Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Security Stakeholder Communication
Communication is part of the program
Security depends on people far outside the security team: executives who fund it, owners who decide risk, IT teams who run controls and staff who follow policy. “Information security program communications and reporting” is a named CISM topic. Communication is how the security manager gets everyone pulling the same way.
Plan by stakeholder
A communication plan lists each stakeholder group, what they need to know, the channel, the frequency and who owns the communication:
| Stakeholder | Wants to know | Channel | Frequency |
|---|---|---|---|
| Board | Risk against appetite, decisions needed | Committee paper, briefing | Quarterly |
| Executives | Impact on their goals, asks of them | One-to-ones, steering committee | Monthly |
| Business owners | Their risks, actions, deadlines | Meetings, dashboards | Monthly or on change |
| IT teams | Requirements, priorities, findings | Tickets, stand-ups, standards | Ongoing |
| All staff | What to do, how to report | Intranet, campaigns, training | Regular, short |
| External parties | Assurance, obligations | Reports, contracts, questionnaires | As required |
Making messages land
- Their language: business terms for leaders, plain words for staff.
- Why it matters to them: link to their goals, not security’s.
- A clear ask: what do you need them to decide or do?
- Stories and evidence: real incidents and data beat abstract warnings. Fear wins attention once and trust never.
Listen as well as tell
Communication is two-way. Listening reveals business needs, pain points and risks the security team can’t see:
- regular conversations with business leaders
- feedback from awareness campaigns and surveys
- security champions as two-way channels
- post-incident reviews with the affected teams
Example. Sales staff keep emailing customer files to their personal accounts. Instead of another warning, the security manager asks why: the approved file-sharing tool doesn’t work on their tablets. Fixing the tool stops the behaviour; another warning wouldn’t have.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step in a communication plan | Identify stakeholders and their needs |
| Best way to communicate with executives | Business impact, in business terms, with clear asks |
| Purpose of two-way communication | Understand business needs and obstacles |
| Staff ignore security messages | Make messages relevant and find the cause |
| What builds credibility | Consistent, honest, timely communication |
In short
- Program communications and reporting is a named CISM topic: the program succeeds only if stakeholders understand and support it.
- A communication plan identifies stakeholders, what each needs to know, the channel, frequency and owner.
- Tailor messages: business impact and decisions for executives, actions for owners, practical guidance for staff.
- Communication is two-way: listening to the business reveals needs, pain points and risks.
- Use plain language and real examples; avoid jargon and fear.
- Consistent, honest communication builds the credibility that wins resources and cooperation.
Exam traps
- One technical report sent to everyone serves nobody.
- Communicating only during incidents makes security look like bad news.
- Fear-based messaging wins attention once and trust never.
- Ignoring feedback from the business leads to controls people work around.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Plan by stakeholder
1 / 8