Think Like a Security Manager: The CISM Mindset
ISACA's CISM item-writing guide is explicit: questions are written from the perspective of information security management and not information security operations, and items that are overly technical are returned. If you answer CISM questions as an engineer, you will often pick the wrong option.
The six questions a security manager asks
- What does the business need? Security exists to enable business objectives within risk appetite.
- Who owns this risk? Business owners own their risks; the security manager advises, measures and escalates.
- What is the risk level against appetite? Decisions are risk-based, not tool-based.
- Who has the authority to decide? Major trade-offs — shutting down a revenue system, accepting a risk — go to the person with authority.
- What is the business case? Funding follows business value expressed in business terms.
- How will we know it works? Metrics should be linked to objectives and lead to decisions.
Typical traps
- Buying a tool first. When a new risk appears, the first step is almost always to assess it, not to purchase technology.
- The security manager accepting risk. Risk acceptance belongs to management with the right authority, not to the security function.
- Blocking instead of enabling. Banning a new technology outright is rarely the best first action; understanding its use and risk is.
- Reporting technical detail to the board. Boards need risk posture against appetite, trends and the decisions required.
A worked example
Business units are rapidly adopting generative AI tools without central approval. What should the information security manager do FIRST?
Blocking every tool or buying an AI security product skips a step. The manager's answer is to assess the risks of the current use and provide guidance aligned with business needs.
Related on Auditor Path
Sources
ISACA CISM Item Development Guide (2022); ISACA CISM Exam Content Outline and 2026 job practice update.