CISM考试包括哪些内容?
认证信息安全经理® CISM(概述个人状况®)考试包括150个问题，涵盖4个工作实践领域, all 测试 your knowledge and ability on real-life job practices leveraged by expert professionals.
Below are the key domains, subtopics and tasks candidates will be tested on:
ISACA的承诺
自2002年成立以来, 超过45,000 people have obtained ISACA’s CISM certification to validate their expertise in information security governance, 项目开发和管理, 事件管理和风险管理. 该域, 子主题和任务是广泛研究的结果, 反馈, and validation from subject matter experts and prominent industry leaders from around the globe.
通过CISM认证测试和验证的工作实践领域
17%域1 -资讯保安管治
这个领域将为您提供对文化的全面了解, 澳门赌场官方下载治理涉及的法规和结构, 也能让你分析, 规划和发展信息安全策略. Together, this will affirm high-level credibility in information security governance to stakeholders.
一个澳门赌场官方下载治理
- 组织文化
- 法律、法规和合同要求
- 组织结构、角色和职责
b -信息安全策略
- 资讯保安策略发展
- 信息治理框架和标准
- 策略规划(e).g.，预算，资源，业务案例)
20%域2 -资讯保安风险管理
This domain empowers you to analyze and identify potential information security risks, threats and vulnerabilities as well as giving you all the information about identifying and countering information security risks you will require to perform at management level.
a -信息安全风险评估
- 新出现的风险和威胁形势
- 脆弱性与控制缺陷分析
- 风险评估与分析
b -信息安全风险应对
- 风险处理/风险应对方案
- 风险与控制
- 风险监察及报告
33%域3 -资讯保安计划
这个域涵盖了资源, asset classifications and frameworks for information security as well as empowering you to manage information security programs, 包括安全控制, 测试, 通讯、报告和执行.
信息安全程序开发
- 信息安全计划资源(e.g.，人，工具，技术)
- 信息资产识别与分类
- 信息安全的行业标准和框架
- 资讯保安政策、程序及指引
- 资讯保安计划指标
b -信息安全项目管理
- 信息安全控制设计与选择
- 信息安全控制实施与集成
- 信息安全控制测试与评估
- 资讯保安意识及训练
- 外部服务管理(e.g.(供应商、供应商、第三方、第四方)
- 信息安全程序通信和报告
30%领域4 -事件管理
This domain provides in-depth training in risk management and preparedness, including how to prepare a business to respond to incidents and guiding recovery. The second module covers the tools, evaluation and containment methods for incident management.
事件管理准备情况
- 事件应变计划
- 业务影响分析(BIA)
- 业务连续性计划(BCP)
- 灾难恢复计划(DRP)
- 事件分类/分类
- 事故管理培训、测试和评估
b -事件管理操作
- 事件管理工具和技术
- 事故调查及评估
- 事件控制方法
- 事件应变通讯(e.g.(报告、通知、升级)
- 事件根除及恢复
- 事后检讨措施
支持任务
- 识别 internal and external influences on the organization that impact the information security strategy.
- 建立 and/or maintain an information security strategy in alignment with organizational goals and objectives.
- 建立 and/or maintain an information security governance framework.
- 将信息安全治理整合到公司治理中.
- 建立 and maintain information security policies to guide the development of 标准, 程序及指引.
- 开发业务案例以支持信息安全方面的投资.
- Gain ongoing commitment from senior leadership and other stakeholders to support the successful implementation of the information security strategy.
- 定义, communicate and monitor information security responsibilities throughout the organization and lines of authority.
- 编写并向主要利益相关者提交有关活动的报告, 信息安全计划的趋势和整体有效性.
- 评估并向关键利益相关者报告信息安全指标.
- 建立 and/or maintain the information security program in alignment with the information security strategy.
- Align the information security program with the operational objectives of other business functions.
- 建立 and maintain information security processes and resources to execute the information security program.
- 建立, 沟通和维护组织的信息安全政策, 标准, 的指导方针, 程序和其他文件.
- 建立, promote and maintain a program for information security awareness and training.
- Integrate information security requirements into organizational processes to maintain the organization’s security strategy.
- Integrate information security requirements into contracts and activities of external parties.
- Monitor external parties' adherence to established security requirements.
- 定义 and monitor management and operational metrics for the information security program.
- 建立 and/or maintain a process for information asset identification and classification.
- 识别 legal, regulatory, organizational and other applicable compliance requirements.
- Participate in and/or oversee the risk identification, risk assessment and risk treatment process.
- Participate in and/or oversee the vulnerability assessment and threat analysis process.
- 识别, recommend or implement appropriate risk treatment and response options to manage risk to acceptable levels based on organizational risk appetite.
- Determine whether information security controls are appropriate and effectively manage risk to an acceptable level.
- Facilitate the integration of information risk management into business and IT processes.
- Monitor for internal and external factors that may require reassessment of risk.
- 报告信息安全风险, 包括不合规和信息变更风险, to key stakeholders to facilitate the risk management decision-making process.
- 建立和维护事件响应计划, in alignment with the business continuity plan and disaster recovery plan.
- 建立 and maintain an information security incident classification and categorization process.
- Develop and implement processes to ensure the timely identification of information security incidents.
- 建立 and maintain processes to investigate and document information security incidents in accordance with legal and regulatory requirements.
- 建立和维护事件处理流程, 包括控制, 通知, 升级, 根除和恢复.
- Organize, train, equip and assign responsibilities to incident response teams.
- 建立 and maintain incident communication plans and processes for internal and external parties.
- 通过测试和审查评估事件管理计划, 包括桌面练习, 按计划的时间间隔审查检查表和模拟测试.
- 进行事件后评审以促进持续改进, 包括根本原因分析, 经验教训, 纠正措施和风险再评估.
为考试做准备
ISACA offers a variety of exam preparation resources including group training, self-paced training and study resources in various languages to help you prepare for your certification exam. 选择适合你的时间表和学习需要的方法.