CCISO study plan

Map every Governance, Risk, and Compliance (GRC) subtopic in Domain 1 to a one-page summary that links each control objective to a specific business driver (e.g., revenue assurance, regulatory obligation).

Draft a risk register with at least eight entries, assigning likelihood, impact, inherent risk score, and one mitigation per entry.

Distinguish the roles of the board, CISO, risk committee, and internal audit in a written one-page RACI matrix.

Explain how ISO 27001, NIST CSF, and COBIT differ in scope and purpose, and state one situation where each is the better fit.

Classify at least twenty security controls into preventive, detective, corrective, and compensating categories, and justify each classification in one sentence.

Build an audit evidence checklist for a hypothetical access-control audit, naming the artifact, owner, and retention period for each item.

Describe how cryptography, identity and access management, network segmentation, and secure SDLC each reduce a specific risk from the week-1 register.

Write five audit findings in standard format (condition, criteria, cause, effect, recommendation) based on a fictional control gap.

Produce a one-page security policy outline that covers purpose, scope, roles, exceptions, and review cadence.

Define three security metrics (one leading, one lagging, one compliance) and state the data source and target threshold for each.

Draft a 12-month security program roadmap that sequences at least six initiatives by risk reduction and dependency.

Explain how to integrate risk appetite statements into project approval decisions using a worked example.

Build a security budget request that separates capital, operating, and personnel costs, and ties each line to a risk or compliance driver.

Compare build, buy, and managed-service options for one security capability, listing total cost of ownership factors for each.

Draft vendor due-diligence questions covering security posture, breach history, data residency, subprocessors, and right-to-audit clauses.

Create an incident response tabletop scenario with at least five injects and the decision owner for each.

Explain, with a concrete example each, how authentication, authorization, encryption, and logging combine to protect a single high-value asset.

Differentiate symmetric and asymmetric cryptography, hashing, digital signatures, and PKI in a comparison table with use cases.

Describe the shared responsibility model for a cloud deployment and identify three controls the customer always owns.

Map five common attack techniques (phishing, credential stuffing, privilege escalation, SQL injection, ransomware) to at least two controls each.

Draft a business continuity and disaster recovery outline that states recovery time objectives and recovery point objectives for three critical systems.

Write a board-level risk report of no more than one page that translates technical risk into financial and reputational exposure.

Design a security awareness program with three audiences, three channels, and a success metric for each channel.

Explain how to handle a policy exception request from intake to expiry, including the approver and compensating controls.

Build a three-year security strategy one-pager that links each initiative to a business objective and a funding source.

Conduct a mock vendor risk re-assessment and record a risk rating with justification and a remediation timeline.

Explain how to evaluate a security investment using return on security investment or a comparable cost-avoidance method, with a worked calculation.

Describe how emerging technologies (AI, cloud-native, zero trust) change control selection and vendor evaluation criteria.

Complete a timed 100-question mixed-domain practice set and log every missed question by domain and root cause.

Re-study the two weakest domains identified by the practice set and rewrite the corresponding week's deliverable summary from memory.

Recite from memory the five domain weightings and three key frameworks, standards, or models associated with each domain.

Write a one-page exam-day plan covering time allocation per question, flagging strategy, and a review checklist.