CNITSEC CISM study plan

Draft a one-page security governance map listing the decision rights of the board, the security steering committee, and the CISO, and mark who approves policy, budget, and risk acceptance.

Explain in writing how security strategy must trace back to business objectives, using two concrete examples from an industry you know.

Define at least 12 governance terms (security charter, steering committee, security strategy, policy hierarchy, roles and responsibilities, security awareness, performance measurement, maturity model) with one-sentence definitions of your own.

Build a table of the three lines of defense model and place at least six security roles into it.

List five metrics a CISO could report to the board and state for each what decision it should trigger.

Write a security policy outline with at least six sections and identify which section addresses each of acceptance, exception handling, and review cycle.

Describe how to run a security awareness program: define target audiences, delivery methods, and two effectiveness measures.

Define risk appetite and risk tolerance and give one quantitative and one qualitative example of each.

Explain the difference between a vulnerability, a threat, and a risk using one worked example with an asset, a threat source, and a business impact.

Compare qualitative, semi-quantitative, and quantitative risk approaches and state when each is appropriate.

Perform a full risk assessment on a fictional system: build an asset inventory of at least eight assets, identify at least ten threats, and score likelihood and impact.

Calculate a risk score for each identified risk and rank them into high, medium, and low tiers.

Select a treatment option (mitigate, transfer, avoid, accept) for each high risk and justify the choice in one sentence.

Produce a risk register with columns for owner, treatment, target date, and residual risk.

Explain how residual risk is accepted and who must sign off on it.

Describe the plan-do-check-act cycle and map each phase to at least two concrete ISMS activities.

List the main clause areas of an ISMS standard (context, leadership, planning, support, operation, performance evaluation, improvement) and state one required artifact for each.

Draft a scope statement for an ISMS that names the organizational boundary, the locations, and the excluded systems with justification.

Explain how risk assessment results feed into the statement of applicability and how controls are selected and justified.

Identify at least five documented-information requirements an ISMS must maintain.

Design an internal audit plan for the ISMS: define audit criteria, sampling approach, auditor independence, and reporting line.

Write a management review agenda with at least eight standing inputs and three expected outputs.

Define at least four ISMS performance metrics and state the data source and review frequency for each.

Describe how nonconformities are logged, root-caused, corrected, and verified as closed.

Explain how continual improvement is evidenced across two consecutive ISMS cycles.

Map at least ten technical controls to the risk categories they mitigate and state one limitation of each.

Explain identity and access management fundamentals: authentication factors, authorization models, privileged access management, and periodic access review.

Describe defense in depth across network, endpoint, application, and data layers with one concrete control per layer.

Compare symmetric and asymmetric cryptography, hashing, and digital signatures, and state one correct use case for each.

Explain how logging, monitoring, and backup controls support detection and recovery, including retention and testing considerations.

Write an incident response plan outline covering preparation, detection and analysis, containment, eradication, recovery, and lessons learned, with a named role for each phase.

Define severity classification criteria and escalation paths with target response times for at least three severity levels.

Describe the evidence-handling steps needed to preserve forensic integrity, including chain of custody.

Explain the difference between an incident, an event, and a crisis, and when to invoke business continuity or disaster recovery.

Draft a post-incident review template with at least six questions that drive corrective action.

Summarize the main categories of security law and regulation (data protection, critical infrastructure, cybercrime, sector rules) and state one compliance obligation from each.

Explain how legal and regulatory requirements are translated into internal policy and how compliance is monitored and evidenced.

Build a crosswalk that links at least five regulatory obligations to specific ISMS controls and to the evidence that proves compliance.

Complete a timed 100-question mixed practice set and record your score by domain.

Review every missed question, write the correct reasoning in your own words, and list the three domains needing the most review.