ISACA Certified Information Security Manager

A program runs on policy and on money. You structure policies, standards and procedures, assign roles, choose frameworks to build on and argue for budget in terms leaders recognize.

• Policy, standard and procedure hierarchy
• Roles, responsibilities and reporting lines
• Choosing and adapting control frameworks
• Legal, regulatory and contractual drivers
• Business cases and budget justification
• Communicating security to executives

You build A policy hierarchy and a business case for one major security investment.

Protection should match value. You identify and classify information assets, analyze the business impact of losing them and set the criticality that drives risk and recovery decisions.

• Identifying information assets and owners
• Classification schemes
• Business impact analysis
• Criticality and dependency mapping
• Recovery objectives
• Linking classification to controls

You build An asset classification scheme and business impact analysis for one business function.

Risk assessment turns uncertainty into priorities. You identify threats and vulnerabilities, estimate likelihood and impact by qualitative and quantitative methods, and record risks in a register leaders can use.

• Threat and vulnerability identification
• Qualitative and quantitative analysis
• Risk scenarios and their documentation
• Risk assessment standards and methods
• Inherent and residual risk
• Maintaining a risk register

You build A risk assessment for one system, with scenarios, ratings and a populated register.

Each risk needs a decision and an owner. You choose among treatments, work within the enterprise’s appetite, assess third-party risk and monitor risk through indicators that trigger action.

• Mitigate, transfer, avoid and accept
• Risk appetite and tolerance in practice
• Risk ownership and acceptance authority
• Third-party and supply chain risk
• Key risk indicators and monitoring
• Reporting risk to management

You build A treatment plan for six risks, each with an owner, a decision and an indicator.

Architecture decides what the program can protect. You apply established architecture approaches, layered defense, zero trust and secure design principles, and fit security into enterprise and cloud architecture.

• Security architecture frameworks
• Defense in depth and zero trust
• Secure design principles
• Cloud and hybrid security architecture
• Integrating security into enterprise architecture
• Reviewing designs for security

You build A security architecture review checklist, applied to a sample system design.

A program needs scope, structure and a plan. You define its scope, resource it, sequence projects, integrate it with business functions and development practice and track progress against a plan.

• Program scope and objectives
• Resources, skills and sourcing
• Project roadmaps and sequencing
• Integration with business and development processes
• Security in change and procurement
• Tracking program progress

You build A security program plan with scope, resources, roadmap and integration points.

Controls only matter if they work. You choose controls by risk and type, implement them with the people who run systems, and test them through assessments, vulnerability management and penetration testing.

• Control types and selection criteria
• Implementation with operations teams
• Vulnerability management programs
• Penetration testing and its governance
• Configuration and change management links
• Control testing and assurance

You build A control selection and testing plan for three risks, with success criteria.

People and suppliers can undo technical controls. You design awareness that changes behavior, set requirements for third parties, and manage the security aspects of contracts and outsourcing.

• Awareness programs that change behavior
• Role-based training
• Third-party security requirements
• Contract clauses and right to audit
• Outsourcing and cloud arrangements
• Measuring awareness and supplier compliance

You build An awareness program plan and a security schedule for a supplier contract.

Managers must show that the program works. You choose measures that matter, report to executives and boards, assess maturity and use audits and reviews to drive improvement.

• Designing security metrics
• Operational, management and strategic reporting
• Maturity assessment
• Working with audit and assurance
• Program reviews and continuous improvement
• Avoiding vanity metrics

You build A metrics set and a board-level security report for one quarter.

The first hour of an incident is decided long before it. You build an incident management capability: plans, teams, classification, playbooks, tools and relationships with legal, communications and law enforcement.

• Incident management policy and plan
• Teams, roles and on-call arrangements
• Classification and severity
• Playbooks for common incidents
• Tools and logging that support response
• Exercises and training

You build An incident management plan with classification, roles and two playbooks.

Once something happens, decisions come fast. You triage and contain, preserve evidence, investigate causes, and communicate with executives, staff and external parties.

• Detection and triage
• Containment and eradication decisions
• Digital forensics and evidence preservation
• Root cause investigation
• Communication during an incident
• Legal, regulatory and notification duties

You build A response log and decision record for a simulated data breach.

Recovery returns the business to normal and teaches it something. You connect incident response to continuity and disaster recovery, restore services safely and run reviews that change the program.

• Recovery strategies and priorities
• Continuity and disaster recovery links
• Restoring services safely
• Post-incident review
• Lessons into policy, controls and training
• Testing recovery and continuity plans

You build A post-incident review with root cause, lessons and program changes.

One scenario spans the whole domain. You assess an organization’s security governance, risk, program and incident capability, set priorities and present a plan to its executive team.

• Assessing governance and strategy fit
• Reviewing risk, architecture and program
• Testing incident readiness
• Setting priorities and a roadmap
• Presenting to executives

You build A program assessment and improvement roadmap for a named organization.