Chapter 3 of 4 · ISACA CISM
Information Security Program
Program resources, asset classification, frameworks, policies, metrics, controls, awareness, external services and architecture.
- 6topics
- 18 minfast track
- 1diagrams and exhibits
- 33%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Program Resources and Asset ClassificationPeople, tools and technology for the security program, skills and roles, and identifying, valuing and classifying information…3 min
- 2Frameworks, Policies and Program MetricsUsing security standards and frameworks, the hierarchy of policies, standards, procedures and guidelines, policy exceptions and…3 min
- 3Control Design, Implementation and TestingSelecting controls by risk and cost, control categories and types, defense in depth, integrating controls into processes, and…3 min
- 4Awareness, Training and Program CommunicationsBuilding a role-based security awareness and training program, measuring behavior change, and reporting the security program to…3 min
- 5Management of External Services and Third PartiesManaging security across suppliers, cloud providers, third and fourth parties: due diligence, contract terms, right to audit…3 min
- 6Enterprise Architecture and Information Security ArchitectureEnterprise and information security architecture in the CISM outline effective November 2026: frameworks, principles, patterns…Diagram3 min
About this chapter
What this chapter covers
The Information Security Program is the largest CISM domain, worth 33 percent of the exam under both the 2022 outline and the outline effective 3 November 2026. It covers how the information security manager builds and runs the program that carries out the strategy: the people, tools, policies, controls, training, suppliers and reporting.
Program development (3A) covers program resources, information asset identification and classification, industry standards and frameworks, policies, procedures and guidelines, and program metrics. Program management (3B) covers control design and selection, control implementation and integration, control testing and evaluation, awareness and training, management of external services and program communications and reporting. ISACA has also announced that the updated exam adds enterprise architecture and information security architecture; this guide covers them on their own page in this chapter.
How the topics fit together
The program is how strategy becomes daily practice. Every element should trace back to a business objective or a risk, and metrics show whether it is working.
In program questions, prefer options that integrate security into existing business processes (procurement, change management, project delivery) over options that bolt on a separate security step.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.