BCS CISMP study guide
BCS CISMP · Work through your exam, one topic at a time.
CISMP - the Certificate in Information Security Management Principles - is a BCS qualification aimed at people who manage, rather than necessarily operate, information security. It suits team leaders, project and line managers, IT staff moving into security, auditors, and anyone who needs a management-level grasp of security rather than hands-on configuration skills. Because the syllabus is principle-based, candidates from non-technical backgrounds can prepare successfully alongside technical colleagues. The exam is commonly organised around five areas: information security management principles; information risk management; information security frameworks and standards; security controls and implementation; and incident management and business continuity. The BCS CISMP study guide has 5 sections and about 1,455 words.
01Information Security Management Principles
Information security management rests on the CIA triad: confidentiality (information is not disclosed to unauthorised parties), integrity (information is accurate, complete and protected from unauthorised modification), and availability (information and systems are accessible to authorised users when needed). Supporting concepts include authenticity, accountability, non-repudiation and reliability.
314 words, about 2 min02Information Risk Management
Risk management is the systematic identification, analysis, evaluation and treatment of risks to information assets. A risk is the combination of a threat exploiting a vulnerability, with likelihood and impact determining the level.
300 words, about 2 min03Information Security Frameworks and Standards
Frameworks and standards give structure and assurance. Candidates should understand ISO/IEC 27001 as the certifiable standard for an information security management system (ISMS) built on continual improvement, and ISO/IEC 27002 as guidance on controls.
280 words, about 1 min04Security Controls and Implementation
Controls are safeguards that reduce risk, and candidates must classify them. By nature they are preventive (stop an event), detective (identify it), corrective (fix it) or deterrent (discourage it).
272 words, about 1 min05Incident Management and Business Continuity
Incident management is the structured response to security events. An event is any observable occurrence; an incident is an event that actually or potentially harms the organisation.
289 words, about 1 min