EXIN ISMP study guide
EXIN ISMP · Work through your exam, one topic at a time.
The EXIN Information Security Management Professional (ISMP) is a certification offered by EXIN, an independent examination and certification body. This page is an independent study resource; it is not affiliated with, endorsed by, or operated by EXIN, and it does not reproduce any official question bank. The certification is aimed at professionals who manage or contribute to an organisation's information security management system: security officers and managers, IT managers, risk and compliance staff, auditors, and consultants who advise on security governance. Candidates typically prepare by studying information security management principles, the plan-do-check-act cycle applied to a management system, risk assessment and risk treatment, security policy and organisation, asset management, human resources security, physical and environmental security, communications and operations management, access control, incident management, business continuity, and compliance. Study usually combines a recognised course or self-study text with practice on scenario-based questions, because the exam tests the ability to apply concepts to realistic organisational situations rather than to recall isolated definitions. Before scheduling, candidates should confirm the current exam format, item count, duration, passing score, price, retake rules and certificate validity directly with EXIN, since the publicly retrieved source for this page contained no exam details at the time of writing. Topics on this exam: Information security management (domain structure not enumerated in retrieved source). The EXIN ISMP study guide has 1 section and about 519 words.
01Information Security Management: the ISMS, risk-driven control selection and continual improvement
Information security management is the spine of the EXIN ISMP syllabus. Questions in this domain test whether you understand an ISMS as a management system - not a pile of technical controls - and whether you can apply ISO/IEC 27001's mandatory clauses, risk-driven control selection and continual-improvement loop to a realistic scenario. Clauses 4–10 are mandatory: context of the organization, leadership, planning, support, operation, performance evaluation, improvement. Annex A is subordinate to them.
519 words, about 3 minMore study resources for EXIN ISMP
- Practice questionsIn information security management, what does the CIA triad represent?
- FlashcardsConfidentiality. Property that information is not made available or disclosed to unauthorized individuals, entities, or processes.
- Cheat sheetInformation security management is a continuous cycle: establish the policy and scope, assess risks, select and implement controls, then monitor, review, and improve; ISMP tests this Plan-Do-Check-Act logic rather than one-off projects.
- Key termsInformation security. The preservation of confidentiality, integrity and availability of information, plus whatever other properties such as authenticity, accountability, non-repudiation and reliability an organization decides matter to it.
- Study planDefine information security management as a governance discipline and distinguish it from IT operations or technical security work.
- Common mistakesThe exam title 'Information Security Management Professional' invites candidates with a technical background to pattern-match to engineering solutions, and technical candidates often assume depth in tooling is what is being tested.
- Exam-day guideBring the exact ID document named in your registration confirmation.