I85PREP
⌘ K
CITM study materials
CITM study resources

CITM: Information Security Management

CITM · Work through your exam, one topic at a time.

All guide sections

Information Security Management

This domain tests whether you can manage security as risk-based governance, not as a product checklist. Expect questions on the CIA triad, ISMS controls, security frameworks, identity, incident response, and third-party risk.

Frameworks and control themes

ISO/IEC 27001:2022 defines an information security management system and Annex A contains 93 controls in four themes: organizational (37), people (8), physical (14), and technological (34). NIST Cybersecurity Framework 2.0 organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Zero Trust, described in NIST SP 800-207, rejects implicit trust based on network location and requires continuous verification. Core principles include least privilege, separation of duties, defense in depth, secure defaults, and assume breach.

Identity and incident response

Identity is the modern control plane: authentication, authorization, privileged access management, and joiner-mover-leaver processes. Incident response follows preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Evidence preservation and chain of custody matter when legal or disciplinary action is possible. Third-party risk requires due diligence, contractual security requirements, ongoing monitoring, and exit planning.

Worked example

A phishing risk is scored likelihood 4 × impact 5 = 20, high. Multi-factor authentication is proposed. It reduces likelihood to 2, giving residual risk 10, medium. The financial case: single loss exposure $400k, annualized rate of occurrence 0.5, so ALE = $200k. With MFA, ARO falls to 0.25, ALE = $100k. The control costs $60k per year, so the net benefit is $40k plus reduced regulatory exposure. If residual risk is within appetite, accept it with monitoring; otherwise add conditional access or token controls.

Traps that cost marks

  • Treating compliance certification as proof of security.
  • Encrypting data without key management, rotation, or recovery plans.
  • Assuming cloud providers secure customer data by default; responsibility is shared.
  • Running incident response without evidence handling or legal counsel.
  • Giving standing privileged access instead of just-in-time access.
  • Ignoring third-party and supply-chain risk because the vendor is large.