Prior to setting IT objectives, an enterprise must have established its strategies. Strategies are the high-level plans that define the direction and goals of the enterprise and how it will achieve them. Strategies provide the context and guidance for setting IT objectives, which are the specific and measurable outcomes that IT will deliver to support the strategies. IT objectives should be aligned with and derived from the enterprise strategies, as well as the enterprise vision, mission, and values

An exception management process is a method for documenting and approving an exception to compliance with established IT governance policies, standards, and practices. An exception management process can accommodate the need for autonomy over technology choices by allowing a functional group to request and justify a deviation from the IT governance requirements, based on the business needs, risks, costs, and benefits. An exception management process can also help to ensure that the exceptions are reviewed and approved by the appropriate authorities, that the exceptions are monitored and reported, and that the exceptions are aligned with the IT strategy and objectives123. References: Exception Management Process Flow. IT/Information Security Exception Request Process. Strategies, Governance, Policies, Standards and Resources.

An enterprise acceptable use policy is the most important document to update if a decision is made to ban end user-owned devices in the workplace, as it defines and communicates the rules and guidelines for the appropriate and secure use of IT resources and services by the employees and other authorized users. An enterprise acceptable use policy also helps to protect the enterprise's data, assets, and reputation from unauthorized or malicious access, disclosure, or damage12. Updating the enterprise acceptable use policy to reflect the ban on end user-owned devices can help to ensure compliance, awareness, and enforcement of the decision. References := CGEIT Exam Content Outline, Domain 1, Subtopic C: Information Governance, Task
2: Ensure that information governance processes are aligned with the enterprise risk management (ERM) processes.

When considering an IT change that would enable a potential new line of business, the first strategic step for IT governance would be to ensure agreement among the stakeholders regarding a vision for the future state, because this would provide a clear direction and purpose for the change, and align the IT strategy with the business strategy. A vision statement should describe the desired outcomes and benefits of the change, and reflect the enterprise's mission, values, and goals12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 23-24.

Adopting wearable technology requires ensuring that IT's infrastructure, processes, and standards can support the new initiative. The CGEIT Review Manual 8th Edition highlights that an enterprise architecture (EA) review is the best method to validate IT's preparedness, as it assesses the alignment of IT capabilities with the requirements of new technologies.
* Extract from CGEIT Review Manual 8th Edition (Domain 4: Strategic Management):"To validate IT's preparedness for adopting new technologies, the CIO should request an enterprise architecture review.
The EA review assesses whether current IT infrastructure, applications, and processes can support the technology initiative, identifying gaps and necessary adjustments." (Approximate reference: Domain 4, Section on Enterprise Architecture and Technology Adoption) Requesting an enterprise architecture review (option A) ensures that the CIO evaluates IT's technical and operational readiness for wearable technology, including compatibility with existing systems, scalability, and security requirements.
* Why not the other options?
* B. Perform a baseline business value assessment: A value assessment focuses on benefits, not IT' s technical preparedness, which is the primary concern here.
* C. Request reprioritization of the IT portfolio: Portfolio reprioritization addresses resource allocation, not the technical readiness of IT systems.
* D. Identify the penalties for noncompliance: Penalties are a risk management concern, not a direct method to validate IT preparedness.
References:
ISACA CGEIT Review Manual 8th Edition, Domain 4: Strategic Management, Section on Enterprise Architecture and Technology Integration.
ISACA CGEIT Study Guide, Chapter on IT Readiness Assessment.