CNITSEC CISM common mistakes
CNITSEC CISM · Understand the traps and how to avoid them.
Choosing the technically strongest control (e.g., encryption, MFA, patching) when the stem asks what a security manager should do first or next, instead of choosing the governance or risk-based action such as approving risk treatment or escalating to management.
Candidates with hands-on technical backgrounds default to the most concrete control they recognize, and CISM-style items deliberately place a plausible technical answer beside the correct managerial answer to test role perspective.
What to do instead
Before answering, identify the actor named in the stem (board, steering committee, CISO, risk owner, administrator). Eliminate any option that a person in that role would delegate rather than perform, and prefer the option that establishes direction, ownership, or decision authority.
Treating the information security strategy as a standalone document and selecting answers where security sets its own objectives, rather than answers where strategy is derived from and aligned with organizational goals and business objectives.
Study material often presents strategy formulation as a security-planning exercise, so candidates miss that alignment with business drivers is the primary evaluation criterion in governance questions.
What to do instead
For any strategy, policy, or charter question, ask which option explicitly links to business objectives, stakeholder needs, or organizational mission. Reject options that begin and end inside the security function.
Answering risk questions with 'eliminate the risk' or 'implement a control' when the correct response is to accept, transfer, or defer based on cost-benefit and the risk owner's authority.
Candidates equate good security with reducing risk to zero and overlook that risk treatment selection depends on comparing control cost against potential loss and on who owns the decision.
What to do instead
Memorize the treatment options (mitigate, transfer, avoid, accept) and the decision rule: the risk owner decides, informed by cost-benefit analysis. When an option reduces risk at a cost exceeding the exposure, treat it as wrong.
Confusing risk assessment with risk treatment, or qualitative with quantitative methods, and selecting an answer that jumps to controls before the assessment or analysis step is complete.
The risk process steps blur together in recall, and exam items often describe a situation mid-process where the next step is identification or analysis rather than treatment.
What to do instead
Anchor the sequence: identify assets and threats, assess likelihood and impact, evaluate against risk criteria, then treat, then monitor and communicate. Locate the stem's position in that sequence and pick the immediately following activity.
Selecting 'implement controls' or 'buy a tool' as the answer to an ISMS question whose correct answer is to establish scope, obtain management commitment, define policy, or set measurable objectives.
The Plan-Do-Check-Act cycle and ISMS establishment steps are learned as a list, so candidates cannot tell which phase a scenario describes and default to the Do-phase activity.
What to do instead
Map each option to a PDCA phase. If the stem describes a new or immature program, the answer is almost always Plan-phase: scope, policy, commitment, objectives, roles. Reserve Do-phase answers for stems where the framework already exists.
Treating ISMS certification or a completed risk assessment as a one-time project endpoint, and choosing answers that stop at documentation rather than continuous monitoring, internal audit, management review, and corrective action.
Candidates study certification as the goal and forget that the standard requires ongoing improvement, so they miss items testing the Check and Act phases.
What to do instead
When a stem mentions certification, audit findings, or metrics, look for the option that closes the loop: management review, corrective action, continual improvement. Prefer options that repeat or sustain the cycle over options that finalize it.
Choosing a preventive control when the scenario calls for a detective or corrective control, or picking the control category (administrative, technical, physical) that does not match the described mechanism.
Control classifications are memorized as vocabulary rather than applied, and many controls plausibly fit two categories, so candidates pick by familiarity instead of by function.
What to do instead
For each control question, first name the function needed (prevent, detect, correct, deter, compensate) based on what the stem says is missing, then check the category. If two options share a function, choose the one whose category matches the described implementation.
Answering architecture and technology questions with the strongest single product or feature rather than the layered, defense-in-depth or least-privilege design principle the stem is testing.
Vendor-oriented study habits and tool familiarity bias candidates toward named technologies, while the exam rewards principle-based reasoning about redundancy, segmentation, and segregation of duties.
What to do instead
Read the stem for the design principle at stake (layering, least privilege, separation of duties, fail-safe defaults). Choose the option that embodies the principle across the environment rather than one point solution.
Escalating an incident to executive management or law enforcement immediately, or conversely containing systems without preserving evidence, instead of following the correct sequence of identification, containment, eradication, recovery, and lessons learned with notification decided by policy.
Candidates either over-escalate out of caution or act as a technician, and they forget that notification timing and evidence preservation are governed by procedure and legal requirements, not instinct.
What to do instead
Order the response phases and place notification and evidence handling inside them. Ask whether the stem's scenario has been confirmed and contained; if not, the answer is the earlier phase. Escalation answers are correct only when impact, scope, or legal obligation justifies them.
Giving legal or regulatory answers based on general impressions of a law rather than on the specific obligation, jurisdiction, data type, or notification threshold named in the stem, including confusing privacy breach notification with security incident reporting duties.
Legal domains are broad and candidates rely on vague familiarity, missing that items hinge on precise triggers such as personal data categories, timelines, or which authority receives notice.
What to do instead
Extract the facts the stem gives: data type, location, sector, and who is affected. Match those to the obligation rather than to the most familiar regulation. When the stem lacks a decisive fact, prefer the answer that requires consulting legal counsel or the compliance function.