Meeting with stakeholders to explain the strategy and incorporate feedback is the best way for a CIO to secure support for a strategy to achieve long-term IT objectives, because it ensures that the strategy is aligned with the needs, expectations, and interests of the stakeholders, and that the stakeholders are engaged, informed, and committed to the strategy. By meeting with stakeholders, the CIO can communicate the vision, goals, and benefits of the strategy, and address any questions, concerns, or objections that the stakeholders may have. By incorporating feedback, the CIO can demonstrate respect and appreciation for the stakeholder input, and make any necessary adjustments or improvements to the strategy based on the stakeholder perspectives. Meeting with stakeholders and incorporating feedback can also foster trust, collaboration, and innovation between the CIO and the stakeholders, and enhance the value proposition and performance of the strategy.
The other options are not as effective as meeting with stakeholders and incorporating feedback, because they are either too autocratic, too vague, or too passive to secure support for a strategy to achieve long-term IT objectives. Making the necessary strategic decisions and notifying staff accordingly is a top-down approach that may alienate or antagonize the stakeholders, and create resistance or conflict. Developing tactics to implement the strategy and share with stakeholders is a tactical approach that may not address the strategic alignment, integration, or evaluation of the strategy. Developing a communication plan for distribution of information to staff is a one-way approach that may not elicit stakeholder feedback, engagement, or commitment. According to Stakeholder management: Your plan for influencing project outcomes,
"Stakeholder management is essentially stakeholder relationship management as it is the relationship and not the actual stakeholder groups that are managed."

Thebest strategic responseis todevelop and enforce IT asset life cycle policies in consultation with business units. This approach ensures that legacy systems are managed proactively and collaboratively, balancing risk management, regulatory compliance, and operational needs. Policies should define criteria for decommissioning, archival solutions, and acceptable retention practices.
Firewalls and isolation are tactical mitigations, not strategic solutions. Surcharges may discourage usage but do not resolve governance and retention challenges comprehensively.
Reference:
CGEIT Review Manual: Domain 2 - IT Resources (IT Asset Management and Life Cycle) COBIT 2019: BAI09 (Manage Assets), APO01 (Manage the IT Management Framework).

Developing an IT risk management framework begins with aligning it to the enterprise risk management (ERM) framework. This ensures consistency across all organizational risk domains and supports the integration of IT risk into the broader enterprise risk strategy. The ERM provides a foundation for identifying, assessing, and managing IT risks in a way that aligns with the organization's overall objectives. Promoting a culture of risk awareness, while critical, is a subsequent step once the framework is defined. References:
COBIT 2019 Risk Management Process, CGEIT Exam Manual.

An enterprise is determining the objectives for an IT training improvement initiative from a governance perspective. Governance is the process of decision-making and implementation that involves various actors and structures, both formal and informal1. Governance aims to achieve good governance, which is characterized by participation, consensus, accountability, transparency, responsiveness, effectiveness, efficiency, equity, inclusion, and rule of law2. Therefore, it would be most important to ensure that the policies and processes for IT training address both the enterprise requirements and the professional growth of the IT employees. This would ensure that the IT training is aligned with the strategic goals and priorities of the enterprise, as well as the needs and expectations of the IT staff. It would also foster a culture of learning and development that enhances the performance, quality, and value of IT services345. The other options are not the most important objectives for an IT training improvement initiative from a governance perspective.
Identifying courses of instruction that will maximize employee productivity, creating several different training strategies for final approval by the CIO, and surveying and interviewing IT employees to identify development needs are all useful steps or methods for designing and implementing an IT training improvement initiative, but they are not the ultimate objectives or outcomes. They are subordinate or instrumental to the main objective of addressing both the enterprise requirements and the professional growth of the IT employees through policies and processes that reflect good governance principles345. References:
3: https://topworkplaces.com/improving-training-and-development-strategies/
4: https://shrm.org/ResourcesAndTools/hr-topics/organizational-and-employee-development/Pages/Key- Steps-for-Better-Training-Development-Programs.aspx
5: https://www.forbes.com/sites/forbeshumanresourcescouncil/2021/07/13/12-ways-to-implement-successful- employee-training-initiatives/
1: https://link.springer.com/article/10.1007/s40647-017-0197-4
2: https://www.unescap.org/sites/default/files/good-governance.pdf

Comprehensive and Detailed Explanation:
The CGEIT Review Manual 8th Edition, in its Risk Optimization domain, emphasizes the importance of aligning IT risk management with the enterprise's overall risk management strategy. Key risk indicators (KRIs) are metrics used to monitor potential risks and provide early warnings. To establish effective KRIs, the enterprise must first understand its risk tolerance and priorities.
Option A: The enterprise risk appetite should be identified first. Risk appetite defines the level of risk the enterprise is willing to accept in pursuit of its objectives, guiding the selection of KRIs. For example, if the enterprise has a low risk appetite for data breaches, KRIs might focus on metrics like unauthorized access attempts. Identifying risk appetite ensures KRIs are relevant and aligned with strategic goals. The manual likely references COBIT 2019's APO12-Managed Risk, which highlights risk appetite as a foundational element of risk management.
* Option B: Key performance metrics relate to performance, not risk, and are not directly relevant to KRIs.
* Option C: Risk mitigation strategies are developed after identifying risks and KRIs, not before.
* Option D: Enterprise architecture (EA) components may inform risk identification but are secondary to defining risk appetite.
Double Verification: The answer aligns with COBIT's APO12 and the CGEIT domain's focus on risk management foundations. Risk appetite is a prerequisite for KRI development in ISACA's frameworks.
ISACA CGEIT Review Manual 8th Edition, Domain 4: Risk Optimization (focus on risk management and KRIs).
COBIT 2019, APO12-Managed Risk.
ISACA Glossary (for definitions of risk appetite and KRIs), available at https://www.isaca.org/resources
/glossary.