Certified Information Systems Security Management Professional (ISSMP) Practice Exam
Certified Information Systems Security Management Professional (ISSMP) Certification Exam
About Certified Information Systems Security Management Professional (ISSMP) Certification Exam
The Information Systems Security Management Professional (ISSMP) is a security leader with specialized expertise in creating, overseeing, and regulating information security initiatives while showcasing adept management and leadership abilities. ISSMPs are tasked with ensuring that security programs are in harmony with the organization's mission, objectives, and strategies to fulfill enterprise financial and operational needs in line with its preferred risk stance.
Who should take this exam?
- For those who want to stand out from your fellow CISSPs its a demonstration of excellence. An elite level of knowledge and expertise is proved by your level of concentration.
- New opportunities. A CISSP Concentration opens doors: from new jobs and career paths, to more exciting work.
- Learning and Growth. An opportunity to dive deep and hone your craft. You’ll find new ways to grow and stay on the forefront of information security. And to earn your concentration is a big challenge.
Experience Required for ISSMP Exam
You must be a CISSP to qualify for the CISSP-ISSMP, in good standing and also have two years cumulative, paid, full-time work experience in one or more of the six domains of the CISSP-ISSMP CBK.
Course Outline
The Certified Information Systems Security Management Professional (ISSMP) Exam covers the following topics -
Domain 1: Leadership and Operational Management
1.1 Establish security’s role in organizational culture, vision, and mission
- Defining information security program vision and mission
- Aligning security with organizational goals, objectives, and values
- Defining security’s relationship with the overall organization processes
- Defining the relationship between organizational culture and security
1.2 Align security program with organizational governance
- Identifying and navigating organizational governance structure
- Verifying and validating roles of key stakeholders
- Validating sources and boundaries of authorization
- Advocating and obtaining organizational support for security initiatives
1.3 Define and implement information security strategies
- Identifying security requirements from organizational initiatives
- Evaluating capacity and capability to implement security strategies
- Prescribing security architecture design
- Managing implementation of security strategies
- Reviewing and maintaining security strategies
1.4 Define and maintain security policy framework
- Determining applicable external standards, laws, and regulations
- Determining data classification and protection requirements
- Establishing internal policies
- Advocating and obtaining organizational support for policies
- Developing procedures, standards, guidelines, and baselines
- Ensuring periodic review of security policy framework
1.5 Manage security requirements in contracts and agreements
- Evaluating service management agreements (e.g., risk, financial)
- Governing managed services (e.g., infrastructure, cloud services)
- Managing security impact of organizational change (e.g., mergers and acquisitions, outsourcing, capability development)
- Ensuring that applicable regulatory compliance statements and requirements are included in contractual and service management agreements
- Monitoring and enforcing compliance with contractual and service management agreements
1.6 Manage security awareness and training programs
- Promoting security programs to key stakeholders
- Identifying needs and implementing training programs by target segment
- Monitoring, evaluating, and reporting on effectiveness of security awareness and training programs
1.7 Define, measure, and report security metrics
- Identifying Key Performance Indicators (KPI) and Key Risk Indicators (KRI)
- Associating metrics to the risk posture of the organization
- Using metrics to drive improvements to the security program and operations
1.8 Prepare, obtain, and manage security budget
- Preparing and securing annual budget
- Adjusting or requesting budget based on evolving risks and threat landscape
- Managing and reporting financial responsibilities
1.9 Manage security programs
- Defining roles and responsibilities
- Determining and managing team accountability
- Building cross-functional relationships
- Resolving conflicts between security and other stakeholders
- Identifying communication bottlenecks and barriers
- Integrating security controls into organization processes
1.10 Apply product development and project management principles
- Incorporating security throughout the lifecycle
- Identifying and applying applicable methodology (e.g., agile, waterfall, lean, rapid application development)
- Analyzing project scope, timelines, quality, and budget
Domain 2: Systems Lifecycle Management
2.1 Manage integration of security throughout system life cycle
- Integration of information security decision points and requirements throughout the system life cycle
- Implementation of security controls throughout the system life cycle
- Overseeing security configuration management (CM) processes
2.2 Integrate organization initiatives and emerging technologies throughout the security architecture
- Implementing security principles
- Addressing impact of organization initiatives on security posture
2.3 Define and manage comprehensive vulnerability management programs (e.g., vulnerabilities, scanning, penetration testing, threat analysis)
- Identification, classification, and prioritization of assets, systems, and services based on criticality and impact to the organization
- Prioritization of threats and vulnerabilities based on risk
- Management of security testing
- Management of mitigation and/or remediation of vulnerabilities
- Monitoring and reporting of vulnerabilities
2.4 Manage security aspects of change control
- Integration of security requirements with change control process
- Conducting a security impact analysis
- Identification and coordination with the stakeholders
- Management of documentation and tracking
- Ensuring policy compliance (e.g., continuous monitoring)
Domain 3: Risk Management
3.1 Develop and manage a risk management program
- Identifying risk management program objectives
- Defining risk management objectives with risk owners and other stakeholders
- Determining scope of organizational risk program
- Identifying organizational risk tolerance/appetite
- Obtaining and verifying organizational asset inventory
- Analyzing organizational risks
- Determine countermeasures, compensating and mitigating controls
- Identifying risk treatment options
- Conducting Cost-benefit analysis (CBA) of risk treatment options
- Recommending risk treatment options to stakeholders
- Documenting and managing agreed risks and issues treatments
- Testing, monitoring, and reporting on risks and issues
3.2 Manage security risks within the supply chain (e.g., supplier, vendor, third-party risk, contracts)
- Identifying supply chain security risk objectives
- Integrating supply chain security risks into organizational risk management
- Verifying and validating security risk control within the supply chain
- Monitoring and reviewing the supply chain security risks
3.3 Conduct risk assessments
- Identifying risk factors
- Determining the risk assessment approach (e.g., qualitative, quantitative)
- Performing the risk analysis
3.4 Manage risk controls
- Identifying controls
- Determining control effectiveness
- Evaluating control coverage
- Monitoring/reporting risk control effectiveness and coverage
Domain 4: Security Operations
4.1 Establish and maintain security operations center
- Development of security operations center (SOC) documentation
4.2 Establish and maintain threat intelligence program
- Aggregating threat data from multiple threat intelligence sources
- Conducting baseline analysis of network traffic, data, and user behavior
- Detecting and analyzing anomalous behavior patterns for potential concerns
- Conducting threat modeling
- Identifying and categorizing attacks
- Correlating related security events and threat data
- Defining actionable alerts
4.3 Establish and maintain incident management program
- Development of program documentation
- Establishing incident response (IR) case management processes
- Establishing incident response (IR) team
- Applying incident management methodologies
- Establishing and maintaining incident handling processes
- Establishing and maintaining investigation processes
- Quantifying and reporting incident impacts and investigations to stakeholders
- Conducting root cause analysis
Domain 5: Contingency Management
5.1 Facilitate development of contingency plans
- Identifying and analyzing factors related to resiliency planning (e.g., Continuity of Operations Plan (COOP), external factors, laws, regulations, business impact analysis (BIA))
- Identifying and analyzing factors related to the business continuity plan (BCP) (e.g., time, resources, verification, business impact analysis (BIA))
- Identifying and analyzing factors related to the disaster recovery plan (DRP) (e.g., time, resources, verification)
- Coordinating contingency management plans with key stakeholders
- Defining internal and external crisis communications plan
- Defining and communicating contingency roles and responsibilities
- Identifying and analyzing contingency impact on organization processes and priorities
- Managing third-party contingency dependencies (e.g., cloud providers, utilities)
- Preparing security management succession plan
5.2 Develop recovery strategies
- Identifying and analyzing alternatives
- Recommending and coordinating recovery strategies
- Assigning recovery roles and responsibilities
5.3 Maintain contingency plan, resiliency plan (e.g., Continuity of Operations Plan (COOP)), business continuity plan (BCP) and disaster recovery plan (DRP)
- Planning testing, evaluation, and modification
- Determining survivability and resiliency capabilities
- Managing plan update process
5.4 Manage disaster response and recovery process
- Declaring and communicating disaster
- Implementing plan
- Restoring normal operations
- Gathering lessons learned
- Updating plan based on lessons learned
Domain 6: Law, Ethics and Security Compliance Management
6.1 Identify the impact of laws and regulations that relate to information security
- Identifying legal jurisdictions that the organization and users operate within (e.g., trans-border data flow)
- Identifying applicable security and privacy laws/regulations/standards
- Identifying intellectual property laws
- Identifying and advising on risks of non-compliance and non-conformity
6.2 Understand, adhere to, and promote professional ethics
- ISC2 Code of Ethics
- Organizational code of ethics
6.3 Validate compliance in accordance with applicable laws, regulations, and industry standards
- Informing and advising senior management
- Evaluating and selecting compliance framework(s)
- Implementing the compliance framework(s)
- Defining and monitoring compliance metrics
6.4 Coordinate with auditors and regulators in support of internal and external audit processes
- Planning
- Scheduling
- Coordinating audit activities
- Evaluating and validating findings
- Formulating response
- Monitoring and validating implemented mitigation and remediation actions
6.5 Document and manage compliance exceptions
- Identifying and documenting controls and workarounds
- Reporting and obtaining authorized approval of risk waiver
FAQs on Certified Information Systems Security Management Professional (ISSMP) Certification Exam
How can I find my (ISC)² ID?
Upon creating your account, you will receive an (ISC)² ID. Your ID number can be located on your profile page on the (ISC)² website.
How can my certification be verified by a potential employer?
Employers can verify your certification status using the Certification Verification page on our website. For verification, your last name and member ID number are required.
What are the steps to become an (ISC)² member?
To become an (ISC)² member, you must first pass one of the six credential examinations. Then, submit an endorsement application to verify your required years of experience. Upon endorsement approval, you must pay the Annual Maintenance Fee (AMF).
What should I do if I can't find a test center near me?
If you are unable to locate a nearby test center, please contact Pearson VUE Customer Service for assistance with scheduling your examination.
Will I receive my exam score?
Exam scores are not provided for passing candidates. However, scores are given upon completion of the exam for those who did not pass.
What items are allowed inside the test center?
No items are permitted inside the test center, as indicated in the instructions. You will be instructed by the test administrator to empty your pockets and place all items in a locker.
Does Testprep Training offer a Money Back Guarantee for the Exam Simulator?
Yes, we offer a 100% unconditional money-back guarantee. If you are unable to clear the exam, you can request a full refund. Please note that refunds are only applicable for products purchased directly from Testprep Training, not from Microsoft Learning.
Is there assistance available from Testprep Training for exam preparation?
Yes, Testprep Training offers email support for any certification-related queries while you are preparing for the exam using our practice exams. Your queries will be handled by experts promptly.
Can I try a free test before purchasing the practice exam?
Yes, Testprep Training offers free practice tests for the Certified Information Systems Security Management Professional (ISSMP) Certification Exam. These tests can be used before making a decision to purchase the complete exam.
Does Testprep Training provide preparation guidance for this certification exam?
Yes, our experts frequently publish blogs containing tips and tricks for exam preparation.
Are there discounts available for bulk purchases?
Yes, we offer nearly a 50% discount for orders of more than 10 products at a time. For more details, you can contact the Testprep Training Helpdesk, and a member of the support staff will respond promptly.
For more FAQs
https://www.isc2.org/Frequently-Asked-Questions
What do we offer?
- Full-Length Mock Test with unique questions in each test set
- Practice objective questions with section-wise scores
- In-depth and exhaustive explanation for every question
- Reliable exam reports to evaluate strengths and weaknesses
- Latest Questions with an updated version
- Tips & Tricks to crack the test
- Unlimited access
What are our Practice Exams?
- Practice exams have been designed by professionals and domain experts that simulate real time exam scenario.
- Practice exam questions have been created on the basis of content outlined in the official documentation.
- Each set in the practice exam contains unique questions built with the intent to provide real-time experience to the candidates as well as gain more confidence during exam preparation.
- Practice exams help to self-evaluate against the exam content and work towards building strength to clear the exam.
- You can also create your own practice exam based on your choice and preference
