CISM Domain 3 · Information Security Program

Exam

CISM

Exam weight

33%

What it covers

Program resources, asset classification, frameworks, policies, metrics, control design, implementation and testing, awareness and training, external services and program reporting.

What the exam rewards

Controls selected from risk
Metrics that show outcomes
Supplier assurance throughout the relationship
Awareness measured by behavior

Common traps

Activity metrics presented as effectiveness
Buying tools without a prioritized need
Assuming suppliers handle their own risk

Official subtopics

Information Security Program Development

Information Security Program Resources (e.g., People, Tools, Technologies)
Information Asset Identification and Classification
Industry Standards and Frameworks for Information Security
Information Security Policies, Procedures and Guidelines
Information Security Program Metrics

Information Security Program Management

Information Security Control Design and Selection
Information Security Control Implementation and Integrations
Information Security Control Testing and Evaluation
Information Security Awareness and Training
Management of External Services (e.g., Providers, Suppliers, Third Parties, Fourth Parties)
Information Security Program Communications and Reporting

How to study it

The largest domain. Practice heavily on metrics, supplier management and control selection trade-offs.