ISACA CISM – Certified Information Security Manager

Security programs often stall when governance, risk, and incident response live in separate silos, with frameworks adopted on paper, metrics no one tracks, and incident plans never rehearsed. This CISM course gives security leadership a shared operating model. It covers selecting frameworks such as COBIT and ISO/IEC 27001, building policies, standards, and procedures, applying NIST and NIST Cybersecurity Framework concepts to risk management, and defining RTO, RPO, and maximum tolerable downtime.

Role fit: Assign this course to Information Security Managers, GRC Leads, Risk Officers, and Team Leads who own audits, security awareness programs, or incident response. It is advanced, management-level content. It works best for mid- to senior-level IT practitioners rather than new analysts.

Time investment: The course has 14 skills totaling about 14 hours. Most learners can finish it in two to four weeks alongside regular duties, either for CISM exam prep or recertification refreshers.

Change management: The course stresses folding risk management into existing culture and dormant frameworks rather than replacing them. It also covers SMART metrics for showing leadership measurable risk reduction, tabletop and simulation exercises, and training sign-off records that support audit readiness.

Training Managers can organize the 14 skills into Playlists for each role. Team Reporting lets them track progress across the security and risk staff.

IT teams complete this CISM training to turn security management theory into decisions that hold up in front of executives, auditors, and incident bridges. The course works through realistic scenarios that connect risk assessments, control selection, and ongoing monitoring. Teams measure whether controls are working, track remaining risk over time, and use accurate reporting to keep leadership confidence in security initiatives.

• Defensible risk decisions: Team Leads learn to frame risk around financial loss and organizational survival. They can then tie RTO, RPO, maximum tolerable downtime, and SLAs to recovery plans that leadership can approve.
• Metrics that prove program value: Practitioners build goal-driven metrics, such as risk reduction after an MDM rollout, that show where controls work and where process gaps need attention.
• Faster, rehearsed incident response: Teams prepare through tabletop exercises and BC/DR testing methods ranging from simulation walkthroughs to parallel tests. This preparation clarifies roles and communication before a real outage.
• Audit-ready governance: Security managers align programs to frameworks like COBIT and ISO/IEC 27001. They build clear policies, standards, and procedures, and they run engaging awareness training with sign-off records that HR can produce as proof.

The result is a security function that integrates risk into change management and secure development, rather than bolting it on after the fact.

Knowledge

• How frameworks such as COBIT and ISO/IEC 27001 form the foundation of an information security program, with policies, standards, processes, and procedures built on top
• The NIST SP 800-39 risk management steps, from risk framing (purpose, scope, assumptions, business priorities) through identifying threats and vulnerabilities
• Recovery and continuity objectives, including RTO, RPO, service delivery objectives, maximum tolerable downtime, and keeping SLAs during an outage
• Asset, threat, and vulnerability identification as part of risk assessments, with controls selected for current business and technology environments
• How incident management processes support coordinated response, escalation, communication, and compliance reporting
• Incident response preparation, including working technical controls and NTP clock synchronization for accurate log correlation

Ability

• Assess where the current security program stands, define the target state, and build a strategy to close the gap
• Use SMART goals to choose metrics, such as measuring MDM coverage gaps and tracking residual device risk each quarter
• Build risk management into change management and secure software development, using automated scanning and penetration testing
• Design security awareness training that is short, engaging, relevant, actionable, and documented for HR records
• Run tabletop exercises to rehearse incident response roles and communication
• Plan BC/DR tests, including simulation and parallel tests, without disrupting production