Information Security Governance

• Explain the need for and the desired outcomes of an effective information security strategy
• Create an information security strategy aligned with organizational goals and objectives
• Gain stakeholder support using business cases
• Identify key roles and responsibilities needed to execute an action plan
• Establish metrics to measure and monitor the performance of security governance

Information Risk Management

• Explain the importance of risk management as a tool to meet business needs and develop a security management program to support these needs
• Identify, rank, and respond to a risk in a way that is appropriate as defined by organizational directives
• Assess the appropriateness and effectiveness of information security controls
• Report information security risk effectively

Information Security Program Development and Management

• Align information security program requirements with those of other business functions
• Manage the information security program resources
• Design and implement information security controls
• Incorporate information security requirements into contracts, agreements and third-party management processes

Information Security Incident Management

• Understand the concepts and practices of Incident Management
• Identify the components of an Incident Response Plan and evaluate its effectiveness
• Understand the key concepts of Business Continuity Planning, or BCP and Disaster Recovery Planning, or DRP
• Be familiar with techniques commonly used to test incident response capabilities

How many people hold the CISM?

More than 40,000 professionals have obtained ISACA®’s Certified Information Security Manager (CISM) certification since it was introduced in 2002.

Are there any pre-requisites to take an exam?

There are no pre-requisites to take an ISACA CISM exam. However, there are experience requirements to become certified after passing the exam. You need a minimum of five years of information security work experience, with a minimum of three years of information security management work experience in three or more of the job practice analysis areas. Having a CISSP, CISA or Security+ certification can count towards some of this experience.

What are the differences between CISA and CISM?

CISA certification is for auditors and the CISM is for information security managers and risk managers.CISM is not designed for practitioners. It is best suited for managerial positions and those making key information security management decisions.

What are the differences between CISSP and CISM?

The biggest difference between CISM and CISSP certifications is that the CISM is focused more on management and strategy, and only covers technical topics in a cursory way, while the CISSP addresses the tactical aspects of security operations and digs deeper into those areas.

The CISM certification targets experienced information security managers and those with information security management responsibilities, including information security managers, aspiring information security managers, IS/IT consultants and CIOs.

The CISM requires 5 years of experience in information security management to achieve, and mandate completion of continuing education to maintain.

Exam:

Certified Information Security Manager – CISM

Duration:

240 minutes

Questions:

150 questions

Passing Score:

450/800

Domain 1. Information Security Governance (24%) Domain 2. Information Risk Management and Compliance (33%) Domain 3. Information Security Program Development and Management (25%) Domain 4. Information Security Incident Management (18%)

Our team can deliver ISACA CISM certification training on-site, anywhere in the world, and can be tailored to fit your organization’s specific needs.

Learn more about our Enterprise Solutions here