COURSE REQUIREMENTS

There are no prerequisites for this course. There are, however, specific steps that must be taken to acquire and maintain the CISM certification:

• Pass the CISM examination;
• Submit an application for CISM certification;
• Adhere to the Code of Professional Ethics;
• Dedicate to the Continuing Professional Education Program; and
• Comply with the Information Security Standards.

COURSE SYLLABUS

Module 1 – Information Security Governance

Estimated Duration: 3 hours 30 minutes 

Session Topics:  

• Enterprise Governance Overview 
• Organizational Culture, Structures, Roles and Responsibilities 
• Legal, Regulatory and Contractual Requirements 
• Information Security Strategy 
• Information Governance Frameworks and Standards 
• Strategic Planning 

Learning Objectives:  

• Describe the role of governance in creating value for the enterprise. 
• Explain the importance of information security governance in the context of overall enterprise governance. 
• Describe the influence of enterprise leadership, structure and culture on the effectiveness of an information security strategy. 
• Identify the relevant legal, regulatory and contractual requirements that impact the enterprise. 
• Describe the effects of the information security strategy on enterprise risk management.
• Evaluate the common frameworks and standards used to govern an information security strategy. 
• Explain why metrics are critical in developing and evaluating the information security strategy. 

Module 2 – Information Security Risk Management 

Estimated Duration: 3 hours 45 minutes 

Session Topics:  

• Risk and Threat Landscape 
• Vulnerability and Control Deficiency Analysis 
• Risk Assessment, Evaluation and Analysis  
• Information Risk Response 
• Risk Monitoring, Reporting and Communication 

Learning Objectives:  

• Apply risk assessment strategies to reduce the impact of information security risk.
• Assess the types of threats faced by the enterprise. 
• Explain how security control baselines affect vulnerability and control deficiency analysis. 
• Differentiate between application of risk treatment types from an information security perspective. 
• Describe the influence of risk and control ownership on the information security program.
• Outline the process of monitoring and reporting information security risk. 

Module 3: Information Security Program Development and Management 

Estimated Duration: 6 hours 45 minutes 

Session Topics:  

• IS Program Development and Resources 
• IS Standards and Frameworks 
• Defining an IS Program Road Map 
• IS Program Metrics 
• IS Program Management 
• IS Awareness and Training 
• Integrating the Security Program with IT Operations 
• Program Communications, Reporting and Performance Management

Learning Objectives:  

• Outline the components and resources used to build an information security program.
• Distinguish between common IS standards and frameworks available to build an information security program. 
• Explain how to align IS policies, procedures and guidelines with the needs of the enterprise. 
• Describe the process of defining an IS program road map. 
• Outline key IS program metrics used to track and report progress to senior management.
• Explain how to manage the IS program using controls. 
• Create a strategy to enhance awareness and knowledge of the information security program. 
• Describe the process of integrating the security program with IT operations and third party providers. 
• Communicate key IS program information to relevant stakeholders. 

Module 4: Information Security Incident Management 

Estimated Duration: 6 hours 0 minutes 

Session Topics:  

• Incident Management and Incident Response Overview 
• Incident Management and Response Plans 
• Incident Classification/Categorization 
• Incident Management Operations, Tools and Technologies 
• Incident Investigation, Evaluation, Containment and Communication 
• Incident Eradication, Recovery and Review 
• Business Impact and Continuity 
• Disaster Recovery Planning 
• Training, Testing and Evaluation 

Learning Objectives:  

• Distinguish between incident management and incident response 
• Outline the requirements and procedures necessary to develop an incident response plan. 
• Identify techniques used to classify or categorize incidents. 
• Outline the types of roles and responsibilities required for an effective incident management and response team 
• Distinguish between the types of incident management tools and technologies available to an enterprise. 
• Describe the processes and methods used to investigate, evaluate and contain an incident. 
• Identify the types of communications and notifications used to inform key stakeholders of incidents and tests. 
• Outline the processes and procedures used to eradicate and recover from incidents.
• Describe the requirements and benefits of documenting events. 
• Explain the relationship between business impact, continuity and incident response.
• Describe the processes and outcomes related to disaster recovery. 
• Explain the impact of metrics and testing when evaluating the incident response plan.