Certified Information Security Manager (CISM)

Overview

The Certified Information Security Manager (CISM) certification, offered by ISACA, is a globally recognized credential designed for information security professionals who manage, design, oversee, and assess an enterprise’s information security program. 

The CISM certification validates an individual’s expertise in information security governance, risk management, program development and management, and incident management. It demonstrates the ability to align information security initiatives with organizational goals and objectives, manage information security risks effectively, and establish and maintain a robust information security program.

Target Audience

The CISM certification is ideal for experienced information security managers, IT managers, security consultants, and other professionals responsible for managing and overseeing information security within their organizations.

Objectives

These domains and their associated objectives provide a comprehensive framework for managing information security within an organization and preparing for the CISM certification exam. Candidates are expected to demonstrate proficiency in each domain to successfully pass the exam and earn the CISM certification.

• Domain 1: Information Security Governance

• • Establish and maintain an information security governance framework and supporting processes to ensure that the information security strategy aligns with organizational goals and objectives.
  • Develop and maintain an information security strategy and roadmap based on organizational priorities and risk appetite.
  • Establish and maintain information security policies, standards, procedures, and guidelines to ensure compliance with regulatory and contractual requirements.
  • Define roles and responsibilities for information security within the organization and ensure accountability for information security management.

• Domain 2: Information Risk Management

• • Identify, assess, and prioritize information security risks to the organization’s assets, including people, processes, and technology.
  • Develop and implement risk treatment plans to mitigate, transfer, accept, or avoid identified risks.
  • Monitor and report on information security risks and compliance with risk management policies and procedures.
  • Integrate information risk management into the organization’s overall risk management process to ensure alignment with business objectives and risk tolerance.

• Domain 3: Information Security Program Development and Management

• • Develop, implement, and manage an information security program that aligns with the organization’s business objectives and risk management strategy.
  • Establish and maintain information security policies, standards, procedures, and guidelines to protect the confidentiality, integrity, and availability of information assets.
  • Develop and implement security awareness and training programs to educate employees and contractors about their roles and responsibilities in safeguarding information assets.
  • Monitor and evaluate the effectiveness of the information security program and make improvements based on lessons learned and emerging threats.

• Domain 4: Information Security Incident Management

• • Develop and implement an incident response plan to detect, respond to, and recover from information security incidents.
  • Establish and maintain incident response procedures and guidelines to ensure a timely and effective response to incidents.
  • Coordinate incident response activities with internal and external stakeholders, including IT, legal, human resources, and law enforcement agencies.
  • Conduct post-incident reviews to identify root causes, lessons learned, and opportunities for improvement in the incident response process.

Benefits