Introduction
This 10-day Information Security Governance (CISM) training course prepares security and assurance professionals to lead, govern and manage an enterprise information security programme and to sit the ISACA Certified Information Security Manager (CISM) examination with confidence. It is built on the ISACA CISM Exam Content Outline that takes effect on 3 November 2026, including its greater emphasis on information security strategy and programme development and its new content on enterprise architecture and information security architecture.
Across two weeks, delegates work systematically through the four CISM domains, applying each one through workshops, case studies and a fictional organisation that develops through the course. Every day closes with an exam-style knowledge check, and the final day is dedicated to a full-length timed mock examination, targeted revision and a personal study plan for the period before the exam.
This GLOMACS 10-Day Certified Information Security Manager (CISM) Exam Preparatory training course will highlight:
- The four CISM domains: Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management
- Aligning information security strategy, governance and architecture with business objectives
- Assessing and treating information security risk within the organisation’s risk appetite
- Developing, managing and measuring an information security programme, including third parties
- Incident management readiness and operations, business continuity and disaster recovery
- Exam technique, daily knowledge checks and a full-length mock CISM examination
Objectives
At the end of this 10-Day Certified Information Security Manager (CISM) Exam Preparatory training course, you will learn to:
- Explain how information security governance integrates with enterprise governance, culture, legal and regulatory requirements
- Develop an information security strategy and business case aligned with organisational goals, frameworks and enterprise architecture
- Assess, treat, monitor and report information security risk in line with risk appetite and control ownership
- Design, implement and evaluate an information security programme, its controls, metrics and awareness activities
- Plan, test and lead incident management, business continuity and recovery activities
- Apply ISACA exam technique to scenario-based questions and prepare effectively for the CISM examination
Training Methodology
This training course uses a variety of proven adult learning techniques to ensure maximum understanding, comprehension and retention of the information presented. Each domain is taught through concise presentations followed by practical workshops, case studies and group discussion based on a fictional organisation, so that delegates apply the material from the perspective of an information security manager.
Learning is reinforced by a timed, exam-style knowledge check at the end of every day, with each answer reviewed against ISACA’s management perspective. The final day includes a full-length mock examination under exam conditions, individual performance analysis by domain and guidance on registration, scheduling and final revision.
Organisational Impact
Upon returning to their organisation, delegates will be able to contribute to:
- Stronger alignment of information security governance and strategy with business objectives
- Consistent, risk-based decisions on information security investment and risk treatment
- A structured information security programme with clear policies, controls, ownership and metrics
- Improved oversight of security requirements in contracts and third-party services
- Tested incident response, business continuity and disaster recovery arrangements
- A team prepared to achieve an internationally recognised information security management certification
Personal Impact
From a personal impact point of view, this 10-Day Certified Information Security Manager (CISM) Exam Preparatory training course will increase your knowledge and experience involving:
- Information security governance, strategy and architecture from a management perspective
- Information security risk assessment, risk response and risk reporting
- Information security programme development, control management and metrics
- Incident management readiness and operations
- Exam technique and confidence in answering scenario-based CISM questions
- Your readiness to apply for CISM certification and progress towards senior security leadership roles
Who should Attend?
This training course is designed for professionals who manage, design, oversee or assure information security. It suits those preparing for the CISM examination and those moving into information security management roles.
This GLOMACS 10-Day Certified Information Security Manager (CISM) Exam Preparatory training course is suitable to a wide range of professionals but will greatly benefit:
- ICT and Information Security Managers and Team Leaders
- Information Security Officers and Analysts moving into management roles
- Quality Assurance and Compliance Professionals
- IT Risk, Governance and Internal Audit Professionals
- IT Managers and Infrastructure Leads with security responsibilities
- Business Continuity and Incident Response Coordinators
- Aspiring Chief Information Security Officers
Course Orientation and Enterprise Governance
- The CISM certification, the 2026 Exam Content Outline and the ISACA management perspective
- The role of the information security manager
- Enterprise governance and the place of information security within it
- Organisational culture and its influence on security
- Legal, regulatory and contractual requirements
- Organisational structures, roles and responsibilities
- Lines of authority, accountability and senior leadership commitment
Information Security Strategy and Architecture
- Internal and external influences on the information security strategy
- Information security strategy development and alignment with business goals
- Information governance frameworks and standards
- Enterprise architecture and its relevance to information security
- Information security architecture principles
- Strategic planning: budgets, resources and business cases
- Integrating information security governance into corporate governance
Information Security Risk Assessment
- Information security risk management in the enterprise context
- Risk appetite, risk tolerance and risk capacity
- The emerging risk and threat landscape
- Information asset valuation as an input to risk
- Vulnerability and control deficiency analysis
- Risk assessment and analysis methods: qualitative and quantitative
- Threat scenarios and risk registers
Information Security Risk Response
- Risk treatment and risk response options
- Selecting controls to bring risk within appetite
- Risk and control ownership
- Integrating risk management into business and IT processes
- Risk monitoring, key risk indicators and reassessment triggers
- Reporting risk, noncompliance and changes to stakeholders
- Review of Domains One and Two
Information Security Program Development
- Establishing the programme in line with the information security strategy
- Programme resources: people, tools and technologies
- Information asset identification and classification
- Industry standards and frameworks for information security
- Information security policies, standards, procedures and guidelines
- Information security programme metrics
Information Security Program Management: Controls and Architecture
- Information security control design and selection
- Applying security architecture: identity, segmentation and layered controls
- Security in cloud, hybrid and third-party hosted environments
- Control implementation and integration into organisational processes
- Control testing and evaluation
- Aligning the programme with the objectives of other business functions
Information Security Program Management: People, Partners and Reporting
- Information security awareness and training programmes
- Management of external services: providers, suppliers, third and fourth parties
- Security requirements in contracts and monitoring of external parties
- Programme communications and reporting to stakeholders
- Management and operational metrics for the programme
- Review of Domain Three
Incident Management Readiness
- Incident management concepts and objectives
- Incident response plan and its alignment with business continuity and disaster recovery
- Business impact analysis (BIA)
- Business continuity plan (BCP) and disaster recovery plan (DRP)
- Incident classification and categorisation
- Organising, training and equipping incident response teams
- Incident management training, testing and evaluation
Incident Management Operations
- Incident management tools and techniques
- Timely detection and identification of incidents
- Incident investigation and evaluation, including legal and regulatory considerations
- Incident containment methods
- Incident response communications: reporting, notification and escalation
- Incident eradication and recovery
- Post-incident review practices and lessons learned
Integrated Review and Exam Preparation
- Cross-domain review of key concepts and common areas of difficulty
- ISACA question styles and exam technique
- Full-length timed mock examination
- Performance analysis by domain
- Targeted revision of weaker areas
- Exam registration, scheduling and certification requirements
- Personal study plan for the period before the exam
- Upon successful completion of this training course, GLOMACS Certificate will be awarded to the delegates. Continuing Professional Education credits (CPE): In accordance with the standards of the National Registry of CPE Sponsors, one CPE credit is granted per 50 minutes of attendance
Endorsed Education Provider
