CISM study plan

Map each Domain 1 governance concept (strategy, steering committee, policies, standards, procedures, metrics) to a concrete artifact you can point to in your own organization

Explain aloud in under three minutes how an information security strategy is derived from and traces back to business objectives

Draft a steering committee charter listing membership, decision rights, meeting cadence, and inputs/outputs

Classify eight candidate security metrics as technical, business-relevant, or both, and discard the ones that cannot support a governance decision

Compare qualitative, quantitative, and hybrid risk assessment methods and justify in writing which one fits your organization's maturity and data availability

Build a 10-row risk register capturing asset, threat, vulnerability, likelihood, impact, owner, and current controls

Distinguish risk appetite, risk tolerance, and risk capacity using one worked example for each

Trace one governance decision (a policy approval) forward into a risk treatment decision and identify where the two processes must connect

Perform a simplified business impact analysis for two business processes, deriving RTO, RPO, and critical dependencies for each

Select and justify controls for your top three risks, documenting cost, benefit, and resulting residual risk rating

Score one third-party vendor's risk using a repeatable scoring model and state the acceptance conditions

Define four key risk indicators with thresholds that would trigger formal escalation

Convert the risk register into a sequenced security program roadmap, ordering initiatives by risk reduction per unit of effort

Design or critique an asset classification scheme and attach concrete handling requirements to each tier

Identify control gaps against a single chosen framework and rank the gaps by associated risk rather than by ease of fix

State how each roadmap initiative will be reported to the steering committee and against which metric

Design a security awareness program with audience tiers, delivery cadence, and at least one behavior-based success measure rather than a completion-rate measure

Map security activities into each phase of one real SDLC process, naming the gate and the responsible role

Define a program metrics set covering both technical and business dimensions and set a reporting cadence and audience for each

Outline security architecture principles and document how policy exceptions are requested, approved, and expired

Write an incident classification scheme with defined severity tiers and the specific conditions that trigger escalation to each tier

Draft the first 60 minutes of an incident response plan as a decision flow covering detection, triage, declaration, and notification

Define incident response roles, decision authority, and the handoff points between incident response and business continuity

Explain how program-level controls from Domain 3 determine what an incident responder can detect and contain

Design and run a 45-minute tabletop exercise against a ransomware scenario, injecting at least three escalation decisions

Document evidence identification, collection, and chain-of-custody steps sufficient to support later legal or disciplinary action

Prepare a communication plan segmenting internal staff, customers, regulators, and media, with approval authority for each

Draft a post-incident review template covering root cause, control failure, and corrective action ownership

Sit two full-length practice exams and log every missed item against its domain and underlying concept

Re-teach from memory, in writing, the three weakest concepts in each domain, then check your notes for errors

Build a one-page decision-rule sheet distinguishing who decides what across governance, risk acceptance, program change, and incident declaration

Rehearse exam-day pacing by completing a timed 150-question block without pausing for notes