ISC2Information Systems Security Management Professional
The ISSMP certification from ISC2 validates your expertise in establishing, presenting, and governing information security programs. Designed for experienced security leaders, it demonstrates deep management and leadership skills across critical functions like incident response, recovery, and risk management. Earning the ISSMP proves you can align security with organizational goals and lead with confidence.
920 practice questions · Updated 2026-07-30
6Domains
30Objectives
218Concepts
920Questions
ISSMP Curriculum
Every domain, objective, and concept the ISSMP exam measures.
- Defining information security program vision
- Defining information security program mission
- Aligning security with organizational goals
- Aligning security with organizational objectives and values
- Defining security's relationship with organizational processes
- Understanding organizational culture
- Assessing culture's impact on security
- Influencing culture to enhance security
- Organizational governance structures
- Navigating governance channels
- Stakeholder roles and responsibilities
- Stakeholder engagement and communication
- Sources of authorization
- Boundaries of authorization
- Advocating for security initiatives
- Obtaining organizational support
- Security Requirements Elicitation
- Capacity and Capability Assessment
- Security Architecture Design Principles
- Security Strategy Implementation Planning
- Security Strategy Execution and Monitoring
- Security Strategy Review and Maintenance
- External Standards, Laws, and Regulations Identification
- Data Classification and Protection Requirements
- Internal Policy Development
- Advocacy and Organizational Support
- Procedures, Standards, Guidelines, and Baselines
- Periodic Review and Maintenance
- Service Management Agreement Evaluation
- Managed Services Governance
- Security Impact of Organizational Change
- Regulatory Compliance in Contracts
- Contractual Compliance Monitoring
- Stakeholder Engagement Strategies
- Training Needs Assessment
- Segmented Training Program Design
- Training Delivery Methods
- Effectiveness Metrics and Evaluation
- Monitoring and Reporting
- Define Key Performance Indicators (KPIs)
- Define Key Risk Indicators (KRIs)
- Differentiate KPIs and KRIs
- Select relevant security metrics
- Map metrics to risk posture
- Establish baseline and thresholds
- Use metrics to drive improvements
- Report metrics to stakeholders
- Annual Security Budget Preparation
- Budget Justification and Approval
- Risk-Based Budget Adjustment
- Budget Execution and Monitoring
- Financial Reporting and Accountability
- Defining security roles and responsibilities
- Establishing team accountability
- Building cross-functional relationships
- Resolving security-stakeholder conflicts
- Identifying communication bottlenecks
- Integrating security controls into processes
- Security in SDLC phases
- Security requirements and design
- Secure coding and testing
- Deployment and operations security
- Agile methodology
- Waterfall methodology
- Lean methodology
- Rapid application development (RAD)
- Methodology selection criteria
- Project scope analysis
- Timeline and scheduling
- Quality assurance and security
- Budget and resource allocation
- Trade-off analysis
- Security decision points in system life cycle
- Security requirements integration
- Security control implementation
- Security configuration management oversight
- Configuration change control
- Security impact analysis of changes
- Security Principles Integration
- Organization Initiative Impact Assessment
- Emerging Technology Security Considerations
- Security Architecture Alignment
- Asset Identification and Classification
- Asset Prioritization
- Threat and Vulnerability Prioritization
- Security Testing Management
- Vulnerability Mitigation and Remediation
- Vulnerability Monitoring and Reporting
- Integrating security requirements into change control
- Security impact analysis
- Stakeholder identification and coordination
- Documentation and tracking of changes
- Policy compliance and continuous monitoring
- Risk Management Program Objectives
- Stakeholder Engagement in Risk Objectives
- Organizational Risk Program Scope
- Risk Tolerance and Appetite
- Asset Inventory Verification
- Organizational Risk Analysis
- Countermeasures and Mitigating Controls
- Risk Treatment Options
- Cost-Benefit Analysis of Risk Treatments
- Risk Treatment Recommendations
- Documenting Risk and Issue Treatments
- Risk Monitoring and Reporting
- Supply Chain Security Risk Objectives
- Supply Chain Risk Identification
- Integration with Organizational Risk Management
- Supply Chain Risk Assessment
- Contractual Security Requirements
- Third-Party Risk Management
- Security Control Verification
- Supply Chain Security Audits
- Continuous Monitoring of Supply Chain Risks
- Supply Chain Risk Review and Improvement
- Identify risk factors
- Determine risk assessment approach
- Perform qualitative risk analysis
- Perform quantitative risk analysis
- Document and communicate risk assessment results
- Identify risk controls
- Determine control effectiveness
- Evaluate control coverage
- Monitor risk control effectiveness
- Report risk control effectiveness and coverage
- SOC Documentation Purpose
- SOC Documentation Types
- SOC Policy Development
- SOC Procedure Creation
- SOC Playbook Design
- SOC Documentation Maintenance
- Threat intelligence sources
- Threat data aggregation
- Baseline analysis of network traffic
- Baseline analysis of data
- Baseline analysis of user behavior
- Anomaly detection techniques
- Anomaly analysis and investigation
- Threat modeling methodologies
- Threat modeling process
- Attack classification
- Attack categorization frameworks
- Security event correlation
- Correlation rules and tools
- Actionable alert definition
- Alert tuning and prioritization
- Incident Management Program Documentation
- IR Case Management Processes
- IR Team Establishment
- Incident Management Methodologies
- Incident Handling Processes
- Investigation Processes
- Incident Impact Quantification and Reporting
- Root Cause Analysis
- Resiliency Planning Factors
- Business Continuity Plan Factors
- Disaster Recovery Plan Factors
- Stakeholder Coordination
- Crisis Communications Plan
- Roles and Responsibilities
- Impact on Processes and Priorities
- Third-Party Dependencies
- Succession Planning
- Identify recovery alternatives
- Analyze recovery alternatives
- Recommend recovery strategies
- Coordinate recovery strategy implementation
- Assign recovery roles
- Define recovery responsibilities
- Contingency plan testing types
- Test plan development
- Test execution and evaluation
- Plan modification based on test results
- Survivability assessment
- Resiliency capability determination
- Resiliency metrics and thresholds
- Plan update process management
- Change management integration
- Continuous improvement of plans
- Disaster declaration criteria
- Disaster declaration process
- Disaster communication plan
- Activation of the business continuity plan
- Incident command and coordination
- Resource management during response
- Restoration of critical functions
- Transition to normal operations
- Lessons learned collection
- After-action review
- Plan update and improvement
- Legal jurisdictions and trans-border data flow
- Applicable security and privacy laws, regulations, and standards
- Intellectual property laws
- Risks of non-compliance and non-conformity
- ISC2 Code of Ethics Overview
- ISC2 Code of Ethics Application
- Organizational Code of Ethics Purpose
- Organizational Code of Ethics Implementation
- Promoting Professional Ethics
- Compliance Communication to Senior Management
- Compliance Framework Evaluation Criteria
- Compliance Framework Selection Process
- Compliance Framework Implementation Planning
- Compliance Framework Operationalization
- Compliance Metrics Definition
- Compliance Monitoring and Reporting
- Audit Planning
- Audit Scheduling
- Coordinating Audit Activities
- Evaluating Audit Findings
- Validating Audit Findings
- Formulating Audit Response
- Monitoring Remediation Actions
- Validating Remediation Actions
- Identify controls and workarounds
- Document controls and workarounds
- Report risk waiver for approval
- Obtain authorized approval of risk waiver
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for ISSMP, so none is invented.