CISM - Certified Information Security Manager Cheat Sheet

Updated 2026-06-14

Next Topic: CISSP - Certified Information Systems Security Professional Cheat Sheet

🎯Take a practice test on this topic11 practice tests · 331 questions→

🧠Study flashcards on this topic202 cards · spaced repetition→

The Certified Information Security Manager (CISM) credential from ISACA validates that you can build and govern an enterprise information security program at the management level, not just operate its tools. The exam is weighted toward judgment across four domains: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%), and Incident Management (30%). The single reflex that separates a passing answer from a merely plausible one is to think like a manager, not a technician: when a scenario allows several defensible actions, ISACA credits the choice that aligns security with business objectives, respects the organization's risk appetite, and follows the established process over the fastest technical fix. This sheet maps every exam task to the concepts ISACA tests, in the manager's-eye framing the credited answers depend on. The current Exam Content Outline remains in force through ISACA's next scheduled update effective 3 November 2026.

What This Cheat Sheet Covers

This topic spans 35 focused tables and 241 indexed concepts, 202 flashcards, 11 practice tests with 331 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Organizational CultureTable 2: Legal, Regulatory and Contractual RequirementsTable 3: Organizational Structures, Roles and ResponsibilitiesTable 4: Information Security Strategy DevelopmentTable 5: Information Governance Frameworks and StandardsTable 6: Strategic Planning, Budgets and the Business CaseTable 7: Emerging Risk and Threat LandscapeTable 8: Vulnerability and Control Deficiency AnalysisTable 9: Risk Assessment and AnalysisTable 10: Risk Treatment and Response OptionsTable 11: Risk and Control OwnershipTable 12: Risk Monitoring and ReportingTable 13: Information Security Program ResourcesTable 14: Information Asset Identification and ClassificationTable 15: Industry Standards and Frameworks for Information SecurityTable 16: Information Security Policies, Procedures and GuidelinesTable 17: Information Security Program MetricsTable 18: Information Security Control Design and SelectionTable 19: Information Security Control Implementation and IntegrationTable 20: Information Security Control Testing and EvaluationTable 21: Information Security Awareness and TrainingTable 22: Management of External Services and Third PartiesTable 23: Information Security Program Communications and ReportingTable 24: Incident Response PlanTable 25: Business Impact Analysis (BIA)Table 26: Business Continuity Plan (BCP)Table 27: Disaster Recovery Plan (DRP)Table 28: Incident Classification and CategorizationTable 29: Incident Management Training, Testing and EvaluationTable 30: Incident Management Tools and TechniquesTable 31: Incident Investigation and EvaluationTable 32: Incident Containment MethodsTable 33: Incident Response CommunicationsTable 34: Incident Eradication and RecoveryTable 35: Post-Incident Review Practices

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Organizational Culture

Domain 1A Enterprise Governance (Information Security Governance, 17%): the role of organizational culture as a governance factor the security manager must assess and influence so that information security aligns with how people actually behave, not just with written policy.

Concept	Example	Description
Security Culture	Staff act securely because it matches their values, not just under audit pressure	• The shared values, attitudes, beliefs and behaviors of employees toward security, in short "how we do things here". A strategic asset, not a soft add-on • Tested against the trap that culture is just published rules
Tone at the Top	Senior leaders visibly follow the same security rules they ask of staff	• Leadership must walk the talk, since culture is top-down and visible example shapes what employees believe is truly expected. • Backed by incentives, training and clear expectations • Board and senior management stay accountable
Culture vs. Awareness Training	Everyone finished training, yet people still avoid reporting phishing	• Culture is the deeper set of shared values and habitual behavior, while awareness training is one activity that supports it • Not to be confused: completing training does not by itself create a healthy culture
Culture as Strategy Constraint and Enabler	A bold zero-trust plan stalls because staff resent controls forced on them	Even a strong security strategy fails if culture does not support it, so the manager treats current culture as both a limit and a lever and designs the strategy to fit how people work.
Behavior Change Beyond Policy and Technology	A new password policy is published, yet weak-password habits persist	• The gap between written policy and actual conduct closes through motivation, ability and reinforcement, not by a mandate or a new tool alone • Conduct does not change through harsh, inflexible controls
Measuring Security Culture	Track reporting rates and survey attitudes as KPIs or KRIs	• Culture is intangible but measurable, so the manager assesses the current culture before acting. • What is visible and gets measured gets managed • Reveals weak points and benchmarks progress

Table 2: Legal, Regulatory and Contractual Requirements

CISM Domain 1 Information Security Governance, Enterprise Governance (Domain 1A): how legal, regulatory, and contractual obligations feed the security program. ISACA's core reflex here is that these requirements set a compliance floor that the program must meet, not the strategy itself; business risk and risk appetite drive the rest.

Concept	Example	Description
Compliance vs. Security	Passing a PCI DSS audit but still breached by an unpatched flaw	Compliance is a minimum baseline / floor, not the goal. Meeting every regulation does not make an organization secure or mean its risk is acceptable. • Treat compliance as the floor, business risk and risk appetite drive the rest

The rest of this section is part of the full cheat sheet

Table 3: Organizational Structures, Roles and Responsibilities

CISM Domain 1: Information Security Governance (Enterprise Governance, 17%). Who is accountable, who executes, and how authority and reporting lines are arranged so that security aligns with business objectives. The governing rule throughout: the board and senior management own governance and accountability, while the security manager facilitates, advises, and executes.

Role	Example	Description
Board of Directors	Endorses the risk appetite, then oversees whether management stays within it	• Governance is the responsibility of the board of directors • They set direction, oversee, and hold ultimate accountability for information security • they have a fiduciary duty to govern cyber risk but do not run the program day to day

The rest of this section is part of the full cheat sheet

Table 4: Information Security Strategy Development

Domain 1B (Information Security Strategy), part of Information Security Governance (17%). The strategy is the plan to move the organization from its current state to a defined desired state; it must support business objectives first, and the gap between the two states defines the roadmap of initiatives that the security program then executes.

Concept	Example	Description
Business Alignment	New control proposed -> first ask which business objective it supports, not which threat it blocks	• The strategy is built business-down, supporting enterprise objectives, NOT technology-up from existing controls • ISACA grades alignment with business objectives as the first test of any strategy

The rest of this section is part of the full cheat sheet

Table 1: Organizational Culture

Concept	Example	Description
Security Culture	Staff act securely because it matches their values, not just under audit pressure	• The shared values, attitudes, beliefs and behaviors of employees toward security, in short "how we do things here". A strategic asset, not a soft add-on • Tested against the trap that culture is just published rules
Tone at the Top	Senior leaders visibly follow the same security rules they ask of staff	• Leadership must walk the talk, since culture is top-down and visible example shapes what employees believe is truly expected. • Backed by incentives, training and clear expectations • Board and senior management stay accountable
Culture vs. Awareness Training	Everyone finished training, yet people still avoid reporting phishing	• Culture is the deeper set of shared values and habitual behavior, while awareness training is one activity that supports it • Not to be confused: completing training does not by itself create a healthy culture
Culture as Strategy Constraint and Enabler	A bold zero-trust plan stalls because staff resent controls forced on them	Even a strong security strategy fails if culture does not support it, so the manager treats current culture as both a limit and a lever and designs the strategy to fit how people work.
Behavior Change Beyond Policy and Technology	A new password policy is published, yet weak-password habits persist	• The gap between written policy and actual conduct closes through motivation, ability and reinforcement, not by a mandate or a new tool alone • Conduct does not change through harsh, inflexible controls
Measuring Security Culture	Track reporting rates and survey attitudes as KPIs or KRIs	• Culture is intangible but measurable, so the manager assesses the current culture before acting. • What is visible and gets measured gets managed • Reveals weak points and benchmarks progress

Table 2: Legal, Regulatory and Contractual Requirements

Concept	Example	Description
Compliance vs. Security	Passing a PCI DSS audit but still breached by an unpatched flaw	Compliance is a minimum baseline / floor, not the goal. Meeting every regulation does not make an organization secure or mean its risk is acceptable. • Treat compliance as the floor, business risk and risk appetite drive the rest

Table 3: Organizational Structures, Roles and Responsibilities

Role	Example	Description
Board of Directors	Endorses the risk appetite, then oversees whether management stays within it	• Governance is the responsibility of the board of directors • They set direction, oversee, and hold ultimate accountability for information security • they have a fiduciary duty to govern cyber risk but do not run the program day to day

Table 4: Information Security Strategy Development

Concept	Example	Description
Business Alignment	New control proposed -> first ask which business objective it supports, not which threat it blocks	• The strategy is built business-down, supporting enterprise objectives, NOT technology-up from existing controls • ISACA grades alignment with business objectives as the first test of any strategy