CISM Certified Information Security Manager

Certified Information Security Manager Training Overview 

Prerequisites to attend this Certified Information Security Manager Training 

Who should attend this Certified Information Security Manager Training?  

• Information Security Managers 
• Internal Auditors 
• Risk Management Specialists 
• Compliance Officers 
• Security Analysts 
• IT Consultants 
• Data Protection Officers 

Course structure  

• In the first 3 days, the course will cover the essential materials needed to understand CISM 
• The last day will cover the essential materials needed to take the CISM Certified Information Security Manager exam 

Certified Information Security Manager Training Outline 

• About Information Security Governance 
• Reason for Security Governance 
  
• Security Governance Activities and Results 
  
• Risk Appetite 
  
• Organisation Culture 
  

• Introduction 
• Requirements for Content and Retention of Business Records 
  

• Roles and Responsibilities 
• Monitoring Responsibilities 
  

• Introduction 
• Business Goals and Objectives 
  
• Information Security Strategy Objectives 
  
• Ensuring Objective and Business Integration 
  
• Avoiding Common Pitfalls and Bias 
  
• Desired State 
  
• Elements of a Strategy 
  

• Security Balanced Scorecard 
• Architectural Approaches 
  
• Enterprise Risk Management Framework 
  
• Information Security Management Frameworks and Models 
  

• Workforce Composition and Skills 
• Assurance Provisions 
  
• Risk Assessment and Management 
  
• Action Plan to Implement Strategy 
  
• Information Security Program Objectives 
  

• Risk Identification 
• Threats 
  
• Defining a Risk Management Framework 
  
• Emerging Threats 
  
• Risk, Likelihood and Impact 
  
• Risk Register 
  

• Introduction 
• Security Control Baselines 
  
• Events Affecting Security Baselines 
  

• Introduction 
• Determining the Risk Management Context 
  
• Operational Risk Management 
  
• Risk Management Integration with IT Life Cycle Management Processes 
  
• Risk Scenarios 
  
• Risk Assessment Process 
  
• Risk Assessment and Analysis Methodologies
• Other Risk Assessment Approaches
• Risk Analysis
• Risk Evaluation
• Risk Ranking 

• Risk Treatment/Risk Response Options 
• Determining Risk Capacity and Acceptable Risk 
  
• (Risk Appetite) 
  
• Risk Response Options 
  
• Risk Acceptance Framework 
  
• Inherent and Residual Risk 
  
• Impact 
  
• Controls 
  
• Legal and Regulatory Requirements 
  
• Costs and Benefits 
  

• Risk Ownership and Accountability 
• Risk Owner 
  
• Control Owner 
  

• Risk Monitoring 
• Key Risk Indicators 
  
• Reporting Changes in Risk 
  
• Risk Communication, Awareness and Consulting 
  
• Documentation 
  

• Introduction 
• Information Security Program Objectives 
  
• Information Security Program Concepts 
  
• Common Information Security Program Challenges 
  
• Common Information Security Program Constraints 
  

• Information Asset Identification and Valuation 
• Information Asset Valuation Strategies 
  
• Information Asset Classification 
  
• Methods to Determine Criticality of Assets and Impact of Adverse Events 
  

• Enterprise Information Security Architectures 
• Information Security Management Frameworks 
  
• Information Security Frameworks Components 
  

• Policies 
• Standards 
  
• Procedures 
  
• Guidelines 
  

• Introduction 
• Effective Security Metrics 
  
• Security Program Metrics and Monitoring 
  
• Metrics Tailored to Enterprise Needs 
  

• Introduction 
• Managing Risk Through Controls 
  
• Controls and Countermeasures 
  
• Control Categories 
  
• Control Design Considerations 
  
• Control Methods 
  

• Risk Management 
• Risk Management Programme 
  
• Risk Treatment 
  
• Audit and Reviews 
  
• Third-Party Risk Management 
  

• Event Monitoring 
• Vulnerability Management 
  
• Security Engineering and Development 
  
• Network Protection 
  
• Endpoint Protection and Management 
  
• Identity and Access Management 
  
• Security Incident Management 
  
• Security Awareness Training 
  
• Managed Security Service Providers 
  
• Data Security 
  
• Cryptography 
  
• Symmetric Key Algorithms 
  

• Service Desk 
• Incident Management 
  
• Problem Management 
  
• Change Management 
  
• Configuration Management 
  
• Release Management 
  
• Service Levels Management 
  
• Financial Management 
  
• Capacity Management 
  
• Service Continuity Management 
  
• Availability Management 
  
• Asset Management 
  

• Internal Control Objectives 
• Information Systems Control Objectives 
  
• General Computing Controls 
  
• Control Frameworks 
  
• Controls Development 
  
• Control Assessment 
  

• Types of Metrics 
• Audiences 
  
• Continuous Improvement 
  

• Phases of Incident Response 

• Objectives 
• Maturity 
  
• Resources 
  
• Roles and Responsibilities 
  
• Gap Analysis 
  
• Plan Development 
  

• Detection 
• Initiation 
  
• Evaluation 
  
• Recovery 
  
• Remediation 
  
• Closure 
  
• Post-Incident Review 
  

• Business Continuity Planning 
• Disaster 
  
• Disaster Recovery Planning 
  
• Testing BC and DR Planning