EC-COUNCILEC-Council Associate C|CISO
The EC-Council Associate C|CISO certification equips cybersecurity professionals with the foundational knowledge required for information security leadership. Designed for aspiring C-suite leaders, it covers the five domains of the Certified CISO program, enabling candidates to support strategic decision-making and contribute to a CISO's office. This credential is a stepping stone to the full Certified CISO title.
1309 practice questions · Updated 2026-07-30
5Domains
26Objectives
218Concepts
1309Questions
ACCISO Curriculum
Every domain, objective, and concept the ACCISO exam measures.
- Information Security Management Program (ISMP) Overview
- ISMP Governance and Alignment
- ISMP Policy Framework
- Risk Management Integration
- Security Awareness and Training
- ISMP Metrics and Reporting
- Continuous Improvement of ISMP
- Information Security Governance Definition
- Governance vs. Management
- Governance Outcomes
- Governance Framework Components
- Strategic Alignment
- Risk Management Integration
- Resource Management
- Performance Measurement
- Value Delivery
- Stakeholder Engagement
- Governance Documentation
- Governance Implementation Steps
- Regulatory Compliance Frameworks
- Legal Compliance Requirements
- Compliance Risk Assessment
- Compliance Monitoring and Reporting
- Compliance Enforcement and Penalties
- Risk Management Fundamentals
- Risk Management Frameworks
- Risk Identification
- Risk Analysis and Assessment
- Risk Evaluation and Prioritization
- Risk Response and Treatment
- Risk Monitoring and Review
- Risk Communication and Reporting
- Risk Governance and Culture
- Risk Management in Compliance
- Security Control Design Principles
- Security Control Deployment Strategies
- Security Control Management Lifecycle
- Security Control Assessment and Optimization
- Define security control types
- Explain security control objectives
- Classify controls by function
- Apply controls to risk mitigation
- Control Assurance Frameworks Overview
- Key Frameworks and Standards
- Framework Selection Criteria
- Implementing a Framework
- Control Assurance Process
- Reporting and Remediation
- Continuous Improvement
- Audit Management Process Overview
- Audit Planning
- Audit Execution
- Audit Reporting
- Audit Follow-up and Closure
- Audit Roles and Responsibilities
- Audit Standards and Frameworks
- Audit Documentation and Evidence
- Audit Communication and Coordination
- Audit Quality Assurance
- CISO Role Overview
- CISO vs Other Security Roles
- CISO Reporting Lines
- CISO Core Competencies
- CISO in Security Governance
- CISO and Risk Management
- CISO and Compliance
- CISO and Security Strategy
- CISO and Incident Response
- CISO and Security Awareness
- CISO and Budgeting
- CISO and Stakeholder Communication
- CISO and Emerging Trends
- Project Management Fundamentals for Security
- Security Project Lifecycle
- Security Project Planning
- Security Project Execution and Control
- Security Project Governance
- Security Project Risk Management
- Security Project Stakeholder Management
- Security Project Metrics and Reporting
- Security Project Integration with Operations
- Security Requirements Integration
- Operational Process Lifecycle
- Security Requirements Elicitation
- Security by Design
- Process Mapping and Security Controls
- Change Management for Security Integration
- Monitoring and Continuous Improvement
- Change Management Process
- Change Advisory Board (CAB)
- Change Types and Classification
- Change Impact and Risk Assessment
- Change Implementation and Rollback
- Version Control Fundamentals
- Version Control Systems and Tools
- Branching and Merging Strategies
- Version Control Security and Access Control
- Change and Version Control Integration
- Access Control Fundamentals
- Access Control Models
- Access Control Mechanisms
- Access Control Implementation
- Access Control Administration
- Access Control Monitoring and Auditing
- Physical Security Fundamentals
- Physical Security Threats
- Physical Security Controls
- Facility Design and Site Selection
- Access Control Systems
- Surveillance and Monitoring
- Environmental and Life Safety
- Physical Security Policies and Procedures
- Physical Security Auditing and Compliance
- Network Fundamentals
- Network Security Threats
- Network Security Controls
- Secure Network Protocols
- Wireless Network Security
- Network Monitoring and Analysis
- Incident Response in Networks
- Threat Landscape Analysis
- Vulnerability Identification
- Risk Assessment and Prioritization
- Vulnerability Remediation Strategies
- Threat Intelligence Integration
- Continuous Monitoring and Reporting
- Application Security Fundamentals
- Secure Software Development Lifecycle (SSDLC)
- Threat Modeling
- Secure Coding Practices
- OWASP Top 10
- Application Security Testing
- Security in DevOps (DevSecOps)
- Web Application Firewalls (WAF)
- API Security
- Mobile Application Security
- Application Security Governance and Compliance
- Symmetric Encryption
- Asymmetric Encryption
- Hash Functions
- Digital Signatures
- Key Management
- Encryption Modes and Padding
- Public Key Infrastructure (PKI)
- Encryption in Transit and at Rest
- Cryptographic Attacks and Weaknesses
- Regulatory and Compliance Considerations
- Vulnerability Assessment Fundamentals
- Vulnerability Assessment Process
- Vulnerability Scanning Tools
- Vulnerability Analysis and Prioritization
- Penetration Testing Fundamentals
- Penetration Testing Phases
- Penetration Testing Methodologies and Standards
- Penetration Testing Tools
- Reporting and Remediation
- Computer Forensics Fundamentals
- Forensic Process and Procedures
- Evidence Collection and Preservation
- Forensic Imaging and Duplication
- Data Recovery and Analysis
- Incident Response Fundamentals
- Incident Detection and Triage
- Containment, Eradication, and Recovery
- Legal and Ethical Considerations
- Forensic Tools and Technologies
- Reporting and Documentation
- Security Strategic Planning Overview
- Strategic vs. Tactical vs. Operational Planning
- Business Alignment
- Security Governance Frameworks
- Risk Management Integration
- Developing a Security Strategy
- Resource Allocation and Prioritization
- Metrics and Performance Measurement
- Communication and Stakeholder Engagement
- Review and Continuous Improvement
- Business-IT Alignment
- Strategic Planning Process
- Stakeholder Analysis
- IT Governance Frameworks
- Value Delivery and Performance Measurement
- Risk Management in Alignment
- Communication and Change Management
- Definition of KPIs
- KPI Categories
- KPI Selection Criteria
- KPI Development Process
- KPI Alignment with Strategy
- KPI Measurement and Data Collection
- KPI Analysis and Reporting
- KPI Review and Improvement
- Financial Planning Fundamentals
- Budgeting for Security Programs
- Cost-Benefit Analysis in Security
- Security Investment Prioritization
- Financial Metrics and KPIs
- Funding Models and Sources
- Financial Risk Management
- Reporting and Communication of Financial Plans
- ROI Fundamentals
- Cost-Benefit Analysis Basics
- Identifying Security Costs
- Quantifying Security Benefits
- Calculating ROI
- Net Present Value (NPV)
- Payback Period
- Internal Rate of Return (IRR)
- Risk-Adjusted ROI
- Presenting ROI to Stakeholders
- Vendor Selection Criteria
- Vendor Risk Assessment
- Procurement Process Steps
- Contract Negotiation and Management
- Vendor Performance Monitoring
- Vendor Relationship Management
- Compliance and Regulatory Considerations
- Vendor Termination and Exit Strategy
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for ACCISO, so none is invented.