CISO study plan
CISO · Give each week a clear focus.
8 weeks · About 6 hours per week
Governance, Risk and Compliance
Map the full GRC domain outline into a one-page concept tree covering governance structures, risk management frameworks, and compliance obligations, and mark every subtopic you cannot yet explain aloud.
Define, in your own words, the distinct accountability of the board, the CISO, the CRO, and internal audit, and write a short paragraph for each that you could defend in an interview.
Compare at least three risk management approaches (qualitative heat mapping, quantitative FAIR-style analysis, and control-framework-driven assessment) and record when each is the defensible choice.
Build a personal glossary of 25 GRC terms (risk appetite, residual risk, control objective, attestation, materiality) with one exam-relevant sentence each.
Your checkpoint
A one-page GRC concept tree plus a 25-term glossary in which every term has a self-written definition and one example of how it appears in a CISO decision.
Governance, Risk and Compliance
Trace how a regulatory obligation becomes an internal control: pick one regime you know (for example GDPR, PCI DSS, or SOX-style financial controls) and diagram obligation to control to evidence to audit.
Draft a risk register with eight realistic enterprise risks, each with likelihood, impact, owner, treatment option, and residual rating, and justify two accepted risks in writing.
Explain the difference between certification, attestation, and continuous compliance monitoring, and identify which one a board is most likely to be misled by.
Practice 30 scenario-style questions on policy exceptions, third-party risk, and audit findings, and log the reasoning error behind every miss rather than the answer itself.
Your checkpoint
A completed eight-risk register with documented treatment decisions plus an error log classifying at least 10 missed questions by root cause (knowledge gap, misread stem, or faulty reasoning).
Information Security Strategy and Leadership
Write a one-page security strategy on a page: business context, three strategic risks, three initiatives, success metrics, and funding ask, framed for a board audience rather than a technical one.
Translate five technical security metrics into business-risk language (for example mean time to remediate expressed as exposure days and revenue risk) and test each translation for clarity.
Articulate how security strategy must align to enterprise risk appetite and identify two signs that a security program has drifted out of alignment.
Draft a 90-second verbal pitch for a security investment that names the business outcome before the technology.
Your checkpoint
A board-ready one-page security strategy with three initiatives, each tied to a named business risk and a measurable success metric.
Information Security Strategy and Leadership & Governance, Risk and Compliance
Build an influence and stakeholder map covering the board, CFO, CIO, legal, and business unit leaders, noting each stakeholder's priorities and the security message most likely to land with them.
Design a security governance reporting cadence, including what the board sees quarterly versus monthly and why operational metrics should not dominate board reporting.
Analyze three leadership failure modes (over-promising compliance, security as blocker, metric theater) and write the corrective behavior for each.
Complete a timed 60-question mixed set weighted toward domains 1 and 2 and review every explanation, including for questions you answered correctly.
Your checkpoint
A stakeholder influence map with tailored messaging plus a timed practice score recorded with a per-domain accuracy breakdown.
Security Architecture, Operations and Controls
Map the security architecture domain into identity and access, network and segmentation, data protection, cloud shared responsibility, and resilience controls, and note the CISO-level decision each area drives.
Evaluate three control selections against cost, risk reduction, and operational burden, and defend one choice in a written recommendation.
Explain zero trust, defense in depth, and least privilege as architectural principles rather than products, and identify one common misapplication of each.
Review how control effectiveness is measured and describe what evidence would convince an auditor that a control actually operates.
Your checkpoint
A control selection memo recommending one of three options with explicit cost, risk-reduction, and operational-burden reasoning, plus the evidence you would collect to prove it works.
Security Architecture, Operations and Controls & Incident Management, Business Continuity and Awareness
Walk through the incident response lifecycle from preparation to lessons learned, and specify the CISO's decision rights at each phase, including who declares an incident and who authorizes containment that disrupts business.
Draft a 24-hour incident communication plan identifying internal escalation, regulator notification triggers, customer messaging, and legal privilege considerations.
Distinguish business continuity, disaster recovery, and crisis management, and explain how RTO and RPO drive recovery investment decisions.
Analyze two tabletop scenarios and record the decisions that would most likely be criticized after the fact.
Your checkpoint
A one-page incident communication and escalation plan with named decision owners and explicit notification triggers for at least two regulatory regimes.
Incident Management, Business Continuity and Awareness
Design a security awareness program that targets behavior change rather than completion rates, including how you would measure whether phishing susceptibility actually fell.
Build a business impact analysis outline for one critical business process, identifying dependencies, maximum tolerable downtime, and recovery priorities.
Evaluate a third-party or supply-chain incident scenario and decide what contractual and technical levers the CISO actually controls.
Complete a timed 60-question set weighted toward domains 3 and 4 and re-derive the reasoning for each missed item before reading the explanation.
Your checkpoint
An awareness program design with two behavioral metrics and a baseline measurement method, plus a timed practice score with per-domain accuracy.
Governance, Risk and Compliance & Information Security Strategy and Leadership & Security Architecture, Operations and Controls & Incident Management, Business Continuity and Awareness
Re-take all previously missed questions and confirm you can explain why each wrong option is wrong, not merely why the right one is right.
Synthesize a two-page cross-domain summary linking governance decisions to strategy, architecture choices, and incident response, since scenario questions often span domains.
Run two full-length timed simulations under exam conditions and analyze pacing, flagging any question type that consistently costs you time.
Consolidate your weak-area list into a final 48-hour review sheet limited to items you still cannot explain from memory.
Your checkpoint
Two full-length timed simulation scores with a final one-page weak-area review sheet and a documented pacing strategy.
Milestones
Week 2: You can explain, without notes, how a regulatory obligation becomes an auditable control, and your risk register shows defensible treatment decisions rather than labels.
Week 4: You can deliver a board-level security strategy pitch in under two minutes and your mixed practice accuracy on domains 1 and 2 is at or above 70 percent.
Week 6: You can state the CISO's decision rights at each incident response phase and explain RTO versus RPO without hesitation; domains 3 and 4 practice accuracy is at or above 70 percent.
Week 8: Both full-length simulations are complete, every missed question has a written root-cause note, and your final review sheet contains only items still unresolved.