Examius

🇬🇧 CISMP (Certificate in Information Security Management Principles) · subject

CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts Syllabus

The Information Security Management Principles and Concepts syllabus for CISMP (Certificate in Information Security Management Principles) in full: 3 chapters, 12 topics and 27 sub-topics, every one listed below, plus 50 Information Security Management Principles and Concepts flashcards with answers.

3Chapters
12Topics
27Sub-topics
50Flashcards

Information Security Management Principles and Concepts syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Core Security Concepts and Terminology

     4 topics
    • The CIA Triad
      • Confidentiality and need-to-know
      • Integrity and data accuracy
      • Availability and business continuity
    • Extended security attributes
      • Authenticity and non-repudiation
      • Accountability and auditability
      • Reliability and resilience
    • Assets, threats, vulnerabilities and risk
      • Distinguishing assets from controls
      • Threat agents and threat sources
      • Impact and likelihood
    • The need for and benefits of information security
      • Protecting business value and reputation
      • Enabling secure operations

  2. The Information Security Lifecycle and Governance

     4 topics
    • Plan-Do-Check-Act and continual improvement
      • The PDCA cycle in an ISMS
      • Measuring effectiveness
    • Information security governance
      • Board and senior management responsibility
      • Direct, monitor and report
    • Roles and responsibilities
      • CISO, information owners and custodians
      • Users and third parties
    • Security culture and behaviour
      • Embedding security into the organisation
      • Influencing user behaviour

  3. Information Security Management Systems (ISMS)

     4 topics
    • Purpose and scope of an ISMS
      • Defining scope and boundaries
      • Context of the organisation
    • ISO/IEC 27001 and 27002 overview
      • Requirements versus guidance
      • Statement of Applicability
    • Certification and accreditation
      • The certification process
      • Surveillance and recertification audits
    • Policy, standards, procedures and guidelines
      • Document hierarchy
      • Maintaining the policy framework

CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts flashcards — 50 questions with answers

  1. What three core attributes make up the CIA Triad in information security?

    Confidentiality, Integrity and Availability.

  2. Define Confidentiality as used in the CIA Triad.

    Ensuring that information is accessible only to those authorised to have access; preventing unauthorised disclosure.

  3. Define Integrity as used in the CIA Triad.

    Safeguarding the accuracy and completeness of information and processing methods; preventing unauthorised or accidental modification.

  4. Define Availability as used in the CIA Triad.

    Ensuring that authorised users have access to information and associated assets when required.

  5. Name the commonly cited extended (additional) security attributes beyond the CIA Triad.

    Authenticity, Accountability, Non-repudiation, and Reliability.

  6. What does the security attribute 'non-repudiation' guarantee?

    That a party cannot deny having performed an action, such as sending a message or authorising a transaction; proof of origin and delivery.

  7. What does the security attribute 'authenticity' mean?

    That an entity (user, process or data) is genuine and is what it claims to be; the property of being verified and trusted.

  8. What does 'accountability' mean as a security attribute?

    The ability to trace actions uniquely to a responsible entity, supporting non-repudiation, detection and prevention.

  9. In information security terms, what is an asset?

    Anything that has value to the organisation and therefore requires protection (e.g. data, hardware, software, people, reputation, services).

  10. Define a 'threat' in risk terminology.

    A potential cause of an unwanted incident that may result in harm to a system or organisation; something that can exploit a vulnerability.

  11. Define a 'vulnerability' in risk terminology.

    A weakness in an asset or control that can be exploited by one or more threats.

  12. Define 'risk' in information security.

    The potential that a given threat will exploit a vulnerability of an asset and thereby cause harm; the effect of uncertainty on objectives.

  13. State the conceptual relationship/formula for information security risk.

    Risk is a function of likelihood and impact: $\text{Risk} = \text{Likelihood} \times \text{Impact}$ (threats exploiting vulnerabilities against assets).

  14. What is the formula for Annualised Loss Expectancy (ALE)?

    $\text{ALE} = \text{SLE} \times \text{ARO}$, where SLE is the Single Loss Expectancy and ARO is the Annualised Rate of Occurrence.

  15. What is the formula for Single Loss Expectancy (SLE)?

    $\text{SLE} = \text{Asset Value} \times \text{Exposure Factor}$, where the Exposure Factor is the proportion of the asset lost in a single event.

  16. Name the four standard options for treating an identified risk.

    Treat (reduce/modify with controls), Tolerate (accept/retain), Transfer (share, e.g. insurance), and Terminate (avoid/eliminate the activity).

  17. Distinguish between inherent risk and residual risk.

    Inherent risk is the level of risk before any controls are applied; residual risk is the risk remaining after controls have been implemented.

  18. What is a 'control' (countermeasure) in information security?

    A measure that modifies risk, including policies, procedures, practices and technical or organisational safeguards that reduce likelihood or impact.

  19. List the four broad categories of security control by function.

    Preventive, Detective, Corrective, and Deterrent (directive/compensating are also sometimes added).

  20. Give the three control types by nature/implementation.

    Physical (e.g. locks, fences), Technical/Logical (e.g. firewalls, encryption), and Administrative/Procedural (e.g. policies, training).

Show the other 30 Information Security Management Principles and Concepts flashcards

  1. State three key business benefits of implementing information security.

    Protection of assets and reputation, legal/regulatory compliance, business continuity, competitive advantage, and increased customer/stakeholder confidence.

  2. Why is information security regarded as a business enabler rather than just a cost?

    It allows the organisation to safely pursue opportunities (e-commerce, partnerships, new markets), maintain trust, and meet obligations, supporting business objectives.

  3. What does the PDCA cycle stand for, and what is its purpose?

    Plan-Do-Check-Act; a continual improvement model used to establish, implement, monitor and improve an ISMS.

  4. In the PDCA cycle, what happens in the 'Plan' phase?

    Establish the ISMS: define scope, policy, risk assessment approach, identify risks and select controls/objectives.

  5. In the PDCA cycle, what happens in the 'Do' phase?

    Implement and operate the ISMS: deploy the risk treatment plan, controls, training and procedures.

  6. In the PDCA cycle, what happens in the 'Check' phase?

    Monitor and review the ISMS: measure performance, conduct audits and reviews against policy and objectives.

  7. In the PDCA cycle, what happens in the 'Act' phase?

    Maintain and improve the ISMS: take corrective and preventive actions based on review results to achieve continual improvement.

  8. What is 'continual improvement' in the context of an ISMS?

    A recurring activity to enhance performance, ensuring the ISMS adapts to changing threats, business needs and review findings over time.

  9. Define information security governance.

    The system of directing and controlling information security activities, by which the board and senior management provide strategic direction, ensure objectives are met, manage risk and use resources responsibly.

  10. Who holds ultimate accountability for information security in an organisation?

    The board of directors / top (senior) management; security is a board-level governance responsibility that cannot be fully delegated.

  11. What is the typical role of a CISO (Chief Information Security Officer)?

    Senior executive responsible for developing and implementing the information security programme, strategy, policy and risk management across the organisation.

  12. What is the role of an 'information asset owner'?

    The individual accountable for a specific information asset, responsible for its classification, acceptable use, and ensuring appropriate controls are applied.

  13. Differentiate between a data owner and a data custodian.

    The data owner is accountable for the data and decides classification/access; the custodian is responsible for the day-to-day technical safeguarding and maintenance of that data.

  14. What is the role of the SIRO (Senior Information Risk Owner), common in UK public sector?

    A board-level executive who owns the organisation's information risk policy, acts as champion for information risk, and provides assurance to the board.

  15. What is meant by a 'security culture' within an organisation?

    The shared attitudes, values, behaviours and norms regarding security that influence how staff protect information in their daily work.

  16. Why is human behaviour considered critical to information security?

    People are often the weakest link; many incidents stem from human error, negligence or manipulation (e.g. social engineering), so awareness and behaviour are key controls.

  17. What is the purpose of security awareness, training and education programmes?

    To change behaviour and build a positive security culture by ensuring staff understand threats, policies and their responsibilities for protecting information.

  18. What is an ISMS (Information Security Management System)?

    A systematic, risk-based framework of policies, procedures, processes and controls for managing an organisation's information security, based on the PDCA continual improvement approach.

  19. State the primary purpose and scope of an ISMS.

    To preserve the confidentiality, integrity and availability of information by applying a risk management process, giving stakeholders confidence that risks are adequately managed; scope defines the boundaries (assets, locations, units) it covers.

  20. Which ISO/IEC standard specifies the requirements for an ISMS and is certifiable?

    ISO/IEC 27001 — the standard against which organisations are audited and certified.

  21. What is the role of ISO/IEC 27002?

    A code of practice / guidance providing a catalogue of information security controls and implementation advice; it supports 27001 but is not itself certifiable.

  22. Key difference between ISO/IEC 27001 and ISO/IEC 27002?

    27001 states mandatory ISMS requirements (the 'what' you must do to be certified); 27002 gives detailed guidance on selecting and implementing controls (the 'how').

  23. What is a Statement of Applicability (SoA) in ISO/IEC 27001?

    A documented statement listing the controls selected (and excluded), the justification for inclusions/exclusions, and their implementation status.

  24. Which broad family of standards covers information security management systems?

    The ISO/IEC 27000 series (27000 provides the overview and vocabulary, 27001 the requirements, 27002 the controls, etc.).

  25. What is the difference between certification and accreditation?

    Certification is the formal third-party attestation that an organisation/system conforms to a standard (e.g. 27001); accreditation is the formal authority granted to a certification body (or, for systems, formal management approval to operate at an accepted risk level).

  26. In the UK, which body accredits certification bodies that issue ISO/IEC 27001 certificates?

    UKAS — the United Kingdom Accreditation Service.

  27. Define an information security 'policy'.

    A high-level document stating management's intentions, principles and direction for information security; mandatory and approved by senior management.

  28. Define a 'standard' in the policy hierarchy.

    A mandatory rule specifying uniform, measurable requirements (e.g. specific technologies or configurations) that support and enforce the policy.

  29. Differentiate a 'procedure' from a 'guideline'.

    A procedure is a mandatory, step-by-step set of instructions for performing a task; a guideline is recommended, non-mandatory best-practice advice offering flexibility.

  30. Place policy, standards, procedures and guidelines in their hierarchical order from highest to lowest.

    Policy (top, high-level intent) → Standards (mandatory requirements) → Procedures (mandatory step-by-step actions) and Guidelines (optional recommendations) at the operational level.

CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts FAQ

What is in the CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts syllabus?

CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts is split into 3 chapters: Core Security Concepts and Terminology, The Information Security Lifecycle and Governance and Information Security Management Systems (ISMS). Together they contain 12 topics and 27 sub-topics.

How many chapters are in CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts?

3 chapters, containing 12 topics and 27 sub-topics. The largest chapter is Core Security Concepts and Terminology, with 4 topics.

Are there flashcards for CISMP (Certificate in Information Security Management Principles) Information Security Management Principles and Concepts?

Yes — a 50-card Information Security Management Principles and Concepts deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.