CISM Certification: CISM Domain 4 Video Boot Camp 2026

What we cover: Incident management governance and preparedness controls across response, continuity, recovery, and post-incident analysis.

Why it matters: It drives consistent containment, recovery, and improvement decisions under pressure using predefined roles and plans.

Exam relevance: Tested through scenario-based selection of incident response versus BCP or DRP actions and prioritization of forensics.

What we cover: Incident management as an administrative control and the definitions separating events, alerts, incidents, problems, and disaster severity. 

Why it matters: Clear classification and predictable response planning enable consistent handling, escalation, and root-cause correction. 

Exam relevance: Tested as terminology distinction and scenario-based selection of incident category, cause type, and severity threshold.

What we cover: The incident management lifecycle phases and the distinction between containment, eradication, remediation, and lessons learned.

Why it matters: Correct phase selection drives consistent response actions, evidence preservation, and prevention of recurrence across the environment.

Exam relevance: Tested as ordering and labeling incident response steps and choosing the correct phase for a described action.

What we cover: Incident response phases from mitigation through recovery, remediation, lessons learned, reporting, and root-cause analysis.

Why it matters: Correct phase actions prevent reinfection, ensure stakeholder coordination, and drive organization-wide fixes and layered controls.

Exam relevance: Tests selecting the correct incident response phase, reporting path, rebuild-versus-restore choice, and remediation scope decisions.

What we cover: The distinction between BCP as organization-wide continuity planning and DRP as IT-focused recovery planning. 

Why it matters: Correct plan scope and ownership drives appropriate controls, priorities, and maintenance for resilience. 

Exam relevance: Tested as conceptual differentiation and scenario-based selection of the right plan type and level of detail.

What we cover: Disaster categories and environmental controls within disaster recovery and business continuity planning.

Why it matters: Correctly classifying disruptions drives appropriate safeguards for availability and facility resilience.

Exam relevance: Tested through scenario-based selection of DRP versus BCP focus and matching controls to disaster type.

What we cover: Personnel shortage planning within business continuity and disaster recovery to maintain minimum operating requirements.

Why it matters: Role-based staffing redundancy and cross-training sustain critical functions when people are unavailable.

Exam relevance: Assessed through scenario-based selection of BCP/DRP controls like role-based plans, remote work readiness, and travel device protections.

What we cover: Disaster recovery planning basics covering purpose, roles, declaration authority, communications, and the mitigation-preparation-response-recovery lifecycle.

Why it matters: Clear responsibilities and escalation paths enable consistent, timely action and coordination during disruptive events.

Exam relevance: Tested as selecting correct DRP phase actions and identifying who declares disasters and who must be notified.

What we cover: Business continuity and disaster recovery planning lifecycle and disaster team roles across activation, failover, and failback. 

Why it matters: It aligns preventive controls, recovery strategies, and ownership to restore prioritized services safely and consistently. 

Exam relevance: Tests selecting correct phase, control type, and team action from keywords like BIA, failover, failback, and tiers.

What we cover: Business impact analysis metrics for criticality and recovery planning including RPO, MTD, RTO, WRT, MTBF, MTTR, and MOR.

Why it matters: These values set acceptable data loss and downtime to drive backup, redundancy, and recovery capability selection.

Exam relevance: Tested as term differentiation and constraint logic, especially ensuring RTO plus WRT does not exceed MTD.

What we cover: Non-IT recovery strategies for supply chain and external utility and connectivity resilience planning.

Why it matters: Recovery depends on third-party dependencies and alternate resources, not only internal system restoration.

Exam relevance: Tests selecting appropriate continuity controls when outages involve vendors, utilities, or ISP path single points of failure.

What we cover: Disaster recovery site types and their recovery capabilities as availability controls. 

Why it matters: Matching site capability to downtime and data currency requirements determines feasible recovery outcomes. 

Exam relevance: Tested as selecting the correct site type by RTO/RPO, automation level, and cost tradeoffs.

What we cover: BCP sub-plans and their distinct scope across continuity, recovery, incident response, safety, IT support, and crisis communications.

Why it matters: Clear plan boundaries assign responsibilities and ensure coordinated action during disruptive events.

Exam relevance: Tested as conceptual distinctions and scenario-based plan selection within organizational resilience and incident management.

What we cover: Business continuity plan handling, emergency operations center purpose, MOU/MOA role assignment, and personnel redundancy controls.

Why it matters: These administrative and operational controls preserve plan availability, authority clarity, and continuity of critical skills during disruption.

Exam relevance: Tested as selecting appropriate BCP/DR documentation, alternate site command functions, role agreements, and redundancy or cross-training decisions.

What we cover: Disaster recovery plan testing phases from document review through exercises, failover drills, and external audit validation.

Why it matters: Testing verifies plan completeness and feasibility while training roles to execute consistently under disruption.

Exam relevance: Assesses recognizing test types and selecting the least disruptive method that still validates recovery capability.

What we cover: Disaster recovery and continuity plan training, awareness, and iterative plan maintenance with version control.

Why it matters: Trained staff and current plans enable predictable execution of recovery tasks under stress.

Exam relevance: Tested as selecting appropriate DRP/BCP lifecycle actions, training versus awareness, and when to update plans.

What we cover: Post-incident lessons learned and governance gaps that weaken BCP and DRP effectiveness. 

Why it matters: Continuous improvement, stakeholder buy-in, training, testing, and version control keep recovery plans usable. 

Exam relevance: Tested as selecting correct continuity actions, identifying plan failure causes, and mapping NIST 800-34 and ISO 22301/27031.

What we cover: Digital forensics evidence handling versus incident response actions and continuous monitoring as a detective control. 

Why it matters: Proper acquisition, hashing, and chain of custody preserve evidence integrity and legal admissibility. 

Exam relevance: Tested as scenario-based selection of forensics steps, volatile-first collection, write-blocking, hashing, and monitoring purpose.

What we cover: Disk forensics storage areas including allocated, unallocated, slack space, and bad sectors plus bit-level imaging. 

Why it matters: These areas can retain hidden or deleted data that normal file access ignores. 

Exam relevance: Tested as selecting forensic acquisition methods and identifying where artifacts persist beyond file deletion.

What we cover: Data remanence and memory types, focusing on volatile versus nonvolatile storage and firmware persistence.

Why it matters: Residual data and persistent firmware storage affect confidentiality and integrity when systems are powered off or repurposed.

Exam relevance: Tested through scenario keyword recognition and selecting correct memory or sanitization methods for RAM, flash, and SSDs.

What we cover: Secure media disposal methods and the distinctions between deletion, clearing, sanitization, purging, and destruction. 

Why it matters: Correct disposal prevents data remanence exposure across paper and digital media throughout the asset lifecycle. 

Exam relevance: Tested as scenario-based selection of disposal technique by media type, sensitivity, and recoverability requirements.

What we cover: Network forensics methods, embedded device evidence handling, malware reverse engineering, egress monitoring, and e-discovery workflow stages.

Why it matters: These controls preserve volatile evidence, prevent exfiltration, and maintain integrity and custody for legal defensibility.

Exam relevance: Tested as choosing monitoring and forensic approaches, distinguishing capture models, identifying DLP purpose, and mapping e-discovery phases.

What we cover: Zero-day vulnerability, exploit, and attack distinctions and related defensive controls. 

Why it matters: Unknown flaws require layered detection and disciplined patch management to reduce exposure. 

Exam relevance: Tested as terminology differentiation and selecting compensating controls when no signature or patch exists.

What we cover: Human-caused disasters including nation-state cyberwarfare, terrorism, sabotage, and financially motivated attacks.

Why it matters: Threat categorization guides appropriate security controls and prioritizes protection of critical infrastructure and key personnel.

Exam relevance: Tested through scenario-based identification of threat actors and attack types, plus selecting mitigations like patching and awareness.

What we cover: Differences between machine code, source code, compiled and interpreted execution, and programming language generations including CASE categories.

Why it matters: These distinctions affect software assurance, reverse engineering exposure, and selecting appropriate development and lifecycle controls.

Exam relevance: Tested as conceptual identification and scenario-based selection of language type, execution model, and CASE tool versus workbench versus environment.

What we cover: Software development approaches and software licensing and distribution models.

Why it matters: These distinctions drive secure procurement, reuse, and legal control decisions for software and source code.

Exam relevance: Tested as conceptual differentiation and scenario-based selection among open versus closed source, licensing terms, and EULA implications.

What we cover: Database security concepts including polyinstantiation, aggregation versus inference, data mining, data analytics, and defense in depth.

Why it matters: These concepts guide confidentiality protection and detection strategy selection across data stores and monitoring controls.

Exam relevance: Tested as terminology distinctions and scenario-based choices between deception, correlation, deduction, pattern discovery, baselining, and layered controls.

What we cover: Common virus types and how signature evasion and multi-vector persistence affect detection.

Why it matters: Correct control selection depends on understanding user-triggered infection paths and antivirus detection limits.

Exam relevance: Tested through scenario keywords that require choosing preventive controls and detection methods for specific virus behaviors.

What we cover: Key malware types and detection concepts including worms, Trojans, rootkits, logic bombs, and packers. 

Why it matters: Correct classification drives appropriate preventive and detective control selection across host and network layers. 

Exam relevance: Tested via scenario-based identification of malware behavior, persistence level, trigger conditions, and signature versus heuristic detection.

In this lecture, we will discuss the topic of Web Architecture and Attacks. First, we will delve into the history and background of the Internet, which was initially designed for secure closed networks and not intended for the widespread use it has today. This means that security was not built into the protocols and standards, leading to a patchwork of security measures being added after the fact. We will also talk about the concept of adding security to an already established system, like building a house without any doors or windows and then trying to add them later. We will also cover topics such as the most common web security issues, as outlined by the Open Web Application Security Project (OWASP) and how to defend against them. The goal of the lecture is to understand the importance of incorporating security into the design and implementation process.

What we cover: Personnel safety controls for evacuation, alerting, and duress notification.

Why it matters: Clear roles, training, and fail-safe egress ensure safe, orderly evacuation for all occupants.

Exam relevance: Tests prioritizing life safety and selecting appropriate physical controls and notification methods in facility scenarios.

What we cover: Incident response and recovery planning as an operational security control category. 

Why it matters: Clear preparation, response, and improvement processes reduce disruption and support consistent containment and restoration. 

Exam relevance: Tested through scenario-based selection of incident management components, including BCP/DRP alignment, testing cadence, and post-incident forensics.