CISM – Certified Information Security Manager Training kit

Course Overview

Learners will have access to the course for one year from date of purchase and will earn 20 CPE upon completion. This course has a seat time of approximately 16 hours and is accessed via the Learning Access tab of your My ISACA dashboard.

Learning Objectives:

At the completion of this course you will be able to:

• Explain the relationship between executive leadership, enterprise governance and information security governance.
• Outline the components used to build an information security strategy.
• Explain how the risk assessment process influences the information security strategy.
• Articulate the process and requirements used to develop an effective information risk response strategy.
• Describe the components of an effective information security program.
• Explain the process to build and maintain an enterprise information security program.
• Outline techniques used to assess the enterprise’s ability and readiness to manage an information security incident.
• Outline methods to measure and improve response and recovery capabilities.

Ideal For:

• Professionals preparing to become CISM certified
• CISA or CISSP-certified individuals looking to move into information security management
• General security management professionals looking to move into information security
• Information security managers
• Mid-level career change

Course Outline

Introduction

• Welcome video

Domain 1 – Information Security Governance 

• Describe the role of governance in creating value for the enterprise.
• Explain the importance of information security governance in the context of overall enterprise governance.
• Describe the influence of enterprise leadership, structure and culture on the effectiveness of an information security strategy.
• Identify the relevant legal, regulatory and contractual requirements that impact the enterprise.
• Describe the effects of the information security strategy on enterprise risk management.
• Evaluate the common frameworks and standards used to govern an information security strategy.
• Explain why metrics are critical in developing and evaluating the information security strategy.

Domain 2 – Information Security Risk Management

• Apply risk assessment strategies to reduce the impact of information security risk.
• Assess the types of threats faced by the enterprise.
• Explain how security control baselines affect vulnerability and control deficiency analysis.
• Differentiate between application of risk treatment types from an information security perspective.
• Describe the influence of risk and control ownership on the information security program.
• Outline the process of monitoring and reporting information security risk.

Domain 3 – Information Security Program 

• Outline the components and resources used to build an information security program.
• Distinguish between common IS standards and frameworks available to build an information security program.
• Explain how to align IS policies, procedures and guidelines with the needs of the enterprise.
• Describe the process of defining an IS program road map.
• Outline key IS program metrics used to track and report progress to senior management.
• Explain how to manage the IS program using controls.
• Create a strategy to enhance awareness and knowledge of the information security program.
• Describe the process of integrating the security program with IT operations and third-party providers.
• Communicate key IS program information to relevant stakeholders.

Domain 4 – Incident Management

Prerequisites for the course: