Module 1: Information Security Governance

• Establish and maintain an information security strategy and align the strategy with corporate governance
• Identify internal and external influences on the organization
• Define roles and responsibilities
• Establish, monitor, evaluate, and report metrics

Module 2: Information Risk Management and Compliance

• Establish a process for information asset classification and ownership
• Identify legal, regulatory, organizational, and other applicable requirements
• Ensure that risk assessment, vulnerability assessments, and threat analyses are conducted periodically
• Determine appropriate risk treatment options
• Evaluate information security controls
• Identify the gap between current and desired risk levels
• Integrate information risk management into business and IT processes
• Monitor existing risk
• Report noncompliance and other changes in information risk

Module 3: Information Security Program Development and Management

• Establish and maintain the information security program
• Identify, acquire, manage, and define requirements for internal and external resources
• Establish and maintain information security architectures
• Establish, communicate, and maintain organizational information security standards, procedures, and guidelines
• Establish and maintain a program for information security awareness and training
• Integrate information security requirements into organizational processes, as well as into contracts and activities of third parties
• Establish, monitor, and periodically report program management and operational metrics

Module 4: Information Security Incident Management

• Establish and maintain an organizational definition and severity hierarchy for information security incidents
• Establish and maintain an incident response plan
• Develop and implement processes to ensure timely identification of information security incidents
• Establish and maintain processes to investigate and document information security incidents
• Establish and maintain incident escalation and notification processes
• Organize, train, and equip teams to respond to information security incidents effectively
• Test and review the incident response plan periodically
• Establish and maintain communication plans and processes
• Conduct post-incident reviews
• Establish and maintain integration among the incident response plan, disaster recovery plan, and business continuity plan.

To succeed in this course and successfully pass the CISM exam, you should have at least five years of information security experience in at least one of the following roles:

• IT consultant, auditor, or manager
• Security policy writer
• Privacy Officer
• Information security officer
• Network administrator
• Security device administrator
• Security engineers
• Similar role