PEOPLE. SKILLS. STRONGER MISSIONS.DEFEND TODAY.
BUILD TOMORROW.
BUILD TOMORROW.
ELITE TRAINING
FOR A MORE
SECURE TOMORROW.
FOR A MORE
SECURE TOMORROW.
CYBERSECURITY TRAINING
Certified Information Security Manager
ISACA / CISMBuild the skills for your next mission.
CISM is designed for management-focused security professionals.
Course objectives
Build practical skills across the key domains covered in Certified Information Security Manager (CISM).
Information Security GovernanceEstablish and/or maintain an information security strategy
- Establish and/or maintain an information security strategy
- Establish and/or maintain an information security governance framework
- Integrate information security governance into corporate governance
- Establish and maintain information security policies
- Develop business cases to support investments in information security
- Identify internal and external influences to the organization
- Gain ongoing commitment from senior leadership and other stakeholders
- Define, communicate, and monitor information security responsibilities
Information Security Risk ManagementEstablish and/or maintain a process for information asset classification
- Establish and/or maintain a process for information asset classification
- Identify legal, regulatory, organizational and other applicable requirements
- Ensure that risk assessments, vulnerability assessments and threat analyses are conducted
- Identify, recommend or implement appropriate risk treatment/response options
- Determine whether information security controls are appropriate
- Facilitate the integration of information risk management into business and IT processes
- Monitor for internal and external factors that may require reassessment of risk
- Report noncompliance and other changes in information risk
Information Security ProgramEstablish and/or maintain the information security program
- Establish and/or maintain the information security program
- Align the information security program with the operational objectives
- Establish and maintain information security processes and resources
- Establish, communicate, and maintain organizational information security standards
- Establish, promote, and maintain a program for information security awareness
- Integrate information security requirements into organizational processes
- Integrate information security requirements into contracts and activities of third parties
- Establish, monitor, and analyze program management and operational metrics
- Compile and present reports to key stakeholders on the activities, trends, and overall effectiveness
Incident ManagementEstablish and maintain an organizational definition of, and severity hierarchy for, information security incidents
- Establish and maintain an organizational definition of, and severity hierarchy for, information security incidents
- Establish and maintain an incident response plan
- Develop and implement processes to ensure the timely identification of information security incidents
- Establish and maintain processes to investigate and document information security incidents
- Establish and maintain incident escalation and notification processes
- Organize, train, and equip teams to effectively respond to information security incidents
- Test and review the incident response plan periodically
- Establish and maintain communication plans and processes
- Conduct post-incident reviews to determine the root cause of information security incidents
- Establish and maintain integration among the incident response plan, disaster recovery plan, and business continuity plan
Find your DoD 8140 pathway
Explore how this training may align to DoD 8140 work roles and proficiency levels.
Verify mapping against the current official matrix.View authoritative source V2.1 · 2025-09-19
About this course
CISM is designed for management-focused security professionals. It validates expertise in information security governance, program development, incident management, and risk management.
Training alone does not establish DoD 8140 qualification. Confirm position-specific requirements with your organization.