CISM Certification Curriculum Outline

Information Security Governance: Overview

Overview/Description
Information security governance is a major part of the job role of an information security manager. The goal of information security governance is to establish and maintain a framework to provide assurance that information security strategies are aligned with the business objectives and consistent with applicable laws and regulations. This course looks at the role of information security governance in an organization, the need for senior management support for all policies and procedures that are put in place, the actual role of the information security manager, and the core principles and metrics that are used as part of this process. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Information Security Governance: Overview

Identify the tasks within the information security governance job practice area

Recognize the outcomes of information security governance

Recognize the difference between corporate governance and information security governance

Match senior management roles with their corresponding responsibilities related to information security governance

Identify the elements of the information security business model

Recognize the interconnections between the elements of the information security business model

Recognize key concepts related to information security governance

Identify the optimal reporting relationship between senior management and the information security manager

Label examples of reports about information security according to their intended recipients within an organization

Identify the goal of converging security-related functions

Identify categories of key goal indicators

Recognize key concepts related to information security management

Course Number:
sp_cism_a01_it_enus

Back to List

Information Security Governance: Strategies and Goals

Overview/Description
Many companies realize that their information security is not in the state that it should be. As an information security manager, it will be your role to guide your organization to where information-related risks are controlled and sound information security processes are being followed by each and every employee. In order to move a company from a current state, to a desired state, there are many steps that must be taken. This course examines what an information security strategy is, frameworks and models you can use to build your strategy, who the strategy participants are, and constraints that may stand in your way. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Information Security Governance: Strategies and Goals

Match the key participants in developing an information security strategy with their corresponding responsibilities

Recognize appropriate models for developing an information security strategy

Label examples of pitfalls that organizations may encounter as they develop an information security strategy

Assess the effectiveness of a given management teams efforts to develop an information security strategy

Recognize questions that an information strategy should answer

Recognize two types of objectives an information security strategy should have

Identify the key elements of a business case for an information security program

Recognize key concepts related to approaches for determining the desired state of security

Identify the aspects of security that must be assessed when determining the current state

Identify the components of a roadmap for achieving security objectives

Match constraints that must be considered when developing an information security strategy to their corresponding descriptions

Assess the efforts of a given management team to create a roadmap for its information security strategy

Course Number:
sp_cism_a02_it_enus

Back to List

Information Security Governance: Developing an Action Plan

Overview/Description
In order for information security governance to succeed, there must be an action plan put into place to lay the groundwork for success. This course examines the assets, departments, resources, and people that play a role in bringing an action plan to life. This course will also examine the components and constraints of an action plan, along with providing a sample information security strategy to bring it all together. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Information Security Governance: Developing an Action Plan

Match organizational resources with descriptions of how they are used in developing an information security strategy

Distinguish between policies, standards, procedures, and guidelines

Match employee-related resources with descriptions of how they impact development of an information security strategy

Identify risk-related resources that become part of an information security strategy

Match strategies for addressing risk to corresponding examples

Recognize key concepts related to information security strategy resources

Match the components of an information security action plan with their corresponding roles within the strategy

Identify types of metrics used to monitor progress toward achieving information security objectives

Match indicators that security objectives have been met with their corresponding descriptions

Recognize the key facts about the components of an information security strategy

Course Number:
sp_cism_a03_it_enus

Back to List

Information Risk Management: Program Framework and Risk Assessment

Overview/Description
Information risk management is a pivotal part of the role of an information security manager. This course will provide an overview of information risk management, as well as examine the elements that come into play when creating an information risk management plan and the frameworks and methodologies that are used. This course also examines risk assessment, with special attention to methods of risk identification, risk analysis, and the calculations used for risk impact analysis. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Information Risk Management: Program Framework and Risk Assessment

Identify the tasks within the information risk management job practice area

Identify the outcomes of risk management

Sequence the steps in planning a risk management program

Recognize the qualities of a good risk management plan

Match roles in risk management program development with their corresponding responsibilities

Recognize the steps of the risk management process

Distinguish between the concepts of risk management, risk analysis, and risk assessment

Recognizing activities of the risk management program planning process

Associate steps in the risk management process with specific outcomes of an effective risk management program

Label examples as either threats or vulnerabilities

Recognize examples of risk categories

Recognize the process for conducting a semiquantitative risk analysis

Match quantitative risk analysis methods with their corresponding descriptions

Match common risk assessment methodologies with corresponding descriptions

Recognize risk assessment concepts

Perform quantitative risk analysis, given a scenario

Course Number:
sp_cism_a04_it_enus

Back to List

Information Risk Management: Analysis, Mitigation, and Monitoring

Overview/Description
Analysis, mitigation, and monitoring play an extremely important role in information risk management. This course examines how to properly classify and valuate information assets, perform a business impact analysis, and the principles of disaster recovery. You will learn about the options available to deal with risk, effective controls, and ways to ensure your risk management program is integrated into your organizations other life-cycle processes. You will also examine the many responsibilities of an information security manager related to risk monitoring and reporting. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security.

Expected Duration (hours)
2.0

Lesson Objectives

Information Risk Management: Analysis, Mitigation, and Monitoring

Identify examples of information assets that should be valuated

Match valuation methods with corresponding examples

Recognize how to classify information assets

Match disaster recovery terms with their corresponding definitions

Recognize considerations related to outsourcing security services to a third-party provider

Determine information asset valuation methodologies used by a given information security manager

Perform information asset classification

Distinguish between examples of RTOs and RPOs

Match risk treatment options with corresponding examples of their use

Classify examples of controls

Identify types of controls

Recognize considerations when planning controls and countermeasures

Identify the key responsibilities of an information security manager related to risk monitoring and communication

Recognize methods of integrating risk management processes with other life-cycle processes within an organization

Determine appropriate actions to effectively manage a given risk

Course Number:
sp_cism_a05_it_enus

Back to List

Information Security Program Development: Introduction and Roadmap

Overview/Description
An information security program is the foundation of an information security managers daily work. This course examines how to prepare your security program, analyzes the outcomes and challenges, and outlines the responsibilities of executive management and the information security manager. This course also looks at the development of an information security roadmap, and the elements that need to be put in place to make the roadmap functional. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Information Security Program Development: Introduction and Roadmap

Recognize elements that are essential for a successful security program

Identify the tasks within the information security program development job practice area

Recognize organizational attributes that would inhibit the development of an effective information security program

Label responsibilities of an information security program as being those of the executive management or those of the information security manager

Recognize challenges an information security manager may face during information security program development

Determine who is responsible for carrying out given information security activities

Recognize how an information security program supports the objectives of information security governance

Identify the purpose of an information security review

Assess a given security review

Sequence excerpts from a security review

Identify the elements of an information security roadmap

Recognize strategies for ensuring an information security program supports strategic objectives

Create a roadmap for an information security program

Course Number:
sp_cism_a06_it_enus

Back to List

Information Security Program Development: Resources

Overview/Description
As an information security manager, one of your primary responsibilities will be to manage and leverage company and external resources needed to make your projects succeed. This course examines information security infrastructures and architectures and the industry models that can be used as a basis for them. This course also examines controls and countermeasures that can be used to detect, prevent, and protect company resources. It examines the roles of individuals in an information security program, and looks at how documentation is kept at all levels while creating the information security program. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam, or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Information Security Program Development: Resources

Recognize the definition of information security architecture

Recognize key concepts of the SABSA Model for security architecture development

Recognize how to use personnel-related resources during information security program development and implementation

Recognize examples of activities that build a security culture

Recognize the results of commonly used risk analysis methods

Recognize the key concepts related to information security architecture

Recognize the methods for managing human resources during the development and implementation of an information security program

Distinguish between various risk analysis methods

Recognize principles of effective security control

Match types of information security controls with corresponding examples

Match technologies with their corresponding definitions

Recognize audit and enforcement activities given a scenario

Recognize security controls and control principles

Recognize the role that a given technology plays in ensuring an information security program is effective

Recognize the role that policies, audits, and compliance enforcement play in ensuring an information security program is effective

Course Number:
sp_cism_a07_it_enus

Back to List

Information Security Program Development: Metrics and Implementation

Overview/Description
The implementation of an information security program can be time consuming but, if done properly, it will ensure that your company is able to meet its security objectives. This course examines the elements necessary for implementing and measuring the success of an information security program, assuming you have created a sound strategy and the resources necessary for program implementation are in place. This course looks at policy and standards compliance, training and education, controls, life cycle integration, monitoring and communication, and the documentation that should be done at all stages of program implementation and monitoring. This course also examines what metrics are, how they should be used, and the types of metrics that play a role in monitoring an information security program. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Information Security Program Development: Metrics and Implementation

Categorize examples of information security metrics

Determine whether a given metric would be effective

Identify methods for measuring the achievement of information security governance outcomes

Assess the effectiveness of metrics used for an information security program

Recognize the responsibilities of an information security manager during program implementation

Recognize the key activities of the PDCA methodology

Recognize the responsibilities of an information security manager with regards to implementing an information security program

Identify COBIT control objectives

Recognize the elements of the Plan-Do-Check-Act cycle

Course Number:
sp_cism_a08_it_enus

Back to List

Information Security Program Management: Introduction and Framework

Overview/Description
As an information security manager, it is your job to make sure that the program for information security management that is put in place is effective, cost-efficient, and most importantly, that it meets the business needs of the organization. This course examines what information security management is, how it is used, and the common challenges that an information security manager faces while trying to establish the program. This course also examines the roles and responsibilities of the individuals in the organization regarding the program, with special attention to the role of upper management and the commitment they must have towards the plan. Finally this course looks at components of the information security framework and metrics used to measure the effectiveness of the program. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam, or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security.

Expected Duration (hours)
2.0

Lesson Objectives

Information Security Program Management: Introduction and Framework

Identify the types of activities that are involved in managing information security

Identify the tasks within the information security program management job practice area

Match security management outcomes with corresponding descriptions of how to achieve each outcome

Identify common challenges to information security management

Match information security management roles to their corresponding responsibilities

Recognize examples of information security management activities

Recognize strategies for overcoming challenges related to information security management

Determine the responsibilities of personnel given a specific information security outcome

Match components of the information security management framework with corresponding examples

Recognize examples of metrics used to measure performance of an information security program

Recognize key concepts related to information security components and performance

Course Number:
sp_cism_a09_it_enus

Back to List

Information Security Program Management: Resources and Implementation

Overview/Description
Once there is an information security program framework in place, the next step for an information security manager is to catalog the resources on hand, and to assemble the resources that are still required in order to implement the information security program. This course examines the policies, controls, and metrics used to make the program function efficiently, and the analyses that will be used to monitor the program on an ongoing basis. This course also examines the technologies, skills, and outside support that the information security program will use. This course will show you how to evaluate the current state of the program and actions to take to properly manage information security. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam, or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security.

Expected Duration (hours)
2.5

Lesson Objectives

Information Security Program Management: Resources and Implementation

Identify information security management tasks with regard to policies, standards, and procedures

Identify key points regarding controls and countermeasures that are important during information security program implementation

Identify key points regarding audits that an information security manager should remember during program implementation

Recognize the results of commonly used risk analysis methods

Recognize how technologies and human resources are used to manage information security

Recognize key points about governing documentation, controls, and audits

Recognize key points about risk analysis resources used in information security management

Recognize key points about technologies and human resources

Identify key points regarding the evaluation of an information security program

Recognize actions that an information security manager should take when implementing an established program

Recognize responsibilities of an information security manager during program implementation

Recognize key points about evaluating an information security program

Recognize key points related to information security management

Recognize key points related to the responsibilities of an information security manager

Course Number:
sp_cism_a10_it_enus

Back to List

Incident Management and Response: Introduction and Resources

Overview/Description
Managing incidents, and the response that is put forward by an organization falls directly under the duties of a CISM. Organizations must have a plan in place, and must know the steps they will take to deal with incidents when they occur. This course examines what incident management is, how responses are prepared, and concepts and technologies that are used when dealing with incidents. This course also looks at the principles, importance of, and outcomes of incident management and how the information security manager, with the approval of senior management, prepares the people and the resources of the organization to deal with incidents when they occur. Finally, this course explains the steps for conducting a business impact analysis as technique used in effective incident management. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam, or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security.

Expected Duration (hours)
2.5

Lesson Objectives

Incident Management and Response: Introduction and Resources

Identify the tasks within the incident management and response job practice area

Recognize incident management planning considerations

Order the steps in the incident management process

Recognize the elements of an incident management plan

Match causes of challenges in developing an incident management plan with corresponding solutions

Recognize key points related to incident management planning

Matching key incident management roles and their corresponding responsibilities

Identify the roles that make up an incident response team

Recognize examples of personal skills required by members of an incident response team

Recognize examples of technical knowledge required by members of an incident response team

Recognize the activities that are performed during a business impact analysis

Conduct a business impact analysis using incident management resources

Course Number:
sp_cism_a11_it_enus

Back to List

Incident Management and Response: Planning and Testing

Overview/Description
Preparing incident response and recovery plans is a very important part of a CISMs role. This course examines how to identify the current state of incident response capability, identifies the elements of incident response and recovery plans, and discusses principles for effectively managing the plans. This course also examines the importance of testing, documentation, and how to physically prepare recovery sites and related offsite resources. This course prepares you for the Certified Information Security Manager (CISM) exam.

Target Audience
Experienced IT security professionals seeking to pass the Certified Information Security Manager (CISM) exam, or otherwise gain knowledge in managing, designing, and overseeing an enterprises information security

Expected Duration (hours)
2.0

Lesson Objectives

Incident Management and Response: Planning and Testing

Determine the appropriate method for identifying the current state of response capability for a given company

Identify the factors that determine incident response capability

Match phases of an incident response plan with their corresponding descriptions

Match members of response and recovery teams with their corresponding responsibilities

Recognize examples of individuals who may require notification in case of a serious security incident

Recognize the types of insurance coverage that an organization may have

Label descriptions of different types of recovery sites

Determine the appropriate type of recovery site given examples of requirements

Recognize methods for recovering communication and computing systems

Distinguish between the characteristics of an incident response plan and a recovery plan

Recognize the method being used to test incident response and recovery plans

Recognize examples of metrics used for testing incident response and recovery plans

Identify important aspects of executing incident response and recovery plans

Recognize key concepts related to testing and incident management

Course Number:
sp_cism_a12_it_enus

Back to List