Your FREE ISSMP Flashcards 2026 – 200+ Cards

Information Systems Security Management Professional — an ISC2 advanced concentration for CISSPs who build, lead, and govern an enterprise security program; it tests management, not hands-on technical depth.

The system of leadership, structures, and processes by which senior management directs and oversees the security program so it supports — and is accountable to — business objectives.

The visible commitment of executives and the board to security; it sets the culture and is the single biggest driver of whether a security program succeeds.

Ensuring the security program's goals, investments, and metrics directly support the organization's mission and business strategy rather than operating as a siloed IT function.

A long-term (3–5 year) plan that defines the security program's vision, goals, and roadmap in alignment with business strategy; tactical and operational plans flow from it.

Policy = high-level mandatory intent; standard = mandatory specific requirement; procedure = mandatory step-by-step; guideline = recommended, optional best practice.

The hierarchy of governance documents (policies → standards → baselines → procedures → guidelines) that translates management intent into enforceable, repeatable controls.

The authorizing document, signed by senior management, that establishes the security program's mission, authority, scope, and reporting lines.

A responsibility-assignment chart marking who is Responsible, Accountable, Consulted, and Informed for each task — clarifying security roles and preventing gaps or overlap.

Accountable = the single owner answerable for the outcome (cannot be delegated); responsible = those who do the work. Management is accountable for security; staff are responsible.

A cross-functional group of business and IT leaders that sets security priorities, approves policy, and aligns the program with enterprise objectives.

Awareness changes behavior (the what); training builds a job skill (the how); education builds understanding and reasoning (the why) — increasing depth in that order.

An ongoing effort to keep every employee mindful of threats and their security responsibilities; the human layer is the most-exploited and most-trainable control.

Key Performance Indicators measure how well the program runs; Key Risk Indicators give early warning of rising risk. Good metrics are tied to business goals and drive decisions.

A management tool that reports security performance across financial, customer, internal-process, and learning-and-growth perspectives to communicate value to executives.

A metric estimating the financial benefit of a control relative to its cost — typically (reduction in ALE − cost of control) ÷ cost of control.

The full lifecycle cost of a security control or system — acquisition plus operation, maintenance, training, and disposal — used to compare investment options.

CapEx = up-front purchases of long-lived assets (appliances); OpEx = recurring run costs (subscriptions, staff). The mix shapes security budgeting and cloud decisions.

Translating security needs into business language — risk reduction, compliance, and ROSI — so executives fund the program; a core ISSMP leadership skill.

The shared attitudes and behaviors that make security a normal part of how people work; built through leadership, awareness, accountability, and consistent reinforcement.

Periodically moving staff between roles to detect fraud, reduce dependence on any one person, and cross-train — a managerial/administrative control.

Requiring employees to take leave so that someone else performs their duties, which can surface concealed fraud or errors; an administrative detective control.

Dividing a sensitive task so no single person can complete it alone, reducing fraud and error; collusion would be required to abuse it.

Granting each user, process, and role only the minimum access needed to perform its function — limiting the damage from compromise or misuse.

Restricting access to information to those whose duties require it, even among users with the same clearance level; narrower than least privilege.

Provisioning access, conveying policy, and completing background and awareness steps when a person joins, so access is granted correctly from day one.

Promptly revoking access, recovering assets, and disabling accounts when a person leaves — a top cause of insider risk when done late or incompletely.

Pre-employment screening (criminal, credit, references) proportional to the role's sensitivity; a preventive personnel control against insider risk.

A coordinated effort (HR, legal, security) to deter, detect, and respond to malicious or negligent insiders using monitoring, analytics, and reporting channels.

A defined approach for who reports security information to whom, how often, and through what channel — ensuring management visibility and timely escalation.

Identifying parties affected by security decisions (executives, owners, users, regulators) and managing their expectations and engagement throughout the program.

Guiding people through the human side of security change — communicating the why, addressing resistance, and reinforcing new behaviors so controls stick.

A staged framework (e.g., CMMI-style levels) that rates how repeatable, measured, and optimized a security program is, guiding improvement priorities.

The ISO standard on governance of information security, defining how the governing body should direct and evaluate the security program.

The broad amount and type of risk an organization is willing to pursue or retain to meet its objectives; set by the board and senior management.

Setting objectives, measuring results, and developing security personnel so the team's capabilities match the program's goals.

A management choice between developing a security capability in-house or acquiring it; weighed on cost, expertise, time-to-value, and control.

The defined boundary of what the program protects (systems, data, locations, lines of business); a clear scope prevents gaps and over-reach.

Doing the research, planning, and ongoing investigation needed to understand and protect the organization — the homework before acting.

Acting on due diligence by implementing and maintaining reasonable controls — what a prudent person would do; together they form the prudent-person rule.

How the security function is positioned and staffed (centralized, decentralized, or hybrid; CISO reporting line) to balance authority, independence, and business reach.

The structured phases through which a system is conceived, built, operated, and retired; security must be integrated into every phase, not bolted on at the end.

Embedding requirements, design review, secure coding, testing, and accreditation activities throughout the lifecycle so flaws are caught when they are cheapest to fix.

Defining security and privacy requirements early — classification, regulatory needs, and control objectives — so they shape design rather than being retrofitted.

Foundational rules (defense in depth, least privilege, fail securely, economy of mechanism, complete mediation) applied during architecture to reduce attack surface.

Systematically identifying and prioritizing threats to a system during design (e.g., with STRIDE) so the right mitigations are built in.

A threat-modeling taxonomy: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

A risk-rating model for threats: Damage, Reproducibility, Exploitability, Affected users, Discoverability — used to prioritize what to fix first.

Mandated coding practices (input validation, output encoding, parameterized queries) that prevent classes of vulnerabilities such as injection and overflow.

Analyzing source code or binaries without executing them to find vulnerabilities early in development (white-box testing).

Testing a running application from the outside to find vulnerabilities at runtime (black-box testing); complements SAST.

A checkpoint in the SDLC where a build must pass defined security tests before it advances — enforcing that security is verified, not assumed.

The technical evaluation of a system's controls against requirements to confirm they are implemented and effective; precedes accreditation.

Management's formal decision (the authorizing official's) to accept the residual risk and authorize a system to operate.

The formal approval, signed by the authorizing official, that a system may go live with its risk accepted — the outcome of accreditation.

A seven-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) for managing system security risk across the lifecycle (NIST SP 800-37).

Ongoing assessment of controls, configurations, and risk after authorization so security keeps pace with change rather than being a point-in-time check.

Identifying, controlling, and recording the state of system components so changes are deliberate and the secure baseline is preserved.

A documented minimum set of security settings for a system or component; deviations must be justified and approved.

A controlled process to request, assess, approve, implement, and document changes so they do not introduce unmanaged risk.

The group that reviews and approves significant changes, weighing risk, impact, and rollback before authorizing implementation.

The process of identifying, testing, and deploying software updates to remediate vulnerabilities within risk-based timelines.

The ongoing cycle of discovering, prioritizing, remediating, and verifying vulnerabilities across the environment — distinct from one-off scanning.

The end-of-life phase that revokes access, sanitizes media, and retires assets so retired systems leave no exploitable data or trust behind.

Residual data that persists on media after deletion or formatting and may be recoverable; defeated by proper sanitization.

Removing data so it cannot be recovered, via clearing (overwrite for reuse), purging (degauss/strong overwrite to release), or destruction (NIST SP 800-88).

Managing security risk introduced by vendors, components, and software dependencies across acquisition, integration, and maintenance.

Evaluating a supplier's security posture before and during engagement (questionnaires, audits, SOC 2 reports) to manage outsourced risk.

A formal inventory of the components and dependencies in a software product, enabling rapid response when a component vulnerability is disclosed.

Building security requirements, evaluation criteria, and contractual obligations into procurement so purchased products and services meet the organization's standards.

A contract clause defining measurable service commitments (availability, response times); for security, it can mandate patch windows and incident notification.

The likelihood that a threat exploits a vulnerability, combined with the resulting impact on an asset; the core unit security management measures and treats.

Any potential event or actor that could cause harm to an asset by exploiting a vulnerability.

A weakness in a system, process, or control that a threat can exploit.

Anything of value to the organization — data, systems, people, reputation — whose protection drives the risk program.

A continuous loop: identify assets and threats, assess risk, choose a treatment, implement controls, and monitor — risk is reduced but never eliminated.

The process of identifying risks and estimating their likelihood and impact, producing a prioritized view to guide treatment (NIST SP 800-30).

A subjective approach ranking risks high/medium/low using scales and expert judgment; fast and good for prioritization but not expressed in dollars.

An objective, dollar-based approach using formulas (SLE, ARO, ALE) to express risk financially and cost-justify controls.

The percentage of an asset's value lost if a specific risk event occurs; expressed as a decimal in the SLE formula.

The expected monetary loss from one occurrence of a risk: $\text{SLE} = \text{Asset Value} \times \text{EF}$.

The expected number of times a specific risk event will occur in one year; an event every 25 years is an ARO of 0.04.

The expected yearly cost of a risk: $\text{ALE} = \text{SLE} \times \text{ARO}$. It is the basis for cost-justifying a control.

A control is justified only when its annual cost is less than the reduction in ALE it provides; spending more than the expected loss is not prudent.

Reducing risk to an acceptable level by implementing controls that lower likelihood or impact.

Shifting the financial impact of a risk to a third party, such as through insurance or outsourcing.

Eliminating a risk by ceasing the activity that creates it.

A documented, management-approved decision to tolerate a risk and its potential impact; ignoring a risk is not acceptance.

The risk that remains after controls are applied; senior management must formally accept it.

The level of risk that exists before any controls are applied — the starting point for choosing treatments.

A living record of identified risks with their owner, likelihood, impact, treatment, and status — the central artifact of risk management.

The individual accountable for managing a specific risk and its treatment decisions — typically a business leader, not the security team alone.

A metric that provides early warning that risk exposure is rising toward an unacceptable level, prompting action before an incident occurs.

The acceptable variation around risk appetite for a specific objective — the practical threshold at which a risk must be treated.

The defined point at which a risk's level triggers escalation or a required treatment decision.

Preventive (stop), detective (find), corrective (fix), deterrent (discourage), recovery (restore), and compensating (alternative) controls.

Administrative (policies, training), technical/logical (encryption, access control), and physical (locks, guards) — defense in depth combines all three.

An alternative control deployed when a required control is impractical, providing equivalent protection and a documented justification.

Layering multiple, overlapping controls so that if one fails, others still protect the asset.

The NIST guide for conducting risk assessments, defining the process of identifying threats, vulnerabilities, likelihood, and impact.

The NIST Risk Management Framework, the seven-step process for authorizing and continuously monitoring system risk.

The NIST guide to managing information security risk at the organization, mission, and information-system tiers.

The ISO standard providing guidelines for information security risk management within an ISMS.

The ISO standard on enterprise risk management principles and guidelines, applicable beyond information security.

An organization-wide approach that treats security risk as one component of total business risk, integrated with strategy and governance.

A visual grid plotting risks by likelihood and impact to communicate priorities to executives at a glance.

Factor Analysis of Information Risk — a quantitative framework that decomposes risk into loss frequency and loss magnitude for financial analysis.

Prioritizing security effort and spending where they reduce the most risk per dollar, rather than treating all assets equally.

Evidence-based knowledge about adversaries, their tactics, and indicators, used to anticipate and prioritize defenses and inform risk decisions.

Use qualitative for fast, broad prioritization and when data is scarce; use quantitative when financial justification and precise comparison are needed.

A documented plan recording, for each significant risk, the chosen treatment, owner, controls, timeline, and acceptance — the bridge from assessment to action.

The day-to-day running of security: monitoring, detection, response, vulnerability handling, and control maintenance that keep the program effective over time.

The team and facility that continuously monitors, detects, and responds to security events across the enterprise.

Security Information and Event Management — a system that aggregates and correlates logs across sources for detection, alerting, and investigation.

Security Orchestration, Automation, and Response — tooling that automates and coordinates incident workflows to speed and standardize response.

Ongoing collection and analysis of security data so threats and control failures are detected as they happen, not at the next audit.

Capturing, protecting, and retaining event records so activity can be detected, investigated, and proven; logs must be tamper-resistant and time-synced.

An event that actually or potentially harms confidentiality, integrity, or availability and warrants a response; distinct from a routine event.

An event is any observable occurrence; an incident is an event with adverse security consequences that triggers the response process.

Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity (NIST SP 800-61).

Building the capability before an incident — plans, tools, training, and communications — so response is fast and coordinated when it counts.

Identifying that an incident has occurred and determining its scope, type, and severity so response can be prioritized correctly.

Limiting the spread and damage of an incident (short-term and long-term) before eradication — stop the bleeding first.

Removing the cause of the incident — malware, compromised accounts, and the exploited weakness — from the environment.

Restoring affected systems to normal operation and verifying they are clean and monitored before returning them to production.

Reviewing the incident and the response to improve plans, controls, and training; the step teams most often skip.

The designated, trained team responsible for handling security incidents end to end and coordinating across the organization.

Rating incidents by impact and urgency so response effort, escalation, and notification match the seriousness.

Defined criteria and paths for raising an incident to higher authority or specialized teams when thresholds are met.

Documentation showing who handled evidence, when, and how — preserving its integrity and admissibility for legal use.

The disciplined collection, preservation, examination, and analysis of digital evidence in a defensible manner.

Collecting evidence from most-volatile to least (CPU/registers and cache → RAM → network state → disk → archives) to avoid losing transient data.

Protecting original evidence (write-blocking, hashing, imaging) so analysis is done on copies and integrity can be proven.

The legal and contractual obligation to inform affected parties and regulators within required timeframes after a data breach.

Proactively searching the environment for adversary activity that evaded automated detection, guided by hypotheses and intelligence.

Forensic artifacts (hashes, IPs, domains, behaviors) that signal a system may be breached and feed detection and hunting.

A knowledge base of real-world adversary tactics and techniques used to map detections, assess coverage, and guide response.

Lockheed Martin's model of attack stages (recon → weaponization → delivery → exploitation → installation → C2 → actions) used to disrupt attacks early.

A scan finds known weaknesses automatically without exploiting them; a pen test authorizedly exploits weaknesses to prove real impact.

Managing scope, rules of engagement, authorization, and reporting for tests so they are safe, legal, and produce actionable results.

An independent, systematic evaluation of controls against a standard or policy, producing findings and recommendations.

Using metrics, audits, and lessons learned to refine operations over time so detection and response capability keeps maturing.

Operational measures such as mean time to detect (MTTD) and mean time to respond (MTTR) that gauge and drive SOC performance.

A third party that delivers security operations (monitoring, detection, response) under contract; managed via SLAs and oversight.

The discipline of preparing for, responding to, and recovering from disruptions through business continuity and disaster recovery planning.

A plan to keep critical business functions operating during and after a disruption; broader than DR, which focuses on IT.

The procedures to restore IT systems, data, and infrastructure after a disruptive event; a subset of the overall BCP.

BCP keeps the whole business running (people, processes, facilities); DRP restores the IT systems that support it. DRP serves the BCP.

The analysis that identifies critical functions and sets recovery objectives (MTD, RTO, RPO); it is the heart of continuity planning.

A process whose loss would cause unacceptable harm; identifying these in the BIA prioritizes recovery effort and resources.

The longest a function can be unavailable before the organization suffers unacceptable harm; it bounds the RTO.

The target time to restore a system or function after a disruption; it must be shorter than the MTD.

The maximum acceptable amount of data loss measured backward in time; it drives how often you back up.

RTO is about TIME to recover; RPO is about DATA you can afford to lose. A 4-hour RTO means restore within 4 hours; a 1-hour RPO means back up at least hourly.

The time needed after systems are restored to validate data and resume normal business operations; RTO + WRT must fit within the MTD.

The average operational time between failures of a component; used in availability planning to predict reliability.

The average time to restore a failed component to service; lower MTTR supports tighter RTOs.

A fully equipped, staffed alternate site offering near-real-time failover — the fastest recovery and the most expensive option.

An alternate site with hardware and connectivity in place but data restored on demand — moderate cost and recovery speed.

An alternate site with power, cooling, and space only — the cheapest option but the slowest to bring online.

A fully redundant copy of the production environment with real-time data replication for immediate failover; the costliest, fastest option.

A mutual-aid arrangement where two organizations agree to host each other's operations after a disaster; low cost but hard to enforce and capacity-limited.

A backup of all selected data; fastest to restore from (one set) but slowest and largest to create.

Backs up only data changed since the last backup of any type; fast to create but slow to restore (full plus every increment).

Backs up data changed since the last full backup; slower to create than incremental but faster to restore (full plus one differential).

Keep three copies of data, on two different media types, with one copy offsite — a resilient backup strategy against most failure modes.

A backup is a recoverable copy for restoration; an archive is long-term retention of data no longer in active use, often for compliance.

The least disruptive BCP test: reviewers verify the plan's contents and contacts on paper without activating anything.

Team members talk through their roles in a simulated scenario to find gaps without touching production systems.

A more realistic test that exercises response steps in a controlled scenario without affecting live operations.

Recovery systems are brought up and run alongside production to confirm they work, without taking production offline.

Production is actually failed over to recovery systems — the most thorough and most risky test; requires management approval.

Four canons every member must follow, applied in order: protect society and the infrastructure; act honorably; provide diligent service to principals; advance and protect the profession.

When canons conflict, the earlier canon outranks the later — protecting society and the public good comes before all others.

Conforming to laws and regulations (e.g., HIPAA, GDPR, SOX, PCI DSS) that apply to the organization's data and industry; non-compliance carries legal and financial penalties.

The EU General Data Protection Regulation governing personal-data processing of EU residents; defines controller/processor duties, breach notice, and large fines.

The U.S. law protecting the privacy and security of protected health information (PHI), with administrative, physical, and technical safeguard requirements.

The Payment Card Industry Data Security Standard — a contractual framework of controls for organizations handling cardholder data.

U.S. law requiring internal controls over financial reporting for public companies, with IT general controls implications for security.

A contract binding an employee or partner to protect confidential information; a legal/administrative control supporting confidentiality.

A policy defining how employees may use organizational systems and data; sets expectations and the basis for disciplinary action.

A situation where a person's private interest could improperly influence their duties; managed through disclosure, separation of duties, and ethics policy.

An organized framework of policies, controls, monitoring, and reporting that demonstrates the organization meets its legal, regulatory, and contractual security obligations.

Due diligence is investigating and planning to meet obligations; due care is the prudent action taken. Courts use both to judge whether an organization was negligent.

Failing to exercise the due care a reasonable organization would, which can create legal liability after a breach.

Legal responsibility for harm; security management limits liability by demonstrating due care and meeting the standard of a prudent person.

The level of caution a reasonable organization in the same industry would exercise; falling below it can establish negligence.

Protections for creations: copyright (works), trademark (brand marks), patent (inventions), and trade secret (confidential business value).

Confidential business information that derives value from secrecy; protected by reasonable safeguards (NDAs, access control) rather than registration.

Security protects data from unauthorized access; privacy governs the appropriate collection, use, and sharing of personal data. They overlap but are not the same.

Data that can identify an individual; its handling is governed by privacy laws and requires protection commensurate with sensitivity.

Under privacy law, the controller decides why and how personal data is processed; the processor acts only on the controller's documented instructions.

The California Consumer Privacy Act granting California residents rights over their personal data, including access, deletion, and opt-out of sale.

The Gramm-Leach-Bliley Act requiring U.S. financial institutions to protect customer financial information and explain their data-sharing practices.

The U.S. Federal Information Security Modernization Act requiring federal agencies to implement risk-based security programs, often using the NIST RMF.

An AICPA audit report on a service organization's controls for security, availability, processing integrity, confidentiality, and privacy (Trust Services Criteria).

The international standard specifying requirements for an Information Security Management System (ISMS) and the basis for ISMS certification.

Regulatory compliance is mandated by law (HIPAA, GDPR); contractual compliance is required by agreements (PCI DSS, SLAs). Both must be managed.

A directive to preserve all potentially relevant data when litigation is anticipated, suspending normal deletion; violating it risks sanctions.

The legal process of identifying, preserving, and producing electronically stored information for litigation or investigation.