Information Security Management Examination cheat sheet

Governance is the set of processes by which the board and executive management set direction, delegate authority, and monitor security performance; management executes within that framework.

Governance structures typically include a board or board committee, a steering committee, a CISO or security function owner, and defined reporting lines with escalation paths to executive leadership.

Strategy alignment means security objectives are derived from and traceable to business objectives; a security program with no documented linkage to business goals fails the alignment test.

Governance effectiveness is measured through maturity models (for example CMMI-style levels 1–5), balanced scorecards, KRIs, and independent assurance reviews rather than through technical metrics alone.

Separation of duties applies at governance level: the function that approves risk appetite should not be the same function that accepts residual risk without oversight.

The three governance questions are: what must be protected (objectives), who decides (authority and accountability), and how performance is verified (monitoring and assurance).

Accountability cannot be delegated away: the board remains accountable for risk appetite, while responsibility for implementation is assigned to named roles.

Policy hierarchy flows from governance: board-level policy sets intent, standards set mandatory requirements, procedures set steps, and guidelines are discretionary.

Risk = likelihood × impact (qualitative) or annualized loss expectancy (ALE) = single loss expectancy (SLE) × annualized rate of occurrence (ARO) in quantitative analysis.

SLE = asset value (AV) × exposure factor (EF); EF is the percentage of asset value lost in a single event.

Risk treatment options are exactly four: mitigate (reduce), transfer (share, e.g. insurance or contract), avoid (eliminate the activity), and accept (retain with documented sign-off by the accountable owner).

Inherent risk is assessed before controls; residual risk is assessed after controls; the gap between them is the control's risk reduction effect.

Risk register minimum fields: identifier, description, cause, affected asset, owner, likelihood, impact, score, treatment, controls, residual score, review date.

Risk appetite is the amount of risk the organization is willing to pursue or retain; risk tolerance is the acceptable variation around that appetite.

Qualitative scales must be defined with explicit criteria per level (for example likelihood 1 = rare, 5 = almost certain) so that scoring is repeatable across assessors.

Risk assessment is iterative: changes in assets, threats, vulnerabilities, or business context trigger reassessment, and treatment effectiveness is monitored over time.

Policy states mandatory management intent and 'what' must be achieved; standards define specific measurable requirements; procedures define 'how' and in what sequence; guidelines are recommended, non-mandatory practice.

A policy document typically contains purpose, scope, definitions, policy statements, roles and responsibilities, compliance/consequences, related documents, and review/approval history.

Policies require documented approval at the appropriate authority level (board, executive, or management) and a defined review cycle, commonly annual or upon significant change.

Exceptions to policy must be formally requested, risk-assessed, time-bound, approved by the risk owner, and recorded in an exceptions register with expiry tracking.

Effective policy communication requires acknowledgement by covered personnel; acknowledgement records are the evidence used in audits.

Policy scope must explicitly state applicability (entities, systems, personnel, third parties) and exclusions, because ambiguous scope is a common audit finding.

A standard must be verifiable: it should specify a measurable requirement (for example encryption algorithm and minimum key length) rather than a general aspiration.

Document control requires version numbering, owner, classification, approval date, distribution list, and retention consistent with legal and audit needs.

Segregation of duties requires that no single person can both initiate and approve a transaction or control, and no person can both administer and audit the same system.

The three-lines model: first line owns and manages risk operationally; second line provides oversight, policy, and risk functions; third line provides independent internal audit assurance.

RACI assigns each activity exactly one Accountable, at least one Responsible, plus Consulted and Informed parties; two Accountables for one activity is a defect.

The CISO typically owns the security program and advises on risk; the business or asset owner accepts residual risk and funds controls.

Third-party relationships require defined security responsibilities in contracts: notification duties, audit rights, subcontractor controls, data return/deletion, and incident cooperation.

Security roles must be documented in job descriptions with required competencies, and role changes must trigger access and responsibility review.

A security steering committee typically includes business unit leaders, IT, legal, risk, and the CISO, and decides on priorities, funding, and risk escalations.

Conflicts of interest must be declared and managed; an individual approving their own access request or exception is an unmanaged conflict.

An asset is anything of value to the organization: information, systems, hardware, software, services, facilities, people, and reputation; each asset needs a named owner.

The asset owner is accountable for classification, access decisions, and periodic review; the custodian implements and operates controls on the owner's behalf.

Classification schemes are defined by the organization (commonly public, internal, confidential, restricted) and must map to handling rules for storage, transmission, sharing, and destruction.

Labeling makes classification visible; handling rules must state concrete controls per level, such as encryption requirements or approved sharing channels.

Asset inventory minimum data: unique ID, description, owner, custodian, location, classification, criticality, dependencies, and lifecycle status.

Criticality assessment ranks assets by business impact of loss (confidentiality, integrity, availability) and drives prioritization of controls and recovery objectives.

Acceptable use rules cover organizational assets and, where lawful and disclosed, personal devices and accounts used for business.

Secure disposal requires sanitization proportionate to classification; media containing confidential data must be destroyed or cryptographically erased with records retained.

The employment lifecycle controls are: pre-employment screening, terms and conditions of employment, induction and awareness, ongoing training, disciplinary process, and termination or change of role.

Screening must be lawful, proportionate to the role's sensitivity, and documented, including verification of qualifications and references where permitted.

Access removal at termination is a time-bound control; privileged and remote access should be revoked immediately, and asset return must be recorded.

Awareness aims to change behavior, training transfers knowledge, and education builds deeper competence; measure awareness with simulated phishing rates and completion data, not attendance alone.

Role-based awareness means higher-risk roles (privileged users, finance, executives) receive additional targeted training.

A non-retaliation reporting channel and a documented disciplinary process are prerequisites for effective security culture and incident reporting.

Confidentiality and non-disclosure obligations must survive termination and be reaffirmed at exit.

Awareness content must be refreshed on a defined cycle and after significant incidents, policy changes, or new hire onboarding.

Layered physical defense: perimeter, building, secure area, and asset-level controls; each layer should assume the previous layer has failed.

Access to secure areas requires authorization, recorded entry, visitor escort and logging, and periodic review of physical access rights.

Environmental controls include temperature and humidity monitoring, water detection, fire suppression appropriate to equipment (commonly clean-agent or inert gas for data centers, not water), and smoke detection.

Power protection follows a hierarchy: surge protection, uninterruptible power supply for ride-through, and generator for extended outages; test under load on a defined schedule.

Cabling carrying confidential data should be protected from interception, interference, and damage, with labeled and documented pathways.

Clear desk and clear screen rules reduce exposure of information to unauthorized on-site persons; enforcement is verified by walkthroughs.

Equipment siting avoids hazards such as flood-prone areas, and equipment must be protected against unauthorized removal with asset tagging and exit controls.

Off-site asset protection requires the same classification-based controls as on-site, including secure transport and storage.

Principles: least privilege, need-to-know, separation of duties, and deny-by-default; access is granted to roles, not to individuals where role-based access control is used.

Authentication factors are knowledge, possession, and inherence; multi-factor authentication requires factors from different categories.

Authorization models include discretionary (owner decides), mandatory (system labels and clearances), and role-based (permissions tied to job roles).

The joiner-mover-leaver process must create, adjust, and revoke access; access reviews (recertification) confirm that entitlements remain justified.

Privileged access management covers shared-account elimination, just-in-time elevation, session recording, credential vaulting, and periodic privileged entitlement review.

Identity lifecycle requires unique user IDs, no shared accounts for accountability, timely disabling of dormant accounts, and documented approval for access requests.

Password and credential policy should align with current guidance: length over forced complexity, screening against breached-password lists, and rate limiting or lockout against guessing.

Physical and logical access should be consistent: a person with data center access but no system access, or vice versa, is an anomaly worth reviewing.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Incident vs event: an event is any observable occurrence; an incident is an event that actually or potentially harms confidentiality, integrity, or availability.

Business impact analysis identifies critical processes, dependencies, and maximum tolerable downtime, and sets recovery time objective (RTO) and recovery point objective (RPO).

RTO is the target time to restore a process; RPO is the maximum acceptable data loss measured in time; maximum tolerable downtime is the business limit that RTO must not exceed.

Continuity strategies include redundancy, failover, alternate sites (hot, warm, cold), manual workarounds, and backup restoration tested at intervals.

Evidence handling requires documented chain of custody, forensic imaging where feasible, and preservation before remediation actions destroy data.

Incident severity classification drives escalation, notification timelines, and whether legal, regulatory, or customer notification is triggered.

Plans are validated by exercises: tabletop, simulation, and full failover tests; results must feed corrective actions with owners and dates.

Compliance obligations arise from law, regulation, contract, and internal policy; each obligation should be mapped to a control and an owner in a compliance register.

Audit types include first-party (internal), second-party (customer or partner), and third-party (independent); each produces findings rated by severity with remediation deadlines.

Audit evidence must be sufficient, relevant, and reliable; system-generated logs and signed records are stronger than verbal assertions.

Key data protection concepts: lawful basis for processing, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Data subject rights commonly include access, correction, deletion, restriction, portability, and objection; response timelines are set by applicable law.

Cross-border transfer restrictions require a documented transfer mechanism and assessment of the destination's protection level.

Records retention schedules must reflect legal minimums and maximums; litigation holds override normal deletion schedules.

Noncompliance consequences include contractual breach, regulatory fines, sanctions, reputational loss, and personal liability for officers in some jurisdictions.