CISM case studies
CISM · Put your knowledge to work in context.
The Certified Information Security Manager (CISM) is ISACA's credential for professionals who manage, rather than solely execute, an enterprise information security function. ISACA positions it around four domains: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. The CISM case studies are 5 cases and about 3,305 words.
1The Annual Board Briefing and a Reporting Line That Bends
Meridian Mutual, a 2,100-employee insurer, has a CISO who reports to the CIO; the CIO also owns infrastructure operations and the IT budget. Internal audit recently reported three high-severity findings open for more than 200 days, including unpatched internet-facing middleware.
687 words, about 3 min2Nine Months Without MFA: Who Signs?
Northline Payments processes $400M in annual card volume for a mid-size retailer. Its new gateway vendor returned a SOC 2 Type 2 with two exceptions: the administrative portal has no MFA, and privileged access reviews happen annually rather than quarterly.
686 words, about 3 min3Sixty Percent of Alerts Never Closed
Vantage Health has 4,500 staff. VPN MFA is deployed, but the 900-user legacy ERP uses local accounts and cannot support MFA before a 2027 platform migration.
629 words, about 3 min4Forty Servers Down and a 72-Hour Clock
At 03:10 on a Saturday, ransomware detonated across 40 of 300 servers at a regional hospital system, encrypting the clinical documentation and imaging platforms. The backup appliance was domain-joined and its catalog is encrypted.
676 words, about 3 min5The CFO Says the Ranges Are Too Wide
At a 900-employee logistics firm, the board risk committee has asked the CISO to express security risk appetite in financial terms. The CISO has a FAIR-style analysis of three scenarios: ransomware outage ( 4M– 18M), BEC wire fraud ( 200K– 1.5M), and vendor data breach ( 2M– 9M).
627 words, about 3 min