CSG study plan
CSG · Give each week a clear focus.
8 weeks · About 6 hours per week
Security Governance
Define security governance and distinguish it from security management and security operations
Map the roles of the board, executive management, CISO, and steering committee in directing security
Explain how organizational culture, business strategy, and legal obligations shape governance structures
Draft a one-page governance model showing decision rights and escalation paths
Your checkpoint
A one-page governance model diagram with a 200-word narrative explaining decision rights, accountability, and escalation
Security Governance
Compare governance frameworks and maturity models at a conceptual level and state when each is appropriate
Build a RACI matrix for a security program covering at least eight activities
Identify metrics and reporting lines that let leadership judge whether security is effective
Evaluate a governance failure scenario and propose structural fixes
Your checkpoint
A RACI matrix plus a metrics dashboard outline with five leading and five lagging indicators tied to governance objectives
Risk Management
Define risk appetite, risk tolerance, and risk capacity and show how they constrain decisions
Walk through the risk management process from identification through monitoring
Apply qualitative and quantitative techniques, including likelihood-impact matrices and annualized loss estimation
Distinguish inherent, residual, and target risk in a worked example
Your checkpoint
A risk register with ten realistic entries, each scored qualitatively and quantitatively, showing inherent and residual values
Risk Management
Select among mitigate, transfer, avoid, and accept treatments and justify each choice
Explain how control selection links to risk tolerance and cost-benefit reasoning
Describe third-party and supply chain risk assessment steps
Practice communicating risk to non-technical executives in plain language
Your checkpoint
A two-page executive risk briefing summarizing the top five risks, chosen treatments, residual exposure, and a recommendation
Compliance and Regulatory Requirements
Differentiate laws, regulations, standards, and contractual obligations and rank them by enforceability
Identify the compliance obligations most relevant to security programs, such as privacy, breach notification, and sector rules
Convert a regulatory requirement into an internal control with an owner and evidence source
Explain the difference between compliance and security and why compliance alone is insufficient
Your checkpoint
A compliance obligations register mapping at least eight requirements to controls, owners, evidence, and review frequency
Compliance and Regulatory Requirements & Security Policies, Standards and Procedures
Outline an audit lifecycle from scoping through evidence collection to findings and remediation tracking
Design a policy hierarchy that separates policy, standard, procedure, and guideline with correct authority
Draft a policy section that is testable, enforceable, and free of vague language
Plan a compliance monitoring cadence with exception handling
Your checkpoint
A complete policy document set for one topic: one policy, two standards, one procedure, and a monitoring schedule
Security Policies, Standards and Procedures
Write procedures that a new hire could follow without asking clarifying questions
Build a policy lifecycle covering drafting, review, approval, publication, training, and retirement
Design an exception and waiver process with time limits and approval thresholds
Create awareness and training activities tied to specific policy requirements
Your checkpoint
A policy lifecycle flowchart plus an exception request form and a 12-month review calendar
Security Governance & Risk Management & Compliance and Regulatory Requirements & Security Policies, Standards and Procedures
Integrate governance, risk, compliance, and policy artifacts into one coherent program narrative
Diagnose weak links between domains in sample scenarios and prescribe corrections
Complete timed practice sets under exam conditions and review every missed item
Consolidate weak areas into a final one-week review list
Your checkpoint
A one-page integrated program map linking all four domains plus a scored practice exam log with an error analysis
Milestones
Week 2: Can explain governance decision rights and produce a RACI matrix from memory without notes
Week 4: Can score a new risk, select a treatment, and defend the choice to a non-technical audience in under five minutes
Week 6: Can convert any stated regulatory requirement into a control, owner, and evidence source on demand
Week 8: Scores at or above 80 percent on a timed mixed-domain practice set and has a written remediation list for remaining gaps