Certified Information Security Manager (CISM)
$699.00
Prepare for ISACA’s CISM exam with training on security governance, risk, programme management and incident response. For security pros moving into management, with 12 hours 38 minutes over 298 videos.
- Login details sent straight after payment
- Self-paced. Study on any device
- StemBoss Certificate of Completion
- 14-day refund promise
Secure checkout. Pay by card, Apple Pay or Google Pay.
Certified Information Security Manager (CISM) is exam prep for the CISM certification from ISACA. It is for experienced IT, security, audit and risk professionals who are ready to lead an information security programme. The course gives you 12 hours 38 minutes of training across 298 videos, with 94 test questions to check your progress.
What you will learn
- Build a security governance framework that supports business goals
- Set up a clear policy hierarchy with oversight and metrics
- Line up security work with legal and compliance needs
- Identify, analyse and treat information risk
- Explain risk to leaders in business terms
- Choose controls that match the level of risk
- Plan, staff and measure a security programme
- Link asset classification to protection choices
- Lead incident detection, response, recovery and communication
- Use lessons from incidents to improve the programme
Topics covered
- Information security governance: policy, oversight, metrics and alignment with compliance needs
- Information security risk management: finding, analysing and treating risk, and choosing controls
- Information security programme: scope, priorities, staffing and measuring results
- Incident management: detection, response, containment, recovery, escalation and communication
Who this course is for
- Security analysts and engineers stepping into leadership
- Information security managers who want a recognised credential
- IT auditors and risk professionals moving into security management
- Governance, risk and compliance (GRC) staff
- Incident response leads
- IT managers who oversee security as part of a wider role
Before you start
This is an advanced course. You should already have solid information security experience, ideally with some time in a management role. ISACA sets work experience rules for anyone who wants to hold CISM after passing the exam, so check the current requirements on isaca.org before you book. A background in IT, security, audit or risk is the usual starting point. Plan to study the four domains in order, as each one builds on the last. Use the 94 test questions to find weak areas, then go back to those lessons before you sit the exam.
About the CISM exam
The CISM credential is issued by ISACA. It shows that you can assess risk, set up effective governance and respond to incidents across an organisation. The exam is built around four domains: Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management. After passing, you apply to ISACA with proof of experience, agree to its Code of Professional Ethics and keep up continuing professional education to stay certified. CISM is often held by people who lead security teams or report on security to senior leaders. It focuses on the business side of security, such as governance, risk and programme decisions, rather than hands-on tools.
Jobs this course supports
- Information Security Manager
- Security Programme Manager
- Risk and Compliance Manager
- GRC Professional
- Incident Response Lead
- IT Security Analyst moving into leadership
| Skill level | Advanced |
|---|---|
| Duration | 12 Hours 38 Minutes |
| Videos | 298 Course Videos |
| Questions | 94 Test Questions |
| Certification | ISACA Certified Information Security Manager (CISM) |
| Exam code | CISM |
| Certification body | ISACA |
| Prerequisites | Several years of information security work, including some security management, is recommended. |
| Best for | Information security managers, security programme managers, GRC staff, risk and compliance managers, incident response leads |
| Topics covered | Security governance, policy and metrics, risk management, control selection, security programme design, incident management |
| Format | Online video lessons, self-paced |
| Language | English |
| Closed captions | Yes |
| Certificate | StemBoss Certificate of Completion |
What is inside this course
6 modules and 48 lessons. Here is the full outline.
Module 1: Introduction3 lessons
- Instructor Introduction
- Course Introduction
- Exam Overview
Module 2: Information Security Governance12 lessons
- Module Overview
- InfoSec Strategic Context Part 1
- InfoSec Strategic Context Part 2
- GRC Strategy and Assurance
- Roles and Responsibilities
- GMA Tasks Knowledge and Metrics
- IS Strategy Overview
- Strategy Implemenation
- Strategy Development Support
- Architecture and Controls
- Considerations and Action Plan
- InfoSec Prog Objectives and Wrap-Up
Module 3: Information Security Risk Management12 lessons
- Module Overview
- Risk Identification Task and Knowledge
- Risk Management Strategy
- Additional Considerations
- Risk Analysis and Treatment Tasks & Knowledge
- Leveraging Frameworks
- Assessment Tools and Analysis
- Risk Scenario Development
- Additional Risk Factors
- Asset Classification and Risk Management
- Risk Monitoring and Communication
- Information Risk Management Summary
Module 4: InfoSec Prog Development and Management10 lessons
- Module Overview
- Alignment and Resource Management - Task and Knowledge
- Key Relationships
- Standards Awareness and Training - Tasks and Knowledge
- Awareness and Training
- Building Security into Process and Practices - Tasks and Knowledge
- Additional Technology Infrastructure Concerns
- Security monitoring and reporting Overview Tasks and Knowledge
- Metrics and Monitoring
- Summary
Module 5: Information Security Incident Management7 lessons
- Module Overview
- Planning and Integration Overview Task and Knowledge
- Incident Response Concepts and Process
- Forensics and Recovery
- Readiness and Assessment - Overview Tasks and Knowledge
- Identification and Response Overview Tasks and Knowledge
- Incident Processes
Module 6: Exam Prep4 lessons
- Case Study - Security On a Shoestring Budget
- Case Study - APT In Action
- Summary
- Exam Prep
Your learning path
Where Certified Information Security Manager (CISM) fits. Build your skills one step at a time.
Frequently asked questions
Who issues the CISM certification?
ISACA issues CISM. It is aimed at people who manage, design and oversee an organisation's information security programme.
What are the CISM exam domains?
There are four: Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management. This course covers all four.
Do I need experience to become CISM certified?
Yes. Passing the exam is only one step. ISACA also asks for proof of information security and security management experience, so check its current rules.
Is CISM technical or management focused?
CISM is management focused. It covers governance, risk, programme building and incident leadership rather than hands-on tools.
How is CISM different from CISA?
CISM is about managing security programmes, while CISA is about auditing and assurance. Many people take both, and StemBoss offers a CISA course too.
Do I get a certificate?
Yes. You get a StemBoss Certificate of Completion when you finish the course.
Can I get a refund?
Yes, within 14 days if you have completed less than 20% of the course. See our refund policy for details. Read the refund policy.
