Governance and Management of IT · Topic 4 of 5
IT Resource and Vendor Management
Managing IT people, budgets and licenses, hiring and termination controls, outsourcing, vendor contracts, SOC reports and source code escrow.
- 4 min
- Includes a diagram
- Mandatory vacation and job rotation help detect fraud.
- Revoke access at the moment of termination.
- Contracts need SLAs, security terms, right to audit and exit terms.
What it is
IT resource management makes the best use of people, money, software and infrastructure for business needs. IT vendor management controls the risks of buying services and products from third parties, from cloud providers to outsourced development, across the whole relationship from selection to exit.
How it works
People
| Control | Purpose |
|---|---|
| Background checks at hiring | Reduce risk from untrustworthy staff in sensitive roles |
| Confidentiality agreements | Protect information |
| Training and succession planning | Keep skills current and avoid key-person dependency |
| Mandatory vacation and job rotation | Expose fraud that relies on one person's constant presence |
| Termination procedures | Revoke access promptly (at or before notification for involuntary leavers) and recover assets |
Access for a dismissed employee should be removed no later than the moment the person is told. Late revocation is a classic finding.
Money and software
- Budgeting ties IT spending to the strategy; chargeback allocates IT costs to business units that use the services.
- Total cost of ownership (TCO) counts purchase, operation, support and disposal, not only the price.
- Software license management keeps an inventory of licenses and installations so the organization is not under-licensed (legal risk) or over-licensed (waste).
Sourcing options
| Option | Note |
|---|---|
| Insourcing | Done by own staff |
| Outsourcing | Done by a third party; accountability stays with the organization |
| Offshore or nearshore | Adds legal, data transfer and time zone considerations |
| Cloud services | Shared responsibility, defined by the service model and contract |
The vendor life cycle
- Due diligence before selection: financial stability, security posture, references, certifications.
- Contract with clear service levels, security and privacy requirements, data ownership, breach notification, subcontractor rules, right to audit, and exit and data return terms.
- Monitoring of performance against SLAs and of security obligations.
- Exit, with data returned or destroyed and access revoked.
Assurance reports
When the right to audit cannot be used directly, the organization relies on independent reports:
| Report | Covers |
|---|---|
| SOC 1 | Controls relevant to the customer's financial reporting |
| SOC 2 | Controls over security, availability, processing integrity, confidentiality and privacy |
| Type 1 | Design of controls at a point in time |
| Type 2 | Design and operating effectiveness over a period |
The auditor checks the report's scope, period and exceptions, and the complementary user entity controls the customer itself must operate.
Source code escrow
When software is critical and the vendor could go out of business, source code escrow puts the code with an independent third party, released to the customer under agreed conditions.
For "which provides the BEST assurance over a service provider's controls over a period", choose a Type 2 report (SOC 2, or SOC 1 where financial reporting is the concern) or the right to audit, not a questionnaire or a Type 1 report.
How the exam asks about this
- "A terminated administrator's account was active for two weeks." Termination procedures failed; access must be revoked at notification.
- "What protects the customer if the software vendor goes bankrupt?" Source code escrow.
- "Outsourcing payroll transfers which responsibility?" Operations only; accountability stays with the organization.
What to remember for the exam
- Mandatory vacation and job rotation help detect fraud.
- Revoke access at the moment of termination.
- Contracts need SLAs, security terms, right to audit and exit terms.
- SOC 2 Type 2 covers operating effectiveness over a period.
- Escrow protects against vendor failure.
Relying on a vendor's SOC report without reading its exceptions and complementary user entity controls leaves gaps on the customer's side.
Common mistakes
Thinking outsourcing transfers accountability. It never does.
Accepting a Type 1 report as evidence of operation. Type 1 is design only.
Forgetting the exit plan. Data return and transition need contract terms.
Check yourself
What does a SOC 2 Type 2 report provide?
An opinion on the design and operating effectiveness of controls over a period.
Why is mandatory vacation a control?
Fraud that depends on one person being present is more likely to be exposed while they are away.
What is source code escrow for?
Giving the customer access to the source code if the vendor cannot support the software, for example after bankruptcy.
Topic 4 of 5 in Governance and Management of IT
Test yourself on Governance and Management of IT
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.