المخرجات
1. Understand the roles & responsibilities of a Certified Information Security Manager and how to properly manage a security program.
2. Learn about current security management standards and best practices for Information Security.
3. Establish effective security policies, programs and procedures.
4. Develop the skills to create and implement an information security strategy, risk management program and security audit process.
5. Identify, evaluate and mitigate threats to an organization's IT infrastructure, applications and data.
6. Know how to ensure that all internal and external stakeholders are compliant with security policies and processes.
7. Gain expertise in handling crisis management, incident response and disaster recovery.
8. Understand the importance of effective communications to ensure awareness of the policies and procedures throughout an organization.
الفئة المستهدفة
• Security professionals and IT administrators advancing their skills in information security
• IT professionals seeking comprehensive understanding of security risks and protection approaches
• Individuals involved in security risk management and security controls
• Professionals developing and evaluating security policies
• Those working in information security or pursuing related degrees
المحتويات
Domain 1: Information Security Governance (17%)
A. Enterprise Governance
• Organizational Culture
• Legal, regulatory, and contractual requirements
• Organizational structure, roles and responsibilities
B. Information Security Strategy
• Information security strategy development
• Information governance framework and standards
• Strategic Planning (e.g., budgets, resources, business case)
Domain 2: Information Security Risk Management (20%)
A. Information Security Risk Assessment
• Emerging Risk and Threat Landscape
• Vulnerability and Control Deficiency Analysis
• Risk Assessment and Analysis
B. Information Security Risk Response
• Risk Treatment / Risk Response Options
• Risk and Control Ownership
• Risk Monitoring and Reporting
Domain 3: Information Security Program (33%)
A. Information Security Program Development
• Information Security Program Resources (e.g., people, tools, technologies)
• Information Asset Identification and Classification
• Industry Standards and Frameworks for Information Security
• Information Security Policies, Procedures, and Guidelines
• Information Security Program Metrics
B. Information Security Program Management
• Information Security Control Design and Selection
• Information Security Control Implementation and Integrations
• Information Security Control Testing and Evaluation
• Information Security Awareness and Training
• Vendor, supplier, third-party, and fourth-party management
• Information Security Program Communications and Reporting
Domain 4: Incident Management (30%)
A. Incident Management Readiness
• Incident Response Plan
• Business Impact Analysis (BIA)
• Business Continuity Plan (BCP)
• Disaster Recovery Plan (DRP)
• Incident Classification/Categorization
• Incident Management Training, Testing, and Evaluation
B. Incident Management Operations
• Incident Management Tools and Techniques
• Incident Investigation and Evaluation
• Incident Containment Methods
• Incident Response Communications (e.g., reporting, notification, escalation)
• Incident Eradication and Recovery
• Post-incident Review Practices