Information Security Management Examination common mistakes
Information Security Management Examination · Understand the traps and how to avoid them.
When asked who is ultimately accountable for information security, the candidate selects the CISO or the security manager instead of the board or senior executive management.
Candidates confuse operational responsibility with ultimate accountability. The CISO runs the programme, but accountability for risk appetite and governance rests with the board or executive management, who set direction and accept residual risk.
What to do instead
Memorise the distinction: the board/executives are accountable (own the risk), the CISO/security manager is responsible (implements), and asset owners are accountable for their assets. In any governance question, ask 'who bears the consequence if this fails?' - that is the accountable party.
Treating risk assessment as a one-time project rather than a continuous, iterative process, and failing to reassess when business, threat, or regulatory changes occur.
The exam often presents a scenario where a major change (new system, merger, new regulation) has occurred, and candidates pick 'conduct the annual risk assessment' instead of 'trigger an immediate reassessment'. They also forget that risk treatment must be monitored and reviewed.
What to do instead
Remember the risk management cycle: identify, assess, treat, monitor, communicate. Any significant change is a trigger for reassessment. When a question mentions a change, look for the answer that reassesses risk before proceeding. Also know that residual risk must be accepted by the accountable owner, not the security team.
Confusing policies, standards, procedures, and guidelines, and selecting a procedure where a policy is required (or vice versa).
Candidates see 'document' and pick the most detailed one. They forget the hierarchy: policy is high-level management intent; standards are mandatory specific requirements; procedures are step-by-step instructions; guidelines are recommended advice.
What to do instead
Memorise the four definitions and their characteristics: policies are short, approved by top management, and say 'what' and 'why'; standards say 'what exactly' (e.g., AES-256); procedures say 'how' (who, when, step-by-step); guidelines are non-mandatory 'should'. In questions, look for the level of detail and the words 'mandatory' vs 'recommended'.
Assuming the information security function should report to IT or to the CIO, rather than maintaining independence to ensure unbiased oversight.
Candidates think security is technical and therefore belongs under IT. But if security reports to IT, it cannot objectively audit or challenge IT's practices; independence is a core governance principle.
What to do instead
Remember that the CISO should report to the CEO, board, or a risk committee, not to the CIO. Independence avoids conflicts of interest. In questions about reporting lines, choose the option that preserves objectivity and separation of duties.
Classifying data based only on its content or sensitivity, while ignoring legal, regulatory, and contractual requirements, and failing to assign an owner.
Candidates focus on the data itself and forget that classification must consider obligations (e.g., PII under GDPR, PHI under HIPAA, card data under PCI DSS) and that the asset owner is accountable for classification.
What to do instead
Use a classification scheme that includes regulatory and contractual drivers. Always assign an owner (business owner) who is accountable for the asset and its classification. In questions, if legal/regulatory requirements are mentioned, they take precedence over internal preferences.
Treating security awareness as a one-off annual training event and measuring success by attendance rather than by behaviour change.
Candidates pick 'conduct annual training' as the answer, but effective awareness is continuous, role-based, and measured by reduced incidents (e.g., phishing click rates), not by completion.
What to do instead
Look for answers that include ongoing reinforcement, simulated phishing, role-specific training, and metrics that reflect behaviour (click rates, report rates). Remember that awareness aims to change culture and behaviour, not just to inform.
Relying solely on logical access controls (passwords, permissions) while neglecting physical and environmental controls, and failing to integrate them.
Candidates focus on cyber controls and forget that physical access to a server or laptop can bypass logical controls. Environmental controls (fire suppression, cooling, power) are also part of availability.
What to do instead
Remember that physical and logical security are complementary. In questions about access control, consider both. For environmental threats, know the difference between fire detection, suppression (e.g., clean agent vs water), and prevention. Choose answers that layer controls.
Granting access based on role or convenience without applying least privilege and separation of duties, and failing to review access regularly.
Candidates choose 'give the user the access they need to do their job' without considering least privilege and segregation of duties. They also forget that access rights must be reviewed periodically and revoked promptly upon termination.
What to do instead
Apply least privilege (minimum necessary) and separation of duties (no single person controls all steps of a critical process). Remember that access reviews are required, and privileged access needs extra controls (e.g., just-in-time, monitoring). In termination scenarios, revoke access immediately.
In incident response, focusing on containment before understanding the scope, or failing to preserve evidence, and in business continuity, confusing BCP with DRP.
Candidates want to 'fix' the incident quickly and skip identification and evidence preservation. They also mix up business continuity (keeping critical business functions running) with disaster recovery (restoring IT infrastructure).
What to do instead
Follow the incident response lifecycle: preparation, identification, containment, eradication, recovery, lessons learned. Containment should not destroy evidence. For continuity, remember BCP is business-focused (people, processes) and DRP is technology-focused (systems, data). Know RTO and RPO definitions.
Assuming compliance with laws and regulations guarantees security, and ignoring the need for independent audit and evidence.
Candidates equate compliance with security. But compliance is a minimum baseline; security requires ongoing risk management. Also, candidates forget that audits must be independent and evidence-based.
What to do instead
Remember that compliance does not equal security; it is a snapshot. Security is broader and continuous. For audit questions, choose independent auditors (not the same team that implemented controls) and look for evidence collection and remediation tracking. Know that legal and regulatory requirements are mandatory and may exceed internal policy.