EXIN ISMP cheat sheet

Information security management is a continuous cycle: establish the policy and scope, assess risks, select and implement controls, then monitor, review, and improve; ISMP tests this Plan-Do-Check-Act logic rather than one-off projects.

Confidentiality, integrity, and availability are the three classic CIA properties; supporting properties often added are authenticity, accountability, non-repudiation, and reliability (ISO/IEC 27000 definitions).

A risk is the combination of the probability of an event and its consequence; information security risk is expressed in terms of likelihood and impact on the organization's information assets.

Risk assessment = risk identification + risk analysis + risk evaluation; risk treatment options are modify (reduce), retain (accept), avoid, and share (e.g., insurance or outsourcing), per ISO/IEC 27005.

Residual risk is the risk remaining after controls are applied; risk acceptance is a formal management decision that residual risk falls within the organization's risk appetite/risk criteria.

A control (safeguard) is a measure that modifies risk; controls are classified as preventive, detective, or corrective, and can be organizational, people, physical, or technological (ISO/IEC 27002:2022 attribute scheme).

The Statement of Applicability (SoA) records which controls from Annex A are applicable, why, whether they are implemented, and the justification for any exclusion; it is a mandatory documented artifact for an ISMS.

Roles must be separated: top management provides direction and resources, the information security manager operates the ISMS, asset/data owners decide classification and access, and custodians implement the technical measures; segregation of duties prevents single-point abuse.

An incident is a single or series of unwanted information security events with significant probability of compromising business operations; incident management phases are prepare, detect and report, assess and decide, respond, and learn.

ISO/IEC 27001 specifies requirements for an ISMS (certifiable); ISO/IEC 27002 provides implementation guidance for controls; ISO/IEC 27005 covers risk management; ISO/IEC 27000 contains vocabulary and overview - know which standard does what.

ISO/IEC 27001:2022 restructured Annex A into 4 themes (organizational, people, physical, technological) with 93 controls; the previous version had 114 controls in 14 clauses.

Mandatory ISMS documented information includes the scope of the ISMS, the information security policy, the risk assessment and risk treatment results, the Statement of Applicability, and evidence of competence and monitoring.

Asset classification drives handling rules: information is typically classified by confidentiality level (e.g., public, internal, confidential, secret), and the owner assigns the classification while the custodian enforces it.

The PDCA cycle maps to ISO/IEC 27001 clauses: Plan (context, leadership, planning, risk treatment), Do (support, operation), Check (performance evaluation, internal audit, management review), Act (improvement, nonconformity and corrective action).

Business continuity management uses a BIA to identify critical processes and their RTO (recovery time objective) and RPO (recovery point objective); the BCP describes how to restore them, and the DRP covers the technical recovery.

A defence-in-depth strategy layers controls (physical, network, host, application, data, human) so that failure of one layer does not compromise the whole; single controls are never assumed sufficient.

Awareness, training, and education differ: awareness is a change in attitude (what and why), training builds skills (how), and education develops deeper knowledge; awareness programmes are continuous, not annual events.

Access control principle: least privilege plus need-to-know; role-based access control (RBAC) assigns permissions to roles rather than individuals, and periodic access reviews (recertification) remove accumulated entitlements.

Authentication factors are something you know, something you have, and something you are; multi-factor authentication requires factors from at least two different categories, and two passwords do not count as MFA.

Cryptography decisions: symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) solves key distribution and enables digital signatures; hashing (SHA-2/3) provides integrity, not confidentiality, and must be salted for passwords.

A digital signature provides authenticity, integrity, and non-repudiation but not confidentiality; it is created with the sender's private key and verified with the sender's public key.

Physical and environmental controls include perimeter protection, access badges, CCTV, fire suppression (e.g., inert gas for server rooms), humidity and temperature control, and uninterruptible power supply with generator backup.

Supplier and third-party management requires due diligence before contracting, security requirements in agreements, and ongoing monitoring; cloud models shift operational responsibility but not accountability for the data.

Compliance obligations come from legislation, regulation, contracts, and internal policy; the ISMS must identify applicable requirements and evaluate fulfilment (ISO/IEC 27001 clause 9.1.2).

Metrics and reporting: key performance indicators show whether security processes are effective, key risk indicators give early warning of rising risk, and management review must consider audit results, incidents, and risk status.

A nonconformity is a failure to meet a requirement; corrective action addresses the root cause, and the organization must retain documented evidence of the nature of the nonconformity, actions taken, and results.