CISM - Certified Information Security Manager

The Certified Information Security Manager (CISM) course is a prestigious certification program tailored for professionals in information security management. This course is designed to equip learners with the knowledge and skills necessary to develop, manage, and lead an organization’s information security program effectively. The course covers four critical domains: Information Security Governance, Risk Management, Information Security Program Development and Management, and Incident Management.

• Information Security Governance: Learners will focus on establishing a robust governance framework that aligns with organizational goals and ensures management support for security initiatives.

• Risk Management: This module delves into the identification, assessment, and management of security risks, enabling learners to monitor and report on risks effectively.

• Information Security Program Development and Management: Students will learn to align security programs with business objectives, manage resources efficiently, and integrate security practices into organizational processes.

• Incident Management: The final module equips learners with the skills to plan for and respond to security incidents, ensuring business continuity and minimizing the impact of security breaches.

By completing the CISM course, participants will be prepared to take on leadership roles in information security, enhance their professional standing, and contribute significantly to their organization's security management practices.

Course Prerequisites

To ensure a successful learning experience in the CISM course, the following prerequisites are recommended:

• Basic Understanding of Information Security Concepts:

  • Familiarity with core principles such as confidentiality, integrity, and availability.

  • Awareness of common security threats and vulnerabilities.

• Foundational IT Knowledge:

  • General understanding of IT infrastructure components (networks, servers, applications, databases).

  • Familiarity with IT operations and the role of information security within IT.

• Experience in Information Security or Related Field:

  • Practical experience in information security or related fields such as IT audit, risk management, or information assurance is beneficial but not mandatory.

• Understanding of Governance and Risk Management:

  • Basic knowledge of governance principles and the importance of aligning security objectives with organizational goals.

  • Awareness of risk management processes including risk identification, assessment, and mitigation strategies.

• Professional Experience:

  • While the CISM certification requires a minimum of five years of professional information security management experience, this is not a prerequisite for the training course. However, participants with some professional experience may find the course content more relatable.

• Willingness to Learn:

  • A committed attitude towards understanding complex security management concepts.

• English Proficiency:

  • Proficiency in reading and understanding technical English, as the course materials and the CISM exam are in English.

These prerequisites are intended to ensure that participants are adequately prepared for the advanced concepts covered in the CISM course. However, individuals with a strong desire to enhance their information security management skills are encouraged to enroll.

Target Audience for Certified Information Security Manager (CISM)

The CISM course is ideal for IT professionals who aspire to manage and oversee enterprise information security. The target audience includes:

• Information Security Managers

• IT Auditors

• Risk Managers

• Chief Information Officers (CIOs)

• Chief Information Security Officers (CISOs)

• IT Consultants specializing in information security

• IT Directors or Managers responsible for security

• Security Systems Engineers

• Security Architects and Designers

• IT Professionals aspiring to management roles in Information Security

• Compliance Officers responsible for IT security compliance

• Information Security Analysts

• Network Architects and Engineers focusing on security

• Data Protection Officers (DPOs)

• Privacy Officers

• IT Project Managers involved in security-related projects

• Incident Responders and Incident Handling professionals

• Business Continuity and Disaster Recovery Specialists

Learning Objectives - What You Will Learn in this Certified Information Security Manager (CISM) Course

The CISM course provides learners with a deep understanding of information security management, focusing on the following objectives:

• Information Security Governance:

  • Develop and manage an information security governance framework aligned with business goals.

  • Influence organizational culture to support information security.

• Risk Management:

  • Identify, assess, and manage information security risks to achieve business objectives.

• Information Security Program Development and Management:

  • Design, implement, and monitor security programs that protect organizational assets.

  • Ensure that information security is integrated into the organization’s processes and practices.

• Incident Management:

  • Plan and manage incident response and business continuity to minimize the impact of security breaches.

  • Communicate effectively with stakeholders to gain support and report on security status.

• Legal, Regulatory, and Contractual Compliance:

  • Understand the legal, regulatory, and contractual requirements affecting the organization’s information security program.

• Security Controls and Incident Response:

  • Select and implement appropriate security controls and measure their effectiveness.

  • Prepare for and respond to security incidents, and conduct post-incident reviews to enhance future resilience.

Course Outline:

DOMAIN 1 – INFORMATION SECURITY GOVERNANCE

• Organizational Culture

• Legal, Regulatory and Contractual Requirements

• Organizational Structures, Roles and Responsibilities

• Information Security Strategy Development

• Information Governance Frameworks and Standards

• Strategic Planning (e.g., Budgets, Resources, Business Case)

DOMAIN 2 – INFORMATION SECURITY RISK MANAGEMENT

• Emerging Risk and Threat Landscape

• Vulnerability and Control Deficiency Analysis

• Risk Assessment and Analysis

• Risk Treatment / Risk Response Options

• Risk and Control Ownership

• Risk Monitoring and Reporting

DOMAIN 3 – INFORMATION SECURITY PROGRAM

• Information Security Program Resources (e.g., People, Tools, Technologies)

• Information Asset Identification and Classification

• Industry Standards and Frameworks for Information Security

• Information Security Policies, Procedures and Guidelines

• Information Security Program Metrics

• Information Security Control Design and Selection

• Information Security Control Implementation and Integrations

• Information Security Control Testing and Evaluation

• Information Security Awareness and Training

• Management of External Services (e.g., Providers, Suppliers, Third Parties, Fourth Parties)

• Information Security Program Communications and Reporting

DOMAIN 4 – INCIDENT MANAGEMENT

• Incident Response Plan

• Business Impact Analysis (BIA)

• Business Continuity Plan (BCP)

• Disaster Recovery Plan (DRP)

• Incident Classification/Categorization

• Incident Management Training, Testing and Evaluation

• Incident Management Tools and Techniques

• Incident Investigation and Evaluation

• Incident Containment Methods

• Incident Response Communications (e.g., Reporting, Notification, Escalation)

• Incident Eradication and Recovery

• Post-Incident Review Practices