CISM Certified Information Security Manager

• Apply risk assessment strategies to reduce the impact of information security risk.
• Assess the types of threats faced by the enterprise.
• Explain how security control baselines affect vulnerability and control deficiency analysis.
• Differentiate between the application of risk treatment types from an information security perspective.
• Describe the influence of risk and control ownership on the information security program.
• Outline the process of monitoring and reporting information security risk.

 Topics:

• Emerging Risk and Threat Landscape
• Vulnerability and Control Deficiency Analysis
• Risk Assessment and Analysis
• Risk Treatment/Risk Response Options
• Risk and Control Ownership
• Risk Monitoring and Reporting

• Describe the goals and objectives of an information security architecture.
• Outline the components and resources used to build an information security program.
• Distinguish between common information security standards and frameworks available for building an information security program.
• Explain how to align information security policies, procedures, and guidelines with the needs of the enterprise.
• Describe the process of defining an information security program road map.
• Outline key information security program metrics used to track and report progress to senior management.
• Explain how to manage the information security program using controls.
• Create a strategy to enhance awareness and knowledge of the information security program.
• Describe the process of integrating the security program with IT operations and third-party providers.
• Communicate key security program information to relevant stakeholders.

 Topics:

• Information Security Architecture
• Information Security Program Resources
• Information Security Industry Standards and Frameworks
• Information Security Policies, Standards, Procedures, and Guidelines
• Information Asset Identification and Classification
• Information Security Control Design and Selection
• Information Security Program Metrics Development
• Information Security Control Implementation and Integrations
• Information Security Control Testing and Evaluation
• Information Security Awareness and Training
• Management of External Services
• Information Security Program Metrics, Communications, and Reporting

• Distinguish between incident management and incident response.
• Outline the requirements and procedures necessary to develop an incident response plan.
• Explain the relationship between business impact, continuity, and incident response.
• Describe the processes and outcomes related to disaster recovery.
• Explain the impact of metrics and testing when evaluating the incident response plan.
• Identify techniques used to classify or categorize incidents.
• Outline the types of roles and responsibilities required for an effective incident management and response team.
• Distinguish between the types of incident management tools and technologies available to an enterprise.
• Describe the processes and methods used to investigate, evaluate, and contain an incident.
• Identify the types of communications and notifications used to inform key stakeholders of incidents and tests.
• Outline the processes and procedures used to eradicate and recover from incidents.

 Topics:

• Incident Response Plan
• Business Impact Analysis (BIA)
• Business Continuity Plan (BCP)
• Disaster Recovery Plan (DRP)
• Incident Classification/Categorization
• Incident Management Training, Testing, and Evaluation
• Incident Management Tools and Techniques
• Incident Investigation and Evaluation
• Incident Containment Methods
• Incident Response Communications
• Incident Eradication and Recovery
• Post-incident Review Practices