CISM quick review

Memory hook: Protect people; understand the business; assign the risk owner.

Must remember

For management scenarios, establish the business objective, scope, authority and acceptable risk before selecting a product. That does not mean delaying urgent safety or containment actions while conducting a lengthy committee review. Read whether the question asks for the first action, strongest control or long-term program improvement.

Professional ethics prioritize the public interest and trust, lawful and honest conduct, competent service to principals and the profession's development. Conflicting instructions require escalation through appropriate authority; employment does not justify unlawful conduct. Due care is reasonable protective action; due diligence is the continuing investigation and verification supporting that care.

Business owners accept residual risk; security specialists analyze and advise. Governance sets direction and accountability; management implements it. Frameworks serve different purposes: NIST CSF organizes outcomes, ISO 27001 specifies an information-security management system, COBIT addresses enterprise governance of information/technology, and SABSA connects security architecture to business attributes. PCI DSS addresses its defined payment-data environment; FedRAMP concerns assessment/authorization of relevant US federal cloud offerings. Choose by scope and need rather than assuming one framework replaces law.

Personnel controls span lawful screening, agreements, onboarding, transfer, monitoring and termination. Separation of duties reduces single-person abuse; job rotation and mandatory absence can expose concealed activity. Contractors, acquisitions and divestitures require the same deliberate review of inherited identities, data and obligations.

Threat modeling starts with assets, data flows and trust boundaries. STRIDE helps examine spoofing, tampering, repudiation, disclosure, denial of service and privilege escalation; attack trees break a goal into paths. Models guide controls and abuse tests, then evolve with the system.

AI adoption adds data provenance, privacy, output verification and delegated-action risks. Decide who owns model/use-case risk and how outcomes will be monitored, rather than treating a vendor promise as assurance.

Choose under exam pressure

Traps

• “Think like a manager” does not mean ignore immediate human safety.
• Compliance certification does not transfer the organization’s accountability.

Practise this topic

Memory hook: Business owns risk; controls reduce it; evidence checks it.

Must remember

Policy states management intent; standards set mandatory requirements; procedures describe steps; guidelines advise. Assign data/system owners and accountable decision makers. Security should enable business objectives within legal and risk constraints.

Threats can exploit vulnerabilities and cause impact. Inherent risk exists before controls; residual risk remains afterward. Appetite is the broad willingness to take risk; tolerance defines acceptable variation/bounds. Treat risk by avoiding, mitigating, transferring/sharing or formally accepting it. Insurance transfers some financial consequences, not accountability or every impact.

Quantitative example: an asset worth $100,000 with 20% expected loss per event has SLE = $20,000. At 0.5 events/year, ALE = $10,000/year. Estimates are uncertain; qualitative matrices express relative likelihood/impact without pretending to precise currency.

Change control records purpose, impact, dependencies, approvals, testing, maintenance window, rollback and validation. Emergency changes still need defined authority and retrospective documentation. Version control supports traceability; it does not approve a change by itself.

Supplier assessment covers security evidence, subcontractors, data location, access, continuity, breach notification and exit/deletion terms. SLAs define service commitments; NDAs protect shared confidential information; rules of engagement constrain testing. Review suppliers throughout the relationship.

Audits compare evidence against criteria; assessments evaluate controls; attestation is a formal assertion/report; penetration tests validate selected attack paths. Compliance is a baseline tied to scope, not proof of complete security. Awareness programs need role-specific training, usable reporting channels and measured outcomes, not only annual attendance.

Choose under exam pressure

Traps

• A technical administrator does not unilaterally accept business risk.
• A supplier certification applies to its stated scope and period.

Practise this topic

Memory hook: Test the requirement; report the business consequence.

Must remember

Define scope, criteria, independence, authorization, frequency and reporting before an assessment. Internal reviews provide organizational context; external independent reviews provide another assurance perspective. Sampling reduces effort but limits what conclusions can be drawn.

Testing methods answer different questions. Code review and SAST inspect implementation; DAST exercises a running system; IAST combines runtime observation with instrumentation; composition analysis examines dependencies. Fuzzing explores unexpected inputs. Synthetic transactions test a known business path; misuse cases test forbidden behavior. Coverage metrics reveal what was exercised, not proof that untested behavior is safe.

A red team pursues objectives within authorization; a blue team defends; purple-team collaboration improves detection and response from shared learning. Penetration tests are scoped snapshots and can miss vulnerabilities. Breach simulations validate selected paths without representing every possible adversary.

Gather technical and administrative evidence: access reviews, change approvals, backups/restores, detection performance, training outcomes and continuity exercises. A control can be well designed yet poorly operated; test both. Distinguish key performance indicators (how a process performs) from key risk indicators (signals of increasing exposure).

Findings should state condition, criteria, cause, impact, evidence and recommended treatment. Confirm false positives, prioritize by risk, assign owners and due dates, then retest. Track accepted exceptions and their expiry. Ethical disclosure follows legal authorization and coordinated reporting, not public release of exploitable details without considering affected parties.

Audit reports differ in intended audience, scope and time period. Read exclusions and customer responsibilities before relying on a supplier report. A polished report is only as useful as its criteria, evidence and follow-through.

Choose under exam pressure

Traps

• High code coverage does not prove secure behavior.
• An external audit is not a guarantee that every system is secure.

Practise this topic

Memory hook: Contain harm while preserving what explains it.

Must remember

Preparation establishes contacts, authority, playbooks, logging, tools and exercises. Detection and analysis distinguish an event from an incident and establish scope. Containment limits damage; eradication removes the cause/persistence; recovery restores trustworthy service; lessons learned improve the system. These activities can overlap and repeat.

Use the scenario's authority and safety requirements. Isolate a compromised endpoint when appropriate, but do not automatically power it off: volatile evidence may matter. Human safety and urgent containment can outweigh evidence collection when the situation requires it. Engage legal, privacy and communications owners for reporting obligations and external statements.

Chain of custody records who collected, handled, transferred and stored evidence. Integrity hashes help demonstrate that a copy has not changed; they do not independently establish who collected it or whether collection was lawful. Preserve originals and work on validated copies where practical.

Volatile sources include running processes, memory and active network connections; disks and archived logs are generally less volatile. Collection order depends on the system and investigative purpose. Record synchronized timestamps, time zones, commands and methods. A legal hold suspends normal deletion for relevant material.

Threat hunting starts with a hypothesis and seeks evidence beyond existing alerts. Root-cause analysis asks why the incident was possible, not only which host was infected. Tabletop exercises test decisions and communication; simulations and technical exercises test execution.

Backups used for recovery must be known good, accessible and protected from the same compromise. Rebuilding without revoking stolen credentials or closing the original entry point invites recurrence.

Choose under exam pressure

Traps

• Reimaging first can destroy the explanation of a broader breach.
• An incident is not closed merely because alerts stop.

Practise this topic

Memory hook: Know the owner, keep only what you need, test restoration.

Must remember

Classify data by business impact and obligations, then label and protect it consistently. Owners decide use/classification; custodians implement handling. Controllers determine processing purposes while processors act under applicable instructions; exact legal duties depend on jurisdiction and contract.

The lifecycle runs through collection/creation, use, sharing, storage, retention and disposal. Minimize collection, restrict purpose and access, discover misplaced sensitive data and track copies. Data residency describes where data is stored; sovereignty/jurisdiction concerns which laws may apply. Encryption does not automatically resolve every cross-border obligation.

Choose disposal by medium and sensitivity: clear, purge or physically destroy using an approved sanitization method. A quick format or ordinary file deletion may leave recoverable data. Track disposal and verify sanitization; retain evidence when required. Legal holds can override routine deletion.

RPO measures tolerable lost data in time; RTO measures target restoration time. A business impact analysis prioritizes services and dependencies. High availability handles component failures; backups recover prior data; disaster recovery restores technology; business continuity sustains critical business operations.

Full backups simplify restoration but copy more data. Incremental backups copy changes since the preceding backup and may require a chain; differential backups copy changes since the full backup. Offline/isolated or suitably immutable copies resist attacks on live systems. Replication can also replicate corruption and deletion.

Hot, warm and cold recovery sites trade readiness for cost. Test restoration, application consistency, key availability, access, DNS and dependent services. Redundant power, UPS/generators, geographic diversity and people/process continuity address different failure modes.

Choose under exam pressure

Traps

• Replication is not a substitute for independent recovery history.
• A backup without usable decryption keys may be worthless.

Practise this topic

Memory hook: Business sets the destination; security manages the risk on the route.

Must remember

Start with business objectives, obligations, critical processes and risk appetite. A security strategy defines desired outcomes and direction; a program turns that direction into initiatives, resources and operating processes. Buying a tool before understanding the risk can consume budget without reducing important exposure.

The governing body oversees direction and risk appetite; executives sponsor and fund; business owners own relevant business risks; security advises, coordinates and reports. Control owners operate controls. Formal risk acceptance belongs to authorized management, with documented rationale, scope and review date. A security manager should not silently accept a business exposure outside delegated authority.

Use asset ownership and classification to prioritize protection. Evaluate inherent risk before controls and residual risk after them, acknowledging uncertainty and control effectiveness. Reassess for new suppliers, business processes, threats and technology. A vulnerability score alone does not reveal business impact or decide investment priority.

Build a business case using expected risk reduction, compliance need, options, lifecycle cost and measurable outcomes. Enterprise architecture connects business capabilities, information, applications and technology; security architecture embeds trust boundaries and control patterns into that design. Trace a control to a requirement and a testable outcome. Policy states intent, standards specify required rules, procedures describe execution and guidelines recommend approaches.

Report in the audience’s terms: service disruption exposure, sensitive-data risk, risk acceptance and progress toward target capability. Avoid promising zero risk. Governance is effective when decisions and accountability work in practice, not merely when a committee exists.

Choose under exam pressure

Traps

• Security supports business objectives; the most restrictive control is not always the best fit.
• A risk owner and a control operator are not necessarily the same person.

Practise this topic

Memory hook: Fund the capability, assign an owner, test the result.

Must remember

Build a roadmap from current-state gaps to target outcomes, with dependencies, staffing, budget and milestones. Integrate security into procurement, development, HR and operations instead of relying on a separate review at the end. Asset inventory and classification identify what needs protection and who can decide its handling.

Select preventive, detective and corrective controls with operational feasibility in mind. Test design effectiveness and operating effectiveness separately: a well-written access-review procedure may never be followed. Retain evidence, address exceptions and verify remediation. Compensating controls require demonstrable coverage of the original risk, not just convenient substitution.

Awareness programs address broad behavior; role-specific training prepares people such as developers, administrators and responders. Measure demonstrated behavior and exposure reduction alongside completion. A high training-attendance rate can coexist with unsafe credential handling.

Supplier due diligence examines criticality, data access, security practices, continuity, subcontractors and exit options. Contracts define responsibilities, incident notification, audit rights, service levels and secure data return/deletion. Review assurance-report scope, period and exceptions, including customer responsibilities. Ongoing monitoring is necessary because a supplier’s condition can change after onboarding.

KPIs track performance, KRIs signal changing exposure, and control indicators show whether safeguards operate. Choose measures with thresholds, owners, trend context and a decision they support. Report unresolved exceptions and accepted risks honestly. A lower incident count could reflect weaker detection rather than improved security.

Choose under exam pressure

Traps

• Certification badges do not eliminate supplier risk.
• A metric without an action threshold may become decorative reporting.

Practise this topic

Memory hook: Prepare authority before the crisis; recover the business, not just servers.

Must remember

Define incident categories, severity criteria, decision rights and escalation paths before an incident. Train a cross-functional team including security, IT, business owners, legal/privacy and communications as appropriate. Tabletop exercises test coordination; technical exercises test execution. Neither alone proves the whole response works.

A business impact analysis identifies critical activities, dependencies and disruption effects. RTO targets recovery duration; RPO targets tolerable data loss. Business continuity keeps essential operations functioning; disaster recovery restores supporting technology. An incident-response plan coordinates security handling and must align with both.

During an event, validate evidence, classify impact and activate the appropriate response. Containment limits harm; eradication removes causes; recovery restores trusted operation. Preserve evidence and action records under the authorized process. Management decisions may balance evidence preservation with urgent safety/continuity needs; follow established authority and expert advice.

Communicate verified facts to the right audience. Notification obligations depend on circumstances and applicable rules; involve the responsible specialists rather than inventing a universal reporting deadline. Protect sensitive investigative details and avoid speculative public statements.

After restoration, monitor for recurrence, confirm business acceptance and conduct a blameless but accountable review. Update controls, playbooks, training and risk assessments. Restoring a vulnerable backup without fixing the entry path can restart the same incident.

Choose under exam pressure

Traps

• Incident containment is not the same as complete recovery.
• A backup restore test does not replace a full continuity exercise.

Practise this topic