Examius

🇺🇸 Certified Information Security Manager (CISM) · subject

Certified Information Security Manager (CISM) Information Security Risk Assessment Syllabus

The Information Security Risk Assessment syllabus for Certified Information Security Manager (CISM) in full: 3 chapters, 10 topics and 20 sub-topics, every one listed below, plus 51 Information Security Risk Assessment flashcards with answers.

3Chapters
10Topics
20Sub-topics
51Flashcards

Information Security Risk Assessment syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Risk Concepts and the Risk Landscape

     4 topics
    • Core Risk Terminology
      • Threats, vulnerabilities, assets, and impact
      • Inherent, residual, and aggregate risk
    • Risk Appetite and Tolerance
      • Establishing acceptable risk levels
      • Aligning appetite with business objectives
    • Emerging Threats and Vulnerabilities
      • Threat intelligence and threat actor profiling
      • Supply chain and third-party risk
    • Risk Management Frameworks
      • NIST SP 800-39 and ISO/IEC 27005
      • FAIR quantitative risk modeling

  2. Asset Identification and Valuation

     3 topics
    • Asset Inventory and Classification
      • Asset ownership and stewardship
      • Information classification schemes
    • Business Impact Considerations
      • Determining asset criticality
      • Valuation methods for tangible and intangible assets
    • Data Lifecycle and Protection Needs
      • Data states and handling requirements
      • Retention and disposal considerations

  3. Risk Identification and Analysis

     3 topics
    • Risk Identification Methods
      • Threat modeling and scenario analysis
      • Vulnerability assessment and penetration testing inputs
    • Risk Analysis Techniques
      • Qualitative vs. quantitative analysis
      • Single loss and annualized loss expectancy
    • Risk Evaluation and Ranking
      • Risk scoring and heat maps
      • Prioritization against risk criteria

Certified Information Security Manager (CISM) Information Security Risk Assessment flashcards — 51 questions with answers

  1. What is the definition of a 'threat' in information security risk terminology?

    A threat is any potential cause of an unwanted incident that may result in harm to a system or organization, e.g., a hacker, malware, natural disaster, or insider.

  2. What is a 'vulnerability' in risk terminology?

    A vulnerability is a weakness or flaw in an asset or control that can be exploited by a threat to cause harm (e.g., unpatched software, weak passwords).

  3. Define 'risk' as used in information security.

    Risk is the potential that a given threat will exploit a vulnerability of an asset, resulting in loss or damage. It is a function of likelihood and impact.

  4. What is an 'asset' in risk management?

    An asset is anything of value to the organization—data, hardware, software, people, reputation, or processes—that needs protection.

  5. What is 'exposure' in risk terminology?

    Exposure is an instance of being susceptible to loss from a threat; the state of being unprotected against a particular vulnerability.

  6. Define 'inherent risk' versus 'residual risk'.

    Inherent risk is the level of risk before any controls are applied; residual risk is the risk that remains after controls/mitigations have been implemented.

  7. What is a 'control' (safeguard/countermeasure)?

    A control is a policy, procedure, practice, or technical mechanism that reduces risk by lowering the likelihood or impact of a threat exploiting a vulnerability.

  8. What is the difference between a threat agent (threat actor) and a threat?

    A threat is the potential danger; a threat agent/actor is the entity (person, group, or thing) that carries out or triggers the threat.

  9. Define 'likelihood' (probability) in risk assessment.

    Likelihood is the chance or frequency that a given threat will successfully exploit a vulnerability within a defined time period.

  10. Define 'impact' in risk assessment.

    Impact is the magnitude of harm or loss resulting from a threat exploiting a vulnerability—measured in financial, operational, reputational, or regulatory terms.

  11. What is 'risk appetite'?

    Risk appetite is the broad amount of risk an organization is willing to accept in pursuit of its objectives, set at the strategic level by senior management/board.

  12. What is 'risk tolerance'?

    Risk tolerance is the acceptable level of variation (deviation) around specific objectives or risk types—a more granular, operational boundary than risk appetite.

  13. How do risk appetite and risk tolerance differ?

    Risk appetite is the overall strategic amount of risk an organization will accept; risk tolerance is the acceptable deviation around specific objectives. Tolerance operationalizes appetite.

  14. What is 'risk capacity'?

    Risk capacity is the maximum amount of risk an organization can absorb before threatening its viability—an objective limit, unlike appetite which is a chosen preference.

  15. Who is ultimately responsible for setting an organization's risk appetite?

    The board of directors and senior management (executive leadership) set risk appetite, aligning it with business strategy and objectives.

  16. Why must risk tolerance levels be documented and communicated?

    So that risk treatment decisions are consistent, risk owners know acceptable thresholds, and exceptions can be escalated when tolerance is exceeded.

  17. What is an Advanced Persistent Threat (APT)?

    An APT is a stealthy, prolonged, and targeted cyberattack—typically by a well-resourced adversary—that gains and maintains unauthorized access to exfiltrate data over time.

  18. What is a 'zero-day vulnerability'?

    A zero-day is a software flaw unknown to the vendor (or with no available patch) that attackers can exploit before a fix is released.

  19. What is a 'supply chain attack' as an emerging threat?

    An attack that compromises an organization indirectly by targeting a trusted third-party vendor, software component, or service provider in its supply chain.

  20. What distinguishes a vulnerability from an emerging threat in monitoring?

    A vulnerability is an existing weakness to be patched/mitigated; an emerging threat is a new or evolving danger (new malware, attack technique) requiring updated threat intelligence.

Show the other 31 Information Security Risk Assessment flashcards

  1. Why is threat intelligence important for managing emerging threats?

    It provides timely, actionable information about new attack vectors, actors, and indicators of compromise, enabling proactive defense before threats materialize.

  2. Name the four core phases of the ISO/IEC 27005 risk management process.

    Context establishment, risk assessment (identification, analysis, evaluation), risk treatment, and risk acceptance/monitoring & review (with ongoing communication).

  3. What does the NIST SP 800-30 framework specifically address?

    NIST SP 800-30 is the 'Guide for Conducting Risk Assessments'—it details preparing for, conducting, communicating, and maintaining risk assessments.

  4. What are the components of NIST's Risk Management Framework (RMF) steps?

    Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.

  5. What is the purpose of ISO/IEC 27001 in relation to risk?

    ISO/IEC 27001 specifies requirements for an Information Security Management System (ISMS), with risk assessment and treatment at its core.

  6. What does COBIT provide in the context of risk management?

    COBIT is a governance and management framework for enterprise IT that helps align IT risk with business goals and integrate risk into governance.

  7. What does FAIR (Factor Analysis of Information Risk) offer?

    FAIR is a quantitative risk analysis framework that decomposes risk into loss event frequency and loss magnitude to express risk in financial terms.

  8. What is the purpose of an asset inventory in risk assessment?

    To identify and catalog all assets so their value, ownership, and protection requirements can be determined—you cannot protect what you do not know you have.

  9. What are the typical data classification levels in a commercial scheme?

    Commonly: Public, Internal (Private), Confidential, and Restricted (Highly Confidential)—from least to most sensitive.

  10. What are the classification levels used by the U.S. government/military?

    Unclassified, Confidential, Secret, and Top Secret (from lowest to highest sensitivity).

  11. What three factors typically determine an asset's classification?

    The asset's value, sensitivity, and criticality—based on the impact of compromise to confidentiality, integrity, or availability.

  12. Who is the 'data owner' and what is their classification responsibility?

    The data owner is a senior/business role accountable for the data; they determine its classification level and authorize access.

  13. What is the difference between a data owner and a data custodian?

    The data owner decides classification and access (accountable); the data custodian implements and maintains controls/backups day-to-day (responsible for protection).

  14. What is the primary purpose of a Business Impact Analysis (BIA)?

    To identify critical business functions and the impact of their disruption over time, establishing recovery priorities and requirements.

  15. Define Recovery Time Objective (RTO).

    RTO is the maximum acceptable length of time to restore a business process or system after a disruption before unacceptable consequences occur.

  16. Define Recovery Point Objective (RPO).

    RPO is the maximum acceptable amount of data loss measured in time—how far back data must be recoverable, determining backup frequency.

  17. What is Maximum Tolerable Downtime (MTD)?

    MTD is the total time a business function can be unavailable before the organization suffers irreparable harm; it bounds the sum of RTO and recovery work.

  18. How does a BIA relate to risk assessment?

    The BIA quantifies the impact (criticality) of asset/process loss, providing the impact input that risk assessment combines with likelihood to prioritize risks.

  19. List the typical stages of the data lifecycle.

    Create/Collect, Store, Use, Share/Transmit, Archive/Retain, and Destroy/Dispose.

  20. Why must protection needs be assessed at each stage of the data lifecycle?

    Because data faces different threats and requires different controls (e.g., encryption in transit vs. at rest, secure disposal) at each stage.

  21. What control protects data 'at rest' versus 'in transit'?

    Data at rest is protected by storage/disk encryption and access controls; data in transit is protected by transport encryption such as TLS/VPN.

  22. What is 'data remanence' and why is it a risk?

    Data remanence is residual data remaining on storage media after deletion; it is a risk because sensitive data can be recovered if media is not properly sanitized.

  23. Name common risk identification methods.

    Brainstorming, interviews, checklists, document/asset reviews, threat modeling, vulnerability scanning, and reviewing historical incident data.

  24. What is the Delphi technique in risk identification?

    An anonymous, iterative method where experts independently provide input and feedback is consolidated over rounds to reach consensus without dominant-personality bias.

  25. What is threat modeling (e.g., STRIDE) used to identify?

    It systematically identifies potential threats to a system. STRIDE = Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

  26. Differentiate quantitative and qualitative risk analysis.

    Quantitative analysis assigns numeric/monetary values (e.g., ALE) to risk; qualitative analysis uses descriptive ratings (high/medium/low) based on judgment.

  27. State the formula for Single Loss Expectancy (SLE).

    SLE = Asset Value (AV) × Exposure Factor (EF), where EF is the percentage of asset value lost in a single incident.

  28. State the formula for Annualized Loss Expectancy (ALE).

    ALE = SLE × ARO (Annualized Rate of Occurrence), giving the expected monetary loss per year from a risk.

  29. What is the Exposure Factor (EF) and Annualized Rate of Occurrence (ARO)?

    EF is the proportion (%) of an asset's value lost in a single event; ARO is the estimated number of times the event is expected to occur per year.

  30. What is the formula used to evaluate and rank risk for prioritization?

    Risk = Likelihood × Impact (often plotted on a risk matrix/heat map to rank and prioritize risks for treatment).

  31. What are the four main risk treatment (response) options after evaluation?

    Risk avoidance (eliminate), risk mitigation/reduction (apply controls), risk transfer (e.g., insurance/outsourcing), and risk acceptance (retain within tolerance).

Certified Information Security Manager (CISM) Information Security Risk Assessment FAQ

What is in the Certified Information Security Manager (CISM) Information Security Risk Assessment syllabus?

Certified Information Security Manager (CISM) Information Security Risk Assessment is split into 3 chapters: Risk Concepts and the Risk Landscape, Asset Identification and Valuation and Risk Identification and Analysis. Together they contain 10 topics and 20 sub-topics.

How many chapters are in Certified Information Security Manager (CISM) Information Security Risk Assessment?

3 chapters, containing 10 topics and 20 sub-topics. The largest chapter is Risk Concepts and the Risk Landscape, with 4 topics.

Are there flashcards for Certified Information Security Manager (CISM) Information Security Risk Assessment?

Yes — a 51-card Information Security Risk Assessment deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.