CISM cheat sheet

Security governance aligns information security strategy with business objectives and is accountable to the board and senior management; the CISO typically advises and executes rather than owns the risk.

A security steering committee is a cross-functional oversight body that prioritizes initiatives, resolves security-versus-business conflicts, and monitors risk treatment and program performance.

Policy hierarchy is policy, then standard, then procedure, then guideline; policy states intent, standards are mandatory and measurable, procedures specify steps, and guidelines are non-mandatory recommendations.

Board accountability for security risk cannot be delegated; senior leadership sets risk appetite and tolerance, and management implements controls within those limits.

Key performance indicators measure process effectiveness against targets, while key risk indicators measure exposure and trends that may increase risk.

Frameworks such as COBIT, ISO/IEC 27001, and NIST CSF provide structure for governance and control selection; certification applies to management systems, not to the framework itself.

A security charter establishes the security function's authority, scope, reporting lines, and relationship with business units and oversight bodies.

When security requirements conflict with business goals, the decision is escalated to the steering committee or accountable business owner for documented risk acceptance within appetite.

Risk is commonly expressed as likelihood multiplied by impact; qualitative scales and quantitative estimates both require documented assumptions and consistent criteria.

Risk assessment consists of identifying assets and threats, analyzing likelihood and impact, evaluating against risk criteria, and selecting treatment.

Risk treatment options are mitigation, transfer, avoidance, and acceptance; acceptance is valid only when residual risk is within appetite and approved by the accountable business owner.

Inherent risk is assessed before controls, and residual risk is assessed after controls; control effectiveness must be monitored because residual risk changes over time.

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence; single loss expectancy equals asset value multiplied by exposure factor.

A risk register records risk description, owner, likelihood and impact ratings, treatment plan, status, and review dates, and supports reporting to management.

Business impact analysis identifies critical business functions and derives recovery time objectives and recovery point objectives from operational and financial impact.

Risk monitoring uses key risk indicators, incident trends, control testing, and changes in business context to detect whether exposure remains within appetite.

The security program coordinates projects, controls, processes, and roles to implement strategy, manage risk, and meet compliance obligations across the organization.

Control selection is based on risk assessment and cost-benefit analysis; controls are categorized as preventive, detective, or corrective and as technical, administrative, or physical.

Segregation of duties divides critical tasks and approvals among different people to reduce the risk of error or fraud within a single process.

Least privilege grants users and systems only the access needed for assigned tasks, for the minimum time required, and is supported by periodic access reviews.

Security awareness training is role-based and measured by behavior, such as phishing simulation results and observed practices, not by completion rates alone.

A maintained asset inventory with owners, locations, classifications, and dependencies is the foundation for risk assessment and control implementation.

Third-party risk management covers due diligence, contract security terms, ongoing monitoring, right-to-audit provisions, and termination or transition planning.

Policy exceptions require formal request, risk review, approval by the accountable owner, compensating controls, and a defined expiration date.

Incident response follows preparation, detection and analysis, containment, eradication, recovery, and post-incident activity; preparation includes plans, roles, tools, and exercises.

An event is any observable occurrence in a system, while an incident is an event that actually or potentially compromises confidentiality, integrity, or availability and requires response.

Severity classification uses business impact, scope, data sensitivity, and urgency to determine escalation, resource allocation, and notification obligations.

Containment strategy depends on incident scope and business impact; short-term containment isolates affected systems, while long-term containment supports continued operations and recovery.

Evidence handling requires documented chain of custody, forensic imaging where appropriate, and protection of evidence integrity for legal, regulatory, or disciplinary use.

The incident response team operates under defined roles and authority, often including an incident commander, communications lead, legal counsel, and technical responders.

Notification requirements arise from laws, regulations, contracts, and internal policy and specify what must be reported, to whom, within what timeframe, and with what content.

Post-incident reviews are blameless, identify root causes, evaluate response effectiveness, and produce corrective actions that feed back into controls and the response plan.