Information Security Management Examination study plan

Explain the difference between governance and management, and describe how security strategy aligns with business objectives.

Identify the components of an information security governance framework, including roles of board, steering committee, and CISO.

Define risk management terminology: asset, threat, vulnerability, likelihood, impact, risk appetite, and residual risk.

Apply a qualitative risk assessment method to a sample scenario and produce a risk register with at least five entries.

Compare risk treatment options (avoid, mitigate, transfer, accept) and justify a chosen treatment for each register entry.

Evaluate common security frameworks (ISO 27001, NIST CSF, COBIT) and map their core components to governance activities.

Design a security strategy roadmap that includes measurable objectives and key performance indicators.

Perform a quantitative risk analysis using annualized loss expectancy (ALE) for two scenarios and compare with qualitative results.

Explain how risk tolerance and risk appetite influence security investment decisions.

Describe the purpose and process of a risk assessment methodology, including identification, analysis, evaluation, and treatment.

Draft an information security policy that includes purpose, scope, roles, and compliance requirements.

Differentiate between policies, standards, procedures, and guidelines, and give an example of each.

Define a security organizational structure with clear reporting lines and responsibilities for at least five roles.

Explain the concept of segregation of duties and how it applies to security roles.

Describe the process for policy approval, communication, review, and exception management.

Create an asset inventory template and classify at least ten sample assets using a defined classification scheme.

Explain the criteria for information classification (confidentiality, integrity, availability) and labeling requirements.

Design a security awareness program that includes onboarding, annual refresher, and phishing simulation.

Describe the employee lifecycle security controls: screening, onboarding, change of role, and termination.

Explain the purpose of non-disclosure agreements and acceptable use policies in human resource security.

Identify physical security controls for perimeter, facility, and equipment, including access control, surveillance, and environmental monitoring.

Explain the principles of access control models (DAC, MAC, RBAC, ABAC) and select an appropriate model for a given scenario.

Describe identity management lifecycle: registration, provisioning, authentication, authorization, and de-provisioning.

Compare authentication factors and multi-factor authentication methods, including their strengths and weaknesses.

Design a physical access control scheme for a data center with at least three layers of defense.

Outline the phases of incident management: preparation, detection, containment, eradication, recovery, and lessons learned.

Define business continuity and disaster recovery objectives, including RTO and RPO, and apply them to a sample business process.

Describe the components of a business impact analysis (BIA) and conduct a mini-BIA for two processes.

Explain the purpose and contents of a business continuity plan and a disaster recovery plan.

Identify access control considerations during an incident and in recovery (e.g., emergency accounts, break-glass procedures).

Identify legal and regulatory requirements relevant to information security (e.g., GDPR, HIPAA, SOX, PCI DSS) and their key obligations.

Explain the purpose and process of security audits, including internal audit, external audit, and certification audits.

Describe the role of compliance monitoring and metrics in a security management system.

Test the incident response plan through a tabletop exercise and document findings.

Explain how business continuity and incident management support compliance with legal and regulatory requirements.

Synthesize all domains by creating a one-page concept map linking governance, risk, and controls.

Complete a timed 100-question practice exam and score at least 75%.

Review weak areas identified by the practice exam and re-study those domains.

Explain how the domains interrelate in a real-world scenario (e.g., a data breach response).

Develop a personal exam-day strategy including time management and question-answering techniques.