CISM Certified Information Security Manager - United States

Certified Information Security Manager (CISM) Training Course Outline

Domain 1: Information Security Governance

Module 1: Introduction to Information Security Governance

• About Information Security Governance
• Reason for Security Governance
• Security Governance Activities and Results
• Risk Appetite
• Organization Culture

Module 2: Legal, Regulatory and Contractual Requirements

• Introduction
• Requirements for Content and Retention of Business Records

Module 3: Organizational Structures, Roles and Responsibilities

• Roles and Responsibilities
• Monitoring Responsibilities
• Module 4: Information Security Strategy Development
• Introduction
• Business Goals and Objectives
• Information Security Strategy Objectives
• Ensuring Objective and Business Integration
• Avoiding Common Pitfalls and Bias
• Desired State
• Elements of a Strategy

Module 5: Information Governance Frameworks and Standards

• Security Balanced Scorecard
• Architectural Approaches
• Enterprise Risk Management Framework
• Information Security Management Frameworks and Models

Module 6: Strategic Planning

• Workforce Composition and Skills
• Assurance Provisions
• Risk Assessment and Management
• Action Plan to Implement Strategy
• Information Security Program Objectives

Domain 2: Information Security Risk Management

Module 7: Emerging Risk and Threat Landscape

• Risk Identification
• Threats
• Defining a Risk Management Framework
• Emerging Threats
• Risk, Likelihood and Impact
• Risk Register

Module 8: Vulnerability and Control Deficiency Analysis

• Introduction
• Security Control Baselines
• Events Affecting Security Baselines

Module 9: Risk Assessment and Analysis

• Introduction
• Determining the Risk Management Context
• Operational Risk Management
• Risk Management Integration with IT Life Cycle Management Processes
• Risk Scenarios
• Risk Assessment Process
• Risk Assessment and Analysis Methodologies
• Other Risk Assessment Approaches
• Risk Analysis
• Risk Evaluation
• Risk Ranking

Module 10: Risk Treatment or Risk Response Options

• Risk Treatment/Risk Response Options
• Determining Risk Capacity and Acceptable Risk
• (Risk Appetite)
• Risk Response Options
• Risk Acceptance Framework
• Inherent and Residual Risk
• Impact
• Controls
• Legal and Regulatory Requirements
• Costs and Benefits

Module 11: Risk and Control Ownership

• Risk Ownership and Accountability
• Risk Owner
• Control Owner

Module 12: Risk Monitoring and Reporting

• Risk Monitoring
• Key Risk Indicators
• Reporting Changes in Risk
• Risk Communication, Awareness and Consulting
• Documentation

Domain 3: Information Security Program Development and Management

Module 13: Information Security Program Resources

• Introduction
• Information Security Program Objectives
• Information Security Program Concepts
• Common Information Security Program Challenges
• Common Information Security Program Constraints

Module 14: Information Asset Identification and Classification

• Information Asset Identification and Valuation
• Information Asset Valuation Strategies
• Information Asset Classification
• Methods to Determine Criticality of Assets and Impact of Adverse Events

Module 15: Industry Standards and Frameworks for Information Security

• Enterprise Information Security Architectures
• Information Security Management Frameworks
• Information Security Frameworks Components

Module 16: Information Security Policies, Procedures, and Guidelines

• Policies
• Standards
• Procedures
• Guidelines

Module 17: Information Security Program Metrics

• Introduction
• Effective Security Metrics
• Security Program Metrics and Monitoring
• Metrics Tailored to Enterprise Needs

Module 18: Information Security Control Design and Selection

• Introduction
• Managing Risk Through Controls
• Controls and Countermeasures
• Control Categories
• Control Design Considerations
• Control Methods

Module 19: Security Program Management

• Risk Management
• Risk Management Program
• Risk Treatment
• Audit and Reviews
• Third-Party Risk Management

Module 20: Security Program Operations

• Event Monitoring
• Vulnerability Management
• Security Engineering and Development
• Network Protection
• Endpoint Protection and Management
• Identity and Access Management
• Security Incident Management
• Security Awareness Training
• Managed Security Service Providers
• Data Security
• Cryptography
• Symmetric Key Algorithms

Module 21: IT Service Management

• Service Desk
• Incident Management
• Problem Management
• Change Management
• Configuration Management
• Release Management
• Service Levels Management
• Financial Management
• Capacity Management
• Service Continuity Management
• Availability Management
• Asset Management

Module 22: Controls

• Internal Control Objectives
• Information Systems Control Objectives
• General Computing Controls
• Control Frameworks
• Controls Development
• Control Assessment

Module 23: Metrics and Monitoring

• Types of Metrics
• Audiences
• Continuous Improvement

Domain 4: Information Security Incident Management

Module 24: Security Incident Response Overview

• Phases of Incident Response

Module 25: Incident Response Plan Development

• Objectives
• Maturity
• Resources
• Roles and Responsibilities
• Gap Analysis
• Plan Development

Module 26: Responding to Security Incidents

• Detection
• Initiation
• Evaluation
• Recovery
• Remediation
• Closure
• Post-Incident Review

Module 27: Business Continuity and Disaster Recovery Planning

• Business Continuity Planning
• Disaster
• Disaster Recovery Planning
• Testing BC and DR Planning