Summary Cism Notes

A snapshot of the summary - CISM Notes

• 1 GOVERNANCE

• 1.0.2 Priorities for the CISM p1

  This is a preview. There are 5 more flashcards available for chapter 1.0.2
  Show more cards here

• Difference between accountability and reponsibility

  A: ultimate control/legally liable R: contributions to end result

• 1.0.6 Evaluating the security environment

  This is a preview. There are 4 more flashcards available for chapter 1.0.6
  Show more cards here

• 
  Difference between auditing and testing

  
  A: compliance
  T: effficiency
• SEIM stands for (SEM, SIM)

  Security Event and Incident Monitoring

• 1.0.7 The information security program

  This is a preview. There are 5 more flashcards available for chapter 1.0.7
  Show more cards here

• 
  ISO 27001 PDCA Cycle entails:

  Plan - Do - Check - Act
• Which key areas of IS are measured with a balanced scorecard?

  1. Financial metrics
  2. Customer metrics
  3. Internal process measures
  4. Measures of learning and growth

• 1.0.8 Information security strategy

  This is a preview. There are 6 more flashcards available for chapter 1.0.8
  Show more cards here

• What is the goal of information security?

  To protect the organization's assets, individuals, mission and vision
• How is the goal of information security achieved (3 areas)?

  1. Asset identification
  2. Classification
  3. Application of controls
• What does an ISRM strategy provide?

  It provides an organization with a roadmap for information and and information infrastructure protection with goals and objectives that ensure capabilities provided are aligned to business goals and the organization's risk profile.
• 
  What do long-term objectives describe?

  "Desired state"

• 1.0.9 Roles and responsibilities

  This is a preview. There are 7 more flashcards available for chapter 1.0.9
  Show more cards here

• Executive management is responsible for:

  • Implementing effective governance
  • Defining strategic security objectives
  • Budget and support
  • Monitoring regulatory compliance