Jawaharlal Nehru University Management Discussion

Reading & Viewing Materials
Required Materials
Whitman, Michael E., Mattord, Herbert J. (2019). Management of Information Security, Boston, MA: Cengage.
Gregory, Peter H. (2012). CISM Certified Information Security Manager All-in-One Exam Guide, New York, NY:
McGraw-Hill.
Read
•
Chapter 2 & 3 Management of Information Security (Page no 87 to 192 in the PDF version of the book shared with
you)
•
Chapter 2 CISM (Page no 54 to 233 in the PDF file of the book)
View
•
At the end of each chapter of Management of Information Security
Hi I have attached the PDF File of the book in google link
Discussion Topic
Answer two of the following questions:
DQ1:
What is your definition of Security Governance and how is it conducted in the organization using
different tools, models, concepts and strategies?
DQ2:
In reviewing the controls on page 84 of CISM, provide some examples besides what is offered
there that would be outcomes of one of those controls.
DQ3
What is the difference between compliance law and ethics?
•
•
•
Assignment Format: Blackboard Discussion Board Thread
Submission Format: Paragraph format
Length: 300 words initial post; at least two 150 word minimum responses to classmates; Answer
instructor questions, Citations Required: wherever required.
ABOUT THE AUTHOR
Peter H. Gregory, CISM, CISA, CRISC, CISSP, CCISO, CCSK,
PCI-QSA, is a 30-year career technologist and an executive
director at Optiv Security, the largest pure-play
cybersecurity solutions provider in the Americas. He has
been developing and managing information security
management programs since 2002 and has been leading
the development and testing of secure IT environments
since 1990. In addition, he has spent many years as a
software engineer and architect, systems engineer, network
engineer, security engineer, and systems operator.
Throughout his career, he has written many articles, white
papers, user manuals, processes, and procedures, and he
has conducted numerous lectures, training classes,
seminars, and university courses.
Peter is the author of more than 40 books about
information security and technology, including Solaris
Security, CISSP Guide to Security Essentials, and CISA
Certified Information Systems Auditor All-In-One Study
Guide. He has spoken at numerous industry conferences
including RSA, Interop, SecureWorld Expo, West Coast
Security Forum, IP3, Society for Information Management,
the Washington Technology Industry Association, and
InfraGard.
Peter is an advisory board member at the University of
Washington’s certificate program in information security and
risk management, the lead instructor (emeritus) and
advisory board member for the University of Washington
certificate program in cybersecurity, a former board
member of the Washington State chapter of InfraGard, and
a founding member of the Pacific CISO Forum. He is a 2008
graduate of the FBI Citizens’ Academy and a member of the
FBI Citizens’ Academy Alumni Association.
Peter resides with his family in the Seattle, Washington,
area and can be found at www.peterhgregory.com.
About the Technical Editor
Jay Burke, CISSP, CISM, is a highly accomplished
information security professional with more than 20 years of
operational and executive experience across a variety of
industries.
Mr. Burke has worked with customers of different sizes
and types to build, enhance, and manage best-in-class
cybersecurity programs. As an executive-level security
professional he has led detailed maturity assessments as
well as facilitated executive workshops to assist CISOs in
maturing their cybersecurity programs. His practical
experience includes engagements addressing strategic
consulting, project management, regulatory compliance
(Sarbanes–Oxley, Payment Card Industry, NERC CIP, HIPAA,
SOC 1 and 2), and cybersecurity program development
leveraging ISO 27001/2, NIST 800-53, Cloud Security
Alliance CCM, Shared Assessments SIG, and Unified
Compliance Framework.
Jay currently serves as the director of strategy and
governance for Kudelski Security, an independent
cybersecurity solutions provider supporting large enterprise
and public-sector clients in Europe and the United States.
Copyright © 2018 by McGraw-Hill Education. All rights
reserved. Except as permitted under the United States
Copyright Act of 1976, no part of this publication may be
reproduced or distributed in any form or by any means, or
stored in a database or retrieval system, without the prior
written permission of the publisher, with the exception that
the program listings may be entered, stored, and executed
in a computer system, but they may not be reproduced for
publication.
ISBN: 978-1-26-002704-4
MHID: 1-26-002704-X
The material in this eBook also appears in the print version
of this title: ISBN: 978-1-26-002703-7,
MHID: 1-26-002703-1.
eBook conversion by codeMantra
Version 1.0
All trademarks are trademarks of their respective owners.
Rather than put a trademark symbol after every occurrence
of a trademarked name, we use names in an editorial
fashion only, and to the benefit of the trademark owner,
with no intention of infringement of the trademark. Where
such designations appear in this book, they have been
printed with initial caps.
McGraw-Hill Education eBooks are available at special
quantity discounts to use as premiums and sales promotions
or for use in corporate training programs. To contact a
representative, please visit the Contact Us page at
www.mhprofessional.com.
Information has been obtained by McGraw-Hill Education
from sources believed to be reliable. However, because of
the possibility of human or mechanical error by our sources,
McGraw-Hill Education, or others, McGraw-Hill Education
does not guarantee the accuracy, adequacy, or
completeness of any information and is not responsible for
any errors or omissions or the results obtained from the use
of such information.
TERMS OF USE
This is a copyrighted work and McGraw-Hill Education and
its licensors reserve all rights in and to the work. Use of this
work is subject to these terms. Except as permitted under
the Copyright Act of 1976 and the right to store and retrieve
one copy of the work, you may not decompile, disassemble,
reverse engineer, reproduce, modify, create derivative
works based upon, transmit, distribute, disseminate, sell,
publish or sublicense the work or any part of it without
McGraw-Hill Education’s prior consent. You may use the
work for your own noncommercial and personal use; any
other use of the work is strictly prohibited. Your right to use
the work may be terminated if you fail to comply with these
terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION
AND ITS LICENSORS MAKE NO GUARANTEES OR
WARRANTIES AS TO THE ACCURACY, ADEQUACY OR
COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM
USING THE WORK, INCLUDING ANY INFORMATION THAT CAN
BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR
OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE. McGraw-Hill Education and its
licensors do not warrant or guarantee that the functions
contained in the work will meet your requirements or that
its operation will be uninterrupted or error free. Neither
McGraw-Hill Education nor its licensors shall be liable to you
or anyone else for any inaccuracy, error or omission,
regardless of cause, in the work or for any damages
resulting therefrom. McGraw-Hill Education has no
responsibility for the content of any information accessed
through the work. Under no circumstances shall McGraw-Hill
Education and/or its licensors be liable for any indirect,
incidental, special, punitive, consequential or similar
damages that result from the use of or inability to use the
work, even if any of them has been advised of the possibility
of such damages. This limitation of liability shall apply to
any claim or cause whatsoever whether such claim or cause
arises in contract, tort or otherwise.
To current and aspiring security managers everywhere who
want
to do the right thing, through professional growth and
practicing
sound security and risk management techniques, to keep
their
organizations out of trouble.
CONTENTS AT A GLANCE
Chapter 1 Becoming a CISM
Chapter 2 Information Security Governance
Chapter 3 Information Risk Management
Chapter 4 Information Security Program Development and
Management
Chapter 5 Information Security Incident Management
Appendix About the Download
Glossary
Index
CONTENTS
Acknowledgments
Introduction
Chapter 1 Becoming a CISM
Benefits of CISM Certification
Becoming a CISM Professional
Experience Requirements
ISACA Code of Professional Ethics
The Certification Exam
Exam Preparation
Before the Exam
Day of the Exam
After the Exam
Applying for CISM Certification
Retaining Your CISM Certification
Continuing Education
CPE Maintenance Fees
Revocation of Certification
Summary
Chapter 2 Information Security Governance
Introduction to Information Security Governance
Reason for Security Governance
Security Governance Activities and Results
Business Alignment
Roles and Responsibilities
Monitoring Responsibilities
Information Security Governance Metrics
The Security Balanced Scorecard
Business Model for Information Security
Security Strategy Development
Strategy Objectives
Control Frameworks
Risk Objectives
Strategy Resources
Strategy Development
Strategy Constraints
Chapter Review
Notes
Questions
Answers
Chapter 3 Information Risk Management
Risk Management Concepts
The Importance of Risk Management
Outcomes of Risk Management
Risk Management Technologies
Implementing a Risk Management Program
Risk Management Strategy
Risk Management Frameworks
Risk Management Context
Gap Analyses
External Support
The Risk Management Life Cycle
The Risk Management Process
Risk Management Methodologies
Asset Identification and Valuation
Asset Classification
Asset Valuation
Threat Identification
Vulnerability Identification
Risk Identification
Risk, Likelihood, and Impact
Risk Analysis Techniques and Considerations
Operational Risk Management
Risk Management Objectives
Risk Management and Business Continuity Planning
Third-Party Risk Management
The Risk Register
Integration of Risk Management into Other Processes
Risk Monitoring and Reporting
Key Risk Indicators
Training and Awareness
Risk Documentation
Chapter Review
Notes
Questions
Answers
Chapter 4 Information Security Program Development and
Management
Information Security Programs
Outcomes
Charter
Scope
Information Security Management Frameworks
Defining a Road Map
Information Security Architecture
Security Program Management
Security Governance
Risk Management
The Risk Management Program
The Risk Management Process
Risk Treatment
Audits and Reviews
Policy Development
Third-Party Risk Management
Administrative Activities
Security Program Operations
Event Monitoring
Vulnerability Management
Secure Engineering and Development
Network Protection
Endpoint Protection and Management
Identity and Access Management
Security Incident Management
Security Awareness Training
Managed Security Services Providers
Data Security
Business Continuity Planning
IT Service Management
Service Desk
Incident Management
Problem Management
Change Management
Configuration Management
Release Management
Service-Level Management
Financial Management
Capacity Management
Service Continuity Management
Availability Management
Asset Management
Controls
Control Classification
Internal Control Objectives
Information Systems Control Objectives
General Computing Controls
Control Frameworks
Controls Development
Control Assessment
Metrics and Monitoring
Types of Metrics
Audiences
Continuous Improvement
Chapter Review
Notes
Questions
Answers
Chapter 5 Information Security Incident Management
Security Incident Response Overview
Phases of Incident Response
Incident Response Plan Development
Objectives
Maturity
Resources
Roles and Responsibilities
Gap Analysis
Plan Development
Responding to Security Incidents
Detection
Initiation
Evaluation
Eradication
Recovery
Remediation
Closure
Post-incident Review
Business Continuity and Disaster Recovery Planning
Business Continuity Planning
Disaster Recovery Planning
Testing BC and DR Plans
Chapter Review
Notes
Questions
Answers
Appendix About the Download
System Requirements
Installing and Running Total Tester
About Total Tester
Technical Support
Glossary
Index
Figure Credits
Figure 2-2 Adapted from The Business Model for Information
Security, ISACA.
Figure 2-4 Adapted from The University of Southern
California, Marshall School of Business,
Institute for Critical Information
Infrastructure Protection, USA.
Figure 2-5 Courtesy Xhienne: SWOT pt.svg, CC BY-SA 2.5,
https://commons.wikimedia.org/w/index.p
hp?curid=2838770.
Figure 2-6 Courtesy High Tech Security Solutions Magazine.
Figure 3-2 Source: National Institute for Standards and
Technology.
Figure 4-1 Courtesy The Open Group.
Figure 4-9 Courtesy Bluefoxicy at en.wikipedia.org.
Figure 5-3 Source: NASA.
ACKNOWLEDGMENTS
I am especially grateful to Wendy Rinaldi for affirming the
need to have this book published on a tight timeline. My
readers, including current and future security managers,
deserve nothing less.
Heartfelt thanks to Claire Yee for proficiently managing
this project, facilitating rapid turnaround, and equipping me
with information I needed to produce the manuscript.
I would like to thank my former consulting colleague, Jay
Burke, who took on the task of tech reviewing the
manuscript. Jay carefully and thoughtfully scrutinized the
entire draft manuscript and made scores of useful
suggestions that have improved the book’s quality and
value for readers.
Many thanks to Jody McKenzie and Vivek Khandelwal for
managing the editorial and production ends of the project,
and to Kim Wimpsett for copyediting the book and further
improving readability. Much appreciation to MPS Limited for
expertly rendering my sketches into beautifully clear line art
and for laying out the pages. Like Olympic athletes, they
make hard work look easy.
Many thanks to my literary agent, Carole Jelen, for diligent
assistance during this and other projects. Sincere thanks to
Rebecca Steele, my business manager and publicist, for her
long-term vision and for keeping me on track.
Despite having written more than 40 books, I have
difficulty putting into words my gratitude for my wife,
Rebekah, for tolerating my frequent absences (in the home
office and away on business travel) while I developed the
manuscript. This project could not have been completed
without her loyal and unfailing support.
INTRODUCTION
The dizzying pace of information systems innovation has
made vast expanses of information available to
organizations and the public. Often, design flaws and
technical vulnerabilities bring unintended consequences,
usually in the form of information theft and disclosure. The
result: a patchwork of laws, regulations, and standards such
as Sarbanes–Oxley, GDPR, Gramm-Leach-Bliley, HIPAA, PCIDSS, PIPEDA, NERC CIP, and scores of U.S. state laws
requiring public disclosure of security breaches involving
private information. Through these, organizations are either
required or incentivized to build or improve their information
security programs to avoid security breaches, penalties,
sanctions, and embarrassing news headlines.
These developments continue to drive demand for
information security professionals and information security
leaders. These highly sought professionals play a crucial
role in the development of better information security
programs that result in reduced risk and improved
confidence.
The Certified Information Security Manager (CISM)
certification, established in 2002, is the leading certification
for information security management. Demand for the CISM
certification has grown so much that the once-per-year
certification exam was changed to twice per year in 2005
and is now offered multiple times each year. In 2005, the
CISM certification was awarded accreditation by the
American National Standards Institute (ANSI) under
international standard ISO/IEC 17024. CISM is also one of
the few certifications formally approved by the U.S.
Department of Defense in its Information Assurance
Technical category (DoD 8570.01-M). In 2017, CISM was a
finalist in SC Magazine’s Best Professional Certification
Program. There are now more than 34,000 professionals
with the certification.
Purpose of This Book
Let’s get the obvious out of the way: this is a comprehensive
study guide for the security management professional who
needs a serious reference for individual or group-led study
for the Certified Information Security Manager (CISM)
certification. The content in this book contains the technical
information that CISM candidates are required to know. This
book is one source of information to help you prepare for
the CISM exam but should not be thought of as the ultimate
collection of all the information and experience that ISACA
expects qualified CISM candidates to possess. No one
publication covers all of this information.
This book is also a reference for aspiring and practicing IT
security managers and CISOs. The content that is required
to pass the CISM exam is the same content that practicing
security managers need to be familiar with in their day-today work. This book is an ideal CISM exam study guide as
well as a desk reference for those who have already earned
their CISM certification.
This book is also invaluable for information security
professionals who are not in a leadership position today. You
will gain considerable insight into today’s information
security management challenges. This book is also useful
for IT and business management professionals who work
with information security leaders and need to better
understand what they are doing and why.
This book is an excellent guide for anyone exploring a
security management career. The study chapters explain all
the relevant technologies, techniques, and processes used
to manage a modern information security program. This is
useful if you are wondering what the security management
profession is all about.
How This Book Is Organized
This book is logically divided into four major sections:
• Introduction The “front matter” of the book and Chapter
1 provide an overview of the CISM certification and
the information security management profession.
• CISM study material Chapters 2 through 5 contain
everything a studying CISM candidate is responsible
for. This same material is a handy desk reference for
aspiring and practicing information security
managers.
• Glossary There are more than 550 terms used in the
information security management profession.
• Practice exams Appendix explains the online CISM
practice exam and Total Tester software
accompanying this book.
CHAPTER 1
Becoming a CISM
In this chapter, you will learn about
• What it means to be a CISM-certified professional
• ISACA, its code of ethics, and its standards
• The certification process
• How to apply for the exam
• How to maintain your certification
• How to get the most from your CISM journey
Congratulations on choosing to become a Certified
Information Security Manager (CISM)! Whether you have
worked for several years in the field of information security
or have just recently been introduced to the world of
security, governance, risk management, and disaster
recovery planning, don’t underestimate the hard work and
dedication required to obtain and maintain CISM
certification. Although ambition and motivation are required,
the rewards can far exceed the effort.
You may not have imagined you would find yourself
working in the world of information security (or infosec, as
it’s often called) or looking to obtain an information security
management certification. Perhaps the increase in
legislative or regulatory requirements for information
system security led to your introduction to this field. Or
possibly you have noticed that CISM-related career options
are increasing exponentially and you have decided to get
ahead of the curve. You aren’t alone: in the past 15 years,
more than 34,000 professionals worldwide reached the
same conclusion and have earned the well-respected CISM
certification. In its 2016 salary survey, Global Knowledge
ranked CISM as one of the top three paying certifications for
2016. CISM was selected as a 2014 SC Magazine Award
Finalist for Best Professional Certification Program. The IT
Skills and Certifications Pay Index from Foote Partners
consistently ranks CISM among the most sought-after IT
certifications. In 2017, CISM was a finalist in SC Magazine’s
Best Professional Certification Program and was a finalist for
Best Professional Training or Certification Programme at SC
Awards Europe. It’s hard to find a professional certification
with so many accolades. Welcome to the journey and the
amazing opportunities that await you.
I have put together this information to help you further
understand the commitment needed, prepare for the exam,
and maintain your certification. Not only is it my wish to see
you pass the exam with flying colors, but I also provide you
with the information and resources to maintain your
certification and to proudly represent yourself and the
professional world of information security management with
your new credentials.
ISACA (formerly known as the Information Systems Audit
and Control Association) is a recognized leader in the areas
of control, assurance, and IT governance. Formed in 1967,
this nonprofit organization represents more than 140,000
professionals in more than 180 countries. ISACA administers
several exam certifications, including the CISM, the Certified
Information Systems Auditor (CISA), the Certified in Risk and
Information Systems Control (CRISC), and the Certified in
the Governance of Enterprise IT (CGEIT) certifications. The
CISM certification program has been accredited by the
American National Standards Institute (ANSI) under
International Organization for Standardization and
International Electrotechnical Commission standard ISO/IEC
17024:2003, which means that ISACA’s procedures for
accreditation meet international requirements for quality,
continuous improvement, and accountability. If you’re new
to ISACA, I recommend you tour the web site and become
familiar with the guides and resources available. In addition,
if you’re near one of the 200+ local ISACA chapters in 80+
countries, consider taking part in the activities and even
reaching out to the chapter board for information on local
meetings, training days, conferences, and study sessions.
You may be able to meet other information security
professionals who can give you additional insight into the
CISM certification and the information security management
profession.
The CISM certification was established in 2002 and
primarily focuses on security management, security
governance, risk management, and business continuity
planning. It certifies the individual’s knowledge of
establishing information security strategies, building and
managing an information security program, preparing for
and responding to security incidents, and business
continuity planning. Organizations seek out qualified
personnel for assistance with developing and maintaining
strong and effective security programs. A CISM-certified
individual is a great candidate for this.
Benefits of CISM Certification
Obtaining the CISM certification offers several significant
benefits:
• Expands knowledge and skills; builds confidence
Developing knowledge and skills in the areas of
security strategy, building and managing a security
program, and responding to incidents can prepare you
for advancement or expand your scope of
responsibilities. The personal and professional
achievement can boost confidence that encourages
you to move forward and seek new career
opportunities.
• Increases marketability and career options Because
of various legal and regulatory requirements, such as
the Health Insurance Portability and Accountability Act
(HIPAA), Payment Card Industry Data Security
Standard (PCI-DSS), Sarbanes–Oxley, Gramm Leach
Bliley Act (GLBA), Food and Drug Administration (FDA),
Federal Energy Regulatory Commission/North
American Electric Reliability Corporation (FERC/NERC),
and the European General Data Protection Regulation
(GDPR), demand is growing for individuals with
experience in developing and running security
programs. In addition, obtaining your CISM
certification demonstrates to current and potential
employers your willingness and commitment to
improve your knowledge and skills in information
systems management. Having a CISM certification can
provide a competitive advantage and open up many
doors of opportunity in various industries and
countries.
• Meets employment requirements Many government
agencies and organizations are requiring CISM
certifications for positions involving information
security management and information assurance. One
example is the United States Department of Defense
(DoD). DoD Directive 8570 mandates that those
personnel performing information assurance activities
within the agency are certified with a commercial
accreditation approved by the DoD. The DoD has
approved the ANSI-accredited CISM certificate
program because it meets ISO/IEC 17024:2003
requirements. All Information Assurance Management
(IAM) Level III personnel are mandated to obtain CISM
certification, as are those who are contracted to
perform similar activities.
• Builds customer confidence and international
credibility Prospective customers needing security
management work will have faith that the quality of
the strategies and execution are in line with
internationally recognized practices and standards.
Regardless of your current position, demonstrating
knowledge and experience in the areas of security strategy
and security management can expand your career options.
The certification does not limit you to security management;
it can provide additional value and insight to those in or
seeking the following positions:
• Executives such as chief executive officers (CEOs), chief
financial officers (CFOs), and chief information officers
(CIOs)
• IT management executives such as chief information
officers (CIOs), chief technology officers (CTOs),
directors, managers, and staff
• Chief audit executives, audit partners, and audit directors
• Chief privacy officers (CPOs), data protection officers
(DPOs), and other privacy professionals
• Compliance executives and management
• Seurity and audit consultants
Becoming a CISM Professional
To become a CISM professional, you are required to pay the
exam fee, pass the exam, prove that you have the required
experience and education, and agree to uphold ethics and
standards. To keep your CISM certification, you are required
to take at least 20 continuing education hours each year
(120 hours in three years) and pay annual maintenance
fees. This is depicted in Figure 1-1.
Figure 1-1 The CISM certification life cycle
The following list outlines the major requirements for
becoming certified:
• Experience A CISM candidate must be able to submit
verifiable evidence of at least five years of
experience, with a minimum of three years of
professional work experience in three or more of the
CISM job practice areas. Experience must be verified
and must be gained within the ten-year period
preceding the application date for certification or
within five years from the date of passing the exam.
Substitution and waiver options for up to three years
of experience are available.
• Ethics Candidates must commit to adhere to ISACA’s
Code of Professional Ethics, which guides the personal
and professional conduct of those certified.
• Exam Candidates must receive a passing score on the
CISM exam. A passing score is valid for up to five
years, after which the score is void. This means that a
CISM candidate who passes the exam has a maximum
of five years to apply for CISM certification; candidates
who pass the exam but fail to act after five years will
have to take the exam again if they want to become
CISM certified.
• Education Those certified must adhere to the CISM
Continuing Professional Education Policy, which
requires a minimum of 20 continuing professional
education (CPE) hours each year, with a total
requirement of 120 CPEs over the course of the
certification period (three years).
• Application After successfully passing the exam, meeting
the experience requirements, and having read
through the Code of Professional Ethics and
Standards, a candidate is ready to apply for
certification. An application must be received within
five years of passing the exam.
Experience Requirements
To qualify for CISM certification, you must have completed
the equivalent of five years of total work experience. These
five years can take many forms, with several substitutions
available. Additional details on the minimum certification
requirements, substitution options, and various examples
are discussed next.
NOTE Although it is not recommended, a CISM candidate
can take the exam before completing any work experience
directly related to information security management. As
long as the candidate passes the exam and the work
experience requirements are filled within five years of the
exam date and within ten years from the application for
certification, the candidate is eligible for certification.
Direct Work Experience
You are required to have a minimum of three years of work
experience in the field of security strategy and
management. This is equivalent to 6000 actual work hours,
which must be related to three or more of the CISM job
practice areas, as follows:
• Information security governance Establish and/or
maintain an information security governance
framework and supporting processes to ensure that
the information security strategy is aligned with
organizational goals and objectives.
• Information risk management Manage information risk
to an acceptable level based on risk appetite to meet
organizational goals and objectives.
• Security program development and management
Develop and maintain an information security
program that identifies, manages, and protects the
organization’s assets while aligning to information
security strategy and business goals, thereby
supporting an effective security posture.
• Information security incident management Plan,
establish, and manage the capability to detect,
investigate, respond to, and recover from information
security incidents to minimize business impact.
All work experience must be completed within the tenyear period before completing the certification application
or within five years from the date of initially passing the
CISM exam. You will need to complete a separate
Verification of Work Experience form for each segment of
experience.
There is only one exception to this minimum three-year
direct work experience requirement: if you are a full-time
instructor. This option is discussed in the next section.
Substitution of Experience
Up to a maximum of three years of direct work experience
can be substituted with the following to meet the five-year
experience requirement.
Two Years
• Certified Information Systems Auditor (CISA) in good
standing.
• Certified Information Systems Security Professional
(CISSP) in good standing.
• A post-graduate degree in information security or a
related field can be substituted for two years of direct
work experience. Transcripts or a letter confirming
degree status must be sent from the university
attended to obtain the experience waiver.
One Year
• One full year of information systems management
experience
• One full year of general security management experience
• Skills-based security certifications (e.g., GIAC, MCSE,
Security+, CBCP, ESL IT Security Manager)
• Completion of an information security management
program at an institution aligned with the Model
Curriculum
As noted earlier, there is only one exception to the
experience requirements. Should you have experience as a
full-time university instructor teaching the management of
information security, each two years of your experience can
be substituted for one year of required direct work
experience, without limitation.
Here is an example CISM candidate whose experience and
education are considered for CISM certification: Jane Doe
graduated in 2000 with a bachelor’s degree in computer
science. She spent five years working for a software
company managing IT, and in January 2005, she began
managing information security. In January 2007, she took
some time off work for personal reasons. In 2012, she
earned her Security+ certification and rejoined the
workforce in December 2013, working for a public company
in its enterprise risk management department as a risk
manager. Jane passed the CISM exam in June 2014 and
applied for CISM certification in January 2015. Does Jane
have all of the experience required? What evidence will she
need to submit?
• Skills-based certification Jane obtained her Security+
certification, which equates to a one-year experience
substitution.
• Two years of direct experience She can count her two
full years of information security management
experience in 2005 and 2006.
• One-year substitution She cannot take into account one
year of IT management experience completed
between January 2000 to January 2005, as it was not
completed within ten years of her application.
• One-year direct experience Jane would want to utilize
her new risk manager experience for work experience.
Jane would need to send the following with her application
to prove the experience requirements are met:
• Verification of Work Experience forms filled out and signed
by her supervisors (or any superior) at the software
company and the public company, verifying both the
security management and nonsecurity management
work conducted
• Transcripts or letter confirming degree status sent from
the university
NOTE I recommend you also read the CISM certification
qualifications on the ISACA web site. From time to time
ISACA does change the qualification rules, and I want you to
have the most up-to-date information available.
ISACA Code of Professional Ethics
Becoming a CISM professional means you agree to adhere
to the ISACA Code of Professional Ethics. The code of ethics
is a formal document outlining those things you will do to
ensure the utmost integrity and that best support and
represent the organization and certification.
Specifically, the ISACA code of ethics requires ISACA
members and certification holders to do the following:
• Support the implementation of, and encourage
compliance with, appropriate standards and
procedures for the effective governance and
management of enterprise information systems and
technology, including audit, control, security, and risk
management.
• Perform their duties with objectivity, due diligence, and
professional care, in accordance with professional
standards.
• Serve in the interest of stakeholders in a lawful manner,
while maintaining high standards of conduct and
character and not discrediting their profession or the
association.
• Maintain the privacy and confidentiality of information
obtained in the course of their activities unless
disclosure is required by legal authority. Such
information shall not be used for personal benefit or
released to inappropriate parties.
• Maintain competency in their respective fields and agree
to undertake only those activities they can reasonably
expect to complete with the necessary skills,
knowledge, and competence.
• Inform appropriate parties of the results of work
performed including the disclosure of all significant
facts known to them that, if not disclosed, may distort
the reporting of the results.
• Support the professional education of stakeholders in
enhancing their understanding of the governance and
management of enterprise information systems and
technology, including audit, control, security, and risk
management.
Failure to comply with this Code of Professional Ethics can
result in an investigation into a member’s or certification
holder’s conduct and, ultimately, in disciplinary measures.
You can find the full text and terms of enforcement of the
ISACA Code of Ethics at www.isaca.org/ethics.
The Certification Exam
The certification is offered throughout the year in several
examination windows. You have several ways to register;
however, regardless of the method you choose, I highly
recommend you plan ahead and register early.
In 2018 the schedule of exam fees in U.S. dollars is
• CISM application fee: $50
• Regular registration: $575 member/$760 nonmember
The test is administered by an ISACA-sponsored location.
For additional details on the location nearest you, see the
ISACA web site.
Once registration is complete, you will immediately
receive an e-mail acknowledging your registration. Next,
you will need to schedule your certification exam. The ISACA
web site will direct you to the certification registration page
where you will select a date, time, and location to take your
exam. When you confirm the date, time, and location for
your exam, you will receive a confirmation via e-mail. You
will need the confirmation to enter the test location—make
sure to keep it unmarked and in a safe place until test time.
When you arrive at the test site, you will be required to
sign in, and you may be required to sign an agreement.
Also, you will be required to turn in your smartphone, wallet
or purse, and other personal items for safekeeping. The
exam proctor will read aloud the rules you are required to
follow while you take your exam. These rules will address
matters such as breaks, drinking water, and snacks.
While you take your exam, you will be supervised by the
proctor, and possibly you will be monitored by video
surveillance to make sure that no one can cheat on the
exam.
Each registrant has four hours to take the multiple-choice
question exam. There are 150 questions on the exam
representing the five job practice areas. The exam is
computerized. Each question has four answer choices; testtakers can select only one best answer. You can skip
questions and return to them later, and you can also flag
questions that you want to review later if time permits.
While you are taking your exam, the time remaining will
appear on the screen.
When you have completed the exam, you are directed to
close the exam. At that time, the exam will display your
pass or fail status, with a reminder that your score and
passing status is subject to review.
You will be scored for each job practice area and then
provided one final score. All scores are scaled. Scores range
from 200 to 800; however, a final score of 450 is required to
pass.
Exam questions are derived from a job practice analysis
study conducted by ISACA. The areas selected represent
those tasks performed in a CISM’s day-to-day activities and
represent the background knowledge required to develop
and manage an information security program. You can find
more detailed descriptions of the task and knowledge
statements at www.isaca.org/CISMjobpractice.
The CISM exam is quite broad in its scope. The exam
covers four job practice areas, as shown in Table 1-1.
Table 1-1 CISM Exam Practice Areas
Independent committees have been developed to
determine the best questions, review exam results, and
statistically analyze the results for continuous improvement.
Should you come across a horrifically difficult or strange
question, do not panic. This question may have been written
for another purpose. A few questions on the exam are
included for research and analysis purposes and will not be
counted against your score. The exam includes no
indications in this regard.
Exam Preparation
The CISM certification requires a great deal of knowledge
and experience from the CISM candidate. You need to map
out a long-term study strategy to pass the exam. The
following sections offer some tips and are intended to help
guide you to, through, and beyond exam day.
Before the Exam
Consider the following list of tips on tasks and resources for
exam preparation. They are listed in sequential order.
1. Read the candidate’s guide For information on the
certification exam and requirements for the current
year, see www.isaca.org/Certification/Pages/CandidatesGuide-for-Exams.aspx.
2. Register If you are able, register early for any cost
savings and to solidify your commitment to moving
forward with this professional achievement.
3. Schedule your exam Find a location, date and time,
and commit.
4. Become familiar with the CISM job practice areas
The job practice areas serve as the basis for the exam
and requirements. Beginning with the 2017 exam, the
job practice areas have changed. Ensure your study
materials align with the current list, shown at
www.isaca.org/CISMjobpractice.
5. Know your best learning methods Everyone has
preferred styles of learning, whether it’s self-study, a
study group, an instructor-led course, or a boot camp.
Try to set up a study program that leverages your
strengths.
6. Self-assess Run through practice exam questions
available for download (see the appendix for more
information). You may also go to the ISACA web site for
a free 50-question CISM self-assessment.
7. Iterative study Depending on how much work
experience in information security management you
have already, I suggest you plan your study program to
take at least two months but as long as six months.
During this time, periodically take practice exams and
note your areas of strength and weakness. Once you
have identified your weak areas, focus on those areas
weekly by rereading the related sections in this book
and retaking practice exams, and note your progress.
8. Avoid cramming We’ve all seen the books on the
shelves with titles that involve last-minute cramming.
Just one look on the Internet reveals a variety of web
sites that cater to teaching individuals how to most
effectively cram for exams. There are also research sites
claiming that exam cramming can lead to susceptibility
to colds and flu, sleep disruptions, overeating, and
digestive problems. One thing is certain: many people
find that good, steady study habits result in less stress
and greater clarity and focus during the exam. Because
of the complexity of this exam, I highly recommend the
long-term, steady-study option. Study the job practice
areas thoroughly. There are many study options. If time
permits, investigate the many resources available to
you.
9. Find a study group Many ISACA chapters and other
organizations have formed specific study groups or offer
less expensive exam review courses. Contact your local
chapter to see whether these options are available to
you. In addition, be sure to keep your eye on the ISACA
web site. And use your local network to find out whether
there are other local study groups and other helpful
resources.
10. Confirmation letter Check your confirmation letter
again. Do not write on or lose it. Put it in a safe place,
and take note of what time you will need to arrive at the
site. Note this on your calendar. Confirm that the
location is the one you selected and located near you.
11. Logistics check Check the candidate’s guide and your
confirmation letter for the exact time you are required
to report to the test site. Check the site a few days
before the exam—become familiar with the location and
tricks to getting there. If you are taking public
transportation, be sure you are looking at the schedule
for the day of the exam: if your CISM exam is scheduled
on a Saturday, public transportation schedules may
differ from weekday schedules. If you are driving, know
the route and where to park your vehicle.
12. Pack Place your confirmation letter and a photo ID in a
safe place, ready to go. Your ID must be a current,
government-issued photo ID that matches the name on
the confirmation letter and must not be handwritten.
Examples of acceptable forms of ID are passports,
driver’s licenses, state IDs, green cards, and national
IDs. Make sure you leave food, drinks, laptops, cell
phones, and other electronic devices behind, as they are
not permitted at the test site. For information on what
can and cannot be brought to the exam site, see
www.isaca.org/CISMbelongings.
13. Notification decision Decide whether you want your
test results e-mailed to you. You will have the
opportunity to consent to an e-mail notification of the
exam results. If you are fully paid (zero balance on exam
fee) and have consented to the e-mail notification, you
should receive a one-time e-mail approximately eight
weeks from the date of the exam with the results.
14. Sleep Make sure you get a sound night’s sleep before
the exam. Research suggests that you avoid caffeine at
least four hours before bedtime, keep a notepad and
pen next to the bed to capture late-night thoughts that
might keep you awake, eliminate as much noise and
light as possible, and keep your room a good
temperature for sleeping. In the morning, rise early so
as not to rush and subject yourself to additional stress.
Day of the Exam
All of your preparation for the CISM certification culminates
on the day you scheduled to take your exam. On the day of
the exam, follow these tips:
• Arrive early Check the Bulletin of Information and your
confirmation letter for the exact time you are required
to report to the test site. The confirmation letter or the
candidate’s guide explains that you must be at the
test site no later than approximately 30 minutes
before testing time. The examiner will begin reading
the exam instructions at this time, and any latecomers
will be disqualified from taking the test and will not
receive a refund of fees.
• Observe test center rules There may be rules about
taking breaks. This will be discussed by the examiner
along with exam instructions. If at any time during the
exam you need something and are unsure as to the
rules, be sure to ask first. For information on conduct
during the exam, see www.isaca.org/CISMbelongings.
• Answer all exam questions Read questions carefully,
but do not try to overanalyze. Remember to select the
best solution. There may be several reasonable
answers, but one is better than the others. If you
aren’t sure about an answer, you can mark the
question and come back to it later. After going through
all the questions, you can return to the marked
questions (and any others) to read them and consider
them more carefully. Above all, don’t try to overanalyze questions, and do trust your instincts. Do not
try to rush through the exam, as there is plenty of
time to take as much as a few minutes for each
question. But at the same time, do watch the clock so
that you don’t find yourself going too slowly that you
won’t be able to thoughtfully answer every question.
• Note your exam result When you have completed the
exam, you should be able to see your pass/fail result.
Your results may not be in large, blinking text; you
may need to read the fine print to get your
preliminary results. If you passed, congratulations! If
you did not pass, do observe any remarks about your
status; you will be able to retake the exam—there is
information about this on the ISACA web site.
If You Did Not Pass
If you did not pass your exam on the first attempt, don’t
lose heart. Instead, remember that failure is a stepping
stone to success. Thoughtfully take stock and determine
your improvement areas. Go back to this book’s practice
exams and be honest with yourself regarding those areas
where you need to learn more. Reread the chapters or
sections where you need to improve your knowledge. If you
participated in a study group or training, contact your study
group coach or class instructor if you feel you can get any
advice from them on how to study up on the topics you
need to master. Do take at least several weeks to study
those topics, and refresh yourself on other topics; then give
it another go. Success is granted to those who are
persistent and determined.
After the Exam
A few weeks from the date of the exam, you will receive
your exam results by e-mail or postal mail. Each job practice
area score will be noted in addition to the overall final score.
All scores are scaled. Should you receive a passing score,
you will also receive the application for certification.
Those unsuccessful in passing will also be notified. These
individuals will want to take a close look at the job practice
area scores to determine areas for further study. They may
retake the exam as many times as needed on future exam
dates, as long as they have registered and paid the
applicable fees. Regardless of pass or fail, exam results will
not be disclosed via telephone, fax, or e-mail (with the
exception of the consented e-mail notification).
NOTE You are not permitted to display the CISM moniker
until you have completed certification. Passage of the exam
is not sufficient to use the CISM designation anywhere,
including e-mail, resumes, correspondence, or social media.
Applying for CISM Certification
To apply for certification, you must be able to submit
evidence of a passing score and related work experience.
Keep in mind that once you receive a passing score, you
have five years to use this score on a CISM certification
application. After this time, you will need to take the exam
again. In addition, all work experience submitted must have
been within ten years of your new certification application.
To complete the application process, you need to submit
the following information:
• CISM application Note the exam ID number as found in
your exam results letter, list the information security
management experience and any experience
substitutions, and identify which CISM job practice
area (or areas) your experience pertains to.
• Verification of Work Experience forms These must be
filled out and signed by your immediate supervisor or
a person of higher rank in the organization to verify
your work experience noted on the application. You
must fill out a complete set of Verification of Work
Experience forms for each separate employer.
• Transcript or letter If you are using an educational
experience waiver, you must submit an original
transcript or letter from the college or university
confirming degree status.
As with the exam, after you’ve successfully mailed the
application, you must wait approximately eight weeks for
processing. If your application is approved, you will receive
an e-mail notification, followed by a package in the mail
containing your letter of certification, certificate, and a copy
of the Continuing Professional Education Policy. You can then
proudly display your certificate and use the “CISM”
designation on your résumé, e-mail and social media
profiles, and business cards.
NOTE You are permitted to use the CISM moniker only after
receiving your certification letter from ISACA.
Retaining Your CISM Certification
There is more to becoming a CISM professional than merely
passing an exam, submitting an application, and receiving a
paper certificate. Becoming a CISM professional is an
ongoing and continuous journey. Those with CISM
certification not only agree to abide by the code of ethics
but must also meet ongoing education requirements and
pay annual certification maintenance fees. Let’s take a
closer look at the education requirements and explain the
fees involved in retaining certification.
Continuing Education
The goal of continuing professional education requirements
is to ensure that individuals maintain CISM-related
knowledge so that they can better develop and manage
security management programs. To maintain CISM
certification, individuals must obtain 120 continuing
education hours within three years, with a minimum
requirement of 20 hours per year. Each CPE hour is to
account for 50 minutes of active participation in educational
activities.
What Counts as a Valid CPE Credit?
For training and activities to be utilized for CPEs, they must
involve technical or managerial training that is directly
applicable to information security and information security
management. The following list of activities has been
approved by the CISM certification committee and can count
toward your CPE requirements:
• ISACA professional education activities and meetings.
• If you are an ISACA member, you can take Information
Systems Control Journal CPE Quizzes online or
participate in monthly webcasts. For each webcast,
CPEs are rewarded after you pass a quiz.
• Non-ISACA professional education activities and meetings.
• Self-study courses.
• Vendor sales or marketing presentations (ten-hour annual
limit).
• Teaching, lecturing, or presenting on subjects related to
job practice areas.
• Publication of articles and books related to the profession.
• CISM exam question development and review.
• Passing related professional examinations.
• Participation in ISACA boards or committees (20-hour
annual limit per ISACA certification).
• Contributions to the information security management
profession (ten-hour annual limit).
• Mentoring (ten-hour annual limit).
For more information on what is accepted as a valid CPE
credit, see the Continuing Professional Education Policy
(www.isaca.org/cpe).
Tracking and Submitting CPEs
Not only are you required to submit a CPE tracking form for
the annual renewal process, but you also should keep
detailed records for each activity. Records associated with
each activity should have the following:
• Name of attendee
• Name of sponsoring organization
• Activity title
• Activity description
• Activity date
• Number of CPE hours awarded
It is in your best interest to track all CPE information in a
single file or worksheet. ISACA has developed a tracking
form for your use, which can be found in the Continuing
Professional Education Policy. To make it easy on yourself,
consider keeping all related records such as receipts,
brochures, and certificates in the same place.
Documentation should be retained throughout the threeyear certification period and for at least one additional year
afterward. This is especially important, as you may someday
be audited. If this happens, you would be required to submit
all paperwork. So why not be prepared?
For new CISMs, the annual and three-year certification
period begins January 1 of the year following certification.
You are not required to report CPE hours for the first partial
year after your certification; however, the hours earned
from the time of certification to December 31 can be utilized
in the first certification reporting period the following year.
Therefore, should you get certified in January, you will have
until the following January to accumulate CPEs and will not
have to report them until you report the totals for the
following year, which will be in October or November. This is
known as the renewal period. During this time, you will
receive an e-mail directing you to the web site to enter CPEs
earned over the course of the year. Alternatively, the
renewal will be mailed to you, and then CPEs can be
recorded on the hard-copy invoice and sent with your
maintenance fee payment. CPEs and maintenance fees
must be received by January 15 to retain certification.
Notification of compliance from the certification
department is sent after all the information has been
received and processed. Should ISACA have any questions
about the information you have submitted, it will contact
you directly.
Sample CPE Submission
Table 1-2 contains an example of a CPE submission.
Table 1-2 Sample CPE Submission
CPE Maintenance Fees
To remain CISM certified, you must pay CPE maintenance
fees each year. These fees are (as of 2018) $45 for
members and $85 for nonmembers each year. These fees
are in addition to ISACA membership and local chapter dues
(neither of which is required to maintain your CISM
certification).
Revocation of Certification
A CISM-certified individual may have his or her certification
revoked for the following reasons:
• Failure to complete the minimum number of CPEs during
the period.
• Failure to document and provide evidence of CPEs in an
audit.
• Failure to submit payment for maintenance fees.
• Failure to comply with the Code of Professional Ethics can
result in investigation and ultimately can lead to
revocation of certification.
If you have received a revocation notice, you will need to
contact the ISACA Certification Department at
certification@isaca.org for more information.
Summary
Becoming and being a CISM professional is a lifestyle, not
just a one-time event. It takes motivation, skill, good
judgment, persistence, and proficiency to be a strong and
effective leader in the world of information security
management. The CISM was designed to help you navigate
the security management world with greater ease and
confidence.
In the following chapters, each CISM job practice area will
be discussed in detail, and additional reference material will
be presented. Not only is this information useful for studying
prior to the exam, but it is also meant to serve as a resource
throughout your career as an information security
management professional.
CHAPTER 2
Information Security Governance
In this chapter, you will learn about
• Business alignment
• Security strategy development
• Security governance activities
• Information security strategy development
• Resources needed to develop and execute a security
strategy
• Obstacles to strategy development and execution
• Information security metrics
The topics in this chapter represent 24 percent of the
Certified Information Security Manager (CISM) examination.
This chapter discusses CISM job practice 1, “Information
Security Governance.”
ISACA defines this domain as follows: “Establish and/or
maintain an information security governance framework and
supporting processes to ensure that the information security
strategy is aligned with organizational goals and
objectives.”
Security governance should be the wellspring from which
security-related strategic decisions and all other security
activities flow.
Properly implemented, governance is a process whereby
senior management exerts strategic control over business
functions through policies, objectives, delegation of
authority, and monitoring. Governance is management’s
oversight for all other business processes to ensure that
business processes continue to effectively meet the
organization’s business vision and objectives.
Organizations usually establish governance through a
steering committee that is responsible for setting long-term
business strategy, and by making changes to ensure that
business processes continue to support business strategy
and the organization’s overall needs. This is accomplished
through the development and enforcement of documented
policies, standards, requirements, and various reporting
metrics.
Introduction to Information Security
Governance
Information security governance typically focuses on several
key processes. Those processes include personnel
management, sourcing, risk management, configuration
management, change management, access management,
vulnerability management, incident management, and
business continuity planning. Another key component is the
establishment of an effective organization structure and
clear statements of roles and responsibilities. An effective
governance program will use a balanced scorecard, metrics,
or other means to monitor these and other key processes.
Through a process of continuous improvement, security
processes will be changed to remain effective and to
support ongoing business needs.
Information security is a business issue, and organizations
that are not yet adequately protecting their information
have a business problem. The reason for this is almost
always a lack of understanding and commitment by boards
of directors and senior executives. For many, information
security is only a technology problem at the tactical level.
Recent events have brought the issue of information
security to the forefront for many organizations. The
challenge is that because of a lack of awareness or
cybersecurity savviness, organizations still struggle with
how to successfully organize, manage, and communicate
about it at the boardroom level.
To be successful, information security is also a people
issue. When people at each level in the organization—from
boards of directors to individual contributors—understand
the importance of information security and their own roles
and responsibilities, an organization will be in a position of
reduced risk. This reduction in risk or identification of a
potential security event results in fewer incidents that, when
they do occur, will have lower impact on the organization’s
ongoing reputation and operations.
Information security governance is a set of activities that
are established so that management has a clear
understanding of the state of the organization’s security
program, its current risks, and its direct activities. A goal of
the security program is to continue to contribute toward
fulfillment of the security strategy, which itself will continue
to align to the business and business objectives. Whether
the organization has a board of directors, council members,
commissioners, or some other top-level governing body,
governance begins with the establishment of top-level
strategic objectives that are translated into actions, policies,
processes, procedures, and other activities downward
through each level in the organization.
For information security governance to be successful, an
organization must also have an effective IT governance
program. IT is the enabler and force multiplier that
facilitates business processes that fulfill organization
objectives. Without effective IT governance, information
security governance will not be able to reach its full
potential. The result may be that the proverbial IT bus will
travel safely but to the wrong destination. This is depicted in
Figure 2-1.
Figure 2-1 Vision flows downward in an organization.
While the CISM certification is not directly tied to IT
governance, this implicit dependence of security
governance on IT governance cannot be understated. IT and
security professionals specializing in IT governance itself
may be interested in ISACA’s Certified in the Governance of
Enterprise IT (CGEIT) certification, which specializes in this
domain. While IT governance and information security
governance may be separate, in many organizations the
governance activities will closely resemble each other. Many
issues will span both IT and security governance bodies, and
a number of individuals will participate actively in both
areas. Some organizations may integrate IT and information
security governance into a single set of participants,
activities, and business records. The most important thing is
that organizations figure out how to establish governance
programs that are effective for achieving desired and
documented business outcomes.
The purpose of security governance is to align the
organization’s security program with the needs of the
business. The term information security governance refers
to a collection of top-down activities intended to control the
security organization (and security-related activities in every
part of the organization) from a strategic perspective to
ensure that information security supports the business.
These are some of the artifacts and activities that flow out
of healthy security governance:
• Objectives These are desired capabilities or end states,
ideally expressed in achievable, measurable terms.
• Strategy This is a plan to achieve one or more objectives.
• Policy At its minimum, security policy should directly
reflect the mission, objectives, and goals of the overall
organization.
• Priorities The priorities in the security program should
flow directly from the organization’s mission,
objectives, and goals. Whatever is most important to
the organization as a whole should be important to
information security as well.
• Standards The technologies, protocols, and practices
used by IT should be a reflection of the organization’s
needs. On their own, standards help to drive a
consistent approach to solving business challenges;
the choice of standards should facilitate solutions that
meet the organization’s needs in a costeffective and
secure manner.
• Processes These are formalized descriptions of repeated
business activities that include instructions to
applicable personnel. Processes include one or more
procedures, as well as definitions of business records
and other facts that help workers understand how
things are supposed to be done.
• Controls These are formal descriptions of critical
activities to ensure desired outcomes.
• Program and project management The organization’s
IT and security programs and projects should be
organized and performed in a consistent manner that
reflects business priorities and supports the business.
• Metrics/reporting This includes the formal measurement
of processes and controls so that management
understands and can measure them.
To the greatest possible extent, security governance in an
organization should be practiced in the same way that the
organization performs IT governance and corporate
governance. Security governance should mimic corporate
and/or IT governance processes, or security governance
may be integrated into corporate or IT governance
processes.
While security governance contains the elements just
described, strategic planning is also a key component of
governance. Strategy development is discussed in the next
section.
Reason for Security Governance
Organizations in most industry sectors and at all levels of
government are increasingly dependent on their information
systems. This has progressed to the point where
organizations—including those whose products or services
are not information related—are completely dependent on
the integrity and availability of their information systems to
continue business operations. As an information security
professional, it is imperative that you understand the
priority of the business with regard to confidentiality,
integrity, and availability (CIA). All three of these should be
considered when building out the security governance
structure, but the type of information used by the business
will drive the priority that is given to confidentiality,
integrity, and availability. Information security governance,
then, is needed to ensure that security-related incidents do
not threaten critical systems and their support of the
ongoing viability of the organization.
Among information security professionals, it is a known
fact that without adequate safeguards, information
technology assets that are Internet accessible would be
compromised in mere minutes of being placed online.
Further, many if not all information technology assets
thought to be behind the protection of firewalls and other
control points may also be easily accessed and
compromised. The tools, processes, and controls needed to
protect these assets are as complex as the information
systems they are designed to protect. Without effective topdown management of the security controls and processes
protecting IT assets, management will not be informed or in
control of these protective measures. The consequences of
failure can impair, cripple, and/or embarrass the
organization’s core operations.
Security Governance Activities and Results
Within an effective security governance program, an
organization’s senior management team will see to it that
information systems necessary to support business
operations will be adequately protected. These are some of
the activities required to protect the organization:
• Risk management Management will ensure that risk
assessments will be performed to identify risks in
information systems and supported processes. Followup actions will be carried out that will reduce the risk
of system failure and compromise.
• Process improvement Management will ensure that key
changes will be made to business processes that will
result in security improvements.
• Event identification Management will be sure to put
technologies and processes in place to ensure that
security events and incidents will be identified as
quickly as possible.
• Incident response Management will put incident
response procedures into place that will help to avoid
incidents, reduce the impact and probability of
incidents, and improve response to incidents so that
their impact on the organization is minimized.
• Improved compliance Management will be sure to
identify all applicable laws, regulations, and standards
and carry out activities to confirm that the
organization is able to attain and maintain
compliance.
• Business continuity and disaster recovery planning
Management will define objectives and allocate
resources for the development of business continuity
and disaster recovery plans.
• Metrics Management will establish processes to measure
key security events such as incidents, policy changes
and violations, audits, and training.
• Resource management The allocation of manpower,
budget, and other resources to meet security
objectives is monitored by management.
• Improved IT governance An effective security
governance program will result in better strategic
decisions in the IT organization that keep risks at an
acceptably low level.
These and other governance activities are carried out
through scripted interactions among key business and IT
executives at regular intervals. Meetings will include a
discussion of the impact of regulatory changes, alignment
with business objectives, effectiveness of measurements,
recent incidents, recent audits, and risk assessments. Other
discussions may include such things as changes to the
business, recent business results, and any anticipated
business events such as mergers or acquisitions.
These are two key results of an effective security
governance program:
• Increased trust Customers, suppliers, and partners trust
the organization to a greater degree when they see
that security is managed effectively.
• Improved reputation The business community,
including customers, investors, and regulators, will
hold the organization in higher regard.
Business Alignment
An organization’s information security program needs to fit
into the rest of the organization. This means that the
program needs to understand and align with the
organization’s highest-level guiding principles including the
following:
• Mission Why does the organization exist? Who does it
serve, and through what products and services?
• Goals and objectives What achievements does the
organization want to accomplish, and when does it
want to accomplish them?
• Strategy What are the activities that need to take place
so that the organization’s goals and objectives can be
fulfilled?
To be business aligned, people in the security program
should be aware of several characteristics about the
organization, including the following:
• Culture Culture includes how personnel in the
organization work, think, and relate to each other.
• Asset value This includes information the organization
uses to operate. This often consists of intellectual
property such as designs, source code, production
costs, and pricing, as well as sensitive information
related to not only its personnel but its customers, its
information-processing infrastructure, and its service
functions.
• Risk tolerance Risk tolerance for the organization’s
information security program needs to align with the
organization’s overall tolerance for risk.
• Legal obligations What external laws and regulations
govern what the organization does and how it
operates? These laws and regulations include the
Gramm-Leach-Bliley Act (GLBA), Payment Card
Industry Data Security Standard (PCI-DSS), European
General Data Protection Regulation (GDPR), Health
Insurance Portability and Accountability Act (HIPAA),
and the North American Electric Reliability Corporation
(NERC) standard. Also, contractual obligations with
other parties often shape the organization’s behaviors
and practices.
• Market conditions How competitive is the marketplace
in which the organization operates? What strengths
and weaknesses does the organization have in
comparison with its competitors? How does the
organization want its security differentiated from its
competitors?
Security as Business Prevention
The information security profession is still plagued by the
reputation of “being the department of ‘no’” or as the
department of business prevention. This stemmed from
overzealous security managers who were more risk-averse
than the business itself and who did not understand the
organization’s need to grow, expand, and establish new
products and services. The result of this reputation is the
still-present tendency for IT and other parts of the business
to avoid involvement with security professionals out of fear
that their involvement will hamper their efforts.
This can lead to shadow IT, which in many cases puts the
organization at a greater risk of data leakage. Most people
within a business want to do the right thing and complete
their job activities in a successful manner. They do not
intentionally set out to expose sensitive data; many
employees are just trying to complete their assigned duties.
As an example, the person in the new accounts department
receives an e-mail from the external marketing team with a
listing of all newly signed-up accounts. What the person
fails to recognize is the file contains sensitive card holder
data and is being shared over a public connection.
Goals and Objectives
An organization’s goals and objectives specify the activities
that are to take place in support of the organization’s overall
strategy. Goals and objectives are typically statements in
the form of imperatives that describe the development or
improvement of business capabilities. For instance, goals
and objectives may be related to increases in capacity,
improvements of quality, or the development of entirely
new capabilities. Goals and objectives further the
organization’s mission, helping it to continue to attract new
customers or constituents, increase market share, and
increase revenue and/or profitability.
Risk Appetite
Each organization has a particular appetite for risk, although
few have documented that appetite. ISACA defines risk
appetite as the level of risk that an organization is willing to
accept while in pursuit of its mission, strategy, and
objectives, and before action is needed to treat the risk.
Risk capacity is related to risk appetite. ISACA defines risk
capacity as the objective amount of loss that an
organization can tolerate without its continued existence
being called into question.
Generally, only highly risk-averse organizations such as
banks, insurance companies, and public utilities will
document and define risk appetite in concrete terms. Other
organizations are more tolerant of risk and make individual
risk decisions based on gut feeling. However, because of
increased influence and mandates by customers, many
organizations are finding it necessary to document and
articulate the risk posture and appetite of the organization.
This is an emerging trend in the marketplace but is still
fairly new to many organizations.
Risk-averse organizations generally have a formal system
of accountability and traceability of risk decisions back to
department heads and business executives. This activity is
often seen within risk management and risk treatment
processes, where individual risk treatment decisions are
made and one or more business executives are made
accountable for their risk treatment decisions.
In a properly functioning risk management program, the
chief information security officer (CISO) is rarely the person
who makes a risk treatment decision and is accountable for
that decision. Instead, the CISO is a facilitator for risk
discussions that eventually lead to a risk treatment decision.
The only time the CISO would be the accountable party
would be when risk treatment decisions directly affect the
risk management program itself, such as the selection of a
governance, risk, and compliance (GRC) tool for managing
and reporting on risk.
Organizations rarely have a single risk tolerance level
across the entire business; instead, different business
functions and different aspects of security will have varying
levels of risk. For example, a mobile gaming software
company may have a moderate tolerance for risk with
regard to the introduction of new products, a low tolerance
for workplace safety risks, and no tolerance for risk for legal
and compliance matters. Mature organizations will develop
and publish a statement of risk tolerance or appetite that
expresses risk tolerance levels throughout the business.
Roles and Responsibilities
Information security governance is most effective when
every person in the organization knows what is expected of
them. Better organizations develop formal roles and
responsibilities so that personnel will have a clearer idea of
their part in all matters related to the protection of systems,
information, and even themselves.
In the context of organizational structure and behavior, a
role is a description of expected activities that employees
are obliged to perform as part of their employment. Roles
are typically associated with a job title or position title,
which is a label assigned to each person that designates
their place in the organization. Organizations strive to
adhere to more or less standard position titles so that other
people in the organization, upon knowing someone’s
position title, will have at least a general idea of a person’s
role in the organization.
Typical roles include the following:
• IT auditor
• Systems engineer
• Accounts receivable manager
• Individual contributor
Often a position title also includes a person’s rank, which
denotes an individual person’s seniority, placement within a
command-and-control hierarchy, span of control, or any
combination of these. Typical ranks include the following in
order of increasing seniority:
• Supervisor
• Manager
• Senior manager
• Director
• Senior director
• Executive director
• Vice president
• Senior vice president
• Executive vice president
• President
• Chief executive officer
• Member, board of directors
• Chairman, board of directors
This should not be considered a complete listing of ranks.
Larger organizations also include the modifiers assistant (as
in assistant director), general (general manager), and first
(first vice president).
A responsibility is a statement of activities that a person is
expected to perform. Like roles, responsibilities are typically
documented in position descriptions and job descriptions.
Typical responsibilities include the following:
• Perform monthly corporate expense reconciliation
• Troubleshoot network faults and develop solutions
• Audit user account terminations and develop exception
reports
In addition to specific responsibilities associated with
individual position titles, organizations typically also include
general responsibilities in all position titles. Examples
include the following:
• Understand and conform to information security policy,
harassment policy, and other policies
• Understand and conform to code of ethics and behavior
In the context of information security, an organization
assigns roles and responsibilities to individuals and groups
so that the organization’s security strategy and objectives
can be met.
RACI Charts
Many organizations utilize Responsible-AccountableConsulted-Informed (RACI) charts to denote key
responsibilities in business processes, projects, tasks, and
other activities. A RACI chart assigns levels of responsibility
to individuals and groups. Development of a RACI chart
helps personnel determine roles for various business
activities. A typical RACI chart follows.
The same RACI chart can also be depicted like this second
example:
This RACI chart specifies the roles carried out by several
parties in the user account access request process.
The meanings of the four roles in a RACI chart are as
follows:
• Responsible The person or group that performs the
actual work or task.
• Accountable The person who is ultimately answerable for
complete, accurate, and timely execution of the work.
Often this is a person who manages those in the
Responsible role.
• Consulted One or more people or groups who are
consulted for their opinions, experience, or insight.
People in the Consulted role may be a subject-matter
expert for the work or task, or they may be an owner,
steward, or custodian of an asset associated with the
work or task. Communication with the Consulted role
is two-way.
• Informed One or more people or groups who are
informed by those in other roles. Depending on the
process or task, Informed may be told of an activity
before, during, or after its completion. Communication
with Informed is one-way.
Several considerations must be taken into account when
assigning roles to individuals and groups in a RACI chart.
These include the following:
• Skills Some or all individuals in a team assignment, as
well as specific named individuals, need to have the
skills, training, and competence to carry out tasks as
required
• Segregation of duties Critical tasks such as the user
account provisioning RACI chart depicted earlier must
be free of segregation of duties conflicts. This means
that there must be two or more individuals or groups
required to carry out a critical task. In this example,
the requestor, approver, and provisioner cannot be
the same person or group.
• Conflict of interest Critical tasks must not be assigned
to individuals or groups when such assignments will
create conflicts of interest. For example, a user who is
an approver cannot approve a request for their own
access. In this case, a different person must approve
the request—while also avoid a segregation of duties
conflict.
There are some variations of the RACI model, including
Participant, Accountable, Review Required, Input Required,
Sign-off Required (PARIS) and Perform, Accountable, Control,
Suggest, Informed (PACSI).
Board of Directors
The board of directors in an organization is a body of people
who oversee activities in an organization. Depending on the
type of organization, board members may be elected by
shareholders or constituents, or they may be appointed.
This role can be either paid or voluntary in nature.
Activities performed by the board of directors, as well as
directors’ authority, are usually defined by a constitution,
bylaws, or external regulation. The board of directors is
typically accountable to the owners of the organization or, in
the case of a government body, to the electorate.
In many cases, board members have fiduciary duty. This
means they are accountable to shareholders or constituents
to act in the best interests of the organization with no
appearance of impropriety, conflict of interest, or ill-gotten
profit as a result of their actions.
In nongovernment organizations, the board of directors is
responsible for appointing a chief executive officer (CEO)
and possibly other executives. The CEO, then, is
accountable to the board of directors and carries out their
directives. Board members may also be selected for any of
the following reasons:
• Investor representation One or more board members
may be appointed by significant investors to give
them control over the strategy and direction of the
organization.
• Business experience Board members bring outside
business management experience, which helps them
develop successful business strategies for the
organization.
• Access to resources Board members bring business
connections, including additional investors, business
partners, suppliers, or customers.
Often, one or more board members will have business
finance experience in order to bring financial management
oversight to the organization. In the case of U.S. public
companies, the U.S. Sarbanes-Oxley Act requires board
members to form an audit committee; one or more audit
committee members are required to have financial
management experience. External financial audits and
internal audit activities are often accountable directly to the
audit committee in order to perform direct oversight of the
organization’s financial management activities. As the issue
of information security becomes more prevalent in
discussions at the executive level, some organizations have
added a board member who is technically savvy or have
formed an additional committee, often referred to as the
Technology Risk Committee.
Boards of directors are generally expected to require that
the CEO and other executives implement a corporate
governance function to ensure that executive management
has an appropriate level of visibility and control over the
operations of the organization. Executives are accountable
to the board of directors to demonstrate that they are
effectively carrying out the board’s strategies.
Many, if not most, organizations are highly dependent
upon information technology for their daily operations. As a
result, information security is an important topic to boards
of directors. Today’s standard of due care for corporate
boards requires that they include information security
considerations in the strategies they develop and the
oversight they exert on the organization. In its publication
Cyber-Risk Oversight, the National Association of Corporate
Directors has developed five principles about the
importance of information security:
• Principle 1: Directors need to understand and approach
cybersecurity as an enterprise-wide risk management
issue, not just an IT issue.
• Principle 2: Directors should understand the legal
implications of cyber risks as they relate to their
company’s specific circumstances.
• Principle 3: Boards should have adequate access to
cybersecurity expertise, and discussions about cyberrisk management should be given regular and
adequate time on board meeting agendas.
• Principle 4: Boards should set the expectation that
management will establish an enterprise-wide cyber-
risk management framework with adequate staffing
and budget.
• Principle 5: Board management discussions about cyber
risk should include identification of which risks to
avoid, which to accept, and which to mitigate or
transfer through insurance, as well as specific plans
associated with each approach.
Executive Management
Executive management is responsible for carrying out
directives issued by the board of directors. In the context of
information security management, this includes ensuring
that there are sufficient resources for the organization to
implement a security program and to develop and maintain
security controls to protect critical assets.
Executive management must ensure that priorities are
balanced. In the case of IT and information security, these
functions are usually tightly coupled but sometimes in
conflict. IT’s primary mission is the development and
operation of business-enabling capabilities through the use
of information systems, while information security’s mission
includes security and compliance. Executive management
must ensure that these two sometimes-conflicting missions
are successful.
Typical IT and security-related executive position titles
include the following:
• Chief information officer (CIO) This is the title of the
topmost leader in a larger IT organization.
• Chief technical officer (CTO) This position is usually
responsible for an organization’s overall technology
strategy. Depending upon the purpose of the
organization, this position may be separate from IT.
• Chief information security officer (CISO) This position
is responsible for all aspects of data-related security.
This usually includes incident management, disaster
recovery, vulnerability management, and compliance.
This role is usually separate from IT.
To ensure the success of the organization’s information
security program, executive management should be
involved in three key areas:
• Ratify corporate security policy Security policies that
are developed by the information security function
should be visibly ratified or endorsed by executive
management. This may take different forms, such as
formal minuted ratification in a governance meeting, a
statement for the need for compliance along with a
signature within the body of the security policy
document, a separate memorandum to all personnel,
or other visible communication to the organization’s
rank and file that stresses the importance of, and
need for compliance to, the organization’s information
security policy.
• Leadership by example With regard to information
security policy, executive management should lead by
example and not exhibit behavior suggesting they are
“above” security policy—or other policies. Executives
should not be seen to enjoy special privileges of the
nature that suggest that one or more security policies
do not apply to them. Instead, their behavior should
visibly support security policies that all personnel are
expected to comply with.
• Ultimate responsibility Executives are ultimately
responsible for all actions carried out by the personnel
who report to them. Executives are also ultimately
responsible for all outcomes related to organizations
to which operations have been outsourced.
Security Steering Committee
Many organizations form a security steering committee,
consisting of stakeholders from many (if not all) of the
organization’s business units, departments, functions, and
principal locations. A steering committee may have a
variety of responsibilities, including the following:
• Risk treatment deliberation and recommendation
The security steering committee may discuss relevant
risks, discuss potential avenues of risk treatment, and
develop recommendations for said risk treatment for
ratification by executive management.
• Discussion and coordination of IT and security
projects The security steering members may discuss
various IT and security projects to resolve any
resource or scheduling conflicts. They might also
discuss potential conflicts between various projects
and initiatives and work out solutions.
• Review of recent risk assessments The security
steering committee may discuss recent risk
assessments in order to develop a common
understanding of their results, as well as discuss
remediation of findings.
• Discussion of new laws, regulations, and
requirements The committee may discuss new laws,
regulations, and requirements that may impose
changes in the organization’s operations. Committee
members can develop high-level strategies that their
respective business units or departments can further
build out.
• Review of recent security incidents Steering
committee members can discuss recent security
incidents and their root causes. Often this can result in
changes in processes, procedures, or technology
changes to reduce the risk and impact of future
incidents.
Reading between the lines, the main mission of a security
steering committee is to identify and resolve conflicts and to
maximize the effectiveness of the security program, as
balanced among other business initiatives and priorities.
Business Process and Business Asset Owners
Business process and asset owners are typically
nontechnical personnel in management positions in an
organization. While they may not be technology experts, in
many organizations their business processes are enhanced
by information technology in the form of business
applications and other capabilities.
Remembering that IT and information security serve the
organization and not the other way around, business
process and business asset owners are accountable for
making business decisions that sometimes impact the use
of information technology, the organization’s security
posture, or both. A simple example is a decision on whether
an individual employee should have access to specific
information. While IT or security may have direct control
over which personnel have access to what assets, the best
decision to make is a business decision by the manager
responsible for the process or business asset.
The responsibilities of business process and business
asset owners include the following:
• Access grants Asset owners decide whether individuals
or groups should be given access to the asset, as well
as the level and type of access. Example access types
include combinations of read only, read-write, create,
and delete.
• Access revocation Asset owners should also decide
when individuals or groups no longer require access to
an asset, signaling the need to revoke that access.
• Access reviews Asset owners should periodically review
access lists to see whether each person and group
should continue to have that access. Access reviews
may also include access activity reviews to determine
whether people who have not accessed assets still
require access to them.
• Configuration Asset owners determine the configuration
needed for assets and applications, ensuring their
proper function and support of applications and
business processes.
• Function definition In the case of business applications
and services, asset owners determine which functions
will be available, how they will work, and how they will
support business processes. Typically, this definition is
constrained by functional limitations within an
application, service, or product.
• Process definition Process owners determine the
sequence, steps, roles, and actions carried out in their
business processes.
• Physical location Asset owners determine the physical
location of their assets. Factors influencing choices of
location include physical security, proximity to other
assets, proximity to relevant personnel, and data
protection and privacy laws.
Often, business and asset owners are nontechnical
personnel, so it may be necessary to translate business
needs into technical specifications.
Custodial Responsibilities
In many organizations, asset owners are not involved in the
day-to-day activities related to the management of their
assets, particularly when those assets are information
systems and the data stored within them. Instead,
somebody in the IT organization (or several people in IT)
acts as a proxy for asset owners and makes access grants
and other decisions on their behalf. While this is a common
practice, it is often carried too far, resulting in the asset
owner being virtually uninvolved and uninformed. Instead,
asset owners should be aware of, and periodically review,
activities carried out by people, groups, and departments
making decisions on their behalf.
The most typical arrangement is that people in IT make
access decisions on behalf of asset owners. Except in cases
where there is a close partnership between these IT
personnel and asset owners, these IT personnel often do not
adequately understand the business nature of assets or the
implications when certain people are given access to them.
Most often, far too many personnel have access to assets,
usually with higher privileges than necessary.
Chief Information Security Officer
The CISO is the highest-ranking security person in an
organization. A CISO will develop business-aligned security
strategies that support present and future business
initiatives and be responsible for the development and
operation of the organization’s information risk program, the
development and implementation of security policies,
security incident response, and perhaps some operational
security functions.
In some organizations, the CISO reports to the chief
operating officer (COO) or the CEO, but in some
organizations the CISO may report to the CIO, chief legal
counsel, or other person in the organization.
Other similar titles with similar responsibilities include the
following:
• Chief security officer (CSO) This position generally has
the responsibilities of a CISO plus responsibilities for
non-information assets such as business equipment
and work centers. A CSO often is responsible for
workplace safety.
• Chief information risk officer (CIRO) Generally this
represents a change of approach to the CISO position,
from being protection-based to being risk-based.
• Chief risk officer (CRO) This position is responsible for
all aspects of risk including information risk, business
risk, compliance risk, and market risk. This role is
separate from IT.
Many organizations do not have a CISO but instead have a
director or manager of information security who reports
further down in the organization chart. There are several
possible reasons for organizations not having a CISO, but
generally it can be said that the organization does not
consider information security as a strategic function. This
will hamper the visibility and importance of information
security and often results in information security being a
tactical function concerned with basic defenses such as
firewalls, antivirus, and other tools. In such situations,
responsibility for strategy-level information security
implicitly lies with some other executive such as the CIO.
This type of situation often results in the absence of a
security program and the organization’s general lack of
awareness of relevant risks, threats, and vulnerabilities.
The one arena where a CISO may not be required is in
small to medium-sized organizations where a full-time
strategic leader may not be cost effective. In these
situations, it is advisable to contract with a virtual CISO
(vCISO) to assist with strategy and planning. The benefit of
taking this type of approach for organizations that may not
require or cannot afford a full-time person is that it allows
the organization to benefit from the knowledge of seasoned
security professional to assist in driving the information
security program forward.
Rank Sets Tone and Gives Power
A glance at the title of the highest-ranking information
security position in an organization reveals much about
executive management’s opinion of information security in
larger organizations. Executive attitudes about security are
reflected in the security manager’s title and may resemble
the following:
• Security manager Information security is tactical only
and often viewed as consisting only of antivirus
software and firewalls. The security manager has no
visibility into the development of business objectives.
Executives consider security as unimportant and
based on technology only.
• Security director Information security is important and
has moderate decision-making capability but little
influence on the business. A director-level person in a
larger organization may have little visibility to overall
business strategies and little or no access to executive
management or the board of directors.
• Vice president Information security is strategic but does
not influence business strategy and objectives. The
vice president will have some access to executive
management and possibly the board of directors.
• CISO/CIRO/CSO/vCISO Information …
Purchase answer to see full
attachment