Certified Information Security Manager (CISM) Information Security Program Development and Management Syllabus

Information Security Program Development and Management syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Information Security Program Development and Management in Certified Information Security Manager (CISM), not a summary of it.

1. 1

   Program Foundations and Resources

   4 topics

   • Program Objectives and Scope
     • Aligning the program to the security strategy
     • Defining program boundaries and outcomes
   • Program Resources and Budgeting
     • Staffing, skills, and competency models
     • Technology and tooling investment
   • Roadmaps and Project Portfolio
     • Prioritizing security initiatives
     • Milestones and dependency management
   • Program Frameworks and Architecture
     • Enterprise security architecture (e.g., SABSA)
     • Defense-in-depth and zero trust principles
2. 2

   Control and Technology Management

   4 topics

   • Administrative, Technical, and Physical Controls
     • Control categories and functions
     • Control objectives and implementation
   • Identity and Access Management
     • Authentication, authorization, and accounting
     • Privileged access and least privilege
   • Data Protection and Cryptography
     • Encryption, key management, and tokenization
     • Data loss prevention and classification controls
   • Security in Emerging Technologies
     • Cloud, mobile, and IoT controls
     • Securing AI and automation pipelines
3. 3

   Awareness, Training, and Documentation

   3 topics

   • Security Awareness Programs
     • Designing role-based awareness content
     • Measuring awareness effectiveness
   • Security Standards and Procedures
     • Operational procedure development
     • Baseline configuration documentation
   • Communication and Stakeholder Engagement
     • Reporting to management and the board
     • Building cross-functional partnerships
4. 4

   Program Measurement and Assurance

   4 topics

   • Program Metrics and KPIs
     • Operational, tactical, and strategic metrics
     • Demonstrating program value
   • Control Testing and Validation
     • Vulnerability scanning and penetration testing
     • Configuration and compliance reviews
   • Audit and Compliance Management
     • Internal and external audit coordination
     • Evidence collection and remediation tracking
   • Continuous Improvement
     • Lessons learned and feedback loops
     • Maturity advancement planning

Information Security Program Development and Management flashcards for Certified Information Security Manager (CISM)

23 of 51 cards from the Information Security Program Development and Management deck — real questions with worked answers.

1. What is the primary objective of an information security program?

   To execute the strategy by establishing, operating, and maintaining the activities, resources, and controls needed to achieve the organization's defined security objectives and acceptable risk levels.

2. What three elements define the scope of an information security program?

   The assets, processes, and organizational units (people, locations, systems, and data) that the program is responsible for protecting, including their boundaries and exclusions.

3. What is the difference between a security program's 'goals' and its 'objectives'?

   Goals are broad, high-level desired outcomes aligned to strategy; objectives are specific, measurable, time-bound targets that, when met, indicate progress toward goals.

4. What is a 'desired state' (or target state) in security program development?

   The defined future condition of the security posture the program aims to reach, often expressed using a framework or maturity model; the gap between current and desired state drives program initiatives.

5. What are the four main categories of resources required for a security program?

   People (staff/skills), processes, technology, and financial resources (budget); some models add information/documentation as a resource.

6. What is the difference between CapEx and OpEx in security budgeting?

   CapEx (capital expenditure) funds one-time asset purchases like hardware/licenses, depreciated over time; OpEx (operating expenditure) funds ongoing recurring costs like salaries, subscriptions, and maintenance.

7. What is Total Cost of Ownership (TCO) in the context of security investments?

   The complete cost of acquiring, deploying, operating, maintaining, and eventually retiring a control or technology over its full life cycle, not just the purchase price.

8. What is Return on Security Investment (ROSI) and its basic formula?

   A metric quantifying the financial value of a security control. ROSI = (Risk Exposure Reduction − Cost of Control) / Cost of Control, where reduction = ALE_before − ALE_after.

9. What is a security program roadmap?

   A time-phased plan that sequences initiatives, milestones, and dependencies to move the program from its current state to the desired state, aligning resources and priorities over time.

10. In a project portfolio, how should security initiatives be prioritized?

    By alignment to strategy and business value, risk reduction impact, cost/resource requirements, dependencies, and regulatory drivers—typically balancing quick wins against longer strategic projects.

11. What is the purpose of a security architecture?

    To provide a structured, holistic design that translates business and security requirements into integrated technical and process controls, ensuring consistency, defense in depth, and alignment with the enterprise architecture.

12. Name two widely used enterprise security architecture frameworks.

    SABSA (Sherwood Applied Business Security Architecture) and TOGAF; The Zachman Framework is also commonly referenced for enterprise architecture.

13. What is the difference between a control framework and a program/management framework?

    A control framework (e.g., NIST SP 800-53, CIS Controls) catalogs specific safeguards; a program/management framework (e.g., ISO/IEC 27001, NIST CSF) defines how to govern, build, and run the overall security program.

14. What are the three broad classes of controls by implementation type?

    Administrative (managerial) controls, technical (logical) controls, and physical controls.

15. What are the functional types of controls (by purpose)?

    Preventive, detective, corrective, deterrent, compensating, and recovery (and directive) controls.

16. Give an example of an administrative, a technical, and a physical control.

    Administrative: a security policy or background check; Technical: firewall, encryption, or access control list; Physical: locks, fences, badge readers, or CCTV.

17. What is a compensating control?

    An alternative control implemented when a primary/required control is not feasible, providing a comparable level of risk reduction to satisfy the control objective.

18. What is the difference between identification, authentication, and authorization?

    Identification asserts who you are (e.g., username); authentication proves that claim (e.g., password/biometric); authorization grants the access rights permitted to the authenticated identity.

19. What are the three authentication factors?

    Something you know (password/PIN), something you have (token/smart card), and something you are (biometric). Multi-factor combines two or more different factors.

20. What is the principle of least privilege?

    Granting users, processes, and systems only the minimum access rights necessary to perform their legitimate functions, and nothing more.

21. What is the difference between RBAC, ABAC, and MAC access control models?

    RBAC grants access based on assigned roles; ABAC grants access based on attributes/policies (user, resource, environment); MAC enforces access via system-assigned security labels/clearances that users cannot override.

22. What is Single Sign-On (SSO) and one key risk it introduces?

    SSO lets a user authenticate once to access multiple systems; the key risk is that a compromised SSO credential grants access to all linked systems (single point of failure).

23. What is the purpose of the access provisioning life cycle (JML)?

    To manage identity access across Joiner, Mover, and Leaver events—granting, modifying, and promptly revoking access as roles change—supported by periodic access recertification.

See more Information Security Program Development and Management flashcards →

Planning Information Security Program Development and Management for Certified Information Security Manager (CISM)

Information Security Program Development and Management (Certified Information Security Manager (CISM)) FAQ