EXIN ISMP study plan

Define information security management as a governance discipline and distinguish it from IT operations or technical security work

Map the core building blocks of an ISMS (scope, policy, risk assessment, risk treatment, controls, measurement, improvement) and state the purpose of each

Explain the Plan-Do-Check-Act cycle and describe what happens in each phase of an ISMS lifecycle

List the main categories of information security controls and give one realistic example of each

Write your own one-page glossary of 20 exam-relevant terms without copying source wording

Differentiate threats, vulnerabilities, likelihood, impact, and risk so you can classify any given scenario correctly

Apply a qualitative risk assessment method to three short invented scenarios and justify each rating

Compare the main risk treatment options (mitigate, transfer, avoid, accept) and select the right one for each scenario

Identify who owns risk decisions versus who implements controls, and explain why that separation matters

Produce a risk register with at least six entries including owner, treatment, and residual risk

Explain how an information security policy hierarchy works, from top-level policy down to procedures and work instructions

Describe the purpose and typical contents of a statement of applicability and how it links risk treatment to controls

Outline the roles of top management, the security manager, control owners, and all staff in an ISMS

Draft the skeleton of an ISMS scope statement for a fictional mid-sized organization

Summarize how legal, regulatory, and contractual requirements feed into the ISMS

Describe the purpose of internal audit, management review, and continual improvement, and how they differ

Design five measurable ISMS performance indicators and explain what decision each indicator supports

Explain how nonconformities are recorded, corrected, and followed up

Identify the inputs and outputs of a management review meeting

Complete a 30-question timed self-test on weeks 1-3 material and log every wrong answer with a corrected explanation

Explain how awareness, training, and competence requirements are determined and evidenced

Describe how incidents are classified, escalated, handled, and learned from within a management system

Outline business continuity and availability considerations at a management level, without going into technical recovery detail

Explain supplier and third-party security management from a governance perspective

Draft an incident escalation and reporting flow for your fictional organization

Reconstruct the full ISMS lifecycle from memory on a blank page and check it against your notes

Explain how certification and audit processes work at a high level, including the difference between certification and compliance

Identify the most commonly confused concept pairs in information security management and write a one-line distinction for each

Answer 40 mixed practice questions under timed conditions and categorize errors by cause

Rewrite your weakest three glossary entries so they are precise and exam-ready

Complete two full-length timed mock exams and record scores per topic area

Analyze every missed question to decide whether the cause was knowledge gap, misreading, or terminology confusion

Re-study only the three weakest topic areas using targeted notes and scenario practice

Practice explaining governance decisions aloud in plain language to test real understanding

Build a one-page pre-exam summary sheet in your own words

Review your summary sheet and glossary daily, reciting definitions without looking

Redo all previously missed questions and confirm each is now answered correctly with a reason

Simulate exam conditions once more and verify your timing strategy works

List the five concepts you are least confident about and close each gap with a short written explanation

Plan exam-day logistics and a calm final 24-hour review routine