Chapter 1 of 4 · ISACA CISM
Information Security Governance
Organizational culture, legal and contractual requirements, roles and responsibilities, strategy, frameworks and planning.
- 2topics
- 7 minfast track
- 1diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Enterprise Governance, Culture, Requirements and RolesSecurity culture, legal, regulatory and contractual requirements, and the roles of the board, senior management, the security…3 min
- 2Information Security Strategy, Frameworks and PlanningBuilding an information security strategy from business goals, gap analysis, frameworks such as COBIT and ISO/IEC 27001, budgets…Diagram4 min
About this chapter
What this chapter covers
Information Security Governance is worth 18 percent of the CISM exam under the outline that takes effect on 3 November 2026 (17 percent under the 2022 outline it replaces). It is about how the organization directs and controls information security so that it supports business objectives, meets its obligations and has clear accountability.
Enterprise governance (1A) covers organizational culture, legal, regulatory and contractual requirements, and organizational structures, roles and responsibilities. Information security strategy (1B) covers strategy development, governance frameworks and standards, and strategic planning, including budgets, resources and the business case.
How the topics fit together
Governance starts from what the business is trying to achieve and how much risk it will accept. The security strategy translates that into goals, the program delivers them, and metrics show the board whether it is working.
CISM questions take the information security manager's viewpoint. The best answer usually aligns security with business objectives and gains senior management support; options that start from a technology or a control in isolation are usually distractors.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.