Section: Volume B

Section: Volume A
Explanation/Reference:

The BEST time to identify metrics to measure the performance of an IT-enabled investment is during business case development. A business case is a document that provides the rationale and justification for initiating a project or investment1. It includes information such as the objectives, scope, benefits, costs, risks, assumptions, and success criteria of the proposed project or investment2. Identifying metrics to measure the performance of an IT-enabled investment during business case development can help to:
Define the expected outcomes and value of the investment3
Establish a baseline and targets for comparison and evaluation4
Align the investment with the strategic goals and objectives of the enterprise5 Communicate and demonstrate the benefits and impacts of the investment to stakeholders Monitor and control the progress and performance of the investment throughout its lifecycle References
:=
Business Case Development - Project Management Institute1
How to Write a Business Case - ProjectManager.com2
How to Measure the Value of an IT Investment - TechSoup3
Maximizing IT Performance: 11 Metrics and KPIs to Monitor - Whatfix4
Top 10 Essential IT Metrics & KPIs - Apptio5
17 Metrics For Evaluating The Success Of Tech Projects And ... - Forbes
8 Portfolio Performance Metrics Investors Should Understand - Navexa

Identifying gaps in information asset protection should be the first high-level initiative for a newly created IT strategy committee in order to support the business goal of making IT security a priority. This initiative would help to assess the current state of IT security, identify the risks and vulnerabilities that may compromise the confidentiality, integrity, and availability of information assets, and determine the actions and resources needed to address them. The other options are not as high-level, as they are more related to the implementation or execution of IT security, rather than the planning or direction of it. References: : CGEIT Review Manual (Digital Version), Chapter 1: Governance of Enterprise IT, Section 1.3: Strategic Management, Subsection
1.3.2: Strategic Management Process, Page 23 : CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3: IT Risk Management, Subsection 4.3.2: IT Risk Management Process, Page 156 :
CGEIT Review Manual (Digital Version), Chapter 5: Resource Optimization, Section 5.3: Security Resource Management, Subsection 5.3.1: Security Resource Management Overview, Page 192 : What is CGEIT? A certification for seasoned IT governance professionals1