CISEC-IT study guide
CISEC-IT · Work through your exam, one topic at a time.
The Certified Information Security Executive (CISEC-IT) is a vendor-neutral credential aimed at the leadership side of information security rather than hands-on configuration work. It is designed for security managers, directors, CISOs and aspiring executives, plus risk, compliance and audit professionals who need to speak the language of the security program office. The CISEC-IT study guide has 9 sections and about 3,726 words.
01Security Governance, Strategy, and Executive Leadership
This domain tests whether you can separate governance from management under pressure. Governance sets decision rights, accountability, and oversight; management executes.
437 words, about 2 min02Risk Management and Enterprise Risk Frameworks
This domain tests whether you can run risk as a decision system rather than a spreadsheet ritual. Expect questions on appetite versus tolerance, quantitative estimation, framework steps, treatment selection, and how risk aggregates to enterprise level.
467 words, about 2 min03Regulatory Compliance, Privacy, and Legal Obligations
This domain tests whether you can translate legal obligation into program requirements and, under time pressure, make defensible notification decisions. Questions commonly involve controller/processor roles, lawful basis, cross-border transfer, breach clocks, and retention.
435 words, about 2 min04Security Architecture and Technology Program Oversight
This domain tests whether you can govern architecture decisions rather than personally design systems. Expect questions on reference architectures, review boards, zero trust, cloud responsibility boundaries, secure development, framework mapping, and technical debt.
402 words, about 2 min05Incident Response, Business Continuity, and Crisis Management
This domain tests whether you can run a structured response while the business is degraded, and whether you understand the recovery objectives that drive investment. Expect questions on lifecycle phases, severity criteria, RTO/RPO, crisis communication, and notification clocks.
387 words, about 2 min06Identity, Access, and Data Protection Governance
This domain tests whether identity and data controls are governed processes with owners and evidence, not just technology deployed. Expect questions on least privilege, joiner-mover-leaver, privileged access, access recertification, and data classification tied to handling rules.
405 words, about 2 min07Third-Party, Supply Chain, and Vendor Risk
This domain tests whether you can tier suppliers by risk, apply proportionate due diligence, and prove ongoing oversight rather than a one-time questionnaire. Expect questions on contract clauses, fourth parties, concentration risk, and software supply chain assurance.
412 words, about 2 min08Security Awareness, Workforce Culture, and Talent Management
This domain tests whether you treat people as a control environment rather than a compliance audience. Expect questions on behaviour change, phishing simulation design, culture measurement, insider risk, and building a sustainable security workforce.
385 words, about 2 min09Security Metrics, Budgeting, and Value Communication to the Board
This domain tests whether you can convert program activity into decisions the board can take. Expect questions on leading versus lagging indicators, metric selection, budget justification, business cases, and honest benchmarking.
396 words, about 2 min