Study guide
Security Control Design and Selection
CISM Study Guide Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CISM Orientation and 2026 Exam Facts
Current CISM Exam Facts The November 2026 Outline Change The Security Manager Mindset Scaled Score and Preliminary Status Registration Scheduling and Fees Certification After Passing
2 Chapter 2: Information Security Governance
Organizational Culture and Governance Signals Legal, Regulatory, and Contractual Requirements Structures, Roles, and Responsibilities Information Security Strategy Development Governance Frameworks and Standards Strategic Planning, Budgets, and Business Cases
3 Chapter 3: Information Security Risk Management
Emerging Risk and Threat Landscape Vulnerability and Control Deficiency Analysis Risk Assessment and Analysis Risk Treatment and Response Options Risk and Control Ownership Risk Monitoring and Reporting
4 Chapter 4: Information Security Program Development
Program Resources: People, Tools, and Technologies Information Asset Identification and Classification Industry Standards and Frameworks Policies, Procedures, and Guidelines Information Security Program Metrics Program Alignment with Strategy
5 Chapter 5: Program Management and Control Execution
Security Control Design and Selection Control Implementation and Integration Control Testing and Evaluation Security Awareness and Training External Services and Supplier Management Program Communications and Reporting
6 Chapter 6: Incident Management Readiness
Incident Response Plan Business Impact Analysis Business Continuity Plan Disaster Recovery Plan Incident Classification and Categorization Incident Training Testing and Evaluation
7 Chapter 7: Incident Management Operations
Incident Management Tools and Techniques Incident Investigation and Evaluation Incident Containment Methods Incident Response Communications Incident Eradication and Recovery Post-Incident Review Practices
8 Chapter 8: Supporting Governance Tasks
Internal and External Influences Maintaining Security Strategy Governance Framework Maintenance Corporate Governance Integration Policy Direction and Standards Business Cases for Security Investment
9 Chapter 9: Cross-Domain Risk and Program Decisions
Senior Leadership Commitment Responsibilities and Lines of Authority Program Effectiveness Reporting Risk Process Oversight Threat and Vulnerability Participation Risk Appetite and Treatment Decisions
10 Chapter 10: External Parties Data and Emerging Technology
Information Security Requirements in Contracts Monitoring External Parties Information Asset Lifecycle Thinking Cloud SaaS and Provider Risk AI, Blockchain, and Ransomware Context Compliance and Control Evidence
11 Chapter 11: CISM Practice Strategy
Domain-Weighted Study Allocation Management-Focused Answer Choices One-Best-Answer Elimination Timed Four-Hour Practice Using Domain Feedback Correctly Retake, Rescore, and Post-Exam Feedback
12 Chapter 12: Final Review and Exam Day Readiness
Two-Week Final Review Plan Exam Day Rules and Identification Remote Proctoring Readiness Preliminary Status Versus Official Score Application Window, Experience, and Ethics CPE Maintenance After Certification
Security Control Design and Selection
Key Takeaways Explain This Topic AI
Domain 3 (Information Security Program) is the largest CISM domain at 33% of 150 questions — roughly 50 scored items.
Controls trace from policy to risk to control objective; CISM expects selection driven by risk treatment, not by product features.
Baseline controls come from a framework (NIST SP 800-53, ISO/IEC 27002, CIS Controls); tailoring removes or adds based on residual risk.
Control types are preventive, detective, corrective, deterrent, and compensating — choose by where in the timeline the control acts.
A compensating control is acceptable only when the primary control is infeasible AND it meets the original control objective.
Last updated: November 2026
Designing and Selecting Controls in Domain 3
Information Security Program is the single largest CISM domain — 33% of the exam , about 50 of the 150 scored multiple-choice questions. The full exam is 150 questions in 4 hours (240 minutes) , scored on ISACA's 200–800 scale with 450 as the passing standard . The Exam Content Outline in effect since 3 November 2026 keeps Domain 3 at 33% and lists Information Security Control Design and Selection under Part A, Information Security Program Development. This section sits at the heart of Domain 3: turning the security strategy into a working set of controls.
In CISM, a control is a safeguard that modifies risk. Controls are never selected because a tool is popular — they are selected to satisfy a control objective that traces back to a policy requirement and an identified risk. The exam tests this chain repeatedly: policy → risk → control objective → control → metric . If a question offers a technically impressive option that does not map to the stated risk, it is a distractor.
The selection sequence the exam expects is consistent. First, the risk assessment establishes which risks exceed appetite and need treatment. Second, management chooses a risk treatment — mitigate, transfer, avoid, or accept — and only mitigation triggers a new control. Third, for risks being mitigated, the manager selects controls that bring residual risk within the defined appetite, no further. Fourth, every control gets an owner and a metric so effectiveness can be proven later.
Notice that designing a control is the fourth step, not the first: a candidate who jumps straight to a control without confirming the risk and the chosen treatment has skipped the management reasoning CISM is testing. Many wrong answers are perfectly good controls aimed at a risk the scenario never raised, or controls layered onto a risk management already decided to accept.
Control Functions
Know these five functions cold; questions often hinge on when a control acts relative to the incident.
- Function Acts Example
- Preventive Before the event Access control list, encryption, segregation of duties
- Detective During/after SIEM alerting, log review, intrusion detection
- Corrective After, to restore Backups/restore, patching, incident response
- Deterrent Discourages Warning banners, visible CCTV, sanctions policy
- Compensating Substitute MFA + monitoring where a required control is infeasible
- Baselining and Tailoring
Managers do not invent controls from scratch. They start from a baseline drawn from a recognized framework — NIST SP 800-53 , ISO/IEC 27002:2022 (93 controls in four themes), or the CIS Critical Security Controls v8 — then tailor it. Tailoring means adding controls for residual risk the baseline misses, and removing or scoping out controls that do not apply (e.g., dropping mainframe controls in an all-cloud shop). The justification for every add/remove is documented so an auditor can trace it.
Worked Example
A SaaS company stores cardholder data and must meet PCI DSS . The standard requires file integrity monitoring on a server that cannot run the agent. The manager cannot simply skip the requirement. The correct move is a compensating control : implement equivalent monitoring (e.g., immutable logging plus daily diff review) that meets the original objective of detecting unauthorized change, document the rationale, and obtain risk-owner sign-off. A compensating control that is cheaper but does not meet the objective is wrong.
Administrative, Technical, and Physical Controls
Beyond the function (preventive/detective/etc.), CISM also classifies controls by nature . Administrative (managerial) controls are policies, standards, procedures, screening, and training — they direct human behavior. Technical (logical) controls are implemented in hardware/software: firewalls, encryption, access control, logging. Physical controls protect facilities: locks, badge readers, guards, fire suppression. A defensible program uses all three in layered defense (defense in depth) so that the failure of one layer does not expose the asset.
A question that offers only a technical fix to a problem rooted in human process (for example, repeated misuse of valid credentials) is steering you toward the wrong category — the better answer is often an administrative control such as access recertification or segregation of duties, reinforced by monitoring.
Cost-Benefit and Risk-Based Selection
Control selection is an economic decision, not a maximalist one. The CISM principle is that the annualized cost of a control should not exceed the value of the loss it prevents — conceptually, compare the control's cost against the reduction in Annual Loss Expectancy (ALE = Single Loss Expectancy × Annual Rate of Occurrence) . If a control costs more than the risk it removes, the correct treatment may be to accept the residual risk, transfer it (insurance or contract), or avoid the activity entirely. The manager documents the chosen treatment and the risk owner's acceptance of any residual risk.
Selecting an expensive control that drives residual risk far below appetite is just as wrong as under-protecting — both waste resources or accept the wrong exposure.
Common Traps
Picking the control with the most advanced technology over the one that treats the stated risk.
Treating a compensating control as a permanent excuse rather than a documented, objective-meeting substitute.
Selecting a detective control when the prompt clearly needs prevention (or vice versa).
Applying only a technical fix to a problem that is administrative or physical in nature.
Forgetting that cost of the control should not exceed the value of the asset it protects — a core CISM cost-benefit principle, anchored in reducing Annual Loss Expectancy.