CISAW Risk Management study guide
CISAW Risk Management · Work through your exam, one topic at a time.
This independent study page provides practice for CISAW Risk Management. Its editorial learning areas include Security foundations, governance and Chinese context; Cyber-risk identification and analysis; Risk treatment, acceptance and reporting; Identity, access and cryptographic protection; Security operations, monitoring and response; Continuity, backup and technical recovery. The CISAW Risk Management study guide has 6 sections and about 4,497 words.
01Security foundations, governance and Chinese context
This domain covers the vocabulary and models that every later domain assumes: what security protects, how it is decomposed, and the formal rules that describe access control. NISP Level 1 questions here are usually definitional, so precision matters more than depth.
917 words, about 5 min02Cyber-risk identification and analysis
IT risk assessment has three phases. Identification builds the inventory: assets, processes, data flows, threats, vulnerabilities, and existing controls, often through risk scenarios ("who or what could exploit which vulnerability, and with what consequence?").
747 words, about 4 min03Risk treatment, acceptance and reporting
Every assessed risk receives one of four responses. Avoid eliminates the activity creating the risk.
443 words, about 2 min04Identity, access and cryptographic protection
This domain tests the identity lifecycle and the mechanisms that turn an identity into an authorised action. Expect questions that separate authentication from authorisation and that ask which access control model fits a scenario.
857 words, about 4 min05Security operations, monitoring and response
This domain is about running security as a repeatable service rather than a series of heroic acts. Questions target process ownership, change control and the operational metrics that show the programme is working.
803 words, about 4 min06Continuity, backup and technical recovery
This domain tests continuity planning: how an organisation keeps critical services running during disruption and how it recovers afterwards. Distinguish the continuity plan from the disaster recovery plan and know the time-based metrics precisely.
730 words, about 4 min