Notes

Notes are grouped by certification and exam domain. Pick a domain to see its topics.

CISA: Certified Information Systems Auditor

• Domain 1: Information System Auditing Process Exam technique, Standards and ethics, Audit basics, Planning, Evidence and testing, Controls, Reporting and quality
• Domain 2: Governance and Management of IT Governance, Organization and policy, Risk, Management
• Domain 3: Information Systems Acquisition, Development and Implementation Project management, Development, Testing, Implementation, Application controls
• Domain 4: Information Systems Operations and Business Resilience Operations, Resilience
• Domain 5: Protection of Information Assets Governance and privacy, Access control, Cryptography, Network and platform security, Physical, Threats, Response and monitoring

CISM: Certified Information Security Manager

• Domain 1: Information Security Governance Exam technique, Governance foundations, Legal and compliance, Roles and structures, Strategy, Frameworks, Strategic planning
• Domain 2: Information Security Risk Management Risk foundations, Threats and vulnerabilities, Risk analysis, Risk treatment, Ownership and monitoring
• Domain 3: Information Security Program Program foundations, Assets and architecture, Frameworks and policies, Metrics, Controls, Awareness and training, External services, Communication and improvement
• Domain 4: Incident Management Incident readiness, Business continuity, Disaster recovery, Training and testing, Detection and investigation, Containment and communication, Recovery and review

CRISC: Certified in Risk and Information Systems Control

• Domain 1: Governance Exam technique, Organisational governance, Policies and assets, Risk governance, Appetite and profile, Legal and compliance
• Domain 2: IT Risk Assessment Risk events and threats, Vulnerabilities and risk factors, Risk scenarios, Assessment methods, Analysis and evaluation, Risk register
• Domain 3: Risk Response and Reporting Risk response, Ownership and accountability, Third-party risk, Issues and exceptions, Control design, Control testing, Risk data and treatment plans, Monitoring and metrics, Reporting, Emerging risk
• Domain 4: Information Technology and Security Architecture and operations, Projects and development, Data lifecycle, Resilience, Emerging technology, Security principles