Information Security Management Principles
Information security management rests on the CIA triad: confidentiality (information is not disclosed to unauthorised parties), integrity (information is accurate, complete and protected from unauthorised modification), and availability (information and systems are accessible to authorised users when needed). Supporting concepts include authenticity, accountability, non-repudiation and reliability. Candidates must also know the difference between a policy (management intent), a standard (mandatory specific requirements), a procedure (step-by-step instructions) and a guideline (recommended advice). Ownership matters: information owners are senior managers accountable for classifying and protecting assets, while custodians apply the controls day to day. Security governance sets direction and ensures risk decisions align with business objectives, and it must be driven from the top rather than delegated to IT alone.
Traps in exam questions
Questions often blur accountability with operational responsibility, or treat availability as a lesser goal. Another common trap is confusing a policy with a procedure, or assuming security is purely technical. Remember that security must enable the business, and that people, process and technology are all part of the management system.
Worked example and rule of thumb
If asked who is accountable for deciding the classification of a customer database, the answer is the information owner, not the IT administrator. Rule of thumb: accountability cannot be delegated, responsibility can. When in doubt, ask which option keeps a named senior manager accountable for the risk decision.
Also understand the security lifecycle: identify assets, assess risk, select controls, implement, monitor and improve. Concepts such as defence in depth (layered controls), least privilege, separation of duties and need-to-know are foundational principles that recur across the syllabus.