Industry Standards and Frameworks

CISM Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: CISM Orientation and 2026 Exam Facts

Current CISM Exam Facts The November 2026 Outline Change The Security Manager Mindset Scaled Score and Preliminary Status Registration Scheduling and Fees Certification After Passing

2 Chapter 2: Information Security Governance

Organizational Culture and Governance Signals Legal, Regulatory, and Contractual Requirements Structures, Roles, and Responsibilities Information Security Strategy Development Governance Frameworks and Standards Strategic Planning, Budgets, and Business Cases

3 Chapter 3: Information Security Risk Management

Emerging Risk and Threat Landscape Vulnerability and Control Deficiency Analysis Risk Assessment and Analysis Risk Treatment and Response Options Risk and Control Ownership Risk Monitoring and Reporting

4 Chapter 4: Information Security Program Development

Program Resources: People, Tools, and Technologies Information Asset Identification and Classification Industry Standards and Frameworks Policies, Procedures, and Guidelines Information Security Program Metrics Program Alignment with Strategy

5 Chapter 5: Program Management and Control Execution

Security Control Design and Selection Control Implementation and Integration Control Testing and Evaluation Security Awareness and Training External Services and Supplier Management Program Communications and Reporting

6 Chapter 6: Incident Management Readiness

Incident Response Plan Business Impact Analysis Business Continuity Plan Disaster Recovery Plan Incident Classification and Categorization Incident Training Testing and Evaluation

7 Chapter 7: Incident Management Operations

Incident Management Tools and Techniques Incident Investigation and Evaluation Incident Containment Methods Incident Response Communications Incident Eradication and Recovery Post-Incident Review Practices

8 Chapter 8: Supporting Governance Tasks

Internal and External Influences Maintaining Security Strategy Governance Framework Maintenance Corporate Governance Integration Policy Direction and Standards Business Cases for Security Investment

9 Chapter 9: Cross-Domain Risk and Program Decisions

Senior Leadership Commitment Responsibilities and Lines of Authority Program Effectiveness Reporting Risk Process Oversight Threat and Vulnerability Participation Risk Appetite and Treatment Decisions

10 Chapter 10: External Parties Data and Emerging Technology

Information Security Requirements in Contracts Monitoring External Parties Information Asset Lifecycle Thinking Cloud SaaS and Provider Risk AI, Blockchain, and Ransomware Context Compliance and Control Evidence

11 Chapter 11: CISM Practice Strategy

Domain-Weighted Study Allocation Management-Focused Answer Choices One-Best-Answer Elimination Timed Four-Hour Practice Using Domain Feedback Correctly Retake, Rescore, and Post-Exam Feedback

12 Chapter 12: Final Review and Exam Day Readiness

Two-Week Final Review Plan Exam Day Rules and Identification Remote Proctoring Readiness Preliminary Status Versus Official Score Application Window, Experience, and Ethics CPE Maintenance After Certification

Industry Standards and Frameworks

Key Takeaways Explain This Topic AI

Frameworks are selected to fit business objectives and obligations, not adopted because they are popular.

ISO/IEC 27001 certifies a management system (ISMS); NIST CSF organizes outcomes into Govern, Identify, Protect, Detect, Respond, Recover.

Standards are mandatory internal rules; frameworks and guidelines are structured guidance you tailor.

Mapping multiple obligations (PCI DSS, HIPAA, GDPR) to one control set avoids duplicated effort.

Last updated: June 2026

Why frameworks matter to a security manager

Frameworks give a program a defensible, repeatable structure so the ISM is not inventing controls ad hoc. The CISM exam tests selection and use , not memorization of clause numbers. The recurring principle: choose the framework that fits the enterprise's objectives, industry, and obligations , then tailor it. Adopting a framework "because it is popular" or implementing every control regardless of risk are both wrong answers.

The frameworks you must distinguish

Framework What it is Best used for

ISO/IEC 27001 Certifiable information security management system (ISMS) standard Demonstrating governed, auditable program maturity

ISO/IEC 27002 Control catalog / code of practice supporting 27001 Selecting and implementing specific controls

NIST Cybersecurity Framework (CSF) 2.0 Outcome-based functions: Govern, Identify, Protect, Detect, Respond, Recover Risk-based program organization and board communication

NIST SP 800-53 Detailed federal control catalog U.S. government and contractors

COBIT Governance of enterprise IT, links IT to business goals Aligning security governance with enterprise governance

PCI DSS Prescriptive standard for cardholder data Any entity handling payment cards

Note that NIST CSF 2.0 added the Govern function to the original five (Identify, Protect, Detect, Respond, Recover), reflecting the same management-first emphasis CISM teaches. ISO 27001 is the one that produces a certification ; CSF and COBIT do not certify, they organize.

Standards vs. frameworks vs. guidelines

Clear the terminology, because the exam exploits it. A standard is a mandatory, specific internal rule ("all laptops use AES-256 full-disk encryption"). A framework is structured external guidance you adopt and tailor. A guideline is recommended, non-mandatory advice. Confusing "we should" (guideline) with "we must" (standard/policy) is a classic distractor.

Mapping to avoid duplicate work

Most enterprises face several obligations at once — perhaps PCI DSS for payments, HIPAA for health data, and GDPR for EU residents. The ISM's efficient move is to build one control set mapped to all applicable obligations (a control crosswalk), so a single access-control implementation satisfies multiple requirements and is audited once. Worked example: encryption-at-rest can simultaneously address PCI DSS Requirement 3, HIPAA's addressable encryption specification, and GDPR's "appropriate technical measures" — documented once, evidenced once.

Selection checklist the exam rewards:

Start from business objectives and obligations , then pick the framework.

Tailor — apply controls proportional to risk; do not implement all of them blindly.

Prefer frameworks that improve board-level communication when governance is the gap.

Map and reuse controls across regulations rather than running parallel programs.

How a framework actually gets used

Adopting a framework is a lifecycle, not a one-time decision, and CISM expects you to manage it: select based on objectives and obligations, scope it (which business units, systems, and data are in scope), perform a gap assessment against current controls, build a remediation roadmap for the gaps, implement and operate, then assess and continually improve . ISO 27001 formalizes this as Plan-Do-Check-Act, with mandatory internal audits and management reviews.

The exam often presents a company that bought a framework but never assessed gaps or measured progress; the corrective answer is to run the gap assessment and tie remediation to risk, not to buy more tooling.

Frameworks support governance and assurance

Frameworks also give the ISM a shared vocabulary for reporting and assurance . Mapping the program to NIST CSF functions or ISO control families lets the manager show the board coverage and maturity at a glance, and gives auditors and customers a recognized basis for assurance — a SOC 2 report or ISO 27001 certificate can reduce the volume of customer security questionnaires the business must answer, a real cost saving the ISM can quantify in a business case. When a regulator or major customer demands evidence of a structured program, certification against a recognized standard is the efficient response.

Trap to avoid

If a scenario says a company adopted a framework wholesale and is drowning in irrelevant controls, the fix is to perform a risk assessment and tailor the control set to the in-scope risks, not to abandon the framework or add staff. Another trap pits frameworks against each other as if you must choose only one; in practice you map several (for example, run the program on NIST CSF while satisfying PCI DSS for the cardholder environment) because they serve different purposes. And do not treat a framework as a guarantee of security — it is a structure for managing security; controls still have to be operated and measured.

The best answer ties control choice back to risk and business need every time, and uses the framework as the organizing scaffold rather than the goal itself.

Privacy frameworks and the regulatory layer

Beyond security control frameworks, the modern ISM coordinates with privacy obligations that overlap but are distinct. GDPR, the California Consumer Privacy Act, and sector rules such as HIPAA impose data-subject rights, breach-notification timelines, and lawful-basis requirements that security controls help satisfy but do not fully cover. The exam expects you to recognize that privacy is a partner discipline: classification and access controls support privacy, yet a data protection officer or legal counsel owns the legal interpretation.

When a scenario blends a security framework with a privacy regulation, the aligned answer maps the shared controls once and engages the accountable privacy/legal owner for the rest, rather than treating the regulation as just another technical checklist. This keeps the program efficient and ensures obligations the security team cannot legally own are routed to the function that can, which is the coordination behavior CISM consistently rewards across Domain 3.