BCS CISMP study plan

Define the CIA triad and distinguish confidentiality, integrity and availability with one workplace example each

Explain the difference between information security, cybersecurity and IT security governance, and identify who owns each in a typical organisation

List the core roles in a security management structure (senior accountable owner, security manager, risk owner, asset owner) and state their responsibilities

Summarise how security policy, standards, procedures and guidelines differ in purpose and authority

Describe the security management lifecycle from policy creation through monitoring and review

Explain the purpose of security awareness, training and education and how effectiveness can be measured

Identify legal and regulatory drivers (data protection, computer misuse, sector rules) that shape an organisation's security obligations

Distinguish due care from due diligence and apply both to a fictional scenario

Define risk, threat, vulnerability, likelihood and impact and separate them correctly in worked examples

Apply a qualitative risk assessment method to identify, analyse and evaluate at least eight risks for a sample organisation

Distinguish risk appetite, risk tolerance and risk capacity and state how each influences treatment decisions

Compare the four treatment options (mitigate, transfer, avoid, accept) and justify a choice for each identified risk

Produce a risk treatment plan that maps each control to the risk it reduces and estimates residual risk

Explain how risk assessment is monitored, reviewed and reported to management on a defined cycle

Revisit domain-1 governance content and link accountability for risk to the roles learned in week 1

Interpret a simple risk matrix and explain why scoring scales must be defined before use

Describe the structure and purpose of the ISO/IEC 27000 family, focusing on what 27001 requires at a high level

Outline the plan-do-check-act cycle as it applies to an information security management system

Explain how a statement of applicability and Annex A control themes fit together without reproducing control text

Distinguish certification, accreditation, compliance and conformance

Compare the roles of legislation, regulation, standards and contractual obligations in setting security requirements

Classify controls by type (physical, technical, administrative) and by function (preventive, detective, corrective, deterrent)

Select appropriate controls for given risks and explain why each control fits the risk and environment

Explain defence in depth and least privilege using concrete examples

Describe access control principles including authentication, authorisation, accounting and segregation of duties

Explain the security purpose of cryptography, hashing and digital signatures and where each is appropriate

Summarise physical and environmental controls and how they support logical controls

Identify common control failure modes such as misconfiguration, poor patching and excessive privileges

Outline the stages of incident response from preparation through detection, containment, eradication, recovery and lessons learned

Explain the purpose and key components of a business impact analysis and a business continuity plan

Distinguish recovery point objective from recovery time objective and apply both to a scenario

Describe how forensic evidence handling and incident reporting obligations affect response decisions

Consolidate all five domains through full-length timed practice under exam conditions