Domain 1: Information Security Governance
Arrow keys or space to move, F for full screen. Read the notes
Information Security Governance
21 topics · Exam technique · Governance foundations · Legal and compliance · Roles and structures · Strategy · Frameworks · Strategic planning
D1Exam Technique: Thinking Like a Security Manager
How CISM questions are built, why two answers often look right, and a simple method for choosing the answer a security manager would give: business-first, risk-based and in the right order.
The exam in numbers
| Item | Detail |
|---|---|
| Questions | 150 multiple choice, one best answer |
| Time | 4 hours |
| Scoring | Scaled 200-800; 450 passes |
| Weights (from Nov 2026) | Governance 18%, Risk 20%, Program 33%, Incident 29% |
| Experience to certify | 5 years in information security, 3 in management |
Two answers look right
Most CISM questions have two or three plausible options. They're written so that a good engineer and a good security manager would choose differently. The exam is testing which one you are thinking as.
Example'A new regulation affects customer data. What should the security manager do FIRST?' Buying encryption, updating the policy and training staff may all happen eventually. The FIRST step is to assess how the regulation applies and what gap it creates.
A method for every question
The manager's mindset
Reading the qualifiers
| Qualifier | What it's really asking |
|---|---|
| FIRST | The correct sequence: what has to happen before anything else? |
| BEST / MOST effective | The option with the greatest benefit for the business, all things considered |
| PRIMARY / MAIN | The fundamental purpose, not a side benefit |
| MOST LIKELY | The probable cause or result, not the worst case |
| GREATEST concern / risk | What would hurt the business most |
Preparing well
- 1Learn concepts, then practise questions and read every explanation.
- 2For wrong answers, ask: why is the right one more 'manager'?
- 3Study by weight: Domain 3 and 4 are 62% of the exam.
- 4Time: about 1.5 minutes per question; flag and return.
- 5Answer every question; there's no penalty for guessing.
Key takeaways
- ✓The CISM exam has 150 multiple-choice questions in 4 hours; scores are scaled from 200 to 800 and 450 passes.
- ✓Every question is answered from the information security manager's viewpoint: business-aligned, risk-based and working through others.
- ✓Read the qualifier carefully: FIRST, BEST, MOST, PRIMARY and MOST LIKELY change which answer is right.
- ✓FIRST questions are about order: understand, assess and get support before acting.
- ✓Eliminate answers that are too technical, outside the manager's role, premature, or absolute.
- ✓Answers that point to business objectives, senior management, risk assessment and the owner's decision are usually right.
Exam traps
- !Picking the most technically impressive answer; CISM rewards management judgement.
- !Choosing what you'd do second when the question asks what to do FIRST.
- !Making the security manager accept or own business risk; the owner does.
- !Ignoring an established plan, policy or process in a scenario that already has one.
- !Choosing answers with 'always', 'never' or 'eliminate all risk'.
Security Governance vs Security Management
Why information security needs governance at board level, what governance delivers, and how it differs from the day-to-day management the CISO runs.
Why security needs governance
Information is now one of the most valuable things most organisations own, and losing it can sink them. Decisions about how much to protect it, and how much risk to accept, are business decisions. That makes them the board's job, not just IT's.
ExampleA retailer's IT team runs good firewalls and patching. But nobody has decided which data matters most, how much risk the business can live with, or who answers for a breach. When customer data leaks through a supplier, the board discovers it never set any direction at all.
Governance vs management
What governance should deliver
Who is accountable for what
| Role | Governance or management? | Main job |
|---|---|---|
| Board of directors | Governance | Accountable; sets direction and risk appetite |
| Executive management | Governance and management | Implements direction; provides resources |
| Security steering committee | Bridge | Aligns security with business priorities |
| CISO / security manager | Management | Develops and runs the security program |
| Business owners | Management | Own their information and its risk |
Signs governance is working
- 1The board discusses security risk regularly, in business terms.
- 2A documented strategy links security to business objectives.
- 3Risk appetite is defined, and decisions are made against it.
- 4Roles and accountability are clear and assigned.
- 5Metrics show progress, and management acts on them.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Who is ultimately accountable for information security | The board / senior management |
| Most important factor for effective governance | Senior management commitment and support |
| What should drive security governance | Business objectives and strategy |
| Main outcome of security governance | Strategic alignment with the business |
| Which activity is governance, not management | Setting direction, appetite and accountability |
Key takeaways
- ✓Information security governance is the board and senior management setting direction, deciding risk appetite, assigning accountability and monitoring results.
- ✓Security management is the CISO and team turning that direction into a program, controls and day-to-day decisions.
- ✓Governance is part of corporate governance. Accountability for protecting information sits with the board, not the IT department.
- ✓Six outcomes of good governance: strategic alignment, risk management, value delivery, resource optimisation, performance measurement and assurance integration.
- ✓The most important ingredient is senior management commitment; without it, the program has no authority or money.
- ✓Governance asks 'are we protecting the right things, to the right level?'; management asks 'are the controls working?'.
Exam traps
- !The CISO manages security; the board is accountable for it. Don't confuse responsibility with accountability.
- !Governance isn't a technical activity. Buying tools or writing firewall rules is management, not governance.
- !Security governance is driven by business objectives, not by the latest threats or by technology.
- !A strong security team with no board oversight is a governance gap, even if operations look fine.
Organisational Culture and Tone at the Top
How an organisation's culture and its leaders' behaviour shape what security can achieve, and how a security manager works with culture rather than against it.
Culture beats policy
Every organisation has written rules and unwritten ones. The unwritten ones, its culture, decide what people actually do when nobody is checking. A security program that ignores culture ends up with policies everybody signs and nobody follows.
ExampleA firm's policy bans sharing passwords. But managers routinely ask assistants to log in as them to approve invoices, and nobody objects. The real rule, set by leaders' behaviour, is that sharing is fine.
Where is the organisation today?
Tone at the top
Staff copy what leaders do, not what they say. When executives skip MFA, demand exceptions or ignore reports, everyone learns that security is optional. When they follow the rules visibly, ask about risk in meetings and fund the program, security becomes normal.
Exam tipWhen the exam asks for the MOST important factor in a security culture or program, the answer is usually senior management commitment and support.
Fit the strategy to the culture
Risk-averse cultureRegulated bank or hospital: formal controls and approvals are accepted. Watch for slow, bureaucratic security.
Risk-tolerant cultureFast-growing tech firm: speed is prized. Build security into tools and pipelines, not paperwork.
Decentralised cultureBusiness units act independently: use champions and shared standards rather than central control.
Command cultureDecisions flow from the top: winning the executive sponsor matters most.
Levers that change culture
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Most important factor for a strong security culture | Senior management commitment, visibly shown |
| Staff routinely bypass a control | Find out why; the control may not fit the culture or process |
| Best way to embed security | Integrate it into business processes |
| Strategy must reflect… | The organisation's culture and risk appetite |
| Best measure of culture change | Behaviour: reporting, exceptions, incidents |
Key takeaways
- ✓Organisational culture is the shared values and habits that decide how people actually behave, whatever the policy says.
- ✓Tone at the top, the visible behaviour of senior leaders, is the strongest single influence on security culture.
- ✓A security strategy must fit the organisation's culture and risk appetite; one that fights the culture will be worked around.
- ✓A healthy security culture rewards reporting mistakes early instead of punishing them.
- ✓Culture changes through many levers: leadership, processes, training, champions, incentives and fair consequences.
- ✓Measure culture with behaviour (reporting rates, policy exceptions, surveys), not just training completion.
Exam traps
- !The security manager can't create culture alone; senior management commitment is the key factor.
- !More rules don't fix a weak culture; they usually create more workarounds.
- !A risk-averse bank and a fast-moving start-up need different strategies; 'best practice' isn't one size fits all.
- !Punishing people who report incidents drives problems underground.
Ethics, Codes of Conduct and Accountability
The ISACA Code of Professional Ethics, how an organisation's code of conduct supports security, and what it takes to make people genuinely accountable.
Why ethics matters in security
Security managers see things others don't: salaries, investigations, private messages, weaknesses in the business. Their power to read, block and monitor has to be used honestly. Ethics is what makes the rest of the organisation trust the security function.
The ISACA Code of Professional Ethics
- 1Support good governance and controls; follow standards and procedures.
- 2Act with diligence, objectivity and professional care.
- 3Serve stakeholders lawfully, with integrity, and don't discredit the profession.
- 4Keep information private and confidential, unless legally required to disclose.
- 5Stay competent; take on only work you can do well.
- 6Inform appropriate parties of the results of work, including significant facts.
The organisation's own rules
Code of conductExpected behaviour for everyone: honesty, conflicts of interest, handling information.
Acceptable use policyWhat staff may and may not do with systems, email, internet and data.
AcknowledgementSigned when joining and reconfirmed regularly; proves people were told.
Disciplinary processDefined, fair, consistent, agreed with HR and legal.
What makes accountability real
An ethical grey area
Monitoring staff email can catch data theft, but it touches privacy. The security manager shouldn't decide alone.
ExampleAfter a leak, a manager asks the CISO to quietly read one employee's mailbox. The CISO checks the acceptable use policy allows monitoring, involves HR and legal, documents the authorisation, and limits the search to what the investigation needs.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| What makes actions traceable to a person | Unique user IDs plus logging |
| Best way to show staff were told the rules | Signed acknowledgement of policies |
| Can an owner delegate accountability? | No; only the work (responsibility) |
| Request to monitor an employee | Check policy and law; involve HR and legal; document |
| CISM holder breaks the code of ethics | ISACA can investigate and revoke the certification |
Key takeaways
- ✓CISM holders must follow the ISACA Code of Professional Ethics; breaching it can lead to losing the certification.
- ✓A code of conduct and an acceptable use policy set clear expectations for everyone; staff should acknowledge them when they join and periodically after.
- ✓Accountability needs clear expectations, named owners, traceable actions, review and fair consequences.
- ✓Unique user IDs are what make actions traceable; shared accounts destroy accountability.
- ✓Consequences must apply consistently, including to senior people, or the code loses credibility.
- ✓Ethical dilemmas, such as monitoring staff, need legal and HR input and a documented basis.
Exam traps
- !Responsibility can be delegated; accountability can't. The owner stays accountable even when someone else does the work.
- !A code of conduct nobody has read or acknowledged doesn't create accountability.
- !Ethics isn't only about not committing crimes: concealing a known risk from management is an ethical failure too.
- !Monitoring employees without a legal basis and a clear policy can itself break laws and trust.
Integrating Security into Corporate Governance
How information security becomes part of how the whole organisation is governed: one risk language, board oversight, integrated assurance and security built into business decisions.
One organisation, one governance
Boards already govern finance, legal risk and operations. Information security belongs in the same structure, using the same committees, the same risk language and the same reporting cycle. When it sits apart, the board can't weigh security against everything else it has to decide.
Speak the language of enterprise risk
Information risks should go into the enterprise risk process, rated on the same likelihood and impact scales and compared with the same appetite as financial or operational risks.
ExampleThe CISO rates 'ransomware stops order processing' as High on the company's own 5x5 scale, with an estimated 2 million impact. The board can now compare it directly with a supply-chain risk of similar size.
Assurance integration
Built into business decisions
Project approvalSecurity requirements and risk review are gates in the project life cycle.
ProcurementSupplier security checked before contracts are signed.
Mergers and acquisitionsSecurity due diligence on the target before the deal.
New products and marketsLegal, privacy and security requirements assessed up front.
Board oversight
- 1A board committee (audit or risk) has security oversight in its charter.
- 2Regular reporting: top risks, trends, major incidents, program progress, decisions needed.
- 3Risk appetite for information risk approved by the board.
- 4Independent assurance from internal audit.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Best way to integrate security into corporate governance | Through enterprise risk management |
| What the board should receive | Business-focused risk reporting |
| When to involve security in projects | From the start: in approval and requirements |
| Benefit of assurance integration | Fewer gaps and overlaps; one view of risk |
| Information risk should be expressed… | On the same scales as other business risks |
Key takeaways
- ✓Information security governance is a subset of corporate governance, not a separate IT activity.
- ✓The most effective integration is through enterprise risk management: information risk described in the same language, scales and appetite as other business risks.
- ✓The board oversees security through its committees (audit or risk) and through regular reporting in business terms.
- ✓Assurance integration means security, audit, risk, legal, privacy, HR, physical security and IT share information and avoid gaps and overlaps.
- ✓Security is integrated into business processes such as project approval, procurement, mergers and new products.
- ✓Reporting to the board focuses on risk, trends and decisions needed, not on technical detail.
Exam traps
- !Reporting firewall statistics to the board isn't integration; reporting business risk is.
- !A separate security risk register with its own scales makes information risk hard to compare with other risks.
- !Integration doesn't mean the CISO reports to internal audit; audit must stay independent.
- !Security added at the end of a project or deal is too late; it belongs in the approval process.
Legal, Regulatory and Contractual Requirements
Where security obligations come from (laws, sector regulation, contracts, standards), how the security manager identifies them with legal counsel, and how they shape the strategy.
Where obligations come from
Examples you should recognise
| Requirement | Type | Security impact |
|---|---|---|
| GDPR and other privacy laws | Law | Lawful processing, breach notice in 72 hours, rights |
| NIS2 (EU) | Regulation | Risk management and incident reporting for essential sectors |
| DORA (EU financial sector) | Regulation | ICT risk, resilience testing, third-party oversight |
| HIPAA (US health) | Law | Protect health information |
| SOX (US listed companies) | Law | Controls over financial reporting |
| PCI DSS | Contract | Protect cardholder data |
The compliance process
Jurisdiction and data location
One organisation can be subject to many legal systems at once: where it's incorporated, where it trades, where its servers sit, and where its customers live.
ExampleA US company stores EU customers' data in a cloud region in Singapore. GDPR applies because of the customers, local law may apply because of the data centre, and US law applies to the company. The security manager flags the transfer question to legal before the migration.
Compliance is a floor, not a ceiling
Compliant but insecurePasses the PCI assessment once a year, but unpatched systems outside scope are breached.
Secure but can't prove itGood controls, but no evidence or documentation for the regulator.
Risk-basedCompliance requirements are inputs to the risk-based strategy, not the strategy itself.
Accepted non-complianceRare, documented and approved by senior management with legal advice.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| First step when a new regulation is announced | Determine whether and how it applies (with legal) |
| Who interprets legal requirements | Legal counsel |
| Is PCI DSS a law? | No; a contractual obligation |
| Relationship of compliance to security | Compliance is a minimum input to a risk-based program |
| Who decides to accept non-compliance | Senior management, informed of the risk |
Key takeaways
- ✓Security obligations come from laws, sector regulations, contracts, listing rules, certifications the organisation commits to, and its own policies.
- ✓Identifying which requirements apply is the first step; legal counsel interprets them, the security manager turns them into controls.
- ✓Jurisdiction matters: where the organisation operates, where data is stored and where customers live can all bring in different laws.
- ✓Contractual obligations such as PCI DSS or customer security clauses are as binding as laws for the organisation.
- ✓Compliance is a minimum, not the goal: a compliant organisation can still be insecure.
- ✓Regulatory change must be monitored so the strategy and controls stay current.
Exam traps
- !The security manager doesn't interpret the law alone; consult legal counsel.
- !When a new regulation appears, the first step is to assess what it requires and the gap, not to buy tools.
- !Non-compliance is a business risk decision: management may accept some, knowingly, if the impact is understood.
- !Being compliant doesn't mean being secure, and being secure doesn't automatically prove compliance.
Due Diligence, Due Care and Legal Liability
What 'reasonable' security means in law, the difference between due diligence and due care, and how documentation protects the organisation and its leaders.
What does 'reasonable' mean?
After a breach, regulators, courts and customers ask one question: did the organisation do what a reasonable, prudent organisation would have done? Nobody expects perfection. They expect sensible, documented effort proportionate to the risk.
Due diligence vs due care
How liability arises
NegligenceHarm was foreseeable, a reasonable control existed, and the organisation didn't use it.
Breach of contractSecurity promises in a customer contract weren't kept.
Regulatory penaltyA law or regulation required controls that weren't in place.
Downstream liabilityYour weak security harmed a partner, e.g. attackers used your network to reach theirs.
Proving you took care
- 1Risk assessments showing risks were identified.
- 2Recorded decisions: who accepted which risk, and why.
- 3Policies, standards and evidence that controls operate.
- 4Supplier assessments before and during contracts.
- 5Training records and incident response records.
ExampleTwo companies suffer the same ransomware attack. One can show a risk assessment, a board-approved plan to fix the gap, and progress reports. The other has nothing written down. Regulators treat them very differently.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Assessing a supplier before signing | Due diligence |
| Implementing controls to address known risk | Due care |
| Best protection against negligence claims | Documented, reasonable, risk-based decisions |
| Legal standard for security | What a prudent person would do (reasonable care) |
| Does outsourcing remove the duty? | No; due diligence and oversight still required |
Key takeaways
- ✓Due diligence is investigating and understanding risk; due care is acting reasonably on what you know.
- ✓The legal test is usually what a prudent person in a similar organisation would have done: the standard of care.
- ✓Negligence is failing to exercise due care when harm was foreseeable; it can create liability for the organisation and, sometimes, its directors.
- ✓Documentation (risk assessments, decisions, approvals, evidence of controls) is how an organisation proves it exercised due care.
- ✓Downstream liability arises when weak security at one organisation harms its customers or partners.
- ✓Following recognised frameworks and industry practice helps show a reasonable standard of care.
Exam traps
- !Due diligence = find out; due care = act. Exam options often swap them.
- !Accepting a known risk without documentation looks like negligence, even if the decision was reasonable.
- !Outsourcing doesn't remove the duty of care; you must still do due diligence on the supplier.
- !Perfect security isn't the legal standard; reasonable security is.
Privacy and Data Protection Governance
How privacy differs from security, what a privacy program contains, how the security manager works with the privacy officer, and the privacy-by-design practices the exam expects.
Privacy isn't just security
A hospital can lock patient records in a perfect vault and still break privacy law, by collecting data it doesn't need, using it for marketing, or keeping it forever. Security asks 'is the data protected?'. Privacy asks 'should we have it, and are we using it as promised?'.
The privacy principles
What a privacy program contains
Who does what
Privacy by design
MinimiseCollect and keep only what's needed for the stated purpose.
PseudonymiseReplace identifiers; still personal data, but lower risk.
AnonymiseIrreversibly remove identity; then outside privacy law.
Default to protectiveMost private settings on by default; sharing is opt-in.
ExampleA retailer plans a loyalty app that tracks customers' location constantly. The privacy impact assessment, with security input, finds location is needed only at checkout. The design changes to collect it only then, cutting both privacy and breach risk.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Privacy vs security | Privacy: appropriate use. Security: protection |
| Collecting more data than needed | Breaks data minimisation |
| When to do a privacy impact assessment | Before high-risk processing starts |
| Is pseudonymised data personal data? | Yes |
| Security manager's role in privacy | Protect data; support impact assessments and breach response |
Key takeaways
- ✓Privacy is about whether personal data should be collected, how it's used and shared, and people's rights over it; security is one of the means to protect it.
- ✓Privacy laws such as GDPR rest on principles: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
- ✓A privacy program includes records of processing, notices, lawful bases, privacy impact assessments, rights handling, processor contracts, transfer safeguards and breach response.
- ✓The privacy officer or DPO leads privacy; the security manager provides the protection and contributes to impact assessments and breaches.
- ✓Privacy by design and by default builds protection into systems from the start, with the most protective settings as standard.
- ✓Privacy-enhancing techniques include minimisation, pseudonymisation, anonymisation, encryption and access restriction.
Exam traps
- !A perfectly secure system can still break privacy law if it collects data it doesn't need.
- !Pseudonymised data is still personal data; only truly anonymised data falls outside privacy law.
- !Privacy impact assessments happen before processing starts, not after.
- !The controller stays accountable even when a processor causes the breach.
Governance Roles, the CISO and Reporting Lines
Who does what in information security, from the board to the user, what the CISO is responsible for, and why the CISO's reporting line matters.
Who does what
The CISO's job
- 1Develop the security strategy and program with the business.
- 2Advise management on information risk, in business terms.
- 3Set policies and standards; oversee controls.
- 4Lead incident management and security operations.
- 5Measure and report on program effectiveness.
- 6Build and lead the security team and its budget.
Owners, custodians and users
| Role | Usually | Responsible for |
|---|---|---|
| Information owner | Business manager | Classification, access approval, accepting risk |
| Custodian | IT, DBAs, cloud teams | Implementing protection the owner requires |
| User | Everyone with access | Following policy; reporting incidents |
| Security administrator | Security or IT | Granting access as approved; not deciding it |
Where the CISO reports
ExampleA CISO reports to the head of infrastructure, who delays a critical patch to protect a launch. The CISO's warning never reaches the executive team. Moving the reporting line to the COO, with a dotted line to the risk committee, fixes the escalation path.
Writing roles down
Job descriptionsSecurity responsibilities in every relevant role, not just security staff.
RACI chartsWho is responsible, accountable, consulted, informed for each process.
PolicyThe security policy names roles and lines of authority.
CommunicationPeople are told, and reminded, what's expected of them.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Who is accountable for information security | Board / senior management |
| Who classifies data and approves access | The information owner |
| Concern with CISO reporting to the CIO | Conflict of interest; reduced independence |
| The CISO's main role | Develop and manage the program; advise on risk |
| Best way to clarify responsibilities | Documented roles (RACI) communicated to all |
Key takeaways
- ✓The board is accountable for information security; executive management provides resources and owns business risk.
- ✓The CISO or information security manager develops, runs and reports on the security program; they don't own the business's risks.
- ✓Information owners (business managers) classify data, approve access and accept residual risk; custodians (often IT) implement the protection.
- ✓The CISO should report high enough, and independently enough of IT delivery, to raise risks without being overruled.
- ✓Roles and responsibilities should be written down (job descriptions, RACI) and communicated.
- ✓Clear lines of authority let the security manager escalate issues quickly when risk exceeds appetite.
Exam traps
- !Security is everyone's responsibility, but accountability must be assigned to named roles.
- !The CISO doesn't accept business risk on the owner's behalf.
- !A CISO reporting to the CIO can face conflicts between security and delivery deadlines.
- !IT is usually the custodian of data, not its owner.
The Security Steering Committee
Why a cross-functional security steering committee is the security manager's best tool for alignment and support, who sits on it and what it should decide.
Why have one?
Security decisions affect every part of the business: budgets, projects, how people work. No CISO can make them alone and expect support. A steering committee gives the business a seat at the table, so security priorities become business priorities.
Who sits on it
What it does
AlignReviews strategy so it supports business objectives.
PrioritiseRanks security initiatives and allocates resources.
ApproveEndorses policies and major changes before senior management sign-off.
ResolveSettles conflicts between security and business units.
MonitorTracks risk, metrics and program progress.
EscalateRaises risks beyond appetite to executives and the board.
Making it work
- 1A written charter: purpose, authority, membership, quorum.
- 2Senior members who can commit their departments.
- 3Regular meetings with an agenda tied to risk and strategy.
- 4Minutes recording decisions, owners and dates.
- 5Follow-up on actions at the next meeting.
ExampleA company's committee meets quarterly, but only IT managers attend and minutes show no decisions. Meanwhile business units buy cloud tools without review. The CISO asks the COO to chair and invites the business heads; within two meetings, a cloud approval process is agreed.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Best way to gain cross-functional support | A steering committee with senior business representation |
| Main purpose of the committee | Align security with business objectives and priorities |
| Who should chair it | A senior business executive / sponsor |
| Internal audit's role on it | Adviser or observer, not decision-maker |
| Best evidence it works | Minutes showing decisions and follow-up |
Key takeaways
- ✓A security steering committee brings senior business, IT, legal, HR and risk leaders together to align security with business priorities.
- ✓It's the most effective way to get cross-functional support and resolve conflicts between security and business goals.
- ✓It reviews strategy and policy, prioritises initiatives, monitors risk and program progress, and escalates to the board.
- ✓Membership must be senior and business-led; a committee of only IT and security people can't ensure alignment.
- ✓Internal audit may attend as an adviser but shouldn't make decisions, to protect its independence.
- ✓A charter, regular meetings and recorded decisions are the evidence that it works.
Exam traps
- !A committee of IT managers can't ensure business alignment.
- !The CISO usually presents and coordinates; a senior business executive should chair.
- !Internal audit voting on security decisions would impair its independence.
- !A charter alone proves nothing; minutes and follow-up show the committee works.
The Three Lines Model and Independent Assurance
How the IIA's Three Lines Model divides risk work between management, oversight functions such as security, and internal audit, and why independent assurance matters to the security manager.
Who checks the checkers?
Organisations need people who manage risk, people who oversee and challenge that management, and people who independently confirm the whole system works. The Institute of Internal Auditors calls this the Three Lines Model.
The three lines
Where security fits
Security operationsRunning firewalls, access management and monitoring is often first-line work.
Security governance and riskSetting policy, standards and monitoring compliance is second-line work.
Internal auditAssesses both, independently, and reports to the audit committee.
External assuranceExternal auditors, regulators and certification bodies add an outside view.
Working with audit
- 1Treat findings as independent evidence, not criticism.
- 2Agree action plans with owners and dates.
- 3Use audit results to support budget requests.
- 4Don't ask audit to design controls you want them to approve later.
ExampleInternal audit finds that privileged access reviews haven't been done for a year. The CISO agrees a fix with the IT director, then uses the finding to win funding for a privileged access management tool that the board had previously deferred.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Who provides independent assurance | Internal audit (third line) |
| Who owns and manages risk | First line: business and operational management |
| Role of risk and compliance functions | Second line: oversight, frameworks, challenge |
| Can audit design the controls it will test? | No; it impairs independence |
| Best use of audit findings | Drive agreed remediation and support resourcing |
Key takeaways
- ✓First line: management and operations own and manage risk, including running controls day to day.
- ✓Second line: specialist functions (risk, compliance, usually information security) provide frameworks, expertise, monitoring and challenge.
- ✓Third line: internal audit gives independent, objective assurance to the board through the audit committee.
- ✓The governing body is accountable and oversees all three; external auditors and regulators add assurance from outside.
- ✓The security manager should welcome audit findings as independent evidence and use them to drive improvement.
- ✓Independence means auditors don't design or run the controls they will later assess.
Exam traps
- !Internal audit is independent of management; the security function is not.
- !The CISO shouldn't report to internal audit; that would compromise audit's independence.
- !Where security sits (first or second line) varies; what matters is that ownership and oversight are clear.
- !Audit giving assurance doesn't transfer responsibility for controls away from management.
Aligning Security Strategy with Business Objectives
Why strategic alignment is the first goal of security governance, how to understand what the business needs, and how to show that every security initiative supports a business goal.
Security exists to serve the business
A security program can be technically excellent and still fail if it protects the wrong things, slows down what the business most needs, or costs more than the risks it reduces. Alignment means security decisions start from what the business is trying to achieve.
ExampleA logistics firm's security team spends its budget on a data-loss tool. But the board's priority is keeping warehouses running, and ransomware on operational systems is the real threat. The program is busy, but not aligned.
Understand the organisation first
Trace every control to a goal
How to stay aligned
- 1Meet business leaders; learn their plans and pain points.
- 2Express security objectives in business terms.
- 3Use the steering committee to set priorities with the business.
- 4Join strategic planning, not just IT planning.
- 5Review the strategy when the business changes direction.
Signs of misalignment
WorkaroundsBusiness units bypass security to get things done.
Tech-first reportingReports talk about tools and alerts, not business risk.
Unfunded programLeaders can't see why security spending matters.
SurprisesSecurity learns about major business changes after they happen.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Primary goal of security governance | Strategic alignment with business objectives |
| First step in developing a security strategy | Understand business strategy and objectives |
| Best indicator of alignment | Security initiatives trace to business goals, with business support |
| Business enters a new market | Reassess risk and update the strategy |
| Most important input to the strategy | Business objectives (not threats or technology) |
Key takeaways
- ✓Strategic alignment, security supporting business goals, is the primary outcome of information security governance.
- ✓The first step in developing a security strategy is understanding the business strategy, objectives and culture.
- ✓The strategy must account for internal influences (strategy, culture, appetite, resources) and external ones (laws, threats, industry, customers).
- ✓Security objectives should be stated in business terms and trace down to initiatives, controls and metrics.
- ✓Good security enables the business: new markets, customer trust, faster safe delivery.
- ✓Alignment is continuous: when the business changes direction, the security strategy is reviewed.
Exam traps
- !Starting a strategy with a technology choice or a threat list, before understanding business objectives, is wrong.
- !A strategy that only aims for compliance isn't aligned; compliance is one input.
- !Security that blocks the business without explaining risk leads to workarounds and loss of support.
- !IT's priorities aren't the same as the business's priorities.
Developing a Security Strategy and Roadmap
How the security manager builds a strategy: define the desired state, assess the current state, analyse the gap, account for constraints, and turn it into a funded roadmap.
What a strategy is
A strategy answers three questions: where do we need to be, where are we now, and how do we get there? Without it, security spending follows the latest incident or vendor pitch instead of the business's needs.
From current state to desired state
Defining the desired state
Control objectivesWhat security must achieve, from COBIT or ISO 27001.
Maturity targetse.g. CMMI-style level 3 for access management, level 4 for incident response.
Framework profilesNIST CSF target profile for the organisation.
Risk targetsKey risks reduced to within appetite.
Constraints shape the route
The roadmap
ExampleA new CISO finds no asset inventory, MFA only for email, and no incident plan. The roadmap starts with MFA for admins and remote access (quick win), then inventory and IAM (foundation), then automation and metrics (maturity). The board approves a three-year budget tied to these phases.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| First step in building a strategy | Understand business objectives / define desired state |
| Best way to establish the current state | Risk and maturity assessments, gap analysis |
| What the roadmap is based on | Gaps prioritised by risk and business need |
| Who approves the strategy | Senior management / the board |
| When to update the strategy | Regularly, and after significant business change |
Key takeaways
- ✓A security strategy is a plan to move from the current state to a desired state that supports business objectives.
- ✓The desired state is defined with business input, often using frameworks or maturity targets (COBIT, CMMI, ISO 27001, NIST CSF).
- ✓The current state comes from risk assessments, maturity assessments, audit findings, BIA results and metrics.
- ✓Gap analysis shows what must change; the roadmap orders initiatives by risk, dependencies, cost and quick wins.
- ✓Constraints (legal, budget, culture, skills, technology, time) shape the route and pace.
- ✓The strategy is approved by senior management and reviewed regularly, and whenever the business changes.
Exam traps
- !Don't start with solutions: define objectives and assess the current state first.
- !A list of projects isn't a strategy unless it links to business objectives and a desired state.
- !Ignoring culture or budget constraints gives a strategy that can't be delivered.
- !The desired state isn't 'maximum security'; it's the level the business needs and can afford.
Gaining and Keeping Executive Commitment
Why senior management support is the deciding factor for every security program, and practical ways the security manager earns and keeps it.
Why it decides everything
Senior management controls the budget, sets priorities and models behaviour. Without their visible support, policies have no authority, projects lose funding and business units ignore security. That's why CISM answers so often point to senior management commitment.
How to earn it
Speak their language
| Instead of… | Say… |
|---|---|
| 'We have 400 critical vulnerabilities.' | 'Our online store could be down for a week; that's 3 million in sales.' |
| 'We need a SIEM.' | 'We'd currently take months to notice a breach; this cuts it to hours.' |
| 'ISO 27001 requires it.' | 'Two of our largest customers require it to renew contracts.' |
| 'Phishing is rising.' | 'Fraudulent payment requests cost a peer company 4 million last year.' |
Opportunities to win support
IncidentsA breach here or at a peer focuses attention. Use it to show the gap, not to frighten.
Audit findingsIndependent evidence carries weight.
RegulationNew rules make some actions non-optional.
Business plansNew markets, products or acquisitions need security to succeed.
Keeping it
- 1Regular, concise reporting on risk and progress.
- 2Deliver what was promised; show quick wins early.
- 3Be honest about problems and setbacks.
- 4Keep executives involved through the steering committee.
ExampleA CISO gets funding after a peer's ransomware attack, then reports quarterly with three measures the board chose: time to detect, critical systems backed up offline, and phishing report rate. Two years later, funding continues without a new crisis.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Most important factor for program success | Senior management commitment |
| Best way to obtain management support | Show how security supports business objectives, in business terms |
| Most effective way to present risk | Business impact, with options and costs |
| Management declines to fund a control | Document the decision and the accepted risk |
| How to maintain support | Regular reporting on progress and risk |
Key takeaways
- ✓Senior management commitment is the most important success factor for an information security program.
- ✓Executives commit when security is explained in their terms: business goals, risk, money and reputation.
- ✓Offer options with costs and residual risk, so executives make informed decisions rather than approve demands.
- ✓Incidents, audits, regulation and peer benchmarks can create interest, but lasting commitment comes from alignment.
- ✓Keep support through regular, honest reporting, delivered quick wins and a seat on the steering committee.
- ✓Visible commitment (policy signed by the CEO, executives following the rules) tells everyone security matters.
Exam traps
- !Fear, uncertainty and doubt may get a one-off budget, but not lasting support.
- !Technical detail loses executives; business impact keeps them.
- !Commitment isn't a one-time approval; it must be maintained.
- !Without senior support, the right answer is rarely 'push ahead anyway'; it's to build the case and get it.
Governing AI and Emerging Technology
How the security manager helps the organisation adopt AI and other emerging technology safely: an AI policy, inventory, risk assessment, approval with controls, and the frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) that guide it.
Enable, don't block
Staff are already using AI tools, and the business wants the productivity they promise. A security manager who simply says no loses influence and pushes use into the shadows. The 2026 CISM outline emphasises today's technologies: the job is to make adoption safe.
What can go wrong
Governing AI
Frameworks and regulation
| Framework | What it gives you |
|---|---|
| NIST AI RMF | Govern, Map, Measure, Manage functions for AI risk |
| ISO/IEC 42001 | Certifiable AI management system (2023) |
| EU AI Act | Risk tiers: prohibited, high-risk, limited, minimal; obligations phasing in from 2025 |
| OWASP Top 10 for LLMs | Common technical risks in AI applications |
Controls that work
Approved toolsEnterprise versions with no training on your data.
Data rulesWhich classifications may go into which tools.
Human oversightPeople review AI output before important decisions.
Technical guardrailsInput and output filtering, least-privilege tool access, logging.
ExampleA law firm finds staff pasting client documents into a free chatbot. Instead of a ban, it licenses an enterprise AI service that doesn't retain or train on data, allows only that tool for confidential material, blocks the free ones, and trains staff. Usage rises, and so does control.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| First step before adopting a new technology | Assess the business case and the risk |
| Best response to unapproved AI use | Govern it: policy, approved tools, data rules |
| Certifiable AI management standard | ISO/IEC 42001 |
| NIST AI RMF functions | Govern, Map, Measure, Manage |
| Who owns the AI use case's risk | The business owner, advised by security, legal and privacy |
Key takeaways
- ✓Emerging technology is a business opportunity and a risk; the security manager's job is to enable safe adoption, not to block it.
- ✓AI risks include data leakage, prompt injection, unreliable or biased output, poisoned models or data, vendor and IP issues, and shadow AI.
- ✓Governance steps: policy and ownership, inventory, risk assessment, approval with controls, monitoring and review.
- ✓NIST AI RMF (Govern, Map, Measure, Manage) and ISO/IEC 42001 (a certifiable AI management system) provide structure.
- ✓The EU AI Act takes a risk-based approach, from prohibited uses to high-risk systems with strict obligations, phasing in from 2025.
- ✓The same approach applies to any emerging technology: understand the business case, assess the risk, set guardrails, monitor.
Exam traps
- !Banning AI outright usually drives it underground (shadow AI); govern it instead.
- !AI risk isn't only a security issue; legal, privacy, ethics and the business owner are involved.
- !AI features inside existing SaaS products need assessment too.
- !Approving a tool once isn't enough; models and vendor terms change.
Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
The three frameworks a security manager meets most, what each is for, how they differ and how they fit together in one governance program.
Why frameworks?
A framework gives the security program a recognised structure: a checklist of what good looks like, a common language for the board and auditors, and evidence of a reasonable standard of care. It saves the security manager from inventing everything from scratch.
NIST Cybersecurity Framework 2.0
The three side by side
How they fit together
COBITHow the board and management govern IT as a whole; security sits inside it.
ISO 27001The management system that runs security: risk assessment, controls, internal audit, improvement.
NIST CSFDescribes outcomes in plain terms; profiles show current vs target state.
Control cataloguesISO 27002, NIST SP 800-53, CIS Controls give the detailed controls.
Using CSF profiles
A profile is a snapshot of which CSF outcomes the organisation achieves. Comparing a current profile with a target profile shows the gaps.
ExampleA hospital's current profile shows strong Protect outcomes but weak Detect and Recover. The target profile, agreed with the board, raises both. The difference becomes the next two years of the roadmap.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Framework an organisation can be certified against | ISO/IEC 27001 |
| Function added in NIST CSF 2.0 | Govern |
| ISACA's IT governance framework | COBIT |
| How to use a CSF profile | Compare current and target profiles to find gaps |
| Should a framework be adopted as-is? | No; tailor it to the organisation |
Key takeaways
- ✓NIST Cybersecurity Framework 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
- ✓ISO/IEC 27001 sets requirements for an information security management system (ISMS); organisations can be certified against it.
- ✓COBIT 2019 is ISACA's framework for governance and management of enterprise IT, with governance (EDM) separate from management.
- ✓Frameworks complement each other: COBIT for IT governance, ISO 27001 for the management system, NIST CSF to describe and communicate outcomes.
- ✓CSF profiles compare a current profile with a target profile, which feeds gap analysis and the roadmap.
- ✓No framework should be adopted unchanged; it's tailored to the organisation's risks and needs.
Exam traps
- !Only ISO 27001 is certifiable among these three; NIST CSF and COBIT aren't.
- !ISO 27002 is guidance on controls; you get certified to 27001, not 27002.
- !Govern is the function added in CSF 2.0; older material lists only five functions.
- !A framework is a structure, not a strategy; the strategy comes from business objectives.
Selecting and Implementing a Framework
How a security manager chooses a governance or security framework, tailors it to the organisation, maps it to others, and puts it into practice.
There's no single right framework
A small software company, a national bank and a hospital all need security governance, but not the same framework. The security manager's job is to pick the one that fits, and make it work.
What drives the choice
Tailor and map
TailorKeep what fits the organisation's risks; record and justify exclusions, as ISO 27001's Statement of Applicability does.
MapCrosswalk frameworks so one control satisfies ISO 27001, NIST CSF and PCI DSS together.
IntegrateFit with what exists: COBIT for IT governance, ITIL for service management.
Keep it proportionateA 200-person firm doesn't need a 900-control program.
Putting it into practice
ExampleA payments start-up must show customers it's secure. It chooses ISO 27001 for certification, maps it to PCI DSS, which its card processing already requires, and certifies the payment platform first before extending scope to the whole company.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Main factor in choosing a framework | Business, legal and regulatory requirements |
| Benefit of mapping frameworks | One control set meets several requirements |
| Implement every control in the catalogue? | No; select based on risk |
| First step in framework adoption | Senior sponsorship and scope |
| Measure of success | Risk reduction and maturity, not control count |
Key takeaways
- ✓The framework choice is driven by business needs: legal and regulatory expectations, customers, industry, size, maturity and culture.
- ✓Frameworks are tailored: keep what fits the organisation's risks, and document why anything is excluded.
- ✓Mapping (crosswalking) one framework to others lets a single control set meet several requirements.
- ✓Implementation needs a senior sponsor, a defined scope, a gap assessment and phased delivery.
- ✓Success is measured by risk reduction and maturity improvement, not by the number of controls implemented.
- ✓A governance framework covers decisions, roles, policies, metrics and reporting, not just a control list.
Exam traps
- !Choosing a framework because it's popular, without checking business and regulatory needs, is a mistake.
- !Implementing every control in a catalogue regardless of risk wastes money.
- !A framework doesn't replace the strategy; it supports it.
- !Starting implementation without a sponsor and scope leads to stalled, partial adoption.
Governance Models: BMIS and the Security Balanced Scorecard
Two models a security manager uses to think and report about security as part of the business: ISACA's Business Model for Information Security (BMIS) and the security balanced scorecard.
Security as a system
A new tool fails because people find it awkward. A strong policy fails because the culture ignores it. ISACA's Business Model for Information Security (BMIS) explains why: security depends on organisation, people, process and technology together, and changing one affects the others.
BMIS elements and links
OrganisationStructure, strategy, goals, resources.
PeopleEmployees, contractors, partners; their skills and behaviour.
ProcessHow work is done, including security procedures.
TechnologySystems and tools that support processes.
The six dynamic interconnections
Using BMIS
BMIS helps the security manager ask the right questions before a change: who will use it, how will processes adapt, does it fit the culture and architecture?
ExampleA bank rolls out a new data loss prevention tool (technology). Staff find it blocks normal work (human factors), invent workarounds (emergence), and managers tolerate them (culture). Thinking through BMIS beforehand would have added user testing, process updates and leadership messaging to the plan.
The security balanced scorecard
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| ISACA model linking organisation, people, process, technology | BMIS |
| BMIS link between organisation and people | Culture |
| BMIS link between people and technology | Human factors |
| Purpose of a balanced scorecard | Measure strategy from several perspectives |
| Weakness of cost-only security reporting | Not balanced; misses value and capability |
Key takeaways
- ✓BMIS (Business Model for Information Security) is ISACA's systems-thinking model: security depends on organisation, people, process and technology together.
- ✓Its four elements are linked by six dynamic interconnections: governing, culture, architecture, emergence, human factors, and enabling and support.
- ✓BMIS explains why changing one element (say, new technology) affects the others (people, processes, culture).
- ✓A balanced scorecard translates strategy into measures from several perspectives, not just financial ones.
- ✓A security balanced scorecard typically covers business contribution, stakeholders, internal processes, and learning and growth.
- ✓Both models support governance: BMIS for understanding, the scorecard for measuring and reporting.
Exam traps
- !BMIS isn't a control framework; it's a way of understanding how security fits the business.
- !Culture links organisation and people; governing links organisation and process. Don't swap them.
- !A scorecard with only cost measures isn't balanced.
- !Technology-only solutions ignore the human factors and culture links.
Resource Planning and Security Budgets
How the security manager plans people, technology and services for the strategy, builds a risk-based budget, and decides what to build, buy or outsource.
Turning strategy into resources
A strategy without resources is a wish list. Strategic planning works out what the roadmap needs, what the organisation already has, and how to fill the gap, then turns it into a budget the business can approve.
Four kinds of resource
The budget cycle
Build, buy or outsource?
| Option | Good when | Watch out for |
|---|---|---|
| Build in-house | Core capability; need control; skills exist | Hiring, retention, time |
| Buy a product | Mature market; standard need | Total cost of ownership; staff to run it |
| Outsource (MSSP) | 24x7 coverage; scarce skills | Contract, oversight, accountability stays |
| Hybrid | Most organisations | Clear split of responsibilities |
Counting the real cost
- 1Licences or subscriptions, and annual increases.
- 2People to configure, run and tune it.
- 3Integration with existing systems.
- 4Training and certification.
- 5Support, upgrades and eventual replacement.
ExampleA SIEM costs 150,000 a year in licences. Running it well needs two analysts (220,000) and integration work (60,000 in year one). The business case uses 430,000, not 150,000, for year one.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| What should drive the security budget | The strategy and risk priorities |
| Main concern when buying a security tool | Total cost of ownership, including people to run it |
| Benefit of a managed security service | Access to skills and 24x7 coverage |
| Who stays accountable after outsourcing | The organisation |
| Where project security costs belong | In the project's own budget, from the start |
Key takeaways
- ✓Strategic planning turns the security strategy into resources: people, technology, external services and time.
- ✓The budget should follow the strategy and risk priorities, not last year's spend plus a percentage.
- ✓Separate 'run' costs (keeping existing controls working) from 'change' costs (new initiatives).
- ✓Total cost of ownership includes licences, people to run tools, integration, training and support, not just purchase price.
- ✓Build, buy or outsource decisions weigh cost, skills, control, speed and risk.
- ✓Security costs should be built into business projects from the start, not added later from the security budget.
Exam traps
- !Buying a tool without the people or process to run it is a classic waste.
- !Benchmarks (percent of IT budget spent on security) are context, not a justification on their own.
- !Outsourcing a security service doesn't outsource accountability.
- !Cutting run costs to fund new projects can quietly weaken existing controls.
Building a Business Case for Security Investment
How to write a security business case that executives approve: framing the business problem, comparing options, costing them honestly and showing the benefits.
Why business cases matter
Every security investment competes with other uses of the same money: a new product, more sales staff, a new warehouse. A business case puts security on the same footing, explaining in business terms why this spending is worth more than the alternatives.
What goes in it
Options, not demands
| Option | 3-year cost | Residual risk |
|---|---|---|
| Do nothing | 0 | High: unmonitored privileged access; audit finding stays open |
| Manual quarterly reviews | 180,000 (staff time) | Medium: gaps between reviews |
| PAM tool, phased | 420,000 | Low: vaulted, recorded admin access |
| PAM as a managed service | 390,000 | Low, with supplier dependency |
Benefits beyond money
Risk reductionLower likelihood or impact of specific scenarios, quantified where possible.
ComplianceMeets a regulation, contract or audit requirement.
Business enablementLets the business win customers, enter markets, move faster.
EfficiencyAutomation saves staff time; fewer incidents to handle.
After approval
- 1Track delivery against the plan and budget.
- 2Measure the promised benefits.
- 3Report results to the sponsor and steering committee.
ExampleA bank approves MFA for all customers to cut account-takeover fraud. Twelve months later, the CISO reports fraud losses down 70%, against a forecast of 60%. The next business case is approved faster.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Most important element of a security business case | Link to business objectives and risk |
| Must every business case include 'do nothing'? | Yes, with its residual risk |
| Main purpose of a business case | Help management make an informed investment decision |
| Costs to include | Total cost of ownership over the life |
| After approval | Track and report benefits realised |
Key takeaways
- ✓A business case justifies an investment in business terms: the problem, options, costs, benefits, risks and a recommendation.
- ✓Always include a 'do nothing' option and the residual risk of each option, so executives can make an informed choice.
- ✓Costs should be total cost of ownership over the solution's life; benefits include risk reduction, compliance and business enablement.
- ✓Link the investment to business objectives and the security strategy, not to technology for its own sake.
- ✓Financial measures (ROI, NPV, payback) help, but security benefits are often avoided losses, so be realistic about estimates.
- ✓Approved cases are tracked afterwards to show the benefits were delivered.
Exam traps
- !A business case built on fear rather than business impact rarely survives scrutiny.
- !Leaving out running costs makes the case look cheap now and damages credibility later.
- !The business case should be owned by a business sponsor where possible, not only by security.
- !Approval isn't the end: benefits realisation should be measured.
Demonstrating Value and Return on Security Investment
How security shows it's worth what it costs: return on security investment, its limits, and the non-financial value that matters just as much to executives.
Is security worth it?
Executives ask the same question of security as of any other spending: what do we get for it? Because security's main benefit is things that don't happen, the answer needs both numbers and a clear story.
Return on security investment
Handle estimates honestly
- 1Show the assumptions behind loss and likelihood.
- 2Use ranges: best, likely, worst case.
- 3Use internal incident data and industry loss studies.
- 4Agree assumptions with finance before presenting.
Value beyond money
Customer trustCertifications and good security win and keep customers.
Regulatory standingFewer findings, lower fines, smoother inspections.
EnablementSafe cloud adoption, new digital products, faster delivery.
InsuranceBetter controls can lower cyber insurance premiums, or make cover available at all.
Showing value over time
Report measures that link security to business outcomes, quarter after quarter.
ExampleA CISO reports: fraud losses down 60% since customer MFA; two enterprise deals won that required ISO 27001; cyber insurance premium cut by 15% after EDR rollout; zero regulator findings in this year's inspection.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Governance outcome about getting worth from spend | Value delivery |
| When is a control cost-justified? | Loss reduction exceeds its cost (or it's required) |
| Main weakness of ROSI | Relies on estimates of loss and likelihood |
| Best way to show value to executives | Metrics linked to business outcomes |
| Is security value only cost avoidance? | No; enablement and trust count too |
Key takeaways
- ✓Value delivery, security investments being worth what they cost, is one of the six outcomes of security governance.
- ✓Return on security investment (ROSI) = (reduction in annual loss expectancy − annual cost of the control) ÷ annual cost.
- ✓ROSI depends on estimates of loss and likelihood; show assumptions and ranges rather than false precision.
- ✓Much security value is non-financial: customer trust, regulatory standing, enabling new business, lower insurance premiums.
- ✓Value is demonstrated through metrics tied to business outcomes, reported regularly.
- ✓Spending more than a risk could ever cost is poor value, however good the control.
Exam traps
- !A control costing more than the loss it prevents is rarely justified, unless law or contract requires it.
- !Counting 'attacks blocked' isn't a measure of value; reduced business impact is.
- !Security value isn't only cost avoidance; enablement counts too.
- !Precise-looking ROSI figures built on guesses damage credibility when challenged.
1 / 186