EXIN Information Security Essentials study plan

Define information and distinguish data, information, and knowledge with one original example each

Explain the CIA triad plus integrity-adjacent concepts (authenticity, non-repudiation, accountability) and map each to a concrete control

Classify given security measures as preventive, detective, corrective, or compensating

Describe the relationship between likelihood, impact, and risk level using a simple 5x5 matrix you draw yourself

List the main categories of technical controls (access control, cryptography, network security, logging) and state what each protects

Distinguish threat, vulnerability, risk, and incident, and place them correctly in a short scenario

Categorize threat actors (script kiddies, organized crime, insiders, nation-state, hacktivists) by motivation and capability

Explain at least six malware and attack types (phishing, ransomware, social engineering, DoS, man-in-the-middle, injection) and the control that reduces each

Compute a qualitative risk score for five sample scenarios and rank them

Identify which risk treatment option (mitigate, transfer, avoid, accept) fits each scenario

Explain why a security policy exists and how policy, standards, guidelines, and procedures differ in authority

Draft the structure of a top-level information security policy including purpose, scope, roles, and review cycle

Describe governance roles (board, CISO, asset owner, data owner, user) and their decision rights

Explain how risk appetite and risk tolerance shape policy statements

Outline how policy compliance is monitored and how exceptions are handled

Explain the security awareness lifecycle: assess, design, deliver, measure, improve

Design three awareness messages targeting phishing, clean desk, and password hygiene

Describe segregation of duties, least privilege, and mandatory vacation as organizational controls

Explain the employee lifecycle controls: screening, onboarding, acceptable use agreement, change of role, and offboarding

Identify human-factor risks such as shadow IT, tailgating, and social engineering and match each to a measure

Explain authentication factors and the difference between identification, authentication, and authorization

Describe symmetric versus asymmetric encryption and where each is used in practice

Explain the purpose of hashing, digital signatures, and TLS at a conceptual level

List physical controls for perimeter, entry, and equipment protection, and classify each as preventive or detective

Explain environmental controls (fire suppression, humidity, temperature, power conditioning) and why they matter to availability

Define an incident and list the phases of incident response from detection to lessons learned

Draft escalation criteria that decide when an event becomes an incident

Distinguish RTO, RPO, MTD, and MTBF and use them in a short scenario

Explain the difference between a business continuity plan and a disaster recovery plan

Describe how backups, redundancy, and alternate sites support recovery objectives

Conduct a tabletop walkthrough of your runbook and record at least three gaps

Describe the purpose of ISO/IEC 27001 and how a management system differs from a checklist

Explain the role of standards and frameworks such as ISO 27001/27002, NIST CSF, and COBIT at a high level

Identify which laws and regulations commonly drive security obligations and why legal review matters

Explain the audit process, evidence, and the difference between a finding and an observation

Review all eight domains using your glossary, risk register, and control matrix

Re-explain the five weakest concepts from earlier weeks without notes

Complete a timed 60-question self-test and review every wrong answer

Map each exam objective to at least one study artifact you produced

Write a one-page summary of the ten facts you are most likely to forget