CISM Masterclass: Managing Information Security | UPDATED |

Name: CISM Masterclass: Managing Information Security | UPDATED |
Rating: 4.9 (49 reviews)

CISM Certification Essentials: Security Governance, Risk, and Program Oversight, CISM Concepts Made Simple for Success.

Created byArbab Majeed

Last updated 12/2025

English

English [Auto],

What you'll learn

Understand the role of information security management and the responsibilities of a security manager
Distinguish between security governance and security management and apply both effectively
Explain core information security principles, including confidentiality, integrity, and availability
Align information security objectives with business goals and organizational strategy
Apply recognized governance frameworks and standards such as COBIT, ISO/IEC 27001, and NIST at a conceptual level
Develop and maintain an effective information security strategy and high-level policies
Identify legal, regulatory, and contractual requirements that influence security decisions
Define roles, responsibilities, and accountability across the organization
Understand information security risk, including threats, vulnerabilities, impacts, and risk appetite
Establish and manage an information security risk management program
Perform and interpret risk assessments using qualitative and conceptual quantitative approaches
Select and justify appropriate risk response and treatment options
Design and manage an organization-wide information security program
Understand security architecture concepts and control types from a managerial perspective
Build effective security awareness, training, and culture programs
Manage third-party and outsourced service risks
Understand incident management concepts, preparation, response, and recovery at a leadership level
Measure, monitor, and report on security program performance

Course content

6 sections • 24 lectures • 1h 40m total length

Introduction to CISM and the Role of a Security Manager4:24
Guide security planning by aligning governance, risk, and incident management with business goals. Adopt a managerial mindset that emphasizes structure and accountability for daily security.
Information Security Principles and Core Terminology3:04
Explore how confidentiality, integrity, and availability guide security decisions, emphasize access control and policy, and balance governance, risk control, and accountability for reliable operations.
Security Governance vs Security Management3:53
Governance sets direction, accountability, and business-aligned security goals; management translates those into planning, tasks, and daily operations, guided by frameworks like Cobit or ISO 27,001 to ensure oversight.

Governance Frameworks and Standards4:46
Explore how governance frameworks create structure around security, align controls with business objectives, and guide decision making with Cobit, ISO/IEC 27001, and NIST.
Developing an Information Security Strategy4:07
Develop a security strategy that defines goals, aligns with business goals, prioritizes risks, reflects the organization’s environment, and guides long-term planning and road map progress.
Security Policies, Guidelines, and High-Level Requirements3:35
Define security policies, standards, and guidelines to set clear expectations for behavior and data handling. Foster policy lifecycle and governance with leadership, legal, and security teams.
Legal, Regulatory, and Contractual Requirements4:23
Navigate the legal, regulatory, and contractual obligations that shape data protection, governance, incident reporting, and contracts across sectors and regional contexts.
Defining Roles, Responsibilities, and Accountability4:20
Define roles and responsibilities using the raci framework to clarify ownership, accountability, and decision rights, improving security governance, collaboration, and timely action.

Understanding Risk in Information Security4:13
Assess risk in information security by analyzing threats, vulnerabilities, and their potential impact on organizational goals to guide leadership decisions on mitigation, avoidance, transfer, or acceptance.
Establishing a Risk Management Program4:21
Establish a structured risk management program that identifies, assesses, treats, and monitors risks while clarifying ownership, communication, and accountability across the organization.
Risk Assessment Concepts4:20
Assess risks using qualitative and quantitative approaches to prioritize actions with a clear impact and likelihood matrix. Categorize risks, communicate clearly, and empower leadership to act with confidence.
Risk Response and Treatment Options4:13
Identify and assess risks, then select a risk response and treatment: acceptance, avoidance, mitigation, or transfer, based on context, risk level, and resources. Monitor effectiveness and adjust as conditions change.
Risk Monitoring, Reporting, and Review4:28
Monitor risks, track changes in likelihood and impact, review cycles, tailor clear reports for leadership, and update risk records to reflect reality for timely, informed decisions.

Designing the Information Security Program4:42
Design an information security program that aligns with business goals, integrating governance, risk management, compliance, incident processes, awareness, and policy development to deliver consistent security across people, technology, and processes.
Security Architecture Concepts for Managers4:38
Managers guide security architecture by understanding least privilege, segmentation, and defense in depth across layered controls. Standardization and governance align security with business goals through cross-functional integration.
Control Types and Control Frameworks4:34
Explore administrative, technical, and physical controls that reduce risk, guide behavior, and protect assets, and learn their life cycle and how frameworks like Iso27001, NIST, CFS, and Cobit structure them.
Security Training, Awareness, and Culture3:58
Security training and awareness shape daily behavior to protect the organization. Leaders reinforce a practical security culture through steady habits like checking emails, links before opening them, and locking screens.
Managing Third-Party and Outsourced Services4:08
Manage third-party risk by monitoring vendors, cloud services, and outsourced partners who access systems and data, and enforce contracts and security requirements.

Foundations of Incident Management4:03
Learn how incidents are business problems and how structured incident management, clear roles, and thorough preparation empower teams to respond quickly and clearly, contain issues, and recover faster.
Preparing the Organization for Security Incidents4:05
Prepare and practice incident response to speed reactions and reduce uncertainty. Define detection, reporting, investigation, and recovery steps, plus escalation, decision rights, and clear instructions for coordinated action.
Detection, Reporting, and Investigation Concepts4:03
Differentiate events from incidents to prevent burn out and noise, and focus on detection and reporting of meaningful threats, then conduct structured investigations to contain, fix, and learn for improvement.
Response, Containment, and Recovery Concepts4:07
Prioritize protecting people and the organization during incident response, reduce immediate damage, contain the issue, and begin recovery with safe, tested system restoration and clear communication.

Measuring and Monitoring the Security Program4:00
Measure the security program to reveal patterns, issues, and improvements over time, using metrics and KPIs to track risk, align outcomes with business priorities, and inform executive reporting.
Continuous Improvement and Evolving Security Needs4:15
Align security with the evolving business by continuously improving controls and adapting practices as the organization grows. Learn from incidents, audits, and tests to update procedures and trainings.

Requirements

Willingness to learn security concepts from a managerial and business-focused perspective

Description

It's an Unofficial Course.

This course is designed to provide a comprehensive and manager-focused understanding of information security management, aligned with the core concepts and knowledge areas of the Certified Information Security Manager (CISM) framework. It emphasizes governance, risk management, program development, and incident oversight from a leadership and business perspective rather than a purely technical one. The course is ideal for professionals who want to understand how information security supports organizational objectives and how effective security management enables business resilience, trust, and long-term success.

Throughout the course, learners will explore the fundamental principles of information security, including confidentiality, integrity, and availability, and understand how these principles translate into real-world governance and management decisions. The course explains the role of a security manager, clarifies the difference between governance and management, and highlights why strong oversight, accountability, and alignment with business strategy are essential for a successful security program.

The course provides in-depth coverage of information security governance, including widely recognized frameworks and standards such as COBIT, ISO/IEC 27001, and NIST. Learners will gain a clear understanding of how governance frameworks support decision-making, define responsibilities, and ensure alignment between security initiatives and organizational goals.

The course also focuses on developing and maintaining an information security strategy, establishing effective policies, and understanding legal, regulatory, and contractual requirements that influence security governance.

Risk management is a central theme of this course. Learners will develop a strong conceptual understanding of information security risk, including threats, vulnerabilities, impacts, and risk appetite. The course explains how to establish a risk management program, perform risk assessments using qualitative and conceptual quantitative approaches, select appropriate risk treatment options, and communicate risk effectively to leadership. Emphasis is placed on viewing risk from a business perspective and supporting informed decision-making at the management level.

The course also covers the design and management of an organization-wide information security program. Learners will understand how to structure a security program, align it with business objectives, and integrate security architecture and controls across the organization. Key topics include control types, control effectiveness, security awareness and training, and building a strong security culture that influences behavior and accountability. The course further addresses the governance and oversight of third-party and outsourced services, highlighting vendor risk and contractual expectations.

Incident management is addressed from a managerial and strategic viewpoint. Learners will gain an understanding of incident management concepts, preparation and readiness, detection and reporting, investigation principles, and high-level response, containment, and recovery considerations. The course emphasizes the importance of preparation, coordination, and leadership during security incidents to minimize business impact and support timely recovery.

Finally, the course focuses on measuring and monitoring the performance of the information security program and driving continuous improvement. Learners will explore security metrics, key performance indicators, program maturity concepts, and executive-level reporting. The course highlights how organizations must adapt their security strategies over time by learning from incidents, responding to evolving threats, and aligning with new technologies and business changes.

By the end of this course, learners will have a strong managerial understanding of information security governance, risk management, program development, incident oversight, and continuous improvement, preparing them for security leadership roles and supporting their journey toward CISM certification.

Thank you

Who this course is for:

Professionals preparing for the Certified Information Security Manager (CISM) certification
Information security managers and aspiring security leaders
IT managers, project managers, and technical professionals moving into security management roles
Risk management, governance, compliance, and audit professionals
Business and technology leaders who need to understand information security from a governance perspective
Students and early-career professionals interested in information security management and leadership

CISM Masterclass: Managing Information Security | UPDATED |

What you'll learn

Explore related topics

Course content

Foundations of Information Security Management3 lectures • 11min

Information Security Governance5 lectures • 21min

Information Security Risk Management5 lectures • 22min

Information Security Program Development & Management5 lectures • 22min

Information Security Incident Management4 lectures • 16min

Program Performance and Continuous Improvement2 lectures • 8min

Requirements

Description

Who this course is for: