Inside Cloud and Security · Transcript · · Updated
CISM Exam Prep: The Complete Course – Transcript
Video by Inside Cloud and Security · Watch the original on YouTube
Summary
AI-generated from the transcript. Verify details against the source video.
- The CISM exam consists of 150 multiple-choice questions to be completed in 4 hours and covers four information security domains.
- Accountability is the obligation to answer for actions and cannot be delegated, whereas responsibility is the duty to complete tasks and can be delegated.
- The primary goal of incident management and incident response together is to minimize the impact of security and incidents on the organization.
Use this video with Pro
Reading, copying and transcript downloads are free. Create saved AI results for this video with a signed-in Pro account ($9/month).
Transcript
Search ignores accents. All transcript text stays visible.
Welcome to CISM Exam Prep, the full course. In this video, we'll cover every topic on the CISM exam syllabus. We'll travel together through all four domains of the CISM, beginning with domain one, information security governance. In part A, we'll establish the foundation of security governance in our organization.
And in part B, we'll focus on developing security strategies aligned with our business and organizational objectives. Next, we'll dig into domain two, information risk management and compliance. In part A, we'll focus on identifying and assessing risks. And in part B, we'll cover strategies for risk mitigation and treatment. Building on this, in domain three, we'll address
information security program development and management. In part A, we'll explore security architecture design and in part B cover implementation and management of our organization security solutions. And finally, in domain four, we'll focus on information security incident management. Part A outlines incident response planning and preparation, while part B details executing and recovering
from security incidents. all the key concepts you need to know for exam day and I'll test your knowledge at key checkpoints along the way. Let's dig in.
And while you may know me for my exam prep content here on YouTube, in my 9to5, I'm a cyber security strategist and a VCSO for a regional bank where I'm exercising my cyber security knowledge every day like that which you'll find here on the CISM exam. More importantly, last year I helped thousands achieve cyber security certifications like the CISSP, CCSP, and the Security Plus
exams. And I'm bringing that proven formula to you here with the CISM exam. As with all my exam prep courses, you'll find a PDF copy of this presentation available for you in the video description to leverage in your exam preparation as you require. You'll also find a clickable table of contents available in the video description and it should appear automatically on your
YouTube video timeline. This is CISM exam prep the complete course. We're going to cover every topic on the official exam syllabus. We'll start it off with a look at a bit about the exam itself as well as some preparation resources and tips.
So in this video we'll cover all four of the CISM domains and each of those domains is comprised of two sections. Every domain includes a part A and a part B in the syllabus. So I cover those sections separately throughout this video. So essentially we'll have the exam prep strategy and materials plus eight sections in this video to complete the full
course. Now, based on the Isaka certification guide, here are a few key details about the CISM exam you should remember. First, the exam is 150 multiplechoice questions. You have 4 hours to complete the exam. It's a computer-based exam administered at a testing center or via online if you prefer the remote testing experience.
So, that's a minute and a half roughly per question. That means time management is going to be a key aspect of your exam preparation that you'll want to have sorted before exam day. So, let's quickly get through a few more mundane details of the exam. Your scores range from 200 to 800 with 450 being the minimum passing score. 800 is a perfect score. There's no mention of needing to pass individual domains, but
of course, you should go into that testing center prepared to pass all four domains. Preliminary pass fail results will be shared with you immediately upon completion of the exam. You'll receive an official score in the mail within 10 working days. You have testing locations around the world. You can also choose to take the online proctored version if you'd prefer to test from home. The exam at
the time of this recording cost 575 US for Isaka members 760 for non-members bearing in mind that the price may vary around the world and Isaka membership does come at a cost so most are going to take the exam as non-members. The exam comes in a handful of languages though most of you will be testing in English. The exam consists of four domains. Domain one information security
governance. Domain two information risk management. Domain three is information security program and domain four incident management. Now you'll notice that domains three and four have been elevated in terms of their focus in the latest release of the exam and thus there's more material to cover there.
Now I'd like to dive into each of these domains with you briefly and look at the structure of the exam which is very logical in terms of process flow. So if we start with domain one which is information security governance it begins with part A enterprise governance where we'll focus on organizational culture legal regulatory and contractual requirements organizational structure roles and
responsibilities and then moving into information security strategy which will be guided by our governance efforts. We have strategy development, governance frameworks and standards and strategic planning. So governance followed by strategy very logical flow. You will find a heavy focus on alignment with business needs. All of these efforts around security are worth not if they
don't align with the needs of our business. You'll hear some folks mention it as it's all about the business. That's a fact. You're going to see it mentioned repeatedly and it will surface in questions. Moving into domain two where we'll focus on information risk management. This begins with information security risk assessment. We'll look at the emerging risk and threat landscape followed by vulnerability and control deficiency
analysis and then risk assessment and analysis. This then flows naturally into information security risk response where we'll look at risk treatment and risk response options, risk and control ownership and risk monitoring and reporting. Now in domain 2, we see that natural flow from assessment to response and the risk formulas from the CISSP
exam and also from the security plus exam are covered in the CISM although not quite as directly. they receive a bit more specific focus and tend to really focus on the bottom line getting down to the annualized loss expectancy.
In the event you're not already acquainted with these formulas, you'll be very familiar by the time we complete this series. Now, moving into domain three into information security program, we're now moving into that area of the exam that receives increased focus in this latest release. And there's a lot of material to cover here. In fact, domain 3, I would say, is probably the largest of the exam. It begins with
information security program development. And we see here very much development focused activities. Looking first at our program resources, people, tools, technologies. Moving into information asset identification and classification, identifying what we need to secure. industry standards and frameworks for information security that can guide our efforts, policies, procedures and
guidelines, information security program metrics to measure results. And then moving into part B, information security program management where we'll look at control design and selection. So this is where your knowledge of technology is going to surface. control implementation and integration here. So when we're picking controls and implementing controls, that's where having some of that
highlevel technology knowledge and experience is going to come in handy. Control testing and evaluation to make sure that our controls are effective. Information security awareness and training, how we educate our user population, and management of external services. think supply chain risk management and security and finally
program communications and reporting. So reporting our state and results back to senior leadership. So development followed by management. Again we see that very logical flow from a process perspective. The exam expects familiarity with security technologies, but it focuses more on how to choose and apply those controls in risk scenarios. So,
let's take a quick sidebar and talk about technology knowledge expectations on the exam because the CISM definitely includes coverage of an array of cyber security technologies. is you'll see cryptography, references to PKI, network security, cloud security, code security, and a whole lot more. But remember, the CISM is a management exam, and it's a management exam to a greater degree than
other security leadership exams you've taken in the past. So, how will tech be referenced on the exam? Well, you'll need to understand how to choose and apply security controls rather than delving into their detailed design or operation. So knowing use cases and highle functionality is going to be helpful. So for technologies like SIM IDs and DLP having some highle knowledge
of where they apply is going to be helpful. Knowing how IDS in a hostbased scenario versus network ids can be helpful. Cloud DLP versus network DLP understanding the difference in the use cases definitely useful knowledge. Focus on thinking like a manager, understanding the strategic why and how, not the deep technical specifics. Now moving into domain four,
incident management. So this begins with incident management readiness. And here we see the development type activities we would expect in part A of any of these domains. Incident response plan, business impact analysis, business continuity plan, disaster recovery plan, incident classification and categorization, and finally, incident management training, testing and
evaluation. Very logical flow that then leads into part B, incident management operations. So here we'll touch on incident management tools and techniques, incident investigation and evaluation. You'll see forensic techniques surface here. incident containment methods. So, our incident response, incident response, communications, eradication and recovery, and post incident review practices, how we
continually improve our incident management program. So, again, that very logical flow from readiness to operations just as we saw in the first three domains. So, there are two things I hope you noticed in our review of the CISM exam syllabus. So number one, the process flow from a security life cycle perspective is very logical from beginning to end. And number two, there
was almost no direct mention of cyber security technologies in the exam syllabus. So that technical muscle you've developed in your cyber security knowledge from exams like security plus or CISSP or something else are already there. You have that muscle. Now, you just need to learn to apply that knowledge to the leadership problems that we're going to focus on here in the CISM exam. Now, I'm going to take a