Masterclass - CISM Exam (Updated 2025)

Explore essential risk concepts from ISACA's thinking hat, including probability, impact, risk assessment (identification, analysis, evaluation), and risk treatment options like mitigation, acceptance, avoidance, and transfer.

Master the four-phase risk management process—identify, analyze, evaluate, and respond—to balance business opportunities with reducing vulnerabilities and threats and to protect business objectives.

Understand how a risk management strategy aligns with governance to reduce risk to an acceptable level, supported by all staff and integrated with business objectives.

Learn to distinguish risk capacity, risk appetite, and risk tolerance, with examples and guidance on aligning these concepts with business objectives and ownership for risk management.

Identify, analyze, and evaluate risks to determine the current state and justify a risk mitigation strategy, comparing risk levels to risk appetite and referencing the risk register.

Explore risk assessment techniques to identify and evaluate risk, justify risk mitigation plans, and measure risk by probability and impact on business operations, while tracking trends for effective controls.

Explore risk analysis methodologies by comparing qualitative and quantitative approaches, measuring probability and impact, and weighing data availability and cost-benefit analysis for informed risk treatment.

Identify information assets, build an inventory, assign ownership, classify resources, label assets, and implement access controls. Emphasize data integrity, appropriate access guidelines, and data owners' accountability.

Asset valuation ties potential losses to business value, using revenue impact rather than replacement cost, and prioritizes risk analysis through asset inventories and business impact analysis.

Explore recovery time objective (RTO) and recovery point objective (RPO), illustrate how downtime and data loss shape disaster tolerance, and discuss backup strategies to resume services quickly.

Explain how the service delivery objective, maximum tolerable outage, and allowable interruption window drive disaster recovery planning, highlighting an alternate site with 2000 units per day to meet 5000-unit demand.

Assess third-party outsourcing risks by enforcing security requirements, right to audit, and clear subcontracting controls within a robust service level agreement, while addressing privacy law impacts and data ownership responsibilities.

This lecture explains the change management process for hardware, software, and network changes, with approvals, testing (including user acceptance testing), scheduling, rollback, and keeping security teams apprised.

use a consistent change management process to ensure all operations pass through approvals, testing, and logging; prevent unauthorized access and new security exposure while assessing security risks.

Patch management in this masterclass covers applying updates to operating systems and software, enforcing change management with approval, testing, and documentation, and using rollback procedures to mitigate vulnerabilities before deployment.

Summarizes patch management for timely vulnerability mitigation, stressing change management with testing, scheduling, and approvals, and the critical role of security patches and rollback procedures.

Define security baseline as the minimum information security requirements with consistent controls across assets by classification. Enforce two-factor authentication for critical apps and at least one factor for non-critical apps.

Explore the concept of security baseline control, defining minimum requirements, ensuring uniform system hardening, and meeting multinational regulatory needs through location-based supplement standards.

Explore defense in depth, a multi-layer information security approach that uses preventive controls like logging and authentication, containment to limit impact, incident response, and recovery via backup arrangements.

Explore why security managers must understand information technology within information security program development management. Start the integration of business and information security processes with risk assessment and control objectives.

Define an information security program objective that supports business functions, minimizes disruptions, and implements a cost-effective strategy; set key goal indicators and align with organizational needs with stakeholder sign-off.

Explore the five information security framework components: technical, operational, management, administrative, and education, and how governance frameworks, including 27000, shape roi and centralized or decentralized security aligned with business objectives.

Explore information security framework components by analyzing risk assessment, centralized vs decentralized security structures, data owners, and alignment with business objectives to guide security investment.

Explore the information security program road map through practice questions, learning how value delivery hinges on cost-benefit of controls, business-as-usual approvals, and role-based access control mapped to business needs.

Explore information security policy, guidelines, and standards, including data retention and data classification policies, and the documented escalation process for policy exceptions.

Explores practice questions on information security policies, including data classification policy and data retention aligned with business needs. Highlights global policy with regional adaptability and the risk register for compliance.

Learn security program management essentials: daily antivirus updates, virus definition files, data encryption on mobile devices, and establishing a multi-department steering committee with risk assessment.

explore practice questions on security program management and administrative activities, including vulnerability scans, antivirus updates, policy compliance reviews, and system monitoring considerations that avoid business disruption.

Explore privacy principles, consent, and cross-border data transfer, and learn how privacy impact assessments and privacy by design safeguard compliant handling of personal information.

Enterprise information security architecture aligns business objectives with security strategy and designs the security posture, integrating firewalls, IDs, and anti-malware while establishing minimum security levels.

Implement architecture securely by enforcing timely access termination, reviewing security tools, managing firewall rule complexity, mitigating phishing, steganography risks, and ensuring changes remain authorized.

Explore architecture implementation questions, including unauthorized activity by a former employee, responsibility for security, and methods to mitigate social engineering, change management, and data integrity risks.

Examine access control fundamentals, including mandatory, discretionary, and role-based controls, and learn to create a work function matrix to enforce segregation of duties and use physical destruction for data erasure.

Explore identity and access management fundamentals, including access control, password policy, two-factor authentication, single sign-on, and data protection to safeguard confidentiality and integrity.

practice questions on identity and access control demonstrate how role-based access control mitigates temporary staff access, enforces segregation of duties, and supports large organizations.

Explore biometric systems, including fingerprints and iris patterns, and learn how false acceptance and false rejection rates shape accuracy, alongside common attacks like spoofing, brute force, and replay.

Learn how factor of authentication works, with the three factors—something you know, something you have, and something you are—and why two-factor authentication improves access security.

Explore wireless network risks and controls, including encryption, mac filtering, ssid management, dhcp, and rogue access points, plus common attack methods like war driving and war walking.

Explore diverse information system attack methods and techniques, including zombie computers, buffer overflow, ddos, social engineering, and man-in-the-middle threats.

Explore cloud computing basics—internet-based storage, processing power, memory, and virtual machines—and compare deployment models private, public, community, and hybrid with infrastructure, platform, and software as a service.

explain the concepts of free, open, and fail close for control failures and their impact on confidentiality, integrity, and availability, with an automatic door example.

Explore how data custodians and system administrators protect data integrity through classification, routine security controls, and source code reviews, aligning controls with business objectives and targeting high-risk areas for monitoring.

Assess controls and countermeasures, focusing on corrective controls to mitigate impact, data custodian duties, and source code reviews for backdoors, NAT, and data removal from media.

Identify system weaknesses through vulnerability assessment, including misconfigurations and missing updates, and address them before exposure; verify defenses via white-box and black-box penetration testing with clear scope.

Examine security program metrics and monitoring to guide actions and measure effectiveness, focusing on incident trends, SDLC design phase metrics, and unauthorized intrusion investigations.

Explore security program metrics and monitoring to gauge incident response effectiveness. Identify how metrics reveal information security objectives, control effectiveness, and trends for senior management.

Explore the four firewall types—packet filtering, stateful inspection, circuit level, and application level—and how they map to OSI layers, with application level offering the strongest security.

Learn how a proxy server acts as a middleman between internal and external networks, exposing only the proxy IP. Compare circuit-level and application-level proxies, noting application-level proxies are more secure.

Explore how intrusion detection systems and intrusion prevention systems monitor security events, using signature-based, statistical-based, and neural network techniques across network-based and host-based IDs, honeypots, and honey nets.

Explore key IDS and IPS concepts, including statistical, signature, and neural network based approaches, their false positives, sensors, honeypots, and tuning.

Explore how digital signatures create a hash of the message, encrypt the hash with the sender’s private key, and verify authentication, integrity, and non-repudiation using public keys.

Explain how a public key infrastructure issues and manages digital certificates, with the certifying authority issuing certificates, the registration authority verifying information, and the certificate list of revoked certificates.

Explore asymmetric encryption fundamentals, including public and private keys, confidentiality, authenticity, integrity, and non-repudiation, plus hashing, signing, and hybrid approaches.

Explore the five phases of the incident management life cycle: planning and preparation, detection, triage and investigation, containment and recovery, and post-incident review and closure.

Define service delivery objective and max tolerable outage from an alternate site, explain the relationship with allowable interruption window, and base incident response on business impact analysis.

Learn incident management basics through practice questions, covering incident response plans, safety priorities, fire response, network denial of service attack, stolen laptop, disaster reporting, business continuity, and containment.

Learn to minimize the duration and impact of outages and security incidents through a defined incident response plan and clear roles. Emphasize evidence collection and simulator testing.

Explore incident response procedures through practice questions, focusing on reducing SIEM false positives and leveraging a comprehensive security policy for effective SIEM utilization against advanced persistent threat.

Develop and validate an incident response plan by detailing immediate validation after reports, escalation guidelines, and the information security manager’s role in forming the incident response team to mitigate impact.

Develop an incident response plan by confirming incidents, containing them through containment and quarantine, deploying an intrusion detection system, and using metrics to justify incident management for business benefits.

Document a comprehensive business continuity plan with clear responsibilities and disaster declarations. Align offsite locations, backup procedures, and information security with the organization’s risk assessment.

Explore the disaster recovery plan within business continuity, covering downtime and recovery costs, recovery time objective and recovery point objective, service delivery objective, testing, and asset prioritization.

Identify critical processes and assets to determine business impact, prioritize recovery, and design resilient strategies through interviews, questionnaires, and meetings.

Explore testing incident response, business continuity, and disaster recovery plans through checklist reviews, simulation tests, and full interruption tests, with full interruption offering the strongest assurance of readiness.

Explore key aspects of testing incident response plan, BCP, and DRP, including when full interruption or simulation tests best assure effectiveness without disrupting operations, and restoration testing to verify resumption.

Describe executing the response and recovery plan, including daily automated anti-malware signature updates, reporting breach impact to senior management, and isolating compromised segments for forensic analysis.

Learn how to preserve digital evidence through a robust chain of custody, imaging, data acquisition, extraction, interrogation, normalization, and reporting to ensure court admissibility.

Explore post-incident activities and forensic investigation essentials, emphasizing independent root-cause reviews, strict chain of custody, evidence preservation, bit-for-bit imaging, and incident history tracking.

Explore post-incident activities and investigations, emphasizing independent, objective root-cause reviews and lessons learned to improve processes. Master forensic best practices, including chain of custody and preserving admissible evidence.