CISM - Certified Information Security Manager Training Course

Domain 1—Information Security Governance (24%)

Develop and sustain an information security governance framework and associated processes to ensure that the security strategy aligns with organizational goals, information risk is appropriately managed, and program resources are utilized responsibly.

• 1.1 Formulate and maintain an information security strategy that aligns with organizational objectives to guide the creation and ongoing management of the security program.
• 1.2 Implement and maintain a governance framework that directs activities supporting the security strategy.
• 1.3 Integrate information security governance into corporate governance to ensure that the security program supports broader organizational goals.
• 1.4 Establish and maintain information security policies that communicate management directives and guide the development of standards, procedures, and guidelines.
• 1.5 Develop business cases to justify investments in information security.
• 1.6 Identify internal and external factors (such as technology, business environment, risk tolerance, geography, and legal requirements) to ensure they are addressed within the security strategy.
• 1.7 Secure senior management commitment and stakeholder support to maximize the likelihood of successfully implementing the security strategy.
• 1.8 Define and communicate the roles and responsibilities of information security across the organization to establish clear accountability and authority lines.
• 1.9 Establish, monitor, evaluate, and report metrics (such as KGIs, KPIs, and KRIs) to provide management with accurate insights into the effectiveness of the security strategy.

Domain 2—Information Risk Management and Compliance (33%)

Manage information risk to an acceptable level to satisfy the organization’s business and compliance requirements.

• 2.1 Establish and maintain processes for identifying and classifying information assets to ensure protective measures are proportional to their business value.
• 2.2 Identify legal, regulatory, organizational, and other applicable requirements to keep noncompliance risks at acceptable levels.
• 2.3 Ensure periodic and consistent risk assessments, vulnerability assessments, and threat analyses to identify risks to organizational information.
• 2.4 Determine and implement appropriate risk treatment options to manage risk to acceptable levels.
• 2.5 Evaluate information security controls to verify they are appropriate and effectively mitigate risk.
• 2.6 Integrate information risk management into business and IT processes (such as development, procurement, project management, and M&A) to promote a consistent risk management approach across the organization.
• 2.7 Monitor existing risks to identify and manage changes appropriately.
• 2.8 Report noncompliance and other risk changes to relevant management to support risk management decision-making.

Domain 3—Information Security Program Development and Management (25%)

Establish and manage the information security program in alignment with the overall security strategy.

• 3.1 Maintain the information security program in alignment with the defined security strategy.
• 3.2 Ensure alignment between the security program and other business functions (such as HR, accounting, procurement, and IT) to support integration with business processes.
• 3.3 Identify, acquire, and manage internal and external resources, defining requirements necessary to execute the security program.
• 3.4 Establish and maintain information security architectures (people, process, technology) to support program execution.
• 3.5 Establish, communicate, and maintain organizational standards, procedures, guidelines, and documentation to support policy compliance.
• 3.6 Establish and maintain a program for security awareness and training to foster a secure environment and positive security culture.
• 3.7 Integrate security requirements into organizational processes (such as change control, M&A, development, BCP, and DR) to maintain the security baseline.
• 3.8 Incorporate security requirements into third-party contracts and activities (such as joint ventures, outsourcing, partnerships, and customer interactions) to maintain the security baseline.
• 3.9 Establish, monitor, and report program management and operational metrics to evaluate the program’s effectiveness and efficiency.

Domain 4—Information Security Incident Management (18%)

Plan, establish, and manage the capability to detect, investigate, respond to, and recover from information security incidents to minimize business impact.

• 4.1 Establish and maintain incident classification and categorization processes to enable accurate identification and response.
• 4.2 Establish, maintain, and align the incident response plan with business continuity and disaster recovery plans to ensure effective and timely responses.
• 4.3 Develop and implement processes to ensure the timely identification of security incidents.
• 4.4 Establish and maintain processes for investigating and documenting incidents to determine causes and respond appropriately while adhering to legal and organizational requirements.
• 4.5 Establish and maintain incident handling processes to ensure appropriate stakeholder involvement in response management.
• 4.6 Organize, train, and equip teams to respond effectively and promptly to security incidents.
• 4.7 Periodically test and review incident management plans to ensure effective response and improve capabilities.
• 4.8 Establish and maintain communication plans and processes to manage interactions with internal and external entities.
• 4.9 Conduct post-incident reviews to determine root causes, develop corrective actions, reassess risks, evaluate response effectiveness, and implement remedial actions.
• 4.10 Establish and maintain integration among the incident response, disaster recovery, and business continuity plans.