Certified Information Security Manager (CISM) Information Security Governance Syllabus

Information Security Governance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Information Security Governance in Certified Information Security Manager (CISM), not a summary of it.

1. 1

   Enterprise Governance and the Security Function

   4 topics

   • Governance Fundamentals
     • Distinguishing governance from management
     • Roles of the board, executive management, and steering committees
     • Information security governance vs. corporate governance
   • Organizational Culture and Behavior
     • Security culture and its influence on risk posture
     • Tone at the top and accountability structures
   • Organizational Structures and Reporting Lines
     • CISO reporting models and independence
     • Segregation of duties at the governance level
   • Governance Frameworks and Standards
     • COBIT and NIST Cybersecurity Framework alignment
     • ISO/IEC 27001 and 27014 governance guidance
2. 2

   Strategy, Mission, and Business Alignment

   3 topics

   • Developing an Information Security Strategy
     • Linking strategy to business goals and objectives
     • Desired vs. current state and gap analysis
   • Security Strategy Resources and Constraints
     • Budget, people, technology, and time constraints
     • Capability maturity considerations
   • Business Case and Value Delivery
     • Cost-benefit and return on security investment
     • Articulating value to stakeholders
3. 3

   Policies, Standards, and Performance

   4 topics

   • Policy Framework Hierarchy
     • Policies, standards, procedures, and guidelines
     • Policy lifecycle and approval workflows
   • Roles, Responsibilities, and RACI
     • Assigning ownership and accountability
     • Defining data and system owners
   • Governance Metrics and Reporting
     • Key goal indicators and key performance indicators
     • Board-level security reporting and dashboards
   • Assurance and Maturity Models
     • Capability Maturity Model usage
     • Independent assurance and audit interaction

Information Security Governance flashcards for Certified Information Security Manager (CISM)

21 of 67 cards from the Information Security Governance deck — real questions with worked answers.

1. What is information security governance?

   The framework of leadership, organizational structures, and processes by which the board and senior management direct, control, and ensure that information security supports and aligns with business objectives.

2. What are the six outcomes of effective information security governance?

   Strategic alignment, risk management, value delivery, resource management/optimization, performance measurement, and integration/assurance process integration.

3. What is the difference between governance and management?

   Governance sets direction, evaluates options, and monitors performance (the board's 'EDM' role); management plans, builds, runs, and monitors activities to achieve the direction set by governance.

4. What is the primary objective of an information security program in governance terms?

   To support the organization's business objectives by managing risk to an acceptable level, not to achieve perfect or absolute security.

5. Who holds ultimate accountability for information security governance in an organization?

   The board of directors and senior (executive) management; accountability cannot be delegated even though responsibility for tasks can be.

6. In COBIT, what does the 'EDM' domain stand for and to whom does it belong?

   Evaluate, Direct, and Monitor — the governance domain, which is the responsibility of the board/governing body, distinct from the management domains.

7. What is the relationship between corporate governance and information security governance?

   Information security governance is a subset of corporate (enterprise) governance, applying the same direction-and-control principles specifically to information assets.

8. What is organizational culture and why does it matter to security governance?

   The shared values, beliefs, assumptions, and behaviors of an organization; it strongly influences how security policies are accepted and followed, often determining program success more than technology.

9. What is a security culture?

   The collective mindset and behaviors where employees value, understand, and consistently practice good security as a normal part of their work.

10. What is the most effective way to change organizational security behavior?

    Visible support and 'tone at the top' from senior management combined with security awareness training, clear policy, and incentives — culture change is led from the top.

11. What are the typical layers of organizational culture (Schein's model)?

    Artifacts (visible structures/behaviors), espoused values (stated strategies and goals), and underlying basic assumptions (unconscious, taken-for-granted beliefs).

12. Why should the information security manager understand organizational behavior?

    Because human behavior is a primary source of risk and the success of controls depends on people accepting and following them; resistance and habits must be managed.

13. To whom should the CISO ideally report to ensure independence and authority?

    A senior business executive independent of IT operations (e.g., CEO, board, or risk/audit committee), to avoid conflicts of interest with IT and ensure adequate authority.

14. What is the main problem when the CISO reports to the CIO?

    A potential conflict of interest, because security objectives may be subordinated to IT operational or budget goals, reducing objectivity and independence.

15. What is a steering committee in security governance?

    A cross-functional group of senior business and IT stakeholders that provides direction, prioritizes initiatives, allocates resources, and ensures the security program aligns with business needs.

16. What is the purpose of separating duties in organizational structures?

    To prevent any single individual from having enough control to commit and conceal fraud or error, by dividing critical tasks among different people.

17. What is a centralized vs. decentralized security organizational model?

    Centralized concentrates security authority/decisions in one group for consistency and control; decentralized distributes it to business units for flexibility/local responsiveness but with less uniformity.

18. What is the role of the board of directors in security governance structure?

    To set risk appetite, approve strategy and policy at a high level, provide oversight, and hold management accountable for security outcomes.

19. What is a governance framework?

    A structured set of principles, practices, and processes used to establish, direct, and monitor governance — providing a repeatable, standardized approach to managing security and risk.

20. What is COBIT and what is it used for?

    A governance and management framework from ISACA for enterprise IT that helps align IT/security with business goals, covering governance (EDM) and management objectives.

21. What does ISO/IEC 27001 specify?

    The requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS); it is the certifiable standard.

See more Information Security Governance flashcards →

Planning Information Security Governance for Certified Information Security Manager (CISM)

Information Security Governance (Certified Information Security Manager (CISM)) FAQ