CISM Course Notes

Governance makes security a business responsibility rather than a purely technical function. The information security strategy must support enterprise objectives, fit organizational culture, satisfy applicable obligations, and operate through clearly defined authority and accountability. Senior management sets direction and risk appetite; business and risk owners make business-risk decisions; the security manager advises, enables, measures, and reports. Frameworks, policies, metrics, budgets, and business cases should all trace back to business value and risk reduction.

• Treating governance as an IT or security-department responsibility only.

• CISM thinks top-down: business goals -> governance -> strategy -> program -> controls.

Risk management identifies what matters to the enterprise, what could harm it, how likely and severe that harm is, and what management should do about it. Assess risk in business context, including emerging threats, vulnerabilities, control deficiencies, third parties, and dependencies. Choose treatments that bring residual risk within appetite/tolerance, assign accountable owners, and monitor for changes. CISM does not chase every vulnerability: it prioritizes risk to enterprise objectives.

• Equating vulnerability severity with enterprise risk.

• CISM risk sequence: context -> assess -> treat -> owner accepts residual -> monitor/report.

The security program turns governance and strategy into repeatable operations. Build the right organization, inventory and classify assets, establish policies and standards, select and implement controls based on risk, test whether they work, measure the program, train people, manage external services, and report results. Program management is lifecycle work: design, implement, integrate, operate, assess, improve, and communicate. Controls are means to manage risk—not the end goal.

• Treating the program as a collection of security tools.

• Program = people + process + technology + governance support.

Incident management is a business capability, not just a technical response team. Prepare plans, roles, communication paths, BIA/BCP/DRP dependencies, classification criteria, tools, training, and exercises before an event. During an incident, confirm and assess what happened, prioritize by business impact, contain damage, preserve evidence, coordinate communications and third parties, eradicate the cause, recover safely, and track actions. Afterward, perform a blameless review, identify root cause and control/process failures, implement corrective actions, and reassess risk.

• Treating incident response as only containment.

• Incident lifecycle mindset: prepare -> identify/evaluate -> contain -> communicate -> eradicate -> recover -> learn.