Domain 4: Information Systems Operations and Business Resilience

CISA · about 26% of the exam

Running IT day to day (service management, infrastructure, change) and keeping the business alive through disruption.

Revising? All of this domain's slides in one deck. When you're done, take the domain quiz.

Operations

IT Service Management Running IT like a service business: the service desk, the main ITSM processes and how they feed each other, how priority is set, and what the auditor checks.
Hardware Components and Architecture The parts inside a computer and what each means for control, the main computing architectures, and how hardware is bought, maintained, monitored and disposed of.
Operating Systems Why the operating system is the foundation every application control stands on, how it's hardened, and why admin accounts, system utilities and logs need the tightest control.
OSI Model The seven layers of network communication explained with a parcel delivery, which devices and protocols live at each layer, and why knowing the layer tells you what a control can do.
TCP/IP and Common Protocols How the internet's own model works, the difference between TCP and UDP, IP addresses and NAT, and the protocols and ports that come up in security questions.
Network Devices: Switches, Routers, Gateways What each network device does and how much it understands about the traffic, why segmentation matters, and the configuration and access controls the auditor checks.
LAN/WAN Topologies Network sizes from a phone to the world, the shapes networks can take and what breaks them, cable types from cheapest to most secure, and how organisations connect their sites.
Database Models and DBMS How databases organise data, from family trees to tables to NoSQL, what a database management system does, the three SQL language types, and why the database administrator needs watching.
Database Controls and Normalization Storing each fact once (normalisation) and why breaking that rule needs extra controls, plus the access, integrity, backup, recovery and monitoring controls that protect a database.
Asset Management Why knowing exactly what you own comes before almost every other control, what an asset record holds, how assets are tracked from purchase to disposal, and how to keep the list honest.
Configuration Management Keeping an accurate map of IT components and how they depend on each other: configuration items, the CMDB, baselines, and why the map is only useful if change management keeps it current.
Job Scheduling and Batch Processing The automated jobs that run overnight: why the schedule must be controlled, who may change it, how jobs depend on each other, and what happens when one fails.
Incident Management Getting a broken service back as fast as possible: logging, prioritising, escalating, resolving and closing incidents, handling major ones, and where incident management stops and problem management starts.
Problem Management Finding out why things keep breaking and fixing it for good: problems, known errors and workarounds, root cause analysis, and the move from reactive to proactive.
Change Management Making sure nothing changes in production without approval: what counts as a change, who approves what, keeping developers out of production, emergency changes, and how the auditor hunts for changes that skipped the process.
Release and Patch Management Getting approved changes into production safely: types of release, what must exist before deploying, and the patch process that balances speed against the risk of breaking things.
Service Level Management Agreeing what good service looks like and checking it's delivered: the service catalogue, SLAs and the OLAs and supplier contracts that hold them up, and why reported numbers need checking.
Capacity and Performance Monitoring Having enough IT horsepower for today and tomorrow without paying for too much: the three levels of capacity management, why business plans matter more than history, and the warning signs.
End-User Computing The spreadsheets, user-built databases and low-code apps that quietly run important processes: what can go wrong, and the inventory-first, risk-based way to bring them under control.

Resilience

BCP Lifecycle Planning to keep the business going when things go badly wrong: how BCP differs from DRP, the life cycle from policy to maintenance, who owns what, and the 'what comes first' questions.
Business Impact Analysis Working out what would hurt most if it stopped, and how fast: the BIA steps, the four criticality levels, and the cost curves that point to the right recovery strategy.
RTO, RPO, MTD, SDO The recovery numbers the exam asks about again and again, shown on one timeline: what each means, how they relate, and which design decision each one drives.
Recovery Strategies Turning recovery targets into a real plan for every resource a process needs (workspace, IT, data, networks, people, suppliers) and choosing options that meet the targets at a sensible cost.
Alternate Sites: Hot, Warm, Cold The kinds of recovery site, from a full mirror to an empty room, how fast each gets you running, why reciprocal agreements disappoint, and what to check in a recovery site contract.
Backup Types: Full, Incremental, Differential The three classic backup types explained with one week of backups and a Thursday crash, plus replication and the other ways to lose less data.
Backup Storage and Rotation Where backups should live, how long to keep them, how to protect them from loss, theft and ransomware, and how an auditor proves they can actually be restored.
DRP Contents What goes into a disaster recovery plan, the teams that carry it out and who acts first, and how to keep the plan usable on the worst day.
Testing BCP/DRP Proving the plan works before you need it: the ladder of tests from a desk check to shutting the data centre down, how a test is run and judged, and the test-choice questions.
High Availability, RAID, Insurance Keeping systems running when parts fail (clustering, redundancy, power, RAID), why none of it replaces backups, and the insurance that pays when things go wrong anyway.
Auditing BCP How an IS auditor judges whether the organisation could really recover: the questions to answer, the evidence to gather beyond the plan document, and the findings that come up most.