CSPM case studies
CSPM · Put your knowledge to work in context.
The Certified Security Project Manager (CSPM) credential from the Security Industry Association (SIA) is designed specifically for professionals managing security projects. Unlike general project management certifications, the CSPM addresses the unique demands of security project management, demonstrating the ability to manage complex, technical security projects. It is intended for security project managers, systems integrators, systems designers and engineers, security managers and consultants, and lead technicians. The exam consists of 150 multiple-choice questions to be completed in up to two hours, delivered at an approved testing center or via live online proctoring. The CSPM case studies are 5 cases and about 3,066 words.
1Authentication Bypass During a Regulatory Reporting Freeze
You are the security program manager for a 1,400-employee digital lender operating in three jurisdictions. A penetration test found a CVSS 9.1 authentication bypass in the API gateway that fronts the loan-origination platform.
674 words, about 3 min2Awareness Completion Rises While Phishing Clicks Double
A global professional services firm with 22,000 employees completed a security awareness program across 14 countries. LMS completion is 92%, but the phishing simulation click rate rose from 6% to 18% over two quarters following the acquisition of a 4,000-person consultancy with a different email culture.
606 words, about 3 min3SaaS Renewal With an Unaudited Subprocessor
A healthcare payer uses a SaaS analytics vendor for claims anomaly detection. The vendor processes PHI for 2.1 million members.
598 words, about 3 min4Ransomware at a Newly Acquired Subsidiary
At 02:10 on a Saturday, ransomware encrypts 60% of file servers at a recently acquired subsidiary in another region. The subsidiary CEO wants to pay the ransom because backups for the subsidiary were never tested after acquisition, and the parent's incident response plan assigns payment decision authority to the parent CISO.
576 words, about 3 min5Merger Integration With a Refusing Business Unit
You lead security integration for a merger that creates a 30,000-employee company. The target has 14 business units, three identity providers (Okta, Azure AD, and legacy LDAP), 210 applications, and no central logging.
612 words, about 3 min