Examius

🇺🇸 Certified Information Security Manager (CISM) · subject

Certified Information Security Manager (CISM) Information Security Governance Syllabus

The Information Security Governance syllabus for Certified Information Security Manager (CISM) in full: 3 chapters, 11 topics and 23 sub-topics, every one listed below, plus 67 Information Security Governance flashcards with answers.

3Chapters
11Topics
23Sub-topics
67Flashcards

Information Security Governance syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Enterprise Governance and the Security Function

     4 topics
    • Governance Fundamentals
      • Distinguishing governance from management
      • Roles of the board, executive management, and steering committees
      • Information security governance vs. corporate governance
    • Organizational Culture and Behavior
      • Security culture and its influence on risk posture
      • Tone at the top and accountability structures
    • Organizational Structures and Reporting Lines
      • CISO reporting models and independence
      • Segregation of duties at the governance level
    • Governance Frameworks and Standards
      • COBIT and NIST Cybersecurity Framework alignment
      • ISO/IEC 27001 and 27014 governance guidance

  2. Strategy, Mission, and Business Alignment

     3 topics
    • Developing an Information Security Strategy
      • Linking strategy to business goals and objectives
      • Desired vs. current state and gap analysis
    • Security Strategy Resources and Constraints
      • Budget, people, technology, and time constraints
      • Capability maturity considerations
    • Business Case and Value Delivery
      • Cost-benefit and return on security investment
      • Articulating value to stakeholders

  3. Policies, Standards, and Performance

     4 topics
    • Policy Framework Hierarchy
      • Policies, standards, procedures, and guidelines
      • Policy lifecycle and approval workflows
    • Roles, Responsibilities, and RACI
      • Assigning ownership and accountability
      • Defining data and system owners
    • Governance Metrics and Reporting
      • Key goal indicators and key performance indicators
      • Board-level security reporting and dashboards
    • Assurance and Maturity Models
      • Capability Maturity Model usage
      • Independent assurance and audit interaction

Certified Information Security Manager (CISM) Information Security Governance flashcards — 67 questions with answers

  1. What is information security governance?

    The framework of leadership, organizational structures, and processes by which the board and senior management direct, control, and ensure that information security supports and aligns with business objectives.

  2. What are the six outcomes of effective information security governance?

    Strategic alignment, risk management, value delivery, resource management/optimization, performance measurement, and integration/assurance process integration.

  3. What is the difference between governance and management?

    Governance sets direction, evaluates options, and monitors performance (the board's 'EDM' role); management plans, builds, runs, and monitors activities to achieve the direction set by governance.

  4. What is the primary objective of an information security program in governance terms?

    To support the organization's business objectives by managing risk to an acceptable level, not to achieve perfect or absolute security.

  5. Who holds ultimate accountability for information security governance in an organization?

    The board of directors and senior (executive) management; accountability cannot be delegated even though responsibility for tasks can be.

  6. In COBIT, what does the 'EDM' domain stand for and to whom does it belong?

    Evaluate, Direct, and Monitor — the governance domain, which is the responsibility of the board/governing body, distinct from the management domains.

  7. What is the relationship between corporate governance and information security governance?

    Information security governance is a subset of corporate (enterprise) governance, applying the same direction-and-control principles specifically to information assets.

  8. What is organizational culture and why does it matter to security governance?

    The shared values, beliefs, assumptions, and behaviors of an organization; it strongly influences how security policies are accepted and followed, often determining program success more than technology.

  9. What is a security culture?

    The collective mindset and behaviors where employees value, understand, and consistently practice good security as a normal part of their work.

  10. What is the most effective way to change organizational security behavior?

    Visible support and 'tone at the top' from senior management combined with security awareness training, clear policy, and incentives — culture change is led from the top.

  11. What are the typical layers of organizational culture (Schein's model)?

    Artifacts (visible structures/behaviors), espoused values (stated strategies and goals), and underlying basic assumptions (unconscious, taken-for-granted beliefs).

  12. Why should the information security manager understand organizational behavior?

    Because human behavior is a primary source of risk and the success of controls depends on people accepting and following them; resistance and habits must be managed.

  13. To whom should the CISO ideally report to ensure independence and authority?

    A senior business executive independent of IT operations (e.g., CEO, board, or risk/audit committee), to avoid conflicts of interest with IT and ensure adequate authority.

  14. What is the main problem when the CISO reports to the CIO?

    A potential conflict of interest, because security objectives may be subordinated to IT operational or budget goals, reducing objectivity and independence.

  15. What is a steering committee in security governance?

    A cross-functional group of senior business and IT stakeholders that provides direction, prioritizes initiatives, allocates resources, and ensures the security program aligns with business needs.

  16. What is the purpose of separating duties in organizational structures?

    To prevent any single individual from having enough control to commit and conceal fraud or error, by dividing critical tasks among different people.

  17. What is a centralized vs. decentralized security organizational model?

    Centralized concentrates security authority/decisions in one group for consistency and control; decentralized distributes it to business units for flexibility/local responsiveness but with less uniformity.

  18. What is the role of the board of directors in security governance structure?

    To set risk appetite, approve strategy and policy at a high level, provide oversight, and hold management accountable for security outcomes.

  19. What is a governance framework?

    A structured set of principles, practices, and processes used to establish, direct, and monitor governance — providing a repeatable, standardized approach to managing security and risk.

  20. What is COBIT and what is it used for?

    A governance and management framework from ISACA for enterprise IT that helps align IT/security with business goals, covering governance (EDM) and management objectives.

Show the other 47 Information Security Governance flashcards

  1. What does ISO/IEC 27001 specify?

    The requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS); it is the certifiable standard.

  2. What is the difference between ISO/IEC 27001 and ISO/IEC 27002?

    27001 specifies the certifiable ISMS requirements; 27002 is a guidance/code of practice providing detailed implementation guidance for security controls.

  3. What is the NIST Cybersecurity Framework (CSF) and its core functions?

    A voluntary US framework for managing cybersecurity risk; core functions are Identify, Protect, Detect, Respond, and Recover (with Govern added in CSF 2.0).

  4. What is the difference between a standard, a framework, and a regulation?

    A framework is a flexible structure of best practices; a standard is a mandatory, specific requirement; a regulation is a legally enforceable rule imposed by an authority.

  5. What is an information security strategy?

    A long-term plan that defines the desired future state of security and the roadmap of initiatives to move from the current state to that state in support of business objectives.

  6. What are the key inputs to developing a security strategy?

    Business goals and objectives, risk appetite/tolerance, current security (as-is) state, desired (to-be) state, regulatory requirements, and available resources and constraints.

  7. What is a gap analysis in strategy development?

    A comparison of the current state and the desired future state to identify the gaps that the strategy and roadmap must close.

  8. What defines the 'desired state' of a security program?

    A documented target derived from business objectives, risk appetite, and a control framework or maturity target (e.g., CMMI level), against which current state is compared.

  9. Why must a security strategy align with business objectives?

    Because security exists to enable and protect the business; misalignment wastes resources, fails to address real risk, and loses executive support.

  10. What is the first step in developing an information security strategy?

    Understand and obtain the business objectives, mission, and goals so the strategy can be aligned to support them.

  11. What are common resources used to execute a security strategy?

    People (staff/skills), processes, technology, budget, policies/standards, architecture, training, and external services.

  12. What are common constraints on a security strategy?

    Budget, legal/regulatory requirements, organizational culture, available skills/personnel, time, technology limitations, risk appetite, and ethics.

  13. What does 'risk appetite' mean?

    The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by senior management/the board.

  14. What is the difference between risk appetite and risk tolerance?

    Risk appetite is the broad level of risk the organization is willing to take overall; risk tolerance is the acceptable variation/deviation around specific objectives or risk levels.

  15. What is a business case for a security initiative?

    A justification document presenting the costs, benefits, risks, and alignment of a proposed investment to help management decide whether to fund it.

  16. What key elements should a security business case contain?

    Problem/opportunity statement, proposed solution/options, costs, benefits (quantitative and qualitative), risks, alignment to objectives, and expected return or value.

  17. What is value delivery in security governance?

    Ensuring that security investments are optimized to support business objectives and deliver benefits efficiently — getting appropriate value for the security spend.

  18. What is ROSI (Return on Security Investment) and its formula?

    A metric for the financial value of a security control: ROSI = (Risk exposure reduced (ALE saved) − cost of control) / cost of control.

  19. What is Annual Loss Expectancy (ALE) and its formula?

    The expected yearly monetary loss from a risk: ALE = SLE × ARO (Single Loss Expectancy × Annualized Rate of Occurrence).

  20. What is Single Loss Expectancy (SLE) and its formula?

    The monetary loss from a single occurrence of a risk: SLE = Asset Value × Exposure Factor (EF).

  21. How is the cost-justification of a control evaluated?

    A control is justified when its annual cost is less than the reduction in ALE it provides (the risk reduction benefit exceeds the control cost).

  22. What is the correct hierarchy of the security policy framework (top to bottom)?

    Policies (high-level intent) → Standards (mandatory specifics) → Procedures (step-by-step instructions) → Guidelines (recommended best practices).

  23. What is a security policy?

    A high-level statement of management intent and direction for information security that is mandatory and provides the foundation for standards and procedures.

  24. What is a standard in the policy hierarchy?

    A mandatory rule specifying uniform requirements (e.g., specific technologies, configurations, or methods) used to support and enforce policy.

  25. What is a procedure?

    A detailed, mandatory, step-by-step set of instructions describing how to perform a specific task to comply with policies and standards.

  26. What is a guideline?

    A recommended, non-mandatory set of best practices or suggestions that provide flexibility where mandatory standards are not appropriate.

  27. What is the difference between a policy and a procedure?

    A policy states what must be achieved and why (high-level intent, rarely changes); a procedure states how to do it (detailed steps, changes more often).

  28. What is a RACI chart used for in security governance?

    To define and clarify roles by mapping who is Responsible, Accountable, Consulted, and Informed for each task or decision, eliminating ambiguity.

  29. In RACI, what is the difference between 'Responsible' and 'Accountable'?

    Responsible = the person who does the work; Accountable = the single person ultimately answerable for the outcome and who approves it (only one 'A' per task).

  30. What is the role of a data owner vs. a data custodian?

    The data owner (a business manager) is accountable for classification and protection decisions; the custodian (often IT) implements and maintains the controls the owner specifies.

  31. What is the purpose of security metrics and reporting?

    To measure program performance, support decision-making, demonstrate value/effectiveness, ensure accountability, and communicate status to management.

  32. What is a Key Performance Indicator (KPI) vs. a Key Risk Indicator (KRI)?

    A KPI measures how well a process/control is performing (effectiveness/efficiency); a KRI is a forward-looking metric that signals increasing risk exposure or that a threshold is being approached.

  33. What is a Key Goal Indicator (KGI)?

    A metric that indicates whether a process or objective has achieved its intended goal/outcome (a measure of success after the fact).

  34. What makes a security metric effective (SMART criteria)?

    It should be Specific, Measurable, Attainable, Relevant, and Time-bound — and meaningful, actionable, and tied to business objectives.

  35. What is a security balanced scorecard?

    A reporting tool that measures the security program across multiple perspectives (e.g., financial, customer, internal process, learning/growth) to link it to business strategy.

  36. Why should metrics reported to senior management be different from technical metrics?

    Executives need business-relevant, risk- and value-oriented metrics for decision-making, not detailed technical data; reporting should match the audience's needs.

  37. What is assurance in information security governance?

    The confidence that controls are operating effectively and objectives are being met, gained through activities such as audits, reviews, testing, and certifications.

  38. What is a maturity model?

    A framework that describes progressive levels of process capability/maturity, used to assess the current state and define improvement targets for a security program.

  39. What are the five levels of the CMMI maturity model?

    1) Initial (ad hoc), 2) Managed/Repeatable, 3) Defined, 4) Quantitatively Managed/Measured, 5) Optimizing (continuous improvement).

  40. What does CMMI Level 0 represent (in CMMI/COBIT process maturity)?

    Non-existent / Incomplete — there is a complete lack of any recognizable process; the organization has not recognized the need to address the issue.

  41. What is assurance process integration and why is it important?

    Aligning and coordinating the various assurance functions (audit, risk, security, compliance, legal) so they work together, avoid gaps/overlaps, and provide comprehensive coverage.

  42. What is the purpose of a maturity assessment in strategy?

    To benchmark the current capability level against a target level, identify gaps, and prioritize improvements toward the desired state.

  43. What is the difference between effectiveness and efficiency of a control?

    Effectiveness measures whether the control achieves its intended security objective; efficiency measures whether it does so with optimal use of resources/cost.

  44. What is 'tone at the top' and why is it critical to governance?

    The ethical climate and commitment to security demonstrated by senior leadership; it drives organizational culture and is the single most important factor in program success.

  45. What is the difference between a threat, a vulnerability, and a risk?

    A threat is a potential cause of harm; a vulnerability is a weakness that a threat can exploit; risk is the likelihood and impact of a threat exploiting a vulnerability.

  46. What are the three lines of defense model roles in governance?

    1st line: operational management (owns and manages risk); 2nd line: risk/compliance/security functions (oversight); 3rd line: internal audit (independent assurance).

  47. Why must security policies be approved by senior management?

    To give them organizational authority and enforceability, demonstrate management commitment, and ensure alignment with business objectives and risk appetite.

Certified Information Security Manager (CISM) Information Security Governance FAQ

What is in the Certified Information Security Manager (CISM) Information Security Governance syllabus?

Certified Information Security Manager (CISM) Information Security Governance is split into 3 chapters: Enterprise Governance and the Security Function, Strategy, Mission, and Business Alignment and Policies, Standards, and Performance. Together they contain 11 topics and 23 sub-topics.

How many chapters are in Certified Information Security Manager (CISM) Information Security Governance?

3 chapters, containing 11 topics and 23 sub-topics. The largest chapter is Enterprise Governance and the Security Function, with 4 topics.

Are there flashcards for Certified Information Security Manager (CISM) Information Security Governance?

Yes — a 67-card Information Security Governance deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.