CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts Syllabus

Information Security Management Principles and Concepts syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Information Security Management Principles and Concepts in CISMP (Certificate in Information Security Management Principles), not a summary of it.

1. 1

   Core Security Concepts and Terminology

   4 topics

   • The CIA Triad
     • Confidentiality and need-to-know
     • Integrity and data accuracy
     • Availability and business continuity
   • Extended security attributes
     • Authenticity and non-repudiation
     • Accountability and auditability
     • Reliability and resilience
   • Assets, threats, vulnerabilities and risk
     • Distinguishing assets from controls
     • Threat agents and threat sources
     • Impact and likelihood
   • The need for and benefits of information security
     • Protecting business value and reputation
     • Enabling secure operations
2. 2

   The Information Security Lifecycle and Governance

   4 topics

   • Plan-Do-Check-Act and continual improvement
     • The PDCA cycle in an ISMS
     • Measuring effectiveness
   • Information security governance
     • Board and senior management responsibility
     • Direct, monitor and report
   • Roles and responsibilities
     • CISO, information owners and custodians
     • Users and third parties
   • Security culture and behaviour
     • Embedding security into the organisation
     • Influencing user behaviour
3. 3

   Information Security Management Systems (ISMS)

   4 topics

   • Purpose and scope of an ISMS
     • Defining scope and boundaries
     • Context of the organisation
   • ISO/IEC 27001 and 27002 overview
     • Requirements versus guidance
     • Statement of Applicability
   • Certification and accreditation
     • The certification process
     • Surveillance and recertification audits
   • Policy, standards, procedures and guidelines
     • Document hierarchy
     • Maintaining the policy framework

Information Security Management Principles and Concepts flashcards for CISMP (Certificate in Information Security Management Principles)

20 of 50 cards from the Information Security Management Principles and Concepts deck — real questions with worked answers.

1. What three core attributes make up the CIA Triad in information security?

   Confidentiality, Integrity and Availability.

2. Define Confidentiality as used in the CIA Triad.

   Ensuring that information is accessible only to those authorised to have access; preventing unauthorised disclosure.

3. Define Integrity as used in the CIA Triad.

   Safeguarding the accuracy and completeness of information and processing methods; preventing unauthorised or accidental modification.

4. Define Availability as used in the CIA Triad.

   Ensuring that authorised users have access to information and associated assets when required.

5. Name the commonly cited extended (additional) security attributes beyond the CIA Triad.

   Authenticity, Accountability, Non-repudiation, and Reliability.

6. What does the security attribute 'non-repudiation' guarantee?

   That a party cannot deny having performed an action, such as sending a message or authorising a transaction; proof of origin and delivery.

7. What does the security attribute 'authenticity' mean?

   That an entity (user, process or data) is genuine and is what it claims to be; the property of being verified and trusted.

8. What does 'accountability' mean as a security attribute?

   The ability to trace actions uniquely to a responsible entity, supporting non-repudiation, detection and prevention.

9. In information security terms, what is an asset?

   Anything that has value to the organisation and therefore requires protection (e.g. data, hardware, software, people, reputation, services).

10. Define a 'threat' in risk terminology.

    A potential cause of an unwanted incident that may result in harm to a system or organisation; something that can exploit a vulnerability.

11. Define a 'vulnerability' in risk terminology.

    A weakness in an asset or control that can be exploited by one or more threats.

12. Define 'risk' in information security.

    The potential that a given threat will exploit a vulnerability of an asset and thereby cause harm; the effect of uncertainty on objectives.

13. State the conceptual relationship/formula for information security risk.

    Risk is a function of likelihood and impact: $\text{Risk} = \text{Likelihood} \times \text{Impact}$ (threats exploiting vulnerabilities against assets).

14. What is the formula for Annualised Loss Expectancy (ALE)?

    $\text{ALE} = \text{SLE} \times \text{ARO}$, where SLE is the Single Loss Expectancy and ARO is the Annualised Rate of Occurrence.

15. What is the formula for Single Loss Expectancy (SLE)?

    $\text{SLE} = \text{Asset Value} \times \text{Exposure Factor}$, where the Exposure Factor is the proportion of the asset lost in a single event.

16. Name the four standard options for treating an identified risk.

    Treat (reduce/modify with controls), Tolerate (accept/retain), Transfer (share, e.g. insurance), and Terminate (avoid/eliminate the activity).

17. Distinguish between inherent risk and residual risk.

    Inherent risk is the level of risk before any controls are applied; residual risk is the risk remaining after controls have been implemented.

18. What is a 'control' (countermeasure) in information security?

    A measure that modifies risk, including policies, procedures, practices and technical or organisational safeguards that reduce likelihood or impact.

19. List the four broad categories of security control by function.

    Preventive, Detective, Corrective, and Deterrent (directive/compensating are also sometimes added).

20. Give the three control types by nature/implementation.

    Physical (e.g. locks, fences), Technical/Logical (e.g. firewalls, encryption), and Administrative/Procedural (e.g. policies, training).

See more Information Security Management Principles and Concepts flashcards →

Planning Information Security Management Principles and Concepts for CISMP (Certificate in Information Security Management Principles)

Information Security Management Principles and Concepts (CISMP (Certificate in Information Security Management Principles)) FAQ