CISM Domain: 4-Information Security Incident Management

Plan, establish and manage the capability to detect, investigate, respond to and recover from information security incidents to minimize business impact.

• 4.1 CISM: Incident Management Overview
• 4.2 CISM: Incident Response Procedures
  • 4.2.1 CISM: Importance of Incident Management
  • 4.2.2 CISM: Outcomes of Incident Management
  • 4.2.3 CISM: The Role of the Information Security Manager In Incident Management
  • 4.2.4 CISM: Incident Response Concepts
  • 4.2.5 CISM: Incident Management Systems
• 4.3 CISM: Incident Management Organization
  • 4.3.1 CISM: Responsibilities
  • 4.3.2 Senior Management Commitment
• 4.4 CISM: Incident Management Resources
  • 4.4.1 CISM: Policies and Standards
  • 4.4.2 CISM: Incident Response Technology Concepts
  • 4.4.3 Personnel
    • CISM: Incident Response Team Organization
  • 4.4.4 CISM: Roles and Responsibilities
  • 4.4.5 CISM: Skills
  • 4.4.6 CISM: Awareness and Education
  • 4.4.7 CISM: Audits
  • 4.4.8 CISM: Outsourced Security Providers
• 4.5 CISM: Incident Management Objectives
  • 4.5.1 CISM: Strategic Alignment
  • 4.5.2 CISM: Risk Management
  • 4.5.3 CISM: Assurance Process Integration
  • 4.5.4 CISM: Value Delivery
  • 4.5.5 CISM: Resource Management
• 4.6 CISM: Incident Management Metrics and Indicators
  • 4.6.1 CISM: Performance Measurement
• 4.7 CISM: Defining Incident Management Procedures
  • 4.7.1 Detailed Plan of Action for Incident Management
• 4.8 CISM: Current State of Incident Response Capability
  • 4.8.1 CISM: History of Incidents
  • 4.8.2 CISM: Threats
  • 4.8.3 CISM: Vulnerabilities
  • 4.9 CISM: Developing an Incident Response Plan
    • 4.9.1 CISM: Elements of an Incident Response Plan
    • 4.9.2 CISM: Gap Analysis—Basis for an Incident Response Plan
    • 4.9.3 CISM: Business Impact Analysis
    • Elements of a Business Impact Analysis
    • Benefits of Conducting a Business Impact Analysis
  • 4.9.4 CISM: Escalation Process for Effective Incident Management
  • 4.9.5 Help/Service Desk Processes for Identifying Security Incidents
  • 4.9.6 CISM: Incident Management and Response Teams
  • 4.9.7 Organizing, Training and Equipping the Response Staff
  • 4.9.8 CISM: Incident Notification Process
  • 4.9.9 CISM: Challenges in Developing an Incident Management Plan
• 4.10 CISM: Business Continuity and Disaster Recovery Procedures
  • 4.10.1 CISM: Recovery Planning and Business Recovery Processes
  • 4.10.2 CISM: Recovery Operations
  • 4.10.3 CISM: Recovery Strategies
  • 4.10.4 CISM: Addressing Threats
  • 4.10.5 CISM: Recovery Sites
  • 4.10.6 CISM: Basis for Recovery Site Selections
  • 4.10.7 CISM: Response and Recovery Strategy Implementation
  • 4.10.8 CISM: Response and Recovery Plan
  • 4.10.9 CISM: Integrating Incident Response With Business Continuity
    • CISM: Risk Acceptance and Tolerance
    • CISM: Business Impact Analysis
    • CISM: Recovery Time Objectives
    • CISM: Recovery Point Objectives
    • CISM: Service Delivery Objectives
    • CISM: Maximum Tolerable Outage
  • 4.10.10 CISM: Notification Requirements
  • 4.10.11 CISM: Supplies
  • 4.10.12 CISM: Communication Networks
  • 4.10.13 CISM: Methods for Providing Continuity of Network Services
  • 4.10.14 CISM: High-availability Considerations
  • 4.10.15 CISM: Insurance
  • 4.10.16 CISM: Updating Recovery Plans
• 4.11 CISM: Testing Incident Response and Business Continuity/Disaster Recovery Plans
  • 4.11.1 CISM: Periodic Testing of the Response and Recovery Plans
  • 4.11.2 CISM: Testing for Infrastructure and Critical Business Applications
  • 4.11.3 CISM: Types of Tests
  • 4.11.4 CISM: Test Results
  • 4.11.5 CISM: Recovery Test Metrics
• 4.12 CISM: Executing Response and Recovery Plans
  • 4.12.1 CISM: Ensuring Execution as Required
• 4.13 CISM: Post-incident Activities and Investigation
  • 4.13.1 CISM: Identifying Causes and Corrective Actions
  • 4.13.2 CISM: Documenting
    • Events
  • 4.13.3 CISM: Establishing Procedures
  • 4.13.4 CISM: Requirements For Evidence
  • 4.13.5 CISM: Legal Aspects of Forensic Evidence

Workbook

• 

  CISM Workbook