Domain 3: Information Security Program

CISM · about 33% of the exam

Building and running the security program that delivers the strategy, from assets, architecture and policy to controls, people, suppliers and metrics.

Revising? All of this domain's slides in one deck. When you're done, take the domain quiz.

Program foundations

• The Security Program: Charter, Scope and Objectives What an information security program is, how it delivers the strategy, and how a charter gives it a clear mandate, scope, authority and objectives.
• Security Team Structure, Roles and Staffing How the security manager organises the team, decides which roles are needed, builds skills and fills gaps through hiring, training, contractors or managed services.
• Working with Legal, HR, IT, Audit and the Business How the security manager integrates security into the processes of other functions, so the program is delivered through them rather than around them.
• Program Implementation: From Plan to Operating Controls How roadmap initiatives become controls that actually operate: planning, building, integrating with existing systems and processes, handing over to owners, and proving they work.

Assets and architecture

• Information Asset Identification and Valuation Why the asset inventory is the foundation of the program, what counts as an information asset, and how owners value assets so protection matches their importance.
• Data Classification: Owners, Custodians and Users How classification makes protection proportionate to sensitivity and criticality, who decides it, and how labels drive handling rules across the organisation.
• Data Lifecycle: Retention, Archiving and Secure Disposal How information is protected from creation to destruction, how retention schedules balance legal duties with risk, and how to dispose of data so it can't be recovered.
• Enterprise Architecture for Security Managers What enterprise architecture is, why the 2026 CISM outline adds it, and how the security manager uses it to build security into how the organisation's business, data, applications and technology fit together.
• Information Security Architecture: Principles and SABSA What an information security architecture is, the design principles behind it, how SABSA links security mechanisms to business requirements, and how the security manager governs it.
• Defence in Depth and Zero Trust Two architecture strategies every security manager uses: layering independent controls so one failure isn't fatal, and zero trust, which stops trusting anything just because it's inside the network.
• Cloud Security and Shared Responsibility How security responsibilities split between the organisation and its cloud providers, the risks the security manager must govern, and the controls that matter most in cloud environments.

Frameworks and policies

• Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002 The detailed control catalogues a security manager uses to build the program, how they differ, and how to map them so one control set meets several obligations.
• Security Policy Development and Lifecycle How the security manager writes, approves, communicates and maintains information security policies so they guide behaviour and support the rest of the documentation.
• Security Standards and Baseline Requirements How standards turn policy into specific, measurable requirements, and how security baselines define the minimum secure configuration for each type of system.
• Procedures, Guidelines and Acceptable Use How procedures turn standards into repeatable steps, how guidelines help people make good choices, and what an acceptable use policy must cover for every user.
• Policy Enforcement, Exceptions and Review How the security manager makes policies stick: technical enforcement, compliance monitoring, a controlled exception process, consequences, and regular review.

Metrics

• Designing Security Metrics: KPIs, KRIs and KCIs How to choose security metrics that drive decisions: the main types, what makes a metric useful, and how to avoid measuring activity instead of outcomes.
• Collecting, Analysing and Reporting Metrics How the security manager turns raw data into reliable metrics, analyses trends, and reports them so stakeholders act on what they show.
• Security Maturity Models and Program Assessment How maturity models describe how well-run the security program is, how to set realistic targets per area, and how assessments feed the strategy and roadmap.

Controls

• Control Types and Categories How controls are classified by function (deterrent, preventive, detective, corrective, compensating) and by type (administrative, technical, physical), and why good designs layer them.
• Control Design and Selection Based on Risk and Cost How the security manager designs and selects controls: starting from risk and control objectives, weighing effectiveness against cost and usability, and designing in ownership and evidence from the start.
• Control Testing: Design vs Operating Effectiveness How the security manager evaluates controls: whether they're designed to meet their objective, whether they actually operate as designed over time, and which testing methods give reliable evidence.
• Identity and Access Management The security manager's view of IAM: the identity life cycle, strong authentication, least-privilege authorisation, privileged access and access reviews, and the governance that ties them together.
• Network and Endpoint Security Controls The core network and endpoint controls a security program needs, what each protects against, and what the security manager monitors to know they're working.
• Application Security and the Secure SDLC How the security manager builds security into how software is built and bought: requirements, threat modelling, secure coding, testing, release gates and the supply chain of code.
• Configuration, Change and Patch Management How three IT processes keep systems in a known secure state, why they matter so much to security, and what the security manager watches to know they're working.
• Cryptography for Security Managers What a security manager needs to decide about cryptography: where to encrypt, which standards to allow, how keys are managed, and how to prepare for change such as post-quantum algorithms.
• Security Testing: Scanning, Pen Testing and Tracking Remediation How the security manager plans a security testing program (scans, reviews, penetration tests, red teams), authorises tests properly, and makes sure findings get fixed.

Awareness and training

• Security Awareness Program Design How the security manager designs an awareness program that changes behaviour: starting from human risk, setting measurable objectives, using varied delivery and measuring outcomes rather than attendance.
• Role-Based Security Training Why different roles need different training, what to cover for executives, finance, IT, developers and others, and how the security team keeps its own skills current.
• Phishing Simulations and Social Engineering Defences How social engineering works on people, how to run phishing simulations that teach rather than shame, and the layered technical and process defences that back up awareness.

External services

• Third-Party Risk Management and Due Diligence How the security manager governs the risk of suppliers and service providers: tiering, due diligence, contractual requirements, monitoring and exit, scaled to each supplier's risk.
• Vendor Contracts, SLAs and Right to Audit How to build security into supplier contracts: requirements, right to audit, breach notification, data handling, service levels and exit, so they can be enforced later.
• Fourth-Party and Supply Chain Risk Risk that comes from your suppliers' suppliers, concentrations on shared providers, and compromised software, and what a security manager can realistically do about it.
• Outsourcing and Managed Security Services When outsourcing security functions makes sense, what managed security providers typically do, and how the organisation keeps accountability and control.

Communication and improvement

• Security Stakeholder Communication How the security manager plans communication with every stakeholder group, tailors the message, and uses communication to build support for the program.
• Executive Dashboards and Board Reporting How to report on the security program's effectiveness to executives and the board: one-page dashboards, trends, progress against the strategy, and the decisions leaders need to take.
• Continuous Improvement of the Security Program How the security program keeps getting better: Plan-Do-Check-Act, the evidence that drives improvement, management review, and keeping the program aligned as the business and threats change.