BCS CISMP case studies
BCS CISMP · Put your knowledge to work in context.
CISMP - the Certificate in Information Security Management Principles - is a BCS qualification aimed at people who manage, rather than necessarily operate, information security. It suits team leaders, project and line managers, IT staff moving into security, auditors, and anyone who needs a management-level grasp of security rather than hands-on configuration skills. The BCS CISMP case studies are 5 cases and about 3,391 words.
1The Shared Drive That Outgrew Its Owner
Meridian Logistics has 1,400 staff and one information security manager, Priya, who reports to the IT director. A routine access review shows that the finance shared drive holds 90,000 files, of which 38,000 are readable by the entire company because a legacy 'All Staff' group was granted modify rights in 2016.
701 words, about 4 min2Scoring a Supplier Nobody Can Visit
Northgate Health Partners is selecting a cloud provider for a patient appointment system. The provider is based overseas, has no UK data centre, and will store records in two regions.
643 words, about 3 min3The Certification That Certified the Wrong Thing
Arclight Manufacturing achieved ISO/IEC 27001 certification eight months ago. The scope statement reads: 'The information security management system supporting the corporate IT network at head office.' Since certification, Arclight has acquired a smaller competitor and absorbed its 300 staff, moved production planning onto a cloud SaaS platform, and begun a programme to connect factory-floor operational technology (OT) to the corporate network for real-time reporting.
621 words, about 3 min4Layered Controls on a Legacy Build
Harbourline Financial has 600 endpoints, of which 180 run an operating system that stopped receiving vendor patches 14 months ago. The application that forces this is a mortgage origination system used by 40 staff; replacing it is funded but will take 18 months.
707 words, about 4 min5The Ransomware Tabletop That Went Off Script
Cobalt Ridge Retail has a documented incident response plan and a business continuity plan last exercised three years ago. A tabletop exercise is run with the executive team.
719 words, about 4 min