Domain 1: Information Security Governance

CISM · about 18% of the exam

How the board and senior management direct security, and how the security manager turns business goals into a strategy, a framework and a funded plan.

Revising? All of this domain's slides in one deck. When you're done, take the domain quiz.

Exam technique

• Exam Technique: Thinking Like a Security Manager How CISM questions are built, why two answers often look right, and a simple method for choosing the answer a security manager would give: business-first, risk-based and in the right order.

Governance foundations

• Security Governance vs Security Management Why information security needs governance at board level, what governance delivers, and how it differs from the day-to-day management the CISO runs.
• Organisational Culture and Tone at the Top How an organisation's culture and its leaders' behaviour shape what security can achieve, and how a security manager works with culture rather than against it.
• Ethics, Codes of Conduct and Accountability The ISACA Code of Professional Ethics, how an organisation's code of conduct supports security, and what it takes to make people genuinely accountable.
• Integrating Security into Corporate Governance How information security becomes part of how the whole organisation is governed: one risk language, board oversight, integrated assurance and security built into business decisions.

Legal and compliance

• Legal, Regulatory and Contractual Requirements Where security obligations come from (laws, sector regulation, contracts, standards), how the security manager identifies them with legal counsel, and how they shape the strategy.
• Due Diligence, Due Care and Legal Liability What 'reasonable' security means in law, the difference between due diligence and due care, and how documentation protects the organisation and its leaders.
• Privacy and Data Protection Governance How privacy differs from security, what a privacy program contains, how the security manager works with the privacy officer, and the privacy-by-design practices the exam expects.

Roles and structures

• Governance Roles, the CISO and Reporting Lines Who does what in information security, from the board to the user, what the CISO is responsible for, and why the CISO's reporting line matters.
• The Security Steering Committee Why a cross-functional security steering committee is the security manager's best tool for alignment and support, who sits on it and what it should decide.
• The Three Lines Model and Independent Assurance How the IIA's Three Lines Model divides risk work between management, oversight functions such as security, and internal audit, and why independent assurance matters to the security manager.

Strategy

• Aligning Security Strategy with Business Objectives Why strategic alignment is the first goal of security governance, how to understand what the business needs, and how to show that every security initiative supports a business goal.
• Developing a Security Strategy and Roadmap How the security manager builds a strategy: define the desired state, assess the current state, analyse the gap, account for constraints, and turn it into a funded roadmap.
• Gaining and Keeping Executive Commitment Why senior management support is the deciding factor for every security program, and practical ways the security manager earns and keeps it.
• Governing AI and Emerging Technology How the security manager helps the organisation adopt AI and other emerging technology safely: an AI policy, inventory, risk assessment, approval with controls, and the frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) that guide it.

Frameworks

• Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT The three frameworks a security manager meets most, what each is for, how they differ and how they fit together in one governance program.
• Selecting and Implementing a Framework How a security manager chooses a governance or security framework, tailors it to the organisation, maps it to others, and puts it into practice.
• Governance Models: BMIS and the Security Balanced Scorecard Two models a security manager uses to think and report about security as part of the business: ISACA's Business Model for Information Security (BMIS) and the security balanced scorecard.

Strategic planning

• Resource Planning and Security Budgets How the security manager plans people, technology and services for the strategy, builds a risk-based budget, and decides what to build, buy or outsource.
• Building a Business Case for Security Investment How to write a security business case that executives approve: framing the business problem, comparing options, costing them honestly and showing the benefits.
• Demonstrating Value and Return on Security Investment How security shows it's worth what it costs: return on security investment, its limits, and the non-financial value that matters just as much to executives.