application controls

Testing

If compliance testing fails → expand substantive testing.

Sampling

Sample size increases with: higher confidence level · higher expected error rate · lower tolerable error rate · greater precision required · more critical/material population. Sampling risk = sample isn't representative. Non-sampling risk = human error in testing.

Evidence reliability — most to least

1. Auditor's direct observation / re-performance
2. Externally generated, held by the auditor (bank confirmations)
3. Externally generated, in client's possession
4. Internally generated, strong control environment
5. Internally generated, weak control environment
6. Oral / management representation ← always near the bottom

Criteria: sufficiency (quantity) · relevance · reliability (source) · usefulness.

CAATs

Generalized audit software (ACL, IDEA) · test data · integrated test facility (ITF) · parallel simulation · embedded audit modules / SCARF · snapshot · mapping/tracing · source code review. Benefit: 100% population testing, efficiency. Risk: contaminating production data; needs IT cooperation.

Reporting — the 5 Cs

Criteria (the standard) · Condition (what was found) · Cause (why) · Consequence (impact/risk) · Corrective action (recommendation)

Opinions: unqualified · qualified · adverse · disclaimer Management accepts the risk → document it, confirm it's held at the right level, escalate/report to the audit committee. Never silently accept.

3. Domain 2 — Governance & Management of IT (18%)

Governance vs management

• Governance = EDM: Evaluate, Direct, Monitor → board / steering committee
• Management = Plan, Build, Run, Monitor → CIO / IT management

COBIT 2019 — 40 objectives in 5 domains

6 governance system principles (provide stakeholder value · holistic approach · dynamic system · governance distinct from management · tailored · end-to-end) 7 components/enablers (processes · org structures · information flows · people/skills · culture, ethics & behaviour · services/infrastructure/apps · principles, policies & frameworks) Capability levels 0–5 (0 incomplete → 5 optimising). Goals cascade: stakeholder needs → enterprise goals → alignment goals → governance/management objectives.

ISO/IEC 38500 — 6 principles

Responsibility · Strategy · Acquisition · Performance · Conformance · Human behaviour + Evaluate-Direct-Monitor model.

Policy hierarchy

Enterprise architecture

TOGAF ADM: Preliminary + Phases A–H, with Requirements Management at the centre. Zachman 6×6: What/How/Where/Who/When/Why × Planner/Owner/Designer/Builder/Subcontractor/Functioning enterprise. Domains: business · data · application · technology. EA is owned above IT and driven by business strategy.

ERM

• Risk appetite (how much risk we want) vs risk tolerance (acceptable deviation) vs risk capacity (max we can bear)
• Inherent risk (before controls) vs residual risk (after controls)
• Treatment: avoid · mitigate/reduce · transfer/share · accept
• KPI (performance) · KRI (risk) · KGI (goal)
• COSO ERM 2017: 5 components / 20 principles
• COSO ICIF 2013: 5 components / 17 principles — CRIME: Control environment · Risk assessment · Information & communication · Monitoring · control activitiEs
• ISO 31000 = general risk management

Three lines of defence

1st = management/operations · 2nd = risk & compliance · 3rd = internal audit

Laws & standards

Data governance

Business data owner (accountable) · data steward (quality) · custodian (IT, operational). Classification (public/internal/confidential/restricted) must drive the control baseline. Retention, disposal, sovereignty, cross-border transfer.

Vendor management

SLA (service to customer) · OLA (internal) · UC (underpinning contract with supplier). SOC 1 = financial reporting controls · SOC 2 Type 1 = design at a point in time · SOC 2 Type 2 = design + operating effectiveness over a period · SOC 3 = public summary. SOC 2 Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy. Check the period covered, the scope, and the complementary user entity controls (CUECs). The auditor reviews the contract and the vendor's assurance report — the auditor does not re-perform the vendor's audit.

Quality

QA = process-focused (are we building it right?) · QC = product-focused (is the output correct?) Cost of quality: prevention < appraisal < internal failure < external failure (external failure is the most costly).

4. Domain 3 — Acquisition, Development & Implementation (12%)

SDLC

Feasibility → Requirements → Design (logical → physical) → Development → Testing → Implementation → Post-implementation review Requirements definition most determines success; defects are cheapest to fix here.

Feasibility

Economic (NPV, IRR, payback, ROI) · technical · operational · legal/regulatory · schedule NPV preferred — it accounts for the time value of money across the whole life. Include ongoing operating cost (TCO), not just build cost.

Earned value

SV = EV − PV · CV = EV − AC · SPI = EV / PV · CPI = EV / AC (negative SV/CV = behind/over; <1.0 SPI/CPI = behind/over)

Methodologies

Waterfall · V-model · iterative · spiral (risk-driven) · agile/Scrum/Kanban/XP · DevOps/CI-CD · RAD · prototyping · JAD · OO Agile shifts control to: automated testing, CI, backlog control, product owner accountability, security in the backlog (secure SDLC, threat modelling).

Development controls

Developers must NEVER have production access (the classic correct answer) · separate dev/test/staging/prod environments · masked or synthetic test data — never production data in test · version control · code/peer review · change control board · phase gates · requirements traceability matrix · SoD between developer and deployer.

Testing

Unit → Integration → System → Regression → UAT → Performance/Load/Stress → Volume → Recovery → Security/Pen test → Parallel → Pilot UAT is validated against documented business requirements and is owned by the end user. The auditor reviews the test plan and results — never performs or signs off UAT. White box (full knowledge) · black box (none) · grey box (partial) · alpha (internal) · beta (external users)

Cutover strategies

Data conversion

Mapping · cleansing · reconciliation of record counts and control totals before and after ← the critical control · field verification · legacy retention.

Post-implementation review

Timing: after stabilisation, typically 3–12 months post go-live. Purpose: were the business case benefits realised, requirements met, controls effective, costs within budget, lessons learned. PIR is independent — not the project team marking its own homework. It is not testing and not a security assessment.

5. Domain 4 — Operations & Business Resilience (26%)

Availability — the nines

Read whether the question counts scheduled downtime.

RAID

0 stripe (no redundancy) · 1 mirror · 5 stripe + distributed parity (1 disk) · 6 double parity (2 disks) · 10 mirror + stripe Redundancy ≠ backup. RAID does not protect against deletion, corruption or ransomware.

Storage

DAS (direct attached) · NAS (file-level, network) · SAN (block-level, network)

Incident vs problem vs change vs event

Priority = impact × urgency. Escalation: functional vs hierarchical. Known error database. Root cause tools: 5 Whys, fishbone/Ishikawa, Pareto.

Change management

Types: standard (pre-approved) · normal · emergency CAB approves; ECAB for emergency; emergency changes get retrospective approval. Requires: impact/risk assessment, testing, back-out plan, segregation between developer, approver and deployer. Metrics: change success rate, % unplanned/emergency changes.

Patch management

Identify → assess/prioritise (exploitability + criticality) → test → deploy → verify. Goal is risk-based prioritisation, not 100% coverage. Unpatchable systems need documented compensating controls. Emergency/out-of-band patching for actively exploited flaws.

Logs

Highest-value sources: authentication (esp. failures), privilege escalation, admin activity, sensitive data access, configuration changes. Requirements: centralised off-host (a compromised host's local logs can't be trusted) · NTP clock sync · integrity (append-only/WORM/hashing) · retention per legal/regulatory · evidence of review. "Logs collected but never reviewed" = classic finding. Failed logins unmonitored = classic finding.

SLA / OLA / UC

SLA = to the customer · OLA = internal between teams · UC = with the external supplier. Breaches must trigger action, not just reporting.

Database

ACID: Atomicity · Consistency · Isolation · Durability DBA is highly privileged and can often bypass application controls → needs separation from app/security admin and DBA activity monitoring. Transaction log backup enables point-in-time recovery. DAM = database activity monitoring.

EUC & shadow IT

EUC risk: no change control, no version control, single-person dependency, formula errors, unauthorised data copies, no backup. Controls: inventory, version control, locked formulas, maker-checker, input validation, backup. Shadow IT: discovery + risk-based sanctioning beats blanket bans.

Business resilience — the metrics

RTO must be < MTD. RTO + WRT must fit inside MTD. If not → the plan does not meet business requirements = finding. Availability = MTBF / (MTBF + MTTR)

BIA is owned by the BUSINESS, not IT and not audit.

Outputs: critical process list, RTO/RPO per process, dependency map, recovery priority order.

Recovery sites

Backup schemes

3-2-1: 3 copies, 2 media types, 1 offsite. +1 offline/immutable, 0 errors verified. A backup that has never been restored is not a backup. Checking job logs is weak evidence; a restore test is strong evidence. Encrypt backups — and don't lose the key.

BCP vs DRP vs crisis management

IT does not declare a disaster — the business does. ISO 22301 = BCM standard (PDCA). Plan review: at least annually and after significant change.

DR test hierarchy — least to most disruptive

Read-through → Walkthrough → Tabletop/simulation → Component/module → Parallel → Full interruption Parallel = recovery site runs alongside production, production unaffected. Full interruption = most realistic, highest risk, needs executive approval. The auditor observes, does not run it. Most common finding: "the plan exists but has never been tested."

6. Domain 5 — Protection of Information Assets (26%)

CIA + friends

Confidentiality · Integrity · Availability + authenticity · non-repudiation · accountability · privacy

Access control models

AAA: Identification → Authentication → Authorisation → Accountability (audit trail) Factors: something you know / have / are / do. MFA needs two different types. Least privilege · need-to-know · separation of duties · mandatory vacation + job rotation (detective). Identity lifecycle: joiner–mover–leaver. Uncleaned ex-employee accounts = high-severity finding. Access reviews are performed by the business/system owner — not IT alone, not the auditor. PAM: vaulting, credential rotation, session recording, JIT access, break-glass accounts, no shared accounts.

Biometrics

FAR (false acceptance — security risk) · FRR (false rejection — inconvenience) · CER (crossover error rate — lower = better device)

Physical

Layered defence · perimeter · CCTV (detective) · mantraps · turnstiles · badge access · visitor escort. Fire suppression: water sprinklers damage electronics → clean agent/gas (FM-200, INERGEN, Novec) for data centres. UPS = short outages and conditioning. Generator = extended outages. A UPS is not a generator. Environmental: HVAC, humidity, positive air pressure, water detection, EMI shielding.

Network devices by layer

Hub L1 · Switch L2 (MAC) · Router L3 (IP) · Firewall L3–L4 · WAF L7 · IDS/IPS L3–L7 · Proxy L7 · Load balancer L4/L7 Firewall = preventive · IDS = detective · IPS = preventive. Default deny. Stale "any–any" rules = finding. DMZ · VLAN · micro-segmentation · air gap.

Wireless

WEP broken · WPA2 (CCMP/AES) · WPA3 (SAE). WPS is a weakness. SSID hiding is not security. Rogue AP / evil twin. 802.1X + EAP. Guest network isolation.

Encryption

Digital signature = hash + sign with sender's PRIVATE key. Gives integrity, authenticity, non-repudiation — NOT confidentiality. Encryption at rest protects against media theft, NOT against a compromised application account. Key management is the weakest link — never store keys with the data. TLS 1.2+ only; SSLv3/TLS 1.0/1.1 deprecated. Hybrid encryption is how TLS works: asymmetric to exchange the symmetric session key, symmetric for bulk data.

PKI

CA · RA · certificate repository · validation authority · CRL/OCSP · CP & CPS X.509 fields: subject, issuer, validity, public key, serial number, extensions, key usage. Root CA key offline; chain of trust via intermediates. CRL = periodic list (staleness problem) · OCSP = real-time · OCSP stapling = efficient. A compromised CA is catastrophic (rogue certificates). Certificate expiry is a common outage cause.

Cloud

Service models: IaaS · PaaS · SaaS → the split of responsibility moves with the model Deployment: public · private · hybrid · community Essential characteristics: on-demand self-service · broad network access · resource pooling · rapid elasticity · measured service Risks: multi-tenancy isolation failure · data residency/sovereignty · loss of governance & visibility · lock-in · insecure APIs · provider insider risk · lawful access/jurisdiction · provider viability & exit · fourth parties · shadow cloud Assurance: SOC 2 Type 2 (read the period + CUECs) · ISO/IEC 27017 & 27018 · CSA STAR · right-to-audit clause · BYOK/HYOK · CASB · CSPM

Virtualisation

Type 1 bare-metal hypervisor · Type 2 hosted. VM escape breaks all isolation — the hypervisor is a high-value target. Watch: VM sprawl · snapshot/image sprawl (leaked data & credentials) · resource contention · insecure APIs. Containers: image/registry security, orchestration (K8s) hardening, immutable infrastructure, secrets management.

Mobile & IoT

BYOD / COPE / CYOD. MDM/EMM/MAM: enrolment, policy, remote wipe (corporate vs full — matters on personal devices), containerisation, encryption, jailbreak detection. IoT: default/hardcoded credentials · no patching · long lifecycles · insecure protocols · segment IoT/OT away from corporate networks. OT/ICS: availability and safety before confidentiality. You cannot secure what you have not inventoried.

DLP

Three states: at rest · in motion · in use. Data classification is a prerequisite — DLP without it produces noise. Actions: monitor → warn → block → encrypt. High false positives; requires tuning. Insider threat + UEBA. Exfiltration vectors: email, web uploads, USB, cloud sync, printing, screenshots, GenAI/LLM prompt leakage.

Security awareness

Measure behaviour, not completion. Track phishing click rate and report rate over time. Role-based training for privileged users and developers. New joiners and contractors must be covered. "We sent an email" is not a programme.

Attacks → controls

For anything, name the preventive, the detective and the corrective control — that's how ISACA frames it.

Security testing

Vulnerability assessment = identify and report weaknesses. Penetration test = exploit them to prove impact. Both are point-in-time — a clean pen test is not proof of security. Types: authenticated vs unauthenticated · internal vs external · black/white/grey box · blind/double-blind. Written authorisation / rules of engagement are mandatory — testing without authorisation may be illegal. The auditor reviews scope, methodology, tester independence and remediation tracking. The auditor does NOT run the pen test. Red team / blue team / purple team.

Monitoring

SIEM (aggregate, normalise, correlate, alert) — untuned SIEM = alert fatigue. SOAR · SOC tiers · UEBA · threat intelligence / IOCs · CASB · CSPM. Logs must ship off-host in near real time; NTP sync is essential. Auditor's key test: is anyone reviewing the alerts, and is there documented review and follow-up? "Alerts not triaged within SLA" = finding.

Incident response — NIST SP 800-61

1. Preparation → 2. Detection & Analysis → 3. Containment, Eradication & Recovery → 4. Post-Incident Activity (lessons learned) Containment comes BEFORE eradication, and both before recovery. Incident response plan: roles, severity classification, escalation/on-call, communication plan (internal + external), evidence procedures, contacts (legal, forensics, insurer, PR, law enforcement). Declaration authority must be defined. Coordinates with BCP/DRP. Notification timeframes: GDPR — 72 hours to the supervisory authority where feasible; data subjects without undue delay if high risk. Post-incident: RCA, lessons learned, corrective actions tracked to closure, plan update, report to management/board. Metrics: MTTD · MTTR · % detected internally vs by a third party. (Detection matters most — you cannot respond to what you did not detect.)

Forensics & evidence

Order of volatility (RFC 3227), most → least:

1. CPU registers & cache
2. Routing table, ARP cache, process table, memory
3. Temporary file systems
4. Disk
5. Remote logging & monitoring data
6. Physical configuration & network topology
7. Archival media
8. Printed / offline documents

Capture the most volatile first. Chain of custody: who, what, when, where, why, and every transfer and access. Tamper-evident seals. Unique IDs. Hash the image (SHA-256) to prove no alteration. Never analyse the original — work on a forensic copy. Write blockers. Live vs dead-box forensics: live captures volatile data but alters the system. Cloud forensics challenges: another jurisdiction, no physical access, provider cooperation, short log retention, multi-tenancy. Anti-forensics: log wiping, timestomping, encryption, steganography, slack space. Auditor's duty: preserve, do not contaminate, document, and escalate — involve legal counsel and forensic specialists. Do NOT investigate the crime yourself.

Media sanitisation — NIST SP 800-88

Clear · Purge · Destroy. Degaussing (magnetic only) · overwriting · crypto-erasure · physical destruction. Get a certificate of destruction.

7. Frameworks in one line each

8. Mnemonic index

9. Final 10 lines to read before you walk in

1. D4 + D5 = 52%. They decide your result.
2. The auditor assesses and reports — never designs, implements or approves.
3. Risk assessment comes first.
4. Business owns risk and the BIA. IT owns systems. Audit owns assurance.
5. RTO + WRT must fit inside MTD, or the plan fails the business requirement.
6. A backup never restored is not a backup.
7. Digital signatures give integrity and non-repudiation, not confidentiality.
8. Containment before eradication before recovery. Capture the most volatile evidence first.
9. Logs collected but never reviewed is a finding.
10. Answer every question. There is no penalty for being wrong.