Information Security Governance and Management
This domain is weighted heavily on the CISM exam and is where technically minded candidates lose the most marks. Governance sets direction, defines risk appetite, assigns accountability and monitors performance; management executes within that direction. When a question asks what you should do, the correct answer is usually the governance action - align security with business objectives, establish policy, clarify roles - not install a tool.
Core rules
- Strategy before structure. The security strategy must be traceable to business objectives. Asked for the first step of a new initiative, the answer is normally to define or confirm the strategy and obtain senior management sponsorship, not to buy a product.
- Accountability stays with the business. Data owners (business managers) classify information and formally accept residual risk. Custodians implement and operate controls. The security function advises, monitors and reports. A CISO who signs off risk acceptance on the business's behalf has broken the governance model.
- Policy hierarchy. Policy (mandatory intent) → standard (mandatory specifics, e.g. AES-256) → procedure (mandatory step-by-step) → guideline (recommended). A baseline is the minimum configuration for a class of system. Exceptions require documented, time-bound approval by the accountable owner, with a compensating control and remediation date.
- Steering committee. Cross-functional and business-led, chaired at executive level: approves policy, arbitrates between business units, prioritises funding.
- Metrics. KPIs measure process performance (percentage of systems with a current risk assessment). KRIs measure exposure trend. Report to the board in business language - risk, financial impact, regulatory exposure - not packet counts.
Worked example
A sales director needs a SaaS platform in two weeks and it fails the encryption standard. "Refuse, it violates policy" is the weak answer. The governance answer: the security manager documents the gap, the data owner accepts the residual risk in writing with an expiry date, a compensating control (e.g. field-level encryption or restricted integration scope) is applied, and a remediation plan is logged and reported to the steering committee. Governance makes risk decisions visible and owned - it does not silently absorb them.
Traps that cost marks
- Selecting a technical control when the stem describes a governance or accountability gap.
- Treating the CISO as risk owner.
- Reflexively answering "revise the policy" when the real issue is awareness, enforcement or a missing process.
- Confusing a standard (mandatory, specific) with a guideline (advisory).