Information Security Management Examination study guide
Information Security Management Examination · Work through your exam, one topic at a time.
The Information Security Management Examination is a multiple-choice credential aimed at professionals who own or advise on a security programme rather than only operating controls. Typical candidates are security managers, ISMS leads, risk and compliance officers, IT managers moving into governance, and consultants who must align security with business objectives. The Information Security Management Examination study guide has 10 sections and about 2,766 words.
01Information Security Governance and Strategy
Information security governance and strategy examines who decides, who is accountable, and how security work is directed toward business objectives. Questions probe board and executive responsibility, governance bodies, strategy development, performance reporting, and the difference between governance and management.
300 words, about 2 min02Risk Management
Risk management tests whether you can identify, analyze, treat, and monitor information security risk in a repeatable way. Expect questions on risk criteria, assessment methods, treatment options, ownership, residual risk, and third-party risk.
323 words, about 2 min03Information Security Policy, Standards, and Procedures
Policy, standards, and procedures tests the document hierarchy and control of documented information: who approves, what is mandatory, how exceptions work, and how documents stay current. Policy states intent and direction, approved by top management.
272 words, about 1 min04Security Organization and Responsibilities
Security organization and responsibilities tests accountability: who owns information, who operates controls, who approves access, and how duties are separated. Expect RACI models, reporting lines, committees, and third-party roles.
265 words, about 1 min05Asset Management and Classification
Asset management and classification tests whether information and supporting assets are inventoried, owned, classified, labeled, and handled according to value and legal sensitivity. Inventory covers hardware, software, data, services, cloud instances, and media.
285 words, about 1 min06Human Resource Security and Awareness
Human resource security and awareness tests controls across the employment lifecycle, from screening and contracts through onboarding, training, role changes, and termination. Screening must be proportional to role risk and lawful; higher-risk roles need stronger checks.
253 words, about 1 min07Physical and Environmental Security
Physical and environmental security tests protection of facilities, equipment, and media from unauthorized access, damage, and environmental hazards. Use layered defenses: perimeter, building, secure zone, cabinet or room, and device.
263 words, about 1 min08Access Control and Identity Management
Access control and identity management tests how identities are proven, authorized, used, reviewed, and removed. Expect access models, least privilege, authentication, privileged access, and access reviews.
260 words, about 1 min09Incident Management and Business Continuity
Incident management and business continuity tests detection, response, recovery, and resilience. Expect the incident lifecycle, severity, evidence, communications, business impact analysis, RTO and RPO, and testing.
279 words, about 1 min10Compliance, Audit, and Legal/Regulatory Requirements
Compliance, audit, and legal and regulatory requirements tests obligations, evidence, audit process, findings, and corrective action. Expect privacy, records retention, contracts, audit independence, and regulatory reporting.
266 words, about 1 min