CISM study guide
CISM · Work through your exam, one topic at a time.
The Certified Information Security Manager (CISM) is ISACA's credential for professionals who manage, rather than solely execute, an enterprise information security function. ISACA positions it around four domains: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. The CISM study guide has 4 sections and about 1,310 words.
01Information Security Governance
Information security governance is the structure through which senior leadership directs, oversees and remains accountable for security. Know these building blocks: a security strategy explicitly aligned with business objectives; a governance body (board committee or a security steering council with business representation) and a clearly placed CISO with a defined reporting line; the policy hierarchy, where policy states management intent, standards set mandatory requirements, procedures describe the steps and guidelines advise; performance measurement through KPIs and maturity assessments; and assurance, meaning independent audit and review kept separate from the teams operating the controls.
343 words, about 2 min02Information Security Risk Management
Risk management identifies, evaluates and treats the uncertainty that could affect business objectives. Candidates must be fluent in: risk appetite and tolerance as set by leadership; assessment approaches, qualitative (scenario ranking) versus quantitative (monetary loss estimates), and asset-based versus scenario-based scoping; the components of risk - threat, vulnerability, likelihood, impact; the risk register and its ownership; treatment options of mitigate, transfer, avoid and accept; residual risk; monitoring through key risk indicators; third-party and supply-chain risk; and integration with the wider enterprise risk management function so security risk is not managed in a silo.
336 words, about 2 min03Information Security Program
A security program is the coordinated set of people, processes and technology that delivers the governance strategy. Expect questions on: selecting and tailoring a framework (ISO/IEC 27001, NIST Cybersecurity Framework) as a baseline rather than a finished answer; scoping and gap analysis; risk-driven control selection and sequencing; security architecture principles and secure engineering; asset classification and ownership; personnel security; awareness and role-based training; embedding security into the SDLC and DevOps pipelines; third-party and vendor management; program metrics and reporting; budgeting and resource justification; and the interface with business continuity and disaster recovery.
313 words, about 2 min04Incident Management
Incident management covers the preparation, detection, response and learning cycle. Know the phases: prepare (plan, roles, contact lists, tooling, training, exercises); detect and analyse (monitoring, triage, classification and severity); contain; eradicate; recover; and post-incident review with lessons learned fed back into the program.
318 words, about 2 min