ISACA CISM Cheat Sheet

Information Security Governance

18% of exam
Enterprise Governance Security Strategy Roles Policies Business Case

Information Security Risk Management

20% of exam
Risk Assessment Risk Response Ownership Monitoring Risk Appetite

Information Security Program

33% of exam
Program Resources Asset Classification Controls Awareness Third Parties

Incident Management

29% of exam
Incident Readiness BIA BCP DRP Post-Incident Review

Quick Facts

Exam CISM
Credential Security Manager
Questions 150 MCQ
Time 4 hours
Pass 450/800
Provider ISACA
Experience 5 years
Outline Since Nov 3 2026

Manager Lens GO

Business risk before technical detail.
Business Risk Ownership Evidence

Governance vs Management GO

Governance

Direction
Accountability
Oversight

Management

Execution
Resources
Operations
Governance decides why

Enterprise Governance GO

Board Sets direction
Executives Sponsor strategy
Steering committee Prioritizes investments
Culture Shapes behavior
Regulation External obligation
Contract Partner obligation
Charter Authority source
Accountability Owned outcomes

Policy vs Standard GO

Policy

Management intent
High level
Stable

Standard

Mandatory rule
Specific control
Measurable
Policy directs standards

Security Strategy GO

Alignment Supports objectives
Roadmap Sequenced change
Business case Investment rationale
Budget Funded priorities
Framework Governance structure
Policy Management intent
Standard Mandatory rule
Guideline Recommended practice

Management Signals GO

Effectiveness Goal achieved
Efficiency Resources optimized
Compliance Requirement met
Assurance Confidence level
Benchmark External comparison
Trend Direction over time
Dashboard Executive view
Exception Approved deviation

Risk Response Four RI

Avoid, mitigate, transfer, accept.
Avoid Mitigate Transfer Accept

Inherent vs Residual Risk RI

Inherent

Before controls
Raw exposure
Assessment start

Residual

After controls
Accepted exposure
Decision point
Residual needs ownership

Risk Response Picker RI

Risk exceeds appetite → Mitigate ( Reduce exposure )
Activity unnecessary → Avoid ( Stop work )
Insurance fits → Transfer ( Share impact )
Within appetite → Accept ( Document approval )
Owner missing → Assign owner ( Business accountable )
Risk changes → Reassess ( Update register )
Controls fail → Remediate ( Track action )
Executives ask → Risk report ( Business impact )

Risk Assessment RI

Asset Value holder
Threat Potential cause
Vulnerability Weakness
Impact Business harm
Likelihood Event probability
Inherent risk Before controls
Residual risk After controls
Risk register Tracked risks

Risk Response RI

Avoid Stop activity
Mitigate Reduce risk
Transfer Share impact
Accept Approve exposure
Appetite Desired risk
Tolerance Allowed variance
Owner Business accountable
KRIs Risk signals

Program Cycle PR

Design, implement, test, report, improve.
Design Implement Test Report Improve

Metric vs KRI PR

Metric

Program performance
Control status
Trend evidence

KRI

Risk signal
Threshold breach
Decision trigger
KRIs warn early

Program Control Picker PR

Behavior problem → Awareness ( Change conduct )
Missing rule → Policy ( Set intent )
Need mandate → Standard ( Make required )
Need evidence → Test controls ( Prove operation )
Vendor risk → Contract controls ( Set obligations )
Program unclear → Metrics ( Show status )

Program Development PR

Resources People/tools/funds
Architecture Control placement
Asset inventory Known information
Classification Value sensitivity
Metrics Program evidence
Process Repeatable workflow
Capability Operational ability
Maturity Process depth

Control Management PR

Preventive Stops events
Detective Finds events
Corrective Restores state
Directive Guides behavior
Compensating Alternate safeguard
Testing Control evidence
Awareness Behavior change
Suppliers External dependency

Incident Flow IN

Triage, contain, investigate, recover, improve.
Triage Contain Investigate Recover Improve

BCP vs DRP IN

BCP

Business processes
Continuity focus
People included

DRP

Technology recovery
Systems focus
Restore platforms
DRP supports BCP

Incident Action Picker IN

Possible event → Triage ( Classify first )
Damage spreading → Contain ( Limit scope )
Facts unclear → Investigate ( Preserve evidence )
Law requires → Notify ( Meet deadline )
Service down → Recover ( Meet RTO )
Data lost → Restore ( Meet RPO )
Incident closed → Post-review ( Find causes )
Plan untested → Exercise ( Validate readiness )

Incident Readiness IN

IRP Response playbook
BIA Impact priorities
BCP Business continuity
DRP Technology recovery
RTO Restore time
RPO Data loss
Tabletop Scenario exercise
Escalation Authority path

Containment vs Eradication IN

Containment

Limit spread
Short term
Preserve evidence

Eradication

Remove cause
Longer term
Clean environment
Contain before eradicate

Incident Operations IN

Detection Identify incident
Triage Prioritize response
Containment Limit damage
Investigation Establish facts
Evidence Preserve integrity
Notification Required reporting
Recovery Resume service
Lessons learned Improve controls

Common Traps

Security vs Business

Technical perfection ≠ Business alignment

Risk Owner

Security team owns ≠ Business owns

Compliance Trap

Compliance equals security ≠ Compliance informs risk

Incident First Step

Fix immediately ≠ Classify and contain

Metrics Trap

Count activities ≠ Show outcomes

Policy Detail

Procedure steps ≠ Management direction

Last Minute

1. Business owns risk
2. Governance sets direction
3. Management executes strategy
4. Residual risk needs approval
5. Policy guides standards
6. BCP precedes DRP
7. Contain before eradication
8. Metrics show outcomes
9. Vendors need contracts
10. Post-review improves program

CISM

Practice Questions 198 questions Study Guide 72 topics Cheat Sheet 72 facts Flashcards 50 cards Games 20 terms Videos 2 videos Blogs 2 blogs Podcast
Word games 20 terms Guess the Term T E R M S Read the clue and guess the term in 6 tries. Word games 20 terms Term Match Swap tiles to line up three of the same term. Word games 20 terms Term Pairs ? ✓ ✓ ? ? Flip two cards at a time to find matching terms. Word games 20 terms Term Search Q T E R M X Find five hidden terms in a grid of letters.