CISM Domain 1 Lecture notes

Welcome to CISM Domain 1: Information Security Governance

● This chapter is VERY important because:
o Every other knowledge domain build on top of this chapter
o This is the foundation.
● 17% of the exam questions on the certification are from this domain.

● We will be covering our govern, our values, vision, mission, our strategies, policies, standards, and
processes.
● We look at the policies, the procedures, the laws we need to adhere to.
● Data protection, the NIST Cyber Security framework, NIST Risk management framework, NIST 800-
37, 800-53, ISO 27001 and 27002
● We talk about the CIA triad, which is the foundation of Information Security.
● Administrative security controls, roles, and responsibilities.

● This should be what you are tested on for Domain 1 until the next planned CISM curriculum
change in 2027.

Security Governance Principles

Governance vs. Management
● Governance – This is C-level Executives (Not
you).
o Stakeholder needs, conditions and
options are evaluated to define:
▪ Balanced agreed-upon
enterprise objectives to be
achieved.
▪ Setting direction through
prioritization and decision
making.
▪ Monitoring performance and
compliance against agreed-
upon direction and objectives.
▪ Risk appetite – Aggressive, neutral, adverse.
● Management – How do we get to the destination (This is you).
o Plans, builds, runs, and monitors activities in alignment with the direction set by the
governance to achieve the objectives.
o Risk tolerance – How are we going to practically work with our risk appetite and our
environment?

Top-Down vs. Bottom-Up Security Management and Organization Structure

● Bottom-Up: IT Security is seen as a nuisance and not a helper, often changes when breaches
happen.
● Top-Down: IT leadership is on-board with IT Security, they lead and set the direction. (The exam).

1 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
C-Level Executives (Senior Leadership) –
Ultimately Liable
● CEO: Chief Executive Officer.
● CIO: Chief Information Officer.
● CTO: Chief Technology Officer.
● CSO: Chief Security Officer.
● CISO: Chief Information Security Officer.
● CFO: Chief Financial Officer.
● Normal organizations obviously have more
C-Level executives, the ones listed here you
need to know.

Governance Standards and Control Frameworks

● PCI-DSS - Payment Card Industry Data Security Standard
o It is a standard but required if we want to handle or issue credit and debit cards.
● OCTAVE® - Operationally Critical Threat, Asset, and Vulnerability Evaluation.
o Self-Directed Risk Management.
● COBIT - Control Objectives for Information and related Technology.
o Goals for IT – Stakeholder needs are mapped down to IT related goals.
● COSO – Committee of Sponsoring Organizations.
o Goals for the entire organization.
● ITIL - Information Technology Infrastructure Library.
o IT Service Management (ITSM).
● FRAP - Facilitated Risk Analysis Process.
o Analyzes one business unit, application, or system at a time in a roundtable brainstorm
with internal employees. Impact analyzed, threats and risks prioritized.
● ISO 27000 series:
o ISO 27001: Establish, implement, control and improvement of the ISMS. Uses PDCA (Plan,
Do, Check, Act)
o ISO 27002: (From BS 7799, 1/2, ISO 17799) Provides practical advice on how to implement
security controls. It has 10 domains it uses for ISMS (Information Security Management
Systems).
o ISO 27004: Provides metrics for measuring the success of your ISMS.
o ISO 27005: Standards based approach to risk management.
o ISO 27799: Directives on how to protect PHI (Protected Health Information).

Links on all these as well as ones from previous slides in the “Extras” lecture.

2 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
Defense in Depth – Also called Layered Defense or Onion Defense
● We implement multiple overlapping security controls to
protect an asset.
● This applies both to physical and logical controls.
o To get to a server, you may have to go through
multiple locked doors, security guards, man
traps.
o To get to the data, you may need to get past
firewalls, routers, switches, the server, and the
application’s security.
o Each step may have multiple security controls.
● No single security control secures an asset.
● By implementing Defense in Depth, you improve your
organization’s Confidentiality, Integrity, and Availability.

Information Security Governance

Security Governance Principles
● Values:
o What are our values? Ethics, Principles,
Beliefs.
● Vision:
o What do we aspire to be? Hope and
Ambition.
● Mission:
o Who do we do it for? Motivation and
Purpose.
● Strategic Objectives:
o How are we going to progress? Plans, goals,
and sequencing.
● Action & KPIs:
o What do we need to do and how do we know when we achieved it? Actions, Recourses,
Outcomes, Owners, and Timeframes.

3 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Policies – Mandatory
o High level, non-specific.
o They can contain “Patches, updates, strong
encryption”
o They will not be specific to “OS, encryption
type, vendor Technology”
● Standards – Mandatory
o Describes a specific use of technology (All
laptops are W10, 64bit, 8gig memory, etc.)
● Guidelines – Non-Mandatory
o Recommendations, discretionary –
Suggestions on how you would to do it
● Procedures – Mandatory
o Low level step-by-step guides, specific.
o They will contain “OS, encryption type,
vendor Technology”
● Baselines (Benchmarks) – Mandatory
o Benchmarks for server hardening, apps, network. Minimum requirement, we can
implement stronger if needed.

Personnel Security – Users often pose the largest security risk

● Awareness – Change user behavior - this is what we want, we want them to change their
behavior.
● Training – Provides users with a skillset - this is nice, but if they ignore the knowledge, it does
nothing.
● Hiring Practices – We do background checks where we check: References, degrees, employment,
criminal, credit history (less common, more costly). We have new staff sign an NDA (Non-
Disclosure Agreement).
● Employee Termination Practices – We want to coach and train employees before firing them.
They get warnings.
o When terminating employees, we coordinate with HR to shut off access at the right time.
● Vendors, Consultants and Contractor Security
o When we use outside people in our environments, we need to ensure they are trained on
how to handle data. Their systems need to be secure enough for our policies and
standards.
● Outsourcing and Offshoring - Having someone else do part of your (IT in our case) work.
o This can lower cost, but a thorough and accurate Risk Analysis must be performed.
Offshoring can also pose problems with them not having to comply with the same data
protection standards.

4 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
Gap Analysis
● Identify the existing process:
o What are we doing?
● Identify the existing outcome:
o How well do we do it?
● Identify the desired outcome:
o How well do we want to do?
● Identify and document the gap:
o What is the difference between
now and desired result?
● Identify the process to achieve the desired outcome:
o How can we possibly get to the desired result?
● Develop the means to fill the gap:
o Build the tool or processes to get the result.
● Develop and prioritize Requirements to bridge the gap.

SWOT (Strengths, Weaknesses, Opportunities, and Threats)

● Internal Factors:
o Strengths: What we do well, skilled staff, assets, and advantages over competitors.
o Weaknesses: Things we are missing, resource limitations.
▪ Human resources, physical resources, financials, activities and processes, and past
experiences.
● External Factors:
o Opportunities: Elements in the
environment that the business or
project could exploit to its advantage.
o Threats: Elements in the environment
that could cause trouble for the
business or project.
▪ Future trends, the economy,
funding, our physical
environment, legislation,
national, or international events

Organizational Finances
● OPEX vs. CAPEX:
o OPEX (Operating Expense) is the ongoing cost for running a product, business, or system.
(Keeping the lights on).
o CAPEX (Capital Expenditure) is the money a company spends to buy, maintain, or improve
its fixed assets, such as buildings, vehicles, equipment, or land.
● Business plans, roadmaps:
o We build our organizational business plans based on the organizations mission statement
and vision at the direction of senior leadership.
o We have 1-year, 3-year, and 5-year business plans and roadmaps.

5 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Fiscal years (budget year):
o We plan our budgets according to our organization’s fiscal year.

KGIs, KPIs and KRIs

● KGI (Key Goal Indicators)
o Define measures that tell management, after the fact – whether an IT process has
achieved its business requirements.
● KPI (Key Performance Indicators)
o Define measures that determine how well the IT process is performing in enabling the
goal to be reached.
● KRI (Key Risk Indicators)
o Metrics that demonstrate the risks that an organization is facing or how risky an activity is.
o They are the mainstay of measuring adherence to and establishing enterprise risk
appetite.
o Key risk indicators are metrics used by organizations to provide an early signal of
increasing risk exposures in various areas of the enterprise.
o KRI gives an early warning to identify potential event that may harm continuity of the
activity/project.

Confidentiality, Integrity, and Availability

The CIA Triad (sometimes referred to as AIC)
● Confidentiality
o This is what most people think IT Security is.
o We keep our data and secrets secret.
o We ensure no one unauthorized can access the data.
● Integrity
o How we protect against modifications of the data and the
systems.
o We ensure the data has not been altered.
● Availability
o We ensure authorized people can access the data they need when they need to.

Confidentiality, Integrity, and Availability

● Threats:
o Attacks on your encryption (cryptanalysis).
o Social engineering.
o Key loggers (software/hardware), cameras, Steganography.
o IoT (Internet of Things) – The growing number of connected devices we have pose a new
threat, they can be a backdoor to other systems.

● We use:
o Encryption for data at rest (for instance AES256), full disk encryption.
o Secure transport protocols for data in motion. (SSL, TLS or IPSEC).

6 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
o Best practices for data in use - clean desk, no shoulder surfing, screen view angle
protector, PC locking (automatic and when leaving).
o Strong passwords, multi-factor authentication, masking, access control, need-to-know,
least privilege.

Confidentiality, Integrity, and Availability

● Threats:
o Alterations of our data.
o Code injections.
o Attacks on your encryption (cryptanalysis).

● We use:
o Cryptography (again).
o Check sums (This could be CRC).
o Message Digests also known as a hash (This could be MD5, SHA1 or SHA2).
o Digital Signatures – non-repudiation.
o Access control.

Confidentiality, Integrity, and Availability

● Threats:
o Malicious attacks (DDOS, physical, system compromise, staff).
o Application failures (errors in the code).
o Component failure (Hardware).

● We use:
o IPS/IDS.
o Patch Management.
o Redundancy on hardware power (Multiple power supplies/UPS’s/generators), Disks
(RAID), Traffic paths (Network design), HVAC, staff, HA (high availability) and much more.
o SLA’s – How much uptime do we want (99.9%?) – (ROI).

Confidentiality, Integrity, and Availability

● Finding the right mix of Confidentiality, Integrity and Availability is a balancing act.
● This is really the cornerstone of IT Security – finding the RIGHT mix for your organization.
o Too much Confidentiality and the Availability can suffer.
o Too much Integrity and the Availability can suffer.
o Too much Availability and both the Confidentiality and Integrity can suffer.

● The opposites of the CIA Triad are DAD (Disclosure, Alteration and Destruction).
o Disclosure – Someone not authorized getting access to your information.
o Alteration – Your data has been changed.
o Destruction – Your data or systems have been destroyed or rendered inaccessible.

7 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
Sensitive Information and Media Security
Sensitive Information
● Any organization has data that is considered sensitive for a variety of reasons.
● We want to protect the data from Disclosure, Alteration and Destruction (DAD).
● Data has 3 States: We want to protect it as well as we can in each state.
o Data at Rest (Stored data): This is data on disks, tapes,
CDs/DVDs, USB sticks
▪ We use disk encryption (full/partial), USB encryption,
tape encryption (avoid CDs/DVDs).
▪ Encryption can be hardware or software encryption.
o Data in Motion (Data being transferred on a network).
▪ We encrypt our network traffic, end to end encryption,
this is both on internal and external networks.
o Data in Use: (We are actively using the files/data, it can’t be
encrypted).
▪ Use good practices: Clean desk policy, print policy, allow no ‘shoulder surfing’,
may be the use of view angle privacy screen for monitors, locking computer
screen when leaving workstation.

Data Classification and Policies

● Labels: Objects have Labels assigned to them.

o The label is used to allow Subjects with the right clearance to access them.
o Labels are often more granular than just “Top Secret” they can be “Top Secret – Nuclear.”

● Clearance: Subjects have Clearance assigned to them.

o A formal decision on a subject’s current and future trustworthiness.
o The higher the clearance, the more in-depth the background checks should be (always in
military, not always in business).

8 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Formal Access Approval:
o Document from the data owner approving access to the data for the subject.
o Subject must understand all requirements for accessing the data and the liability involved
if compromised, lost, or destroyed.
o Appropriate Security Clearance is required as well as the Formal Access Approval.
● Need to know:
o Just because you have access does not mean you are allowed the data.
o You need a valid reason for accessing the data. If you do not have one you can be
terminated/sued/jailed/fined.
▪ Leaked information about Octomom Natalie Suleman cost 15 Kaiser employees
fines or terminations because they had no valid reason for accessing her file.
▪ We may never know who actually leaked the information. It may not be one of
the 15, but they violated HIPAA by accessing the data.
● Least privilege: Users have the minimum necessary access to perform their job duties.

Sensitive Information and Media Security

Sensitive Information
● Data handling:
o Only trusted individuals should handle our data; we should also have policies on how,
where, when, and why the data was handled. Logs should be in place to show these
metrics.
● Data storage:
o Where do we keep our sensitive data? It should be kept in a secure, climate-controlled
facility, preferably geographically distant or at least far enough away that potential
incidents will not affect that facility too.
▪ Many older breaches were from bad policies around tape backups.
▪ Tapes were kept at the homes of employees instead of at a proper storage facility
or in a storage room with no access logs and no access restrictions (often
unencrypted).
● Data retention:
o Data should not be kept beyond the period of usefulness or beyond the legal
requirements (whichever is greater).
o Regulation (HIPAA or PCI-DSS) may require a certain retention of the data (1, 3, 7 years, or
infinity).
o Each industry has its own regulations and company policies may differ from the statutory
requirements.
o Know your retention requirements!

Data, System, Mission Ownership, Custodians and Users

Each role has unique roles and responsibilities to keep the data safe.
● Mission/business owner:
o Senior executives make the policies that govern our data security.
● Data/information owners:

9 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
o Management level, they assign sensitivity labels and backup frequency.
o This could be you or a data owner from HR, payroll, or other departments.
● Data custodians:
o These are the technical hands-on employees who do the backups, restores, patches,
system configuration. They follow the directions of the data owner.
● System owner:
o Management level and the owner of the systems that house the data.
o Often a data center manager or an infrastructure manager.
● Data controllers and data processors:
o Controllers create and manage sensitive data in the organization (HR/Payroll)
o Processors manage the data for controllers (Outsourced payroll)
● Security Administrators:
o Responsible for firewalls, IPS’ (Intrusion Prevention Systems), IDS’ (Intrusion Detection
Systems), security patches, create accounts, and assigns access to the data following the
data owners’ directions.
● Supervisors:
o Responsible for user behavior and assets created by the users. Directly responsible for
user awareness and needs to inform the security administrator if there are any changes to
user employment status, user access rights, or any other pertinent changes to an
employee’s status.
● Users:
o These are the users of the data. User awareness must be trained; they need to know what
is acceptable and what is not acceptable, and the consequences for not following the
policies, procedures, and standards.
● Auditors:
o Responsible for reviewing and confirming our security policies are implemented correctly,
we adhere to them, and that they provide the protection they should.

Ethics
ISACA professional Code of Ethics: You sign this before the exam.
1. Support the implementation of, and encourage compliance with, appropriate standards and
procedures for the effective governance and management of enterprise information systems and
technology, including audit, control, security, and risk management.
2. Perform their duties with objectivity, due diligence, and professional care, in accordance with
professional standards.
3. Serve in the interest of stakeholders in a lawful manner, while maintaining high standards of
conduct and character, and not discrediting their profession or the Association.
4. Maintain the privacy and confidentiality of information obtained in the course of their activities
unless disclosure is required by legal authority. Such information shall not be used for personal
benefit or released to inappropriate parties.
5. Maintain competency in their respective fields and agree to undertake only those activities they
can reasonably expect to complete with the necessary skills, knowledge, and competence.
6. Inform appropriate parties of the results of work performed including the disclosure of all
significant facts known to them that, if not disclosed, may distort the reporting of the results.

10 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
7. Support the professional education of stakeholders in enhancing their understanding of the
governance and management of enterprise information systems and technology, including audit,
control, security, and risk management.

Failure to comply with this Code of Professional Ethics can result in an investigation into a member's or certification
holder's conduct and, ultimately, in disciplinary measures.

Computer Ethics Institute

Ten Commandments of Computer Ethics:
1. Thou shalt not use a computer to harm other people.
2. Thou shalt not interfere with other people’s computer work.
3. Thou shalt not snoop around in other people’s computer files.
4. Thou shalt not use a computer to steal.
5. Thou shalt not use a computer to bear false witness.
6. Thou shalt not copy or use proprietary software for which you have not paid.
7. Thou shalt not use other people's computer resources without authorization or proper
compensation.
8. Thou shalt not appropriate other people's intellectual output.
9. Thou shalt think about the social consequences of the program you are writing or the system you
are designing.
10. Thou shalt always use a computer in ways that ensure consideration and respect for your fellow
humans.

IAB’s Ethics and the Internet

● Defined as a Request for Comment (RFC), #1087 - Published in 1987
● Considered unethical behavior:
o Seeks to gain unauthorized access to the resources of the Internet.
o Disrupts the intended use of the Internet.
o Wastes resources (people, capacity, computer) through such actions:
▪ Destroys the integrity of computer-based information.
▪ Compromises the privacy of users.

Your Organization’s Ethics

● You need to know the Internal Code of Ethics of your organization
o If you do not, how can you adhere to it?

Legal and Regulatory Issues

There are a handful types of laws covered on the exam and important to your job as an IT Security
Professional.
● Criminal Law:
o “Society” is the victim and proof must be “Beyond a reasonable doubt”.
o Incarceration, death, and financial fines to “Punish and deter”.

11 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Civil Law (Tort Law):
o Individuals, groups, or organizations are the victims and proof must be “the majority of
proof”.
o Financial fines to “Compensate the victim(s)”.
● Administrative Law (Regulatory Law):
o Laws enacted by government agencies (FDA Laws, HIPAA, FAA Laws, etc.).
● Private Regulations:
o Compliance is required by contract (For instance PCI-DSS).
● Customary Law:
o Mostly handles personal conduct and patterns of behavior and it is founded in traditions
and customs of the area or region.
● Religious Law:
o Based on the religious beliefs in that area or country, they often include a code of ethics
and moralities which are required to be upheld.
● Liability:
o If the question is who is ULTIMATELY liable, the answer is Senior Leadership. This does not
mean you are not liable; you may be, that depends on Due Care.
Who is held accountable? Who is to blame? Who should pay?
● Due Diligence and Due Care:
o Due Diligence – The research to build the IT Security architecture of your organization,
best practices and common protection mechanisms, and research of new systems before
implementing.
o Due Care – Prudent person rule
▪ What would a prudent person do in this situation?
● Implementing the IT Security architecture, keep systems patched. If
compromised: fix the issue, notify affected users (Follow the Security
Policies to the letter).

● Negligence (and gross negligence) is the opposite of Due Care.

o If a system under your control is compromised and you can prove you did your Due Care,
you are most likely not liable.
o If a system under your control is compromised and you did NOT perform Due Care, you
are most likely liable.

Evidence
How you obtain and handle evidence is VERY important.
● Types of evidence:
o Real Evidence: Tangible and physical objects in IT Security: Hard disks, USB drives – NOT
the data on them.
o Direct Evidence: Testimony from a first-hand witness, what they experienced with their 5
senses.
o Circumstantial Evidence: Evidence to support circumstances for a point or other evidence.
o Corroborative Evidence: Supports facts or elements of the case; not facts on their own
but they support other facts.

12 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Hearsay:
o Not first-hand knowledge – normally inadmissible in a case.
o Computer-generated records, for us that means log files are considered hearsay, but case
law and updates to the Federal Rule of Evidence have changed that.
o Rule 803 provides for the admissibility of a record or report that was:
▪ “Made at or near the time by, or from information transmitted by, a person with
knowledge, if kept in the course of a regularly conducted business activity, and if it
was the regular practice of that business activity to make the memorandum,
report, record or data compilation.”

● Best Evidence Rule – The courts prefer the best evidence possible.
o Evidence should be accurate, complete, relevant, authentic, and convincing.
● Secondary Evidence – This is common in cases involving IT.
o Logs and documents from the systems are considered secondary evidence.
● Evidence Integrity – It is vital that the evidence’s integrity cannot be questioned.
o We do this with hashes.
o Any forensics is done on copies and never the originals.
o We check hash on both original and copy before and after the forensics.
● Chain of Custody – This is done to prove the integrity of the data; that no tampering was done.
o Who handled it?
o When did they handle it?
o What did they do with it?
o Where did they handle it?

Reasonable Searches
● The Fourth Amendment to the United States Constitution protects citizens from unreasonable
search and seizure by the government.
● In all cases, the court will determine if evidence was obtained legally.
● Exigent circumstances apply if there is an immediate threat to human life or of evidence
destruction.
● Your organization needs to ensure that our employees are aware their actions are monitored.

Entrapment and Enticement

● Entrapment (Illegal and unethical): When someone is persuaded to commit a crime, they had no
intention of committing and is then charged with it.
● Enticement (Legal and ethical): Making committing a crime more enticing, but the person has
already broken the law or at least has decided to do so. Honeypots can be a good way to use
Enticement.

Privacy
● You as a citizen and consumer have the right that your Personally Identifiable Information (PII) is
being kept securely.
o There are a number of Laws and Regulations in place to do just that.

13 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● US privacy regulation is a patchwork of laws, some overlapping and some areas with no real
protection.
● EU Law – Very pro-privacy, strict protection on what is gathered, how it is used and stored.
o There are a lot of large lawsuits against large companies for doing what is legal in the US
(Google, Apple, Microsoft, etc.)

Rules, Regulations, and Laws you should know for the exam (US)
● HIPAA (Not HIPPA) – Health Insurance Portability and Accountability Act:
o Strict privacy and security rules on handling of PHI (Protected Health Information).
● Security Breach Notification Law:
o NOT Federal, all 50 states have individual laws, know your state.
● Electronic Communications Privacy Act (ECPA):
o Protection of electronic communications against warrantless wiretapping.
o The Act was weakened by the Patriot Act.
● PATRIOT Act of 2001:
o Expands law enforcement electronic monitoring capabilities.
o Allows search and seizure without immediate disclosure.
● Computer Fraud and Abuse Act (CFAA) – Title 18 Section 1030:
o Most commonly used law to prosecute computer crimes.
● Gramm-Leach-Bliley Act (GLBA):
o Applies to financial institutions; driven by the Federal Financial Institutions.
● Sarbanes-Oxley Act of 2002 (SOX):
o Directly related to the accounting scandals in the late 90’s.
● Payment Card Industry Data Security Standard (PCI-DSS):
o Technically not a law, created by the payment card industry.
o The standard applies to cardholder data for both credit and debit cards.
o Requires merchants and others to meet a minimum set of security requirements.
o Mandates security policy, devices, control techniques, and monitoring.

GDPR (General Data Protection Regulation)

● GDPR is a regulation in EU law on data protection and privacy for all individuals within the
European Union (EU) and the European Economic Area (EEA).
● It does not matter where we are based, if we have customers in EU/EEA we have to adhere to the
GDPR.
● Violators of the GDPR may be fined up to €20 million or up to 4% of the annual worldwide
turnover of the preceding financial year in case of an enterprise, whichever is greater.
● Unless a data subject has provided informed consent to data processing for one or more purposes,
personal data may not be processed unless there is at least one legal basis to do so.
● Restrictions: Lawful interception, national security, military, police, justice.
● Personal data covers a variety of data types including Names, Email Addresses, Addresses,
unsubscribe confirmation URLs that contain email and/or names, IP Addresses.

14 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Right to access: Data controllers must be able to provide a free copy of an individual’s data if
requested.
● Right to erasure: All users have a “right to be forgotten”.
● Data portability: All users will be able to request access to their data “in an electronic format”.
● Data breach notification: Users and data controllers must be notified of data breaches within 72
hours.
● Privacy by design: When designing data processes, care must be taken to ensure personal data is
secure. Companies must ensure that only data is “absolutely necessary for the completion of
duties”.
● Data protection officers: Companies whose activities involve data processing and monitoring
must appoint a data protection officer.

Legal and Regulatory Issues

Rules, Regulations, and Laws you should know for the exam (EU)
● Legacy laws in the EU and between the EU and the US
o EU Data Protection Directive
o EU-US Safe Harbor
o Privacy Shield

Organization for Economic Cooperation and Development (OECD) Privacy Guidelines

(International):
● 30 member nations from around the world, including the U.S.
● OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, issued in
1980, updated in 2013.
● Eight driving principles:
o Collection limitation principle.
o Data quality principle.
o Purpose specification principle.
o Use limitation principle.
o Security safeguards principle.
o Openness principle.
o Individual participation principle.
o Accountability principle.

Wassenaar Arrangement
Export/Import controls for Conventional Arms and Dual-Use Goods and Technologies.
● 41 countries are a part of the arrangement.
● Cryptography is considered “Dual-Use”.
o Iran, Iraq, China, Russia, and others have import restrictions on strong cryptography.
o If it is too strong it cannot be broken; they want to be able to spy on their citizens.
o Companies have to make “country specific” products with different encryption standards.

15 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● The arrangement is used both to limit what countries want to export and to what some want to
import.
● It is the responsibility of the organization to know the laws concerning import/export from and to
a certain country.
● The Arrangement covers 10 Categories:
o Special materials and related equipment
o Materials processing
o Electronics
o Computers
o Telecommunications, "Information security”
o Sensors and "Lasers”
o Navigation and avionics
o Marine
o Aerospace and propulsion.

Intellectual Property
● Copyright © - (Exceptions: first sale, fair use).
o Books, art, music, software.
o Automatically granted and lasts 70 years after creator’s death or 95 years after creation
by/for corporations.
● Trademarks ™ and ® (Registered Trademark).
o Brand names, logos, slogans – Must be registered, is valid for 10 years at a time, can be
renewed indefinitely.
● Patents: Protects inventions for 20 years (normally) – Cryptography algorithms can be patented.
o Inventions must be:
▪ Novel (New idea no one has had before).
▪ Useful (It is actually possible to use, and it is useful to someone).
▪ Nonobvious (Inventive work involved).
● Trade Secrets.
o You tell no one about your formula, your secret sauce. If discovered anyone can use it;
you are not protected.

Attacks on Intellectual Property

● Copyright.
o Piracy - Software piracy is by far the most common attack on Intellectual Property.
o Copyright infringement – Use of someone else’s copyrighted material, often songs and
images.
● Trademarks.
o Counterfeiting – Fake Rolexes, Prada, Nike, Apple products – Either using the real name or
a very similar name.
● Patents.
o Patent infringement – Using someone else’s patent in your product without permission.

16 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Trade Secrets.
o While an organization can do nothing if their Trade Secret is discovered, how it is done can
be illegal.
● Cyber Squatting – Buying a URL you know someone else will need (gray area legally).
● Typo Squatting – Buying a URL that is VERY close to real website name (Can be illegal in certain
circumstances).

Administrative Personnel Security Controls

Administrative Security
● Provides the means to control people's operational access to data.
● Least Privilege:
o We give employees the minimum necessary access they need, no more, no less.
● Need to know:
o Even if you have access, if you do not need to know, then you should not access the data.
(Kaiser employees).
● Separation of duties:
o More than one individual in one single task is an internal control intended to prevent
fraud and error.
o We do not allow the same person to enter the purchase order and issue the check.
o For the exam assume the organization is large enough to use separation of duties, in
smaller organizations where that is not practical, compensating controls should be in
place.
● Job rotation:
o For the exam think of it to detect errors and frauds. It is easier to detect fraud and there is
less chance of collusion between individuals if they rotate jobs.
o It also helps with employee’s burnout, and it helps employees understand the entire
business.
o This can be to cost prohibitive for the exam/real life, make sure on the exam the cost
justifies the benefit.
● Mandatory vacations:
o Done to ensure one person is not always performing the same task, someone else has to
cover and it can keep fraud from happening or help us detect it.
o Their accounts are locked, and an audit is performed on the accounts.
o If the employee has been conducting fraud and covering it up, the audit will discover it.
o The best way to do this is to not give too much advance notice of vacations.
● With the combination of all 5 we minimize some of the insider threats we may have.
● NDA (non-disclosure agreement):
o We covered NDAs between our and other organizations, it is also normal to have them for
internal employees.
o Some employment agreements will include a clause restricting employees' use and
dissemination of company-owned confidential information.

17 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Background checks:
o References, Degrees, Employment, Criminal, Credit history (less common, more costly).
o For sensitive positions the background check is an ongoing process.
● Privilege monitoring:
o The more access and privilege an employee have the more we keep an eye on their
activity.
o They are already screened more in depth and consistently, but they also have access to
many business-critical systems, we need to audit their use of that access.
o With more access comes more responsibility and scrutiny.

● Privileged Account/Access Management (PAM):

o Account (account safeguarded) vs. Access (Account + what can the account access/do).
o We want to identify and monitor anyone with more access than the normal user. The
higher privileges they have the closer they should be monitored.
o We monitor the what/when/how/why/where of
what is accessed.
o Full monitoring, limit privileges, MFA, monitor
remote connections, logs/records are immutable,
anomaly detection, continuous monitoring, full
visibility of all admins, and no group accounts.
o Users:
▪ Regular users: Analyze performance,
improve efficiency.
▪ Privileged users: Access matrix, what was
changed?
▪ All users: Sensitive data, critical systems,
insider/outsider threats, and meeting
compliance/regulatory requirements.
o Systems:
▪ All servers (including jump servers), all
endpoints, and remote workstations.
● Conduct Logging and Monitoring Activities:
o Logging = Managing all the logs from our applications and infrastructure, the raw data.
o Monitoring = Making sure that our applications and infrastructure is available and
responds to user requests within an acceptable time frame, alerts us of issues, the data
being used.
● Threat Intelligence:
o Threat Feeds: A stream of raw current and potential threats.
▪ We can use a threat intelligence feed to get actual usable data, such as suspicious
domains, malware hashes, potential malicious code, flagged IPs.
▪ We can then use that feed to compare to our ingress/egress traffic.
o Threat Hunting: Actively looking for threats on our network.
▪ We assume attackers are able to access our network and have not been detected,
we aggressively search our systems for any threat indicator.

18 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● User and Entity Behavior Analytics (UEBA):
o We use machine/deep learning to model typical and atypical user behavior, setting a
baseline.
o With the baseline, we can identify anomalies and threats sooner.
o For that we look at:
▪ Use cases – How do normal users use our network and data?
▪ Data sources – Data sources, normally a data lake/warehouse or SIEM, should not
be deployed directly.
▪ Analytics – To build the baseline and detect anomalies.

Cobit 5
● Principle 1: Meeting Stakeholder Needs 1.
o Enterprises have many stakeholders, and ‘creating Meeting
stakeholders
needs
value’ means different—and sometimes conflicting—
things to each of them.
o Governance is about negotiating and deciding amongst 5. Separating
Governance
2. Covering
the
different stakeholders’ value interests. 1. From
management
COBIT 5
Enterprise
End-to end
o The governance system should considerMeeting all stakeholders Principles
when making benefit, resource, and stakeholders
risk assessment
decisions.
needs
o For each decision, the following can and should be
asked: 4. Enabling a
Holistic
3. Applying a
Single
▪ Who receives the benefits? Approach Integrated
Framework
▪ Who bears the risk?
▪ What resources are required?
o Stakeholder needs have to be transformed into an enterprise’s practical
1.
strategy. Meeting

● Principle 2: Covering the Enterprise End-to-End stakeholders

needs
2.
o COBIT 5 addresses the governance and management of Covering the
information and related technology from an enterprise
wide, end-to-end perspective. 5. Separating
Enterprise2. Covering
Governance the
o This means that COBIT 5: From
management End-to-end Enterprise
End-to-end
▪ Integrates governance of enterprise IT into COBIT 5
enterprise governance, i.e., the governance Principles
system for enterprise IT proposed by COBIT 5
integrates seamlessly in any governance system
because COBIT 5 aligns with the latest views on
4. Enabling a 3. Applying a
governance. Holistic Single
Approach Integrated
▪ Covers all functions and processes within the Framework

enterprise; COBIT 5 does not focus only on the ‘IT

function’, but treats information and related technologies as assets that need to
be dealt with just like any other asset by everyone in the enterprise.

19 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Principle 3: Applying a Single, Integrated Framework 1.
o COBIT 5 aligns with the latest relevant other Meeting
stakeholders
needs
standards and frameworks used by enterprises:
▪ Enterprise: COSO, COSO ERM, ISO/IEC 9000,
ISO/IEC 31000 5. Separating
Governance 2. Covering
▪ IT-related: ISO/IEC 38500, ITIL, ISO/IEC From
management
the Enterprise
end-to-end
27000 series, TOGAF, PMBOK/PRINCE2, COBIT 5
Principles
CMMI
o This allows the enterprise to use COBIT 5 as the
overarching governance and management
3. Applying a
framework integrator. 4. Enabling a Single
Holistic Integrated
o ISACA plans a capability to facilitate COBIT user Approach Framework

mapping of practices and activities to third-party

references.
● Principle 4: Enabling a Holistic Approach
o COBIT 5 enablers are: 1.
Meeting
o Factors that, individually and collectively, stakeholders
needs
influence whether something will work—in the
case of COBIT, governance and management
5. Separating
over enterprise IT Governance 2. Covering
From the Enterprise
o Driven by the goals cascade, i.e., higher-level IT- management
COBIT 5 end-to-end

related goals define what the different enablers Principles

should achieve
o Described by the COBIT 5 framework in seven
categories: 4. Enabling a 3. Applying a
1. Principles, policies, and Holistic
Approach
Single
Integrated
frameworks: Are the vehicles to Framework

translate the desired behavior

into practical guidance for day-
to-day management
2. Processes: Describe an organized set of practices and activities to achieve
certain objectives and produce a set of outputs in support of achieving
overall IT-related goals
3. Organizational structures: Are the key decision-making entities in an
organization
4. Culture, ethics, and behavior:
Of individuals and of the
organization; very often
underestimated as a success
factor in governance and
management activities
5. Information: Is pervasive
throughout any organization, it
deals with all information
produced and used by the

20 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
enterprise. Information is required for keeping the organization running
and well governed, but at the operational level, information is very often
the key product of the enterprise itself.
6. Services, infrastructure, and applications: Include the infrastructure,
technology and applications that provide the enterprise with information
technology processing and services
7. People, skills and competencies: Are linked to people and are required
for successful completion of all activities and for making correct decisions
and taking corrective actions

● Principle 5: Separating Governance from Management 1.

Meeting
o The COBIT 5 framework makes a clear distinction stakeholders
needs
between governance and management.
o These two disciplines: 5. Separating
▪ Encompass different types of activities. Governance
From
2. Covering
the
▪ Require different organizational structures managemen
t
COBIT 5 Enterprise
end-to-end
▪ Serve different purposes Principles
o Governance: In most enterprises, governance is the
responsibility of the board of directors under the
leadership of the chairperson. 4. Enabling a 3. Applying a
Holistic Single
o Management: In most enterprises, management is the Approach Integrated
Framework
responsibility of the executive management under the
leadership of the CEO.
o Governance ensures that stakeholders' needs,
conditions, and options are evaluated to
determine balanced, agreed-on enterprise
objectives to be achieved; setting direction
through prioritization and decision making; and
monitoring performance and compliance
against agreed-on direction and objectives.
o Management plans, builds, runs, and monitors
activities in alignment with the direction set by
the governance body to achieve the enterprise
objectives.

21 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
ISO/IEC 27001 and 27002
● Most organizations have many different information security controls, if we do not have an
information security management system (ISMS), our controls are often disorganized and only
cover some of our organization.
● ISO/IEC 27001 is a management system that is used to bring information security under
management control and gives specific requirements. It is the framework, and we can get certified
against ISO27001.
● ISO/IEC 27002 provides best practice recommendations on information security controls for use
by those responsible for initiating, implementing, or maintaining ISMS. Much more in detail, how
we implement our ISMS.

NIST 800-53 Rev. 4:

Security and Privacy Controls for Federal Information Systems and Organizations.
https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final
● Tier 1: Organization.
● Tier 2: Mission / Business Processes.
● Tier 3: Information Systems.

22 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Tier 3: Information System.
o Step 2: Select Security Controls.

NIST 800-37 Rev. 1 and 2

● Revision 1: Date Published: February 2010 (Updated 6/5/2014).
● Revision 2: Date Published: December 2018.

23 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
There are seven major objectives or this update
1. To provide closer linkage and communication between the risk management processes and
activities at the C-suite.
2. To institutionalize critical risk management preparatory activities at all risk management
levels.
3. To demonstrate how the NIST Cybersecurity Framework [NIST CSF] can be aligned with the
RMF and implemented using established NIST risk management processes.
4. To integrate privacy risk management processes into the RMF to better support the privacy
protection needs for which privacy programs are responsible.
5. To promote the development of trustworthy secure software and systems.
6. To integrate security-related, supply chain risk management (SCRM) concepts into the RMF.
7. To allow for an organization-generated control selection approach to complement the
traditional baseline control selection approach and support the use of the consolidated
control catalog in NIST Special Publication 800-53, Revision 5.

24 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
NIST Cyber Security Framework Rev. 1.1

25 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
Data Security Frameworks
We use standards, baselines, scoping, and tailoring to decide which controls we use, and how
we deploy them.
● Different controls are deployed for data at rest and data in motion.
● Some of the standards and frameworks used could be PCI-DSS, ISO27000, OCTAVE, COBIT, or ITIL.
● Scoping is determining which portion of a standard we will deploy in our organization.
o We take the portions of the standard that we want or that apply to our industry and
determine what is in scope and what is out of scope for us.
● Tailoring is customizing a standard to your organization.
o This could be, we will apply this standard, but we use a stronger encryption (AES 256bit).
● Certification: A system, and the security measures to protect it, meet the security requirements
set by the data owner or by regulations/laws.
● Accreditation: The data owner accepts the certification and the residual risk. This is required
before the system can be put into production.

Data Protection
● Digital Rights Management (DRM) - Uses technology and systems to protect copyrighted digital
media.
o Encryption – Regional DVDs.
o Permissions management and limiting access.
o Serial numbers, limit installations, expiry dates, IP addresses, geolocation, VPN.
o Copy restrictions: Copy, edit, saving, screenshots, screen recording, printing.
o Persistent authentication and audit trails.
o Tracking – watermarks or meta data embedded in files.
● Cloud Access Security Broker (CASB) – on-premises or cloud software between our users and our
cloud applications.
o Monitors user activity warns admins about possible malicious/dangerous actions, malware
prevention, protects against shadow IT, and enforces security policy compliance.
● Data Loss Prevention (DLP)
o Loss vs. leak.
o Data in use, in motion, and at rest.
o Network and endpoint DLP.

Security Models and Fundamental Concepts

Security models provide the rules for how we secure our data, while focusing on different goals
and what they provide.
● DAC - (Discretionary Access Control) gives subjects full control of objects they have created or
been given access to.
● MAC - (Mandatory Access Control) is system-enforced access control based on a subject’s
clearance and an object’s labels.
● RBAC - (Role Based Access Control) is where access to objects is granted based on the role of the
subject.

26 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● ABAC - (Attribute Based Access Control) is where access to objects is granted based on subjects,
objects, and environmental conditions.
o Attributes could be:
▪ Subject (user) – Name, role, ID, clearance, etc.
o Object (resource) – Name, owner, and date of creation.
o Environment – Location, and/or time of access, and threat levels.
● RUBAC - (Rule Based Access Control) is access that’s granted based on IF/THEN
statements.

● Bell-LaPadula: (Confidentiality) (Mandatory Access Control):

o Simple Security Property “No Read UP”.
▪ Subjects with Secret clearance can’t read Top Secret data.
o * Security Property: “No Write DOWN”.
▪ Subjects with Top Secret clearance can’t write Top Secret information
to Secret folders.
o Strong * Property: “No Read or Write UP and DOWN”.
▪ Subjects can ONLY access data on their own level.
● BIBA: Integrity (Mandatory Access Control):
o Simple Integrity Axiom: “No Read DOWN”.
▪ Subjects with Top Secret clearance can’t read Secret data.
▪ Remember that integrity is the purpose here; we don’t want to have
wrong or lacking lower clearance level data confuse us.
o * Integrity Axiom: “No Write UP”.
▪ Subjects with Secret clearance can’t write Secret information to Top
Secret folders.
▪ We don’t want wrong or lacking lower-level information to propagate to a higher
level.
o Invocation Property: “No Read or Write UP”.
▪ Subjects can never access or alter data on a higher level.

● Lattice Based Access Control (LBAC) (MAC):

o A subject can have multiple access rights.
▪ A Subject with “Top Secret” {crypto, chemical}
would be able to access everything in this lattice.
▪ A Subject with “Secret” {crypto} would only have
access to that level.
▪ A subject with “Top Secret” {chemical} would
have access to only {chemical} in Top Secret and
Secret.
o These are obviously vastly more complex in real life.
o For the exam, just know what they are and how they
work.

27 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Graham-Denning Model – uses Objects, Subjects, and Rules.
o The 8 rules that a specific subject can execute on an object are:
1. Transfer Access.
2. Grant Access.
3. Delete Access.
4. Read Object.
5. Create Object.
6. Destroy Object.
7. Create Subject.
8. Destroy Subject.

● HRU model (Harrison, Ruzzo, Ullman):

o An operating system level computer security model that deals with the integrity of access
rights in the system.
o It is an extension of the Graham-Denning model, based around the idea of a finite set of
procedures being available to edit the access rights of a subject on an object.
o Considers Subjects to be Objects too (unlike Graham-Denning).
o Uses six primitive operations:
▪ Create object.
▪ Create subject.
▪ Destroy subject.
▪ Destroy object.
▪ Enter right into access matrix.
▪ Delete right from access matrix.

● Clark-Wilson - Integrity:
o Separates end users from the back-end data through ‘Well-
formed transactions’ and ‘Separation of Duties’.
o The model uses Subject/Program/Object.
▪ We have discussed the Subject/Object relationship
before, but this puts a program between the two.
▪ We don’t allow people access to our inventory when
they buy from us.
▪ We give them a limited functionality interface they
can access.
o Separation of duties:
▪ The certifier of a transaction and the implementer are different entities.
▪ The person making purchase orders should not be paying the invoices.
o Well-formed transactions are a series of operations that transition a system from one
consistent state to another consistent state.

28 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Brewer-Nash (Chinese Wall or Information Barriers):
o Designed to provide controls that mitigate conflict of interest in
commercial organizations and is built upon an information flow
model.
o No information can flow between the subjects and objects in a
way that would create a conflict of interest.
● Non-Interference Model:
o Ensures that any actions that take place at a higher security
level do not affect or interfere with actions that take place at a
lower level.
o The model is not concerned with data flow, but with what a
subject knows about the state of the system.
o Any changer by a higher-level subject will never be noticed by a lower-level subject.

● Take-Grant Protection Model:

o Uses rules that govern the interactions between subjects and objects.
o It uses permissions that subjects can grant to (or take from) other
subjects.
o It has 4 rules:
▪ Take rule allows a subject to take rights of another object.
▪ Grant rule allows a subject to grant own rights to another
object.
▪ Create rule allows a subject to create new objects.
▪ Remove rule allows a subject to remove rights it has over
another object.

o Thor can Take (t) Jane’s rights for the object.

o Jane can Create (c) and Remove (r) rights for the object.
o Jane can Grant (g) any of her rights to Bob.
● Access Control Matrix:
o Model describing the rights of every subject for every object in the system.
o An access matrix is like an Excel sheet.
▪ One row per subject.
▪ One column per object.
▪ The rows are the rights of each
subject, each row is called a
capability list.
▪ The columns show the ACL (Access Control List) for each object or application.

● Zachman Framework (for Enterprise Architecture):

o Provides six frameworks:
▪ What, How, Where, Who, When, and Why.
o Mapping those frameworks to rules for:
▪ Planner, Owner, Designer, Builder, Programmer, and User.

29 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● Security Modes - can be MAC or DAC (Mandatory or Discretionary Access Control):
o The systems contain information at
various levels of security classification.
o The mode is determined by:
▪ The type of users who will be
directly or indirectly accessing
the systems.
▪ The type of data, including
classification levels,
compartments, and categories
that are processed on the
system.
▪ The type of levels of users, their need to know, and formal access approvals that
the users will have.
o Dedicated security mode - All users must have:
▪ Signed NDA for ALL information on the system.
▪ Proper clearance for ALL information on the system.
▪ Formal access approval for ALL information on the system.
▪ A valid need to know for ALL information on the system.
▪ users can access ALL data.
o System High Security Mode - All users must have:
▪ Signed NDA for ALL information on the system.
▪ Proper clearance for ALL information on the
system.
▪ Formal access approval for ALL information on
the system.
▪ A valid need to know for SOME information on
the system.
▪ All users can access SOME data, based on their
need to know.
o Compartmented Security Mode - All users must have:
▪ Signed NDA for ALL information on the system.
▪ Proper clearance for ALL information on the system.
▪ Formal access approval for SOME information they will access on the system.
▪ A valid need to know for SOME information on the system.
▪ All users can access SOME data, based on their need to know and formal access
approval.
o Multilevel Security Mode - (Controlled Security Mode) - All users must have:
▪ Signed NDA for ALL information on the system.
▪ Proper clearance for SOME information on the system.
▪ Formal access approval for SOME information on the system.
▪ A valid need to know for SOME information on the system.
▪ All users can access SOME data, based on their need to know, clearance and
formal access approval.

30 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
Artificial Intelligence
● Intelligence exhibited by machines, rather than humans or other animals.
● What true AI is, is a topic of discussion, what was considered AI years
ago we have achieved and when once goal is reached the AI
definition is tweaked a little.
● From what we are seeing published we do in my mind not currently
have true AI, but very highly simulated intelligence, that being said
IBM and Google do seem to be getting a lot closer.
● It is also used when a machine mimics cognitive functions that
humans associate with other human minds, such as learning and
problem solving.
● AI currently defined as advice that perceives its environment and
takes actions that maximize its chance of success at some goal, not
through experience/programming, but through reasoning.
● Expert systems:
o A computer system that emulates the decision-making ability of a human expert.
o Designed to solve complex problems by reasoning about knowledge, represented mainly
as if–then rules rather than through conventional procedural code.
o An expert system is divided into two subsystems:
▪ The knowledge base represents facts and rules.
▪ The inference engine applies the rules to the known facts to deduce new facts and
can also include explanation and debugging abilities.
● ANN's (Artificial neural networks):
o Computing systems inspired by the biological neural networks that constitute animal
brains, we make decisions based on 1000’s of memories, stories, the situation and many
other factors, the ANN tries to emulate that.
o The systems learn and progressively improve their performance, to do tasks, generally
without task-specific programming.
o They can learn to identify images that contain geckos by analyzing example images that
have been manually labeled as "gecko" or "no gecko" and using the analytic results to
identify geckos in other images.
o They are mostly used in areas that are difficult to express in a traditional computer
algorithm using rule-based programming.
o An ANN is based on a collection of connected units called artificial neurons.
o Each connection (synapse) between neurons can transmit a signal to another neuron.
o Typically, neurons are organized in layers, different layers may perform different
transformations on their inputs.
o Signals travel from the first input to the last output layer, at times after traversing the
layers multiple times.

31 | Page
https://thorteaches.com/
 CISM Domain 1 Lecture notes
● GP (Genetic Programming):
o A technique where computer programs are encoded as a set of genes that are then
modified (evolved) using an evolutionary algorithm often a GA (Genetic Algorithm).
o The results are computer programs able to perform well in a predefined task.
o The methods used to encode a computer program in an artificial chromosome and to
evaluate its fitness with respect to the predefined task are central in the GP technique and
still the subject of active research.
o GP evolves computer programs, traditionally represented in memory as tree structures.
o Trees can be easily evaluated in a recursive manner.
o Every tree node has an operator function, and every terminal node has an operand,
making mathematical expressions easy to evolve and evaluate.
o Traditionally GP favors the use of programming languages that naturally embody tree
structures for example, Lisp or other functional programming languages.

What we covered in Domain 1

● Congratulations on finishing Domain 1: Information Security governance. This is the CISM
foundation.
● 17% of the exam questions on the certification are from this domain.

● We will be covering our govern, our values, vision, mission, our strategies, policies, standards, and
processes.
● We look at the policies, the procedures, the laws we need to adhere to.
● Data protection, the NIST Cyber Security framework, NIST Risk management framework, NIST 800-
37, 800-53, ISO 27001 and 27002
● We talked about the CIA triad, which is the foundation of Information Security
● Administrative security controls, roles, and responsibilities.

● This should be what you are tested on for Domain 1 until the next planned CISM curriculum
change in 2027.

32 | Page
https://thorteaches.com/