Information Systems Fundamentals

Why this topic matters

Area I of Information Systems and Controls (ISC) — Information Systems and Data Management — is 35–45% of the section. It starts with how information systems are built and delivered: enterprise systems, processing methods, cloud models, network components, and how organizations keep systems available through business continuity and disaster recovery planning.

Types of business information systems

System	Purpose
Enterprise resource planning (ERP)	An integrated suite (finance, procurement, inventory, sales, human resources) sharing one database — eliminates duplicate data entry and supports real-time reporting
Accounting information system	Captures, processes, and reports financial transactions (often a module of the ERP)
Customer relationship management (CRM)	Sales pipeline, customer data, service history
Supply chain management (SCM)	Procurement, logistics, supplier coordination
Human capital management	Employee records, payroll, benefits
Transaction processing system	High-volume routine transactions (point of sale)
Management information and decision support systems	Reports, dashboards, and models for managers

Processing methods

• Batch processing: transactions are accumulated and processed together (for example, nightly payroll). Efficient, allows batch control totals, but data is not current between runs.
• Online real-time processing: each transaction is processed immediately — current data, but requires stronger input and access controls because errors enter the system at once.
• Centralized versus distributed processing — distributed systems improve resilience but complicate control and consistency.

Cloud computing

Service model	Provider manages	Customer manages	Example
Infrastructure as a service (IaaS)	Hardware, storage, networking, virtualization	Operating systems, middleware, applications, data	Renting virtual servers
Platform as a service (PaaS)	Infrastructure + operating systems and runtime	Applications and data	A development and hosting platform
Software as a service (SaaS)	Everything up to the application	Data, user access, configuration	Cloud accounting, email, customer relationship software

Under the shared responsibility model, the customer always remains responsible for its data, user access management, and configuration choices — even in SaaS.

• Deployment models: public (shared multi-tenant infrastructure), private (dedicated to one organization), community (shared by organizations with common needs), and hybrid (a mix).
• Benefits: scalability and elasticity, lower upfront cost, pay-per-use, resilience.
• Risks: reliance on the provider (need System and Organization Controls (SOC) reports), data location and privacy, vendor lock-in, misconfiguration, and multi-tenancy.

Infrastructure and networks

• Local area network (LAN) within a site; wide area network (WAN) across locations; virtual private network (VPN) — an encrypted tunnel over the internet for remote access.
• Client-server architecture: clients request services from central servers.
• Virtualization runs multiple virtual machines on one physical server; containers package applications with their dependencies.
• Edge computing processes data near where it's generated (for example, Internet of Things (IoT) sensors).
• Application programming interfaces (APIs) let systems exchange data automatically — they need authentication and monitoring.

Availability — business continuity and disaster recovery

• A business continuity plan (BCP) keeps critical business functions running during a disruption; a disaster recovery plan (DRP) restores information technology (IT) systems and data.
• A business impact analysis identifies critical processes and sets recovery objectives:
  • Recovery time objective (RTO): the maximum acceptable time to restore a system.
  • Recovery point objective (RPO): the maximum acceptable amount of data loss, measured in time — it drives backup frequency.

Recovery site	Readiness	Cost
Hot site	Fully equipped with current data; recovery in hours or less	Highest
Warm site	Hardware and connectivity, data needs restoring; recovery in days	Moderate
Cold site	Space and power only; recovery in weeks	Lowest
Cloud-based recovery	Replicated systems spun up on demand	Variable

• Backups: full, incremental (changes since the last backup — fastest to create, slowest to restore), and differential (changes since the last full backup). Follow the 3-2-1 rule: three copies, on two media types, one offsite (ideally one immutable or offline, against ransomware).
• Redundancy (redundant array of independent disks (RAID), failover clusters, load balancing) and uninterruptible power supplies reduce downtime.
• Plans must be tested — tabletop exercises, simulations, parallel tests, and full interruption tests — and updated.

How it is tested

• Match an organization's need to a system type or cloud service model.
• Apply the shared responsibility model.
• Distinguish RTO and RPO, and hot, warm, and cold sites.
• Choose backup strategies and business continuity controls.