Certified Information Security Manager (CISM)

Description

Background / Overview

The Certified Information Security Manager (CISM) certification, offered by ISACA, is a globally recognized credential for professionals who design, manage, and oversee enterprise information security programs. Unlike purely technical certifications, CISM emphasizes the management and governance aspects of information security—aligning security initiatives with organizational goals, managing risk, and ensuring regulatory compliance.

This training program prepares participants to successfully pass the CISM exam while also equipping them with practical knowledge and leadership skills to effectively manage information security functions.

Agenda / Content

The program is structured around the four domains of the CISM certification exam:

Day 1: Information Security Governance

• Role of information security in business strategy

• Establishing and maintaining an information security governance framework

• Security policies, standards, and procedures

• Business cases for security investments

• Legal, regulatory, and contractual requirements

• Case Study: Aligning security with enterprise goals

Day 2: Information Risk Management

• Risk management fundamentals and frameworks

• Identifying, analyzing, and evaluating information security risks

• Risk treatment strategies (avoid, transfer, mitigate, accept)

• Business impact analysis and risk appetite

• Third-party and supply chain risk management

• Workshop: Conducting a risk assessment

Day 3: Information Security Program Development and Management

• Designing and implementing an information security program

• Resource management (people, processes, and technology)

• Integrating security into enterprise architecture

• Security awareness and training programs

• Program performance metrics and continuous improvement

• Practical Exercise: Developing a security program roadmap

Day 4: Information Security Incident Management

• Establishing and maintaining an incident response plan

• Roles and responsibilities in incident response

• Incident classification, escalation, and communication

• Business continuity and disaster recovery planning

• Post-incident activities (lessons learned, process improvement)

• Simulation: Incident response tabletop exercise

Day 5: Exam Preparation & Review (Optional)

• Exam structure, question styles, and test-taking strategies

• Practice exam questions with guided discussion

• Key focus areas and exam readiness checklist

Objectives

By the end of this training, participants will be able to:

1. Understand the CISM domains and exam requirements.

2. Establish an effective information security governance framework.

3. Identify and manage enterprise information security risks.

4. Develop and manage information security programs aligned with business goals.

5. Plan, implement, and manage incident response and recovery processes.

6. Apply practical strategies for passing the CISM exam.

Outcomes

Participants will leave the training with:

• Comprehensive knowledge of the CISM domains and their business applications.

• Ability to align security initiatives with organizational strategy.

• Practical skills in risk management, governance, and incident response.

• Improved readiness to pass the CISM certification exam.

• Confidence to take on leadership roles in information security management.