CNITSEC CISM study guide
CNITSEC CISM · Work through your exam, one topic at a time.
CNITSEC CISM（注册信息安全员）是由中国信息安全测评中心（CNITSEC）面向国内从业人员推出的信息安全资质认证，定位于安全管理与实务能力，而不是纯技术攻防。它适合刚进入安全管理岗位的人员、承担等保与内控职责的运维和审计人员，以及需要把安全要求落到制度与流程中的项目负责人。考试为中文单选题，覆盖安全治理与管理、风险管理、信息安全管理体系（ISMS）、安全技术与控制措施、安全事件管理与运营、法律法规与合规等模块，强调在组织情境中判断“应当先做什么”，而非记忆产品参数。备考建议按三条线并行：一是通读 GB/T 22080（ISO/IEC 27001）与 GB/T 20984 等基础标准，建立体系与风险评估的概念框架；二是结合《网络安全法》《数据安全法》《个人信息保护法》以及等级保护制度，理解合规义务如何转化为控制措施；三是通过情境题训练答题视角，习惯从管理层与流程角度而非单一技术手段作答。本页内容为学习整理，不代表官方，考试科目设置、题型与安排请以中国信息安全测评中心发布的最新通知为准。. The CNITSEC CISM study guide has 6 sections and about 2,747 words.
01Information Security Governance and Management
This domain is weighted heavily on the CISM exam and is where technically minded candidates lose the most marks. Governance sets direction, defines risk appetite, assigns accountability and monitors performance; management executes within that direction.
450 words, about 2 min02Information Security Risk Management
CISM treats risk management as a continuous business process, not an annual IT exercise. The exam tests the vocabulary precisely and tests judgement about who decides.
465 words, about 2 min03Information Security Management System (ISMS)
An ISMS is the management system that makes security repeatable: scope, leadership, risk-based planning, operation, performance evaluation and improvement. CISM tests ISO/IEC 27001 as the reference model and expects you to know which documents are mandatory, how certification works, and how the Statement of Applicability is used.
426 words, about 2 min04Information Security Technology and Controls
CISM is a management exam, so technology questions test whether you can select and justify a control, not whether you can configure it. You must classify controls by function and by nature, and know which layer of defence reduces likelihood versus impact.
454 words, about 2 min05Information Security Incident Management and Operations
This domain tests what you do in the first ten minutes of an incident and how you keep the business running. The examiner looks for the manager's sequence: follow the plan, activate the team, contain without destroying evidence, communicate, then learn.
460 words, about 2 min06Information Security Laws, Regulations and Compliance
Compliance asks whether you can map obligations in law, regulation and contract onto controls, and prove it. CISM tests the distinction between being compliant and being secure, and expects awareness of the major regimes rather than legal drafting skill.
492 words, about 2 min