Exam Mindset Rules

The judgment patterns CISA and CISM questions test, the traps that catch experienced IT professionals, and worked examples for each rule.

• Report, don't fix — CISA
• Independence comes first — CISA
• Escalate to the right level — CISA & CISM
• Business objectives before technology — CISA & CISM
• Risk drives everything — CISA & CISM
• The business owns its risk — CISM
• Policy before procedure — CISA & CISM
• FIRST means the first logical step — CISA & CISM
• BEST and MOST mean the most complete answer — CISA & CISM
• Prevent beats detect beats correct — CISA & CISM
• Evidence must be reliable — CISA
• Compensating controls when the ideal is impossible — CISA & CISM
• Accountability can't be outsourced — CISA & CISM
• Contain, then recover, then learn — CISM
• Speak the board's language — CISM
• Follow the standards' sequence — CISA
• No absolutes — CISA & CISM
• Read the role in the stem — CISA & CISM