Certified Information Security Manager (CISM) Information Security Program Development and Management Syllabus

What is the difference between RBAC, ABAC, and MAC access control models?

RBAC grants access based on assigned roles; ABAC grants access based on attributes/policies (user, resource, environment); MAC enforces access via system-assigned security labels/clearances that users cannot override.

What is Single Sign-On (SSO) and one key risk it introduces?

SSO lets a user authenticate once to access multiple systems; the key risk is that a compromised SSO credential grants access to all linked systems (single point of failure).

What is the purpose of the access provisioning life cycle (JML)?

To manage identity access across Joiner, Mover, and Leaver events—granting, modifying, and promptly revoking access as roles change—supported by periodic access recertification.

What are the three states of data that must be protected?

Data at rest (stored), data in transit (moving across networks), and data in use (being processed in memory).

What is the difference between symmetric and asymmetric encryption?

Symmetric uses a single shared secret key for both encryption and decryption (fast, e.g., AES); asymmetric uses a public/private key pair (slower, e.g., RSA) enabling key exchange, digital signatures, and non-repudiation.

What security services does a digital signature provide?

Integrity, authentication of origin, and non-repudiation—created by encrypting a message hash with the sender's private key and verified with the sender's public key.

What is hashing and how does it differ from encryption?

Hashing is a one-way function producing a fixed-length digest used to verify integrity; it is not reversible, whereas encryption is reversible with the correct key and protects confidentiality.

What is the role of a Public Key Infrastructure (PKI)?

To manage digital certificates and public-key encryption—including a Certificate Authority (CA), Registration Authority (RA), certificate issuance, distribution, revocation (CRL/OCSP), and trust binding of keys to identities.

What is data classification and why is it foundational to data protection?

The process of categorizing data by sensitivity/criticality (e.g., public, internal, confidential, restricted) so that appropriate, proportionate handling and protection controls can be applied.

What is Data Loss Prevention (DLP)?

A set of technologies and processes that detect and prevent unauthorized exfiltration or disclosure of sensitive data across endpoints, networks, and storage, based on content/classification policies.

What security challenges are introduced by cloud computing's shared responsibility model?

Security duties are split between provider and customer (varying by IaaS/PaaS/SaaS); misunderstanding the boundary leads to gaps. Customers always retain responsibility for data, identities, and access governance.

What security concerns are associated with IoT devices?

Weak/default credentials, limited patching capability, large attack surface, lack of encryption, weak physical security, and difficulty in inventory and lifecycle management.

What is a key security consideration when adopting AI/machine learning systems?

Risks include data poisoning, model/prompt manipulation, training-data privacy leakage, bias, and adversarial inputs; governance over data sourcing, model integrity, and output validation is required.

Why must security be embedded early in DevOps (DevSecOps)?

Because rapid, automated CI/CD pipelines can deploy vulnerabilities quickly; integrating automated security testing and 'shift-left' practices catches issues early and reduces cost of remediation.

What is the primary objective of a security awareness program?

To change behavior and build a security-conscious culture so personnel recognize, avoid, and report threats—reducing human-factor risk such as phishing and social engineering.

What is the difference between awareness, training, and education?

Awareness focuses attention to change behavior (the 'what'); training teaches specific job skills (the 'how'); education provides deeper conceptual understanding (the 'why'), often for security professionals.

How should the effectiveness of a security awareness program be measured?

Through metrics such as phishing simulation click/report rates, incident reporting rates, training completion, policy acknowledgment, and trends in human-error incidents over time.

What is the difference between policies, standards, procedures, and guidelines?

Policies are high-level mandatory intent; standards are mandatory specific requirements/metrics; procedures are step-by-step mandatory instructions; guidelines are recommended, non-mandatory best practices.

What is a baseline in the context of security standards?

A minimum mandatory level of security configuration or control that a system, platform, or process must meet (e.g., a hardened OS configuration baseline).

Why is stakeholder engagement critical to security program success?

Stakeholders provide funding, authority, and adoption; engaging them builds buy-in, aligns the program to business needs, resolves conflicts, and ensures controls are accepted rather than circumvented.

What is the difference between a metric and a Key Performance Indicator (KPI)?

A metric is any measured value; a KPI is a selected metric tied to a critical objective that indicates how well the program is performing against its goals.

What is a Key Risk Indicator (KRI) and how does it differ from a KPI?

A KRI is a forward-looking metric signaling increasing risk exposure (predictive), while a KPI measures performance/achievement of objectives (often retrospective).

What makes a security metric effective (SMART criteria)?

It should be Specific, Measurable, Attainable, Relevant, and Timely—plus meaningful to its audience, actionable, and tied to objectives rather than just activity counts.

What is the difference between control testing and control validation?

Control testing checks whether a control is implemented and operating as designed; validation confirms the control actually achieves its intended risk-reduction objective (effectiveness vs. mere existence).

What is the difference between vulnerability assessment and penetration testing?

A vulnerability assessment identifies and catalogs weaknesses (broad, automated, no exploitation); a penetration test actively exploits weaknesses to demonstrate real-world impact (focused, often manual).

What is the difference between testing control 'design effectiveness' and 'operating effectiveness'?

Design effectiveness asks whether the control, if operating, would meet its objective; operating effectiveness asks whether it actually functioned consistently over a period of time.

What is the difference between an internal audit and an external audit?

Internal audits are conducted by the organization's own auditors for management assurance and improvement; external audits are performed by independent third parties for objective assurance to regulators, customers, or boards.

What is the difference between compliance and security?

Compliance is meeting external/internal mandatory requirements (laws, regulations, standards); security is actual protection of assets. Being compliant does not guarantee being secure, and vice versa.

What is a gap analysis in audit and compliance management?

A systematic comparison of the current state against a required standard, framework, or regulation to identify deficiencies that must be remediated, prioritized by risk.

What is continuous improvement in a security program, and which model supports it?

An ongoing cycle of measuring, learning, and enhancing the program based on metrics, audits, and incidents. The Plan-Do-Check-Act (PDCA) cycle is the classic model supporting it.

What is a maturity model and how is it used for continuous improvement?

A model (e.g., CMMI) that rates capability across defined levels from ad hoc to optimized; it benchmarks current maturity, sets target maturity, and guides prioritized improvement of processes.