CISM Domain 3: Video Bootcamp & Exam Prep 2026 UPDATED ISACA

What we cover: Information security program management controls across access, crypto, SDLC, architecture, and governance. 

Why it matters: It enables consistent control selection, lifecycle integration, and assurance of security effectiveness. 

Exam relevance: Tested through scenario-based control choice, lifecycle and architecture alignment, and governance versus technical control distinctions.

What we cover: The information lifecycle phases and the distinction between archiving and backup as data management controls.

Why it matters: Lifecycle alignment drives correct confidentiality, integrity, availability protection and retention handling from creation through disposal.

Exam relevance: Tested as choosing appropriate lifecycle actions and differentiating archive versus backup and disposal in policy-driven scenarios.

What we cover: Secure system design concepts using layering, security domains, open versus closed systems, and the ring model. 

Why it matters: These concepts enforce isolation and abstraction to limit privilege and reduce unintended interactions between components. 

Exam relevance: Tested as conceptual distinctions and scenario-based choices involving privilege boundaries, kernel versus user mode, and open versus proprietary designs.

What we cover: Asset inventory tracking and hardware hardening as foundational technical security controls. 

Why it matters: Accurate inventories enable consistent protection, lifecycle management, and rapid response actions like device wipe. 

Exam relevance: Tested through selecting appropriate controls for asset management, secure configuration baselines, patching, IoT segmentation, and port restrictions.

What we cover: DevOps versus DevSecOps integration across development, QA, operations, and security using CI/CD automation. 

Why it matters: Embedding security into the delivery pipeline improves control consistency and reduces late-stage security gaps. 

Exam relevance: Tested as selecting DevOps or DevSecOps and identifying CI/CD and automation roles in secure SDLC questions.

What we cover: Configuration management as a preventive control using hardened baselines, documented deviations, and controlled configuration changes.

Why it matters: It reduces attack surface and prevents insecure defaults or ad hoc changes from weakening security posture.

Exam relevance: Tested through selecting baseline hardening, vulnerability validation, and change control monitoring in administrative control decisions.

What we cover: Patch management as a corrective control integrated with change and configuration management.

Why it matters: Timely tested patching reduces exposure to known vulnerabilities while preventing destabilizing unreviewed changes.

Exam relevance: Assessed through control-type classification and selecting patching, testing, automation, and change control in scenarios.

What we cover: Change management versus change control within formal change governance and approval workflows.

Why it matters: It reduces unintended outages and security exposure by enforcing risk assessment, testing, documentation, and oversight.

Exam relevance: Tested as selecting the correct governance process step and distinguishing management scope from control execution.

What we cover: Security evaluation criteria models and Common Criteria components including TOE, Protection Profile, Security Target, and EALs.

Why it matters: These frameworks standardize assurance claims so controls and products can be compared consistently.

Exam relevance: Tested as model identification and Common Criteria term distinctions, including EAL rigor increasing from 1 to 7.

What we cover: Security assessments evaluate access control effectiveness across a defined organizational scope. 

Why it matters: They validate administrative and technical controls and guide balanced improvements without enabling user workarounds. 

Exam relevance: Tested as selecting appropriate assessment types and scope decisions, including audits, change management review, and penetration testing.

What we cover: Security audit types and SOC report distinctions including SOC 1 versus SOC 2 versus SOC 3 and Type I versus Type II.

Why it matters: Audit scope and report type determine which controls are evaluated and how assurance is communicated to stakeholders.

Exam relevance: Tested through scenario-based selection of audit type and SOC report based on financial reporting, trust criteria, and time period.

What we cover: Security audit logging as a detective control with centralized collection and integrity protection. 

Why it matters: Logs enable accountability and incident investigation when access controls fail or systems are compromised. 

Exam relevance: Tested as choosing detective monitoring, centralized logging versus local, retention needs, and protecting logs from tampering.

What we cover: Vulnerability scanning tools and their role in identifying common weaknesses across defined targets. 

Why it matters: Proper scoping and change control prevent disruption while producing actionable findings for remediation prioritization. 

Exam relevance: Tested through selecting appropriate assessment methods, interpreting severity ratings, and distinguishing vulnerability presence from risk.

What we cover: Penetration testing scope control and tester knowledge models plus hat roles and BAS versus compliance checks.

Why it matters: Clear authorization and defined boundaries enable valid testing without unlawful actions or unintended system impact.

Exam relevance: Tested as terminology distinctions and choosing the correct assessment type and engagement model from scenario details.

What we cover: Penetration testing concepts covering legacy and wireless reconnaissance, attack initiation types, and ethical disclosure boundaries.

Why it matters: Correctly classifying attack vectors and disclosure duties guides appropriate controls and professional conduct.

Exam relevance: Tested as terminology distinctions and scenario-based selection of attack type, wireless risk, and ethical reporting actions.

What we cover: Social engineering influence techniques as a social attack category that bypasses technical controls. 

Why it matters: It exploits human trust and weak awareness, requiring training and strict access control enforcement. 

Exam relevance: Tested by identifying attack types and selecting appropriate administrative controls when users are manipulated.

What we cover: Capability maturity models and the CMM versus CMMI scope distinction for process improvement. 

Why it matters: Maturity levels guide selecting governance controls that make processes repeatable, measurable, and continuously optimized. 

Exam relevance: Tested as recognizing maturity progression and choosing the correct model or level description in governance-focused questions.

What we cover: OWASP SAMM maturity model categories and acceptance testing types for software release readiness.

Why it matters: These structures guide risk-based security process improvement and validate software meets security and operational requirements.

Exam relevance: Tested as selecting the correct maturity model purpose or acceptance test type based on a described need.

What we cover: Access control models and the IAAA sequence for identity and access management.

Why it matters: Correctly separating identification, authentication, authorization, and accountability enables appropriate control selection and traceability.

Exam relevance: Tested through scenario-based selection of access control type, MFA factor categories, and rejecting shared accounts for accountability.

What we cover: Access control categories and control types used to classify security measures. 

Why it matters: Correct classification drives appropriate control selection and layered defense design. 

Exam relevance: Tested through scenario-based identification of control category and type when wording varies or overlaps.

What we cover: IAAA as identity and access control flow from identification through authentication, authorization, and accountability.

Why it matters: Correctly separating these functions drives appropriate access decisions and reliable auditability for non-repudiation.

Exam relevance: Tested as conceptual distinctions and scenario-based selection of MFA factors, access control models, and auditing accountability.

What we cover: Least privilege, need-to-know, non-repudiation, and subject versus object access control concepts.

Why it matters: These principles constrain access and enforce accountability through auditable identity-bound actions.

Exam relevance: Tested through scenario-based selection between access control models and authentication versus non-repudiation controls.

What we cover: Knowledge-based authentication and password storage controls including hashing, salting, nonces, and account lockout behavior.

Why it matters: Weak secrets are easily captured or guessed, so compensating controls reduce credential compromise and replay risk.

Exam relevance: Tests choosing mitigations for brute force, dictionary, rainbow table, keylogger, and replay attacks in access scenarios.

What we cover: Type 2 authentication as possession factors including smart cards, tokens, and one-time passwords.

Why it matters: Possession factors strengthen identity assurance by requiring control of a trusted physical or logical authenticator.

Exam relevance: Tested by selecting correct factor types and distinguishing HOTP versus TOTP and contact versus contactless cards.

What we cover: Type 3 authentication as biometrics, including physiological versus behavioral traits and multifactor combinations.

Why it matters: Biometric tuning balances false accepts and false rejects while managing privacy and non-revocability risks.

Exam relevance: Tested via selecting authentication factors and interpreting FAR, FRR, CER, and Type 1 versus Type 2 errors.

What we cover: Authorization decisions using access control models including DAC, MAC, RBAC, ABAC, and context or content based controls.

Why it matters: Correct model selection enforces confidentiality, integrity, and availability requirements through consistent permission assignment and policy constraints.

Exam relevance: Identify models by traits like owner discretion, labels and clearance, roles, attributes and conditions, and avoid confusing rule based firewalls.

What we cover: Accountability auditing ties actions to a unique identity using audit logs for non-repudiation.

Why it matters: It enables reliable attribution and preserves log integrity for investigations and enforcement.

Exam relevance: Tested as selecting auditing and unique accounts over shared accounts and protecting centralized logs from tampering.

What we cover: Access control models and architectures including centralized, decentralized, hybrid, and adaptive authorization approaches.

Why it matters: Correct model selection balances availability, administrative control, and consistent enforcement across locations and systems.

Exam relevance: Tested as scenario-based choices among RBAC, ABAC, risk-based, JIT federation, SAML, OIDC, and centralized versus distributed designs.

What we cover: Identity and access provisioning concepts including identity attributes, lifecycle provisioning, federation, SSO, and IDaaS. 

Why it matters: Correct provisioning and federation choices enforce least privilege while maintaining accountability across systems and providers. 

Exam relevance: Tested as scenario-based selection between SSO versus federation, SAML browser SSO, and provisioning actions like disable versus delete.

What we cover: Core cryptography terms and functions including modular arithmetic and plaintext, ciphertext, encryption, decryption, and cipher.

Why it matters: Correct cryptographic control selection depends on understanding confidentiality, integrity, authentication, and nonrepudiation tradeoffs.

Exam relevance: Tested through scenario wording that distinguishes cryptology, cryptography, and cryptanalysis and identifies basic crypto components.

What we cover: Monoalphabetic versus polyalphabetic substitution ciphers and XOR as a symmetric cryptographic operation. 

Why it matters: These concepts explain how cipher design resists pattern leakage through confusion and diffusion. 

Exam relevance: Tested as conceptual distinctions and scenario-based selection of cipher types and XOR properties in symmetric encryption.

What we cover: Historical ciphers and cipher machines as early symmetric encryption and substitution methods. 

Why it matters: Recognizing cipher types clarifies how secrecy depends on keys, rotation, and algorithm strength. 

Exam relevance: Tested as identification of cipher categories and selecting correct terms when given brief encryption descriptions.

What we cover: One-time pads and cryptography export controls as confidentiality controls.

Why it matters: Security depends on correct key management and compliance constraints, not just algorithm strength.

Exam relevance: Tested as identifying OTP properties and failure from key reuse, plus recognizing export-control governance concepts.

What we cover: Symmetric versus asymmetric encryption and hybrid key exchange for secure communication. 

Why it matters: Encryption choice balances performance, key distribution, and key management complexity. 

Exam relevance: Tested as conceptual comparison and scenario-based selection, including symmetric key-scaling n(n-1)/2.

What we cover: Symmetric encryption distinctions among DES, 3DES, and IDEA, including modes and keying options.

Why it matters: Correct algorithm and mode selection determines confidentiality strength and limits predictable patterns or error propagation.

Exam relevance: Tested as identifying insecure legacy ciphers versus acceptable options and choosing appropriate modes in scenario questions.

What we cover: Symmetric cipher distinctions across AES, Blowfish/Twofish, Feistel structure, and RC4/RC5/RC6 properties.

Why it matters: Correct algorithm selection depends on cipher type, block size, key size, and known security status.

Exam relevance: Tested as identification and selection questions using AES rounds and key lengths, and stream versus block cipher recognition.

What we cover: Asymmetric encryption key pairs and how public and private keys support confidentiality and digital signatures.

Why it matters: Correct key usage determines whether communications provide confidentiality, authenticity, or nonrepudiation.

Exam relevance: Tested as choosing encryption versus signing flows and recognizing RSA’s reliance on hard one-way math problems.

What we cover: Key distinctions among common asymmetric algorithms and their primary uses and limitations. 

Why it matters: Correct algorithm selection depends on understanding key exchange, signatures, and confidentiality-only properties. 

Exam relevance: Tested as scenario-based identification of asymmetric options, PKI terminology, and choosing appropriate algorithms by constraints.

What we cover: Hashing as a one-way integrity control producing fixed-length output from variable-length input. 

Why it matters: Hashes verify data has not changed and support evidence integrity during handling and analysis. 

Exam relevance: Tested as selecting hashing for integrity only and recognizing collision weaknesses that deprecate MD5.

What we cover: Hash algorithm strength differences and the purpose of salts and nonces in authentication.

Why it matters: Proper hash and randomness choices reduce collision risk and prevent password cracking and replay.

Exam relevance: Tests selecting secure hashes over legacy ones and distinguishing salting for stored passwords versus nonces for replay resistance.

What we cover: Common cryptographic attacks and related control categories affecting confidentiality and integrity.

Why it matters: Correctly selecting protections depends on distinguishing key compromise, interception, and cryptanalysis risks.

Exam relevance: Tested as scenario-based identification of attack type and best mitigation for key management, authentication, and sessions.

What we cover: Social engineering influence techniques and cryptographic attacks including rainbow tables, plaintext variants, and meet-in-the-middle.

Why it matters: These attacks exploit human behavior and weak hashing or cipher design to recover secrets and keys.

Exam relevance: Tested as attack-type identification and selecting mitigations like salting, user training, and appropriate encryption choices.

What we cover: Cryptographic attack types including cryptanalysis, side-channel and implementation weaknesses, and Kerberos credential replay and ticket abuse.

Why it matters: Correctly classifying attack methods drives appropriate control selection for authentication hardening and cryptographic implementation assurance.

Exam relevance: Tested as scenario-based identification of attack category and choosing mitigations for hashes, tickets, and cryptographic implementations.

What we cover: Digital signatures and PKI components including key storage, certificate issuance, and certificate status validation.

Why it matters: Correct key handling and certificate lifecycle controls preserve integrity, nonrepudiation, and trusted identity binding.

Exam relevance: Tested as choosing the correct signing and verification flow and distinguishing CA, RA, CRL, and OCSP roles.

What we cover: Message authentication codes and TLS versus SSL for integrity, authenticity, and confidentiality controls.

Why it matters: Correctly selecting cryptographic protections prevents tampering and enables trusted encrypted communications.

Exam relevance: Tested as conceptual distinctions between MAC and HMAC and scenario-based selection of TLS over deprecated SSL.

What we cover: Software testing distinctions across SDLC including static versus dynamic testing and black box versus white box approaches.

Why it matters: Early, continuous security requirements and testing reduce design-level weaknesses and improve control selection during development.

Exam relevance: Tested as scenario-based selection between testing types and access levels and as secure SDLC requirements traceability concepts.

What we cover: Software testing phases and security-focused methods for validating code, interfaces, installation, and coverage.

Why it matters: Correct testing selection reduces defects and vulnerabilities before production through controlled verification and change management.

Exam relevance: Tested as choosing the right testing type for a given goal and distinguishing fuzzing, regression, misuse cases, and coverage.

What we cover: Third-party software and cloud procurement controls including due diligence, vendor assurance, and shared responsibility models.

Why it matters: Vendor claims are insufficient so validation and contract terms reduce supply chain and outsourcing security gaps.

Exam relevance: Tests selecting procurement controls and distinguishing IaaS, PaaS, SaaS responsibilities in scenario-based questions.

What we cover: Secure-by-design software development with change and configuration management plus risk analysis and mitigation.

Why it matters: Building security into requirements reduces exploitable weaknesses and keeps changes controlled and traceable.

Exam relevance: Tested through selecting preventive controls, distinguishing errors versus vulnerabilities, and applying change control and risk treatment decisions.

What we cover: Differences between waterfall, modified waterfall, and agile software development methodologies as project management controls.

Why it matters: Method choice determines how teams handle changing requirements, feedback cycles, and phase rework constraints.

Exam relevance: Tested as conceptual comparisons and scenario-based selection of the best methodology for evolving requirements.

What we cover: Agile methodologies distinctions across Scrum, XP, Spiral, RAD, and Prototyping development approaches.

Why it matters: Method selection drives control integration timing, risk handling, and assurance practices during secure software delivery.

Exam relevance: Tested as scenario-based selection and role identification, emphasizing Scrum roles, XP practices, and Spiral risk-driven iteration.

What we cover: SDLC phases and project versus program versus portfolio distinctions in development governance.

Why it matters: Correctly classifying lifecycle and governance elements drives appropriate security integration and accountability.

Exam relevance: Tested as scenario-based selection of SDLC phase actions and differentiating project, program, and portfolio terminology.

What we cover: Source code escrow, source code repositories, API security, and configuration and change management governance. 

Why it matters: These controls preserve software integrity, availability, and accountability across development, integration, and lifecycle changes. 

Exam relevance: Tested as selecting appropriate controls and governance structures for third-party code, APIs, and baseline change control.

What we cover: Physical security control types and their primary classification. 

Why it matters: Correct control categorization drives appropriate selection and layered protection. 

Exam relevance: Tested as choosing the correct control type from keywords and distinguishing overlapping control purposes.

What we cover: Physical security controls for perimeter and monitoring with deterrent, preventive, and detective classifications.

Why it matters: Correct control classification drives layered defense design and reduces predictable gaps in physical protection.

Exam relevance: Tested through scenario-based selection of fence height, gate class, bollards, lighting, and CCTV type and storage.

What we cover: Physical locks as preventive physical controls and key-based access mechanisms with common bypass methods.

Why it matters: Lock and key management determines physical access assurance and limits compromise from copied keys or bypass.

Exam relevance: Assessed through control-type classification and selecting appropriate lock types and key controls for given security requirements.

What we cover: Physical access controls including smart cards, magnetic stripe cards, tailgating defenses, mantraps, turnstiles, and contraband checks.

Why it matters: Correct control selection reduces unauthorized entry and limits social engineering and data exfiltration through physical pathways.

Exam relevance: Tested as scenario-based selection between physical controls and as distinctions between preventive, detective, and deterrent measures.

What we cover: Physical security detection sensors and perimeter hardening for protected areas including data centers. 

Why it matters: Correct control selection prevents bypass paths and preserves life safety while maintaining layered physical protection. 

Exam relevance: Tested as scenario-based choice between sensor types and facility design requirements like slab-to-slab walls and panic egress.

What we cover: Physical security controls using guards, dogs, and restrictive work areas for access control.

Why it matters: Correct control selection depends on capability limits, training requirements, and controlled visitor access.

Exam relevance: Tested as scenario-based choices distinguishing guard types, dog roles, and visitor badge time-bounded access with escorting.

What we cover: Site selection and shared-tenancy physical security risks for facilities and data centers.

Why it matters: Environmental dependencies and co-tenant access paths drive physical control selection and layered defense design.

Exam relevance: Tested as choosing appropriate physical and environmental controls for facilities, demarc, and shared wiring closet exposure.

What we cover: Data center site selection and facility controls for power, cooling, and fire suppression redundancy. 

Why it matters: Proper environmental and power design prevents outages and physical damage through resilient infrastructure planning. 

Exam relevance: Tests selecting appropriate physical and environmental controls and applying due care, due diligence, and risk analysis decisions.

What we cover: Power conditioning and redundancy controls using UPS, PDU, generators, and dual power supplies plus EMI basics.

Why it matters: Stable, clean power and EMI mitigation preserve availability and integrity while reducing interception risk on copper.

Exam relevance: Tested as selecting correct power and cabling controls from outage and interference terms in scenario questions.

What we cover: Environmental controls for data centers including HVAC, humidity, positive pressure, airflow design, water detection, and ESD protection.

Why it matters: These physical controls prevent equipment damage and reduce contamination, corrosion, static discharge, and environmental-triggered failures.

Exam relevance: Tested as physical security control selection and distinguishing preventive versus detective environmental safeguards in facility scenarios.

What we cover: Fire detection sensor types as environmental controls for heat, smoke, and flame detection. 

Why it matters: Correct detector selection reduces false alarms and ensures timely activation of safety and suppression controls. 

Exam relevance: Tested as conceptual distinctions between detector types and choosing appropriate environmental controls in facility security questions.

What we cover: Data center fire suppression controls using the fire triangle and sprinkler system types.

Why it matters: Correct suppression selection reduces fire spread while prioritizing life safety and limiting collateral equipment damage.

Exam relevance: Tested as scenario-based choice between clean-agent suppression and sprinkler configurations, plus fire class distinctions.

What we cover: Clean-agent gas suppression for data centers and fire extinguisher classes and operation.

Why it matters: Correct suppression selection protects people and equipment while avoiding unsafe agents and mismatched extinguishers.

Exam relevance: Tested as scenario-based choice of clean-agent versus water and matching extinguisher class and PASS usage.

What we cover: Backup types and archive-bit behavior for fault tolerance and data recovery planning.

Why it matters: Correct backup selection and validation ensures recoverability while meeting retention and restoration requirements.

Exam relevance: Tested as choosing full, incremental, differential, or copy backups based on restore speed, storage use, and archive-bit effects.

What we cover: RAID fault tolerance concepts and RAID 0, 1, and 5 behavior. 

Why it matters: RAID choice determines redundancy level, performance tradeoffs, and tolerated disk failures. 

Exam relevance: Tested as selecting the correct RAID level given requirements for speed, storage efficiency, and single-disk fault tolerance.

What we cover: High-availability design using redundancy, failover clustering modes, and advanced backup replication methods. 

Why it matters: These controls reduce single points of failure and maintain service continuity during component or site outages. 

Exam relevance: Tested as selecting appropriate resiliency controls and distinguishing active-active vs active-passive, shadowing, eVaulting, and remote journaling.

What we cover: Secure backup media storage using offsite facilities, encryption, inventory tracking, retention, and destruction controls.

Why it matters: Proper media handling preserves recoverability while preventing data-at-rest exposure and unauthorized access during storage and transport.

Exam relevance: Tested as selecting administrative and physical controls for backup media, retention requirements, and secure disposal decisions.

What we cover: Third-party and organizational change risk management using SLAs and security due diligence. 

Why it matters: Vendor and merger boundaries create weak links unless controls and accountability match required standards. 

Exam relevance: Tests selecting contractual and governance controls for vendors, acquisitions, and divestitures based on risk.

What we cover: Security architecture within enterprise architecture and how SABSA and TOGAF structure security design decisions.

Why it matters: It aligns controls to business requirements while keeping security consistent, layered, modular, and adaptable.

Exam relevance: Tested as distinguishing architecture frameworks from control frameworks and selecting SABSA versus TOGAF by focus.

What we cover: Security architecture governance using roadmaps, control objectives, and review gates to enforce conformance.

Why it matters: It ensures controls meet intended outcomes and implementations stay aligned with approved security design.

Exam relevance: Tested through selecting governance mechanisms, distinguishing control objectives from controls, and handling exceptions with compensating controls.

What we cover: Secure design principles and threat modeling methods for access control, layered controls, failure modes, and trust models.

Why it matters: These concepts drive correct control selection and reduce exposure through least access, layered safeguards, and early risk identification.

Exam relevance: Tested as conceptual distinctions and scenario-based choices among access models, threat frameworks, Zero Trust, and cloud responsibility boundaries.

What we cover: Modern security architecture decisions across zero trust, cloud shared responsibility, API security, and OT segmentation. 

Why it matters: Correct control placement depends on trust boundaries, ownership, and safety-driven constraints across environments. 

Exam relevance: Tested as scenario-based selection of architectures, responsibility models, and compensating controls for cloud, APIs, and OT.

What we cover: Security program charter authority, compliance obligation register ownership, and supply chain risk across third parties and nth parties.

Why it matters: These governance controls define scope, accountability, and risk oversight when requirements or dependencies change.

Exam relevance: Tested as choosing the correct governance document or vendor-risk control when authority, compliance, or fourth-party exposure is questioned.

What we cover: Core security program controls across access, crypto, SDLC, architecture governance, resiliency, and third-party risk.

Why it matters: It enables consistent control selection and lifecycle governance to maintain confidentiality, integrity, and availability.

Exam relevance: Tested through scenario-based control choice, architecture and SDLC governance distinctions, and audit versus assessment versus penetration testing.