CISRM case studies

The Certified Information Security Risk Manager (CISRM) is a vendor-neutral credential aimed at professionals who own or contribute to an organization's information security risk program. Typical candidates are risk managers, security managers and architects, GRC analysts, internal auditors, and consultants who need to move beyond checklist compliance and defend risk decisions to executives and boards. The exam is delivered as multiple choice and is built around nine domains: risk management fundamentals and governance; risk identification and asset inventory; risk analysis and assessment methodologies; risk evaluation and prioritization; risk treatment and control selection; risk monitoring, reporting, and communication; third-party and supply chain risk; compliance, legal, and regulatory considerations; and business continuity and incident response risk. Expect questions that test judgment rather than recall alone: choosing a qualitative versus quantitative approach, interpreting a risk register or heat map, selecting among avoid, mitigate, transfer, and accept, and deciding what a risk report should say to which audience. The CISRM case studies are 5 cases and about 4,123 words.