Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
The Security Program: Charter, Scope and Objectives
From strategy to program
Domain 1 covered the strategy: where security needs to be and the roadmap to get there. Domain 3 covers the information security program: the organised, funded, ongoing effort that delivers the strategy and keeps security running day after day. It’s the largest domain in the exam (33%), and the 2026 outline puts extra emphasis on program development.
What the program includes
| Element | Examples |
|---|---|
| People | The security team, security champions, owners with security responsibilities |
| Processes | Risk management, policy, access management, change, incident response, assurance |
| Technology | The tools and platforms that implement controls |
| Projects | Time-bound initiatives from the roadmap |
| Operations | Monitoring, response and administration, every day |
| Governance | Charter, metrics, reporting and continuous improvement |
A program isn’t a project. Projects finish; the program continues, combining run (operations) and change (projects).
The charter
A program charter, approved by senior management, gives the program its mandate. It typically sets out:
- mission and objectives, linked to the strategy
- scope: business units, locations, systems, data and third parties covered
- authority: the right to set policy, assess risk, access information and require action
- roles and reporting lines: the CISO, the steering committee, owners
- resources: the commitment of budget and people
- measures of success: how the program’s effectiveness will be judged
Without senior management approval, a charter has no authority, and every request becomes a negotiation.
Getting scope right
Scope decides what the program protects. Anything left out, by accident or on purpose, needs to be a known, accepted decision.
Example. A group’s security program covers head office and its data centre. A recently acquired subsidiary runs its own IT and isn’t mentioned in the charter. When the subsidiary is breached, nobody knew whose job it was. The revised charter brings acquisitions into scope within 90 days of closing.
Program objectives
Good program objectives:
- come from the strategy’s desired state
- are specific and measurable, such as “MFA on 100% of remote access by Q4”
- are aligned with the operational objectives of other business functions (a CISM task)
- are reviewed as the business changes
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| What the security program must align with | The security strategy and business objectives |
| Document that establishes the program’s mandate | A charter approved by senior management |
| Main purpose of defining scope | Clarify what’s protected and who is responsible |
| Program vs project | The program is ongoing; projects are time-bound parts of it |
| Best basis for program objectives | The strategy’s desired state |
In short
- The information security program is the organised set of people, processes, technology and projects that delivers the security strategy and keeps security running.
- Program objectives come from the strategy and must align with business objectives and with other business functions.
- A charter approved by senior management gives the program its mandate: mission, scope, authority, roles, resources and measures of success.
- Scope covers which business units, locations, systems, data and third parties are included; gaps in scope are gaps in protection.
- The program combines ongoing operations (run) with time-bound projects (change).
- Domain 3 is the largest part of the exam (33%); the 2026 outline puts extra emphasis on program development.
Exam traps
- A program is not a single project; it's ongoing.
- Program objectives come from the strategy and business needs, not from a product catalogue.
- Without senior management approval, a charter has no authority.
- Leaving parts of the organisation out of scope without a decision creates unmanaged risk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From strategy to program
The charter