ISSMP case studies
ISSMP · Put your knowledge to work in context.
The Information Systems Security Management Professional (ISSMP) is a management-focused credential in the ISC2 portfolio; ISSMP is a registered mark of ISC2, Inc., and the organization positions security management alongside its other certification tracks for practitioners who have moved from hands-on control work into program leadership. The exam targets professionals who already hold a core security credential and now own the business side of the job: setting direction, defending budget, building governance, and answering to executive stakeholders. The ISSMP case studies are 5 cases and about 2,859 words.
1The 18% Cut: Choosing What Not to Fund
The CISO of a mid-size property insurer is told to cut the security budget 18%, from 4.2M to 3.44M, after an underwriting loss. Four commitments compete: EDR renewal ( 600k per year) due in 60 days, a PCI DSS assessment ( 250k), and phishing-resistant MFA ( 900k) promised in a customer contract with a nine-month deadline.
592 words, about 3 min2The Security Gate Everyone Bypasses
A 14-team SaaS company runs a CI/CD pipeline with a security gate that blocks releases only when a critical vulnerability is found. Last quarter 38% of releases used an emergency exception approved by whichever security engineer was on call; most approvals happened between midnight and 4 a.m.
572 words, about 3 min3Conflicting Obligations and Missing Evidence
A US-headquartered healthcare analytics firm serves EU hospital customers. Its GDPR DPIA requires minimizing personal data, but a state records law requires seven-year retention of certain clinical data.
563 words, about 3 min4The $2.4M Insurance Bet
A retailer's risk register shows ransomware as a tier-1 risk. Analysts estimate a single-event loss of 6M and an annual likelihood of 40% without additional controls.
542 words, about 3 min5Contain or Keep Shipping
At a third-party logistics provider, EDR flags credential dumping on a domain controller three days before peak holiday shipping. Threat intelligence shared by a sector ISAC says the actor uses double extortion, dwells three to five days before encryption, and targets warehouse management systems.
590 words, about 3 min