Chapter 2 of 4 · ISACA CISM
Information Security Risk Management
The threat landscape, vulnerability and control deficiency analysis, risk assessment, treatment, ownership and reporting.
- 2topics
- 6 minfast track
- 1diagrams and exhibits
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Threats, Vulnerabilities and Risk AssessmentThe emerging threat landscape, threat intelligence, vulnerability and control deficiency analysis, and qualitative and…3 min
- 2Risk Response, Ownership and MonitoringMitigating, transferring, avoiding and accepting risk, residual risk, risk and control ownership, key risk indicators and…Diagram3 min
About this chapter
What this chapter covers
Information Security Risk Management is worth 20 percent of the CISM exam, the same under the outline effective 3 November 2026 as under the 2022 outline. It is about finding, analyzing and responding to information risk so that it stays within the organization's appetite, and keeping management informed as risk changes.
Risk assessment (2A) covers the emerging risk and threat landscape, vulnerability and control deficiency analysis, and risk assessment and analysis. Risk response (2B) covers risk treatment and response options, risk and control ownership, and risk monitoring and reporting.
How the topics fit together
Risk management is a continuous cycle, not an annual exercise. New threats, business changes and incidents all trigger a fresh look.
In risk questions, the information security manager facilitates and advises. Business owners own and accept risk; senior management sets appetite. An option in which the security manager accepts a business risk alone is usually wrong.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.