Overview
Information Security Governance covers how an enterprise directs and oversees information security. Part A, Enterprise Governance, looks at organizational culture, legal, regulatory and contractual requirements, and the structures, roles and responsibilities that make someone accountable. Part B, Information Security Strategy, covers developing a strategy that supports business goals, choosing governance frameworks and standards, and strategic planning with budgets, resources and business cases.
Candidates must reason as an information security manager who reports to senior management and the board. You need to know why strategy starts from business objectives and a gap between current and desired state, why governance sets direction while management executes, and how a business case wins funding. Domain 2 applies this direction to risk decisions, Domain 3 turns the strategy into a program, and Domain 4 relies on governance for incident authority and escalation paths.
How it's tested
Domain 1 questions are short business scenarios with a FIRST, BEST or MOST important stem. A new CISO, a merger, a new regulation or a stalled initiative is described, and you choose the action that aligns security with business objectives, defines accountability or gains management support. Technical options appear as distractors; the answer usually sits one level higher.
-
What should happen FIRST
A manager arrives at an organization or faces a new demand. The right answer establishes understanding (business objectives, current state, requirements) before any plan, policy or control.
-
Who is accountable
A decision about risk acceptance, policy approval or funding is described. You assign it to senior management, the steering committee, the business owner or the security manager according to accountability, not expertise.
-
Best way to gain support
Security initiatives stall or are underfunded. The answer frames security in business terms, such as a business case, risk to objectives or value delivered, rather than technical severity.
A newly hired information security manager finds no documented strategy and several urgent audit findings. Options include remediating the findings, writing policies, buying a monitoring tool and meeting business leaders to understand objectives. The strategy must support the business, so learning business objectives and the current state comes first; remediation and policy writing follow once priorities are anchored to what the enterprise is trying to achieve.
Sub-topics 6
Official sub-topics from the ISACA outline, in outline order.
1.1 Organizational CultureHow shared values, risk attitude and behavior shape whether security succeeds.
- What it means
- Culture is the set of beliefs and habits that decide how people treat security when nobody is checking, including risk appetite, tolerance for workarounds and how bad news travels upward.
- What to understand
- A security program designed against the culture fails no matter how sound the controls are, so the manager assesses culture before choosing an approach. A positive security culture is built through visible leadership support, clear expectations and making the secure path the easy one, not through enforcement alone.
- How it shows up
- A scenario describes repeated policy bypasses by staff who are meeting deadlines, and asks for the BEST long-term response; the answer addresses culture and incentives rather than adding a technical block.
- Common confusion
- Treating culture as the same thing as awareness training; training is one tool, while culture is the outcome that leadership behavior and incentives shape.
1.2 Legal, Regulatory and Contractual RequirementsExternal obligations the security program must identify, interpret and meet.
- What it means
- Laws (privacy, breach notification), industry regulations (financial, health) and contracts (customer agreements, card-brand rules such as PCI DSS) impose security requirements that are not optional.
- What to understand
- The manager identifies which obligations apply, works with legal counsel to interpret them and maps them to policy and controls, so compliance becomes one input to strategy rather than the strategy itself. Contracts can be stricter than law and are enforceable through penalties or loss of business.
- How it shows up
- An organization expands into a new jurisdiction or signs a contract with a new data-handling clause, and the question asks what the security manager should do FIRST: identify and assess the requirement with legal input.
- Common confusion
- Assuming compliance equals security; meeting a regulation sets a floor, and a strategy built only on audit checklists can leave material business risk unaddressed.
1.3 Organizational Structures, Roles and ResponsibilitiesWho directs, who owns, who executes and how security reports.
- What it means
- This covers the board and senior management (direction and accountability), steering committees (cross-functional prioritization), business and data owners (accountable for their assets and risk), the information security manager or CISO (designs and manages the program) and custodians and users.
- What to understand
- Accountability cannot be delegated, while responsibility for tasks can. Reporting lines matter: a security function that reports outside IT, or with direct access to senior leadership, is better placed to avoid conflicts of interest. A RACI matrix (responsible, accountable, consulted, informed) is the usual tool for removing ambiguity.
- How it shows up
- A question asks who should approve a policy exception, accept a residual risk or decide classification, and the answer is the business owner or senior management, not the security manager.
- Common confusion
- Picking the security manager as the risk acceptor because they know the risk best; the manager advises and reports, and the business owner decides.
1.4 Information Security Strategy DevelopmentBuilding a strategy from business objectives, current state and desired state.
- What it means
- A security strategy is the long-term plan for reaching a desired security state that supports business objectives, built from a current-state assessment, a defined desired state and a roadmap that closes the gap.
- What to understand
- Strategy starts from business goals, not threats or tools. The desired state can be described with a maturity model or framework target, and the gap analysis between current and desired state produces the roadmap, resource needs and metrics. Constraints such as budget, culture, legal requirements and skills shape what is realistic.
- How it shows up
- A scenario asks what is MOST important when developing or updating a strategy, and the answer is alignment with business objectives, or the input to collect FIRST, which is the current state or business goals.
- Common confusion
- Confusing a strategy with a policy or a project plan; strategy sets direction and objectives, policy states management intent, and plans implement both.
1.5 Information Governance Frameworks and StandardsUsing frameworks such as COBIT, ISO/IEC 27001 and NIST to structure governance.
- What it means
- Frameworks provide a tested structure for governance and control: COBIT for enterprise governance of information and technology, ISO/IEC 27001 for an information security management system with certifiable requirements, ISO/IEC 27002 for control guidance and the NIST Cybersecurity Framework for organizing outcomes.
- What to understand
- A framework is adopted and tailored to the organization's size, sector and risk, not applied wholesale. Its value lies in common language, completeness and a way to measure maturity. Choosing a framework is a governance decision linked to business and regulatory needs.
- How it shows up
- A question asks the BEST reason to adopt a framework or what to do after selecting one; the answer stresses tailoring to business needs and using it to measure the gap.
- Common confusion
- Treating ISO/IEC 27002 as certifiable; certification is against ISO/IEC 27001, while 27002 is guidance on implementing controls.
1.6 Strategic Planning (e.g., Budgets, Resources, Business Case)Turning strategy into funded, staffed initiatives with a justified business case.
- What it means
- Strategic planning converts the strategy into prioritized initiatives with budgets, people and timelines, and the business case is the document that asks for funding by showing costs, benefits, risks and alignment to objectives.
- What to understand
- A business case wins approval when it ties the initiative to a business objective or risk reduction in terms executives use, such as reduced expected loss, enabled revenue or regulatory exposure avoided, and shows alternatives considered. Budgets and resources must be revisited when business priorities change.
- How it shows up
- A security initiative was rejected by management, and the question asks the BEST next step: reframe the business case around business impact and value rather than resubmitting technical detail.
- Common confusion
- Believing a high technical risk rating alone justifies spending; management funds initiatives that show value or reduce business risk at a cost proportional to the benefit.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Business alignment
Every security objective, policy and investment should trace back to a business objective it supports or a business risk it reduces.
- Remember
- When two options both improve security, the one explicitly tied to business objectives is usually the CISM answer.
- Tested as
- It is the tie-breaker in most BEST and MOST important questions across all four domains.
- Trap
- Choosing the option that most reduces technical risk while ignoring whether it serves what the business is trying to achieve.
-
Governance vs. management
Governance evaluates, directs and monitors (board and senior management); management plans, builds, runs and monitors activities within that direction.
- Remember
- Governance decides what and why; management decides how.
- Tested as
- Questions about who approves policy or sets risk appetite turn on this split.
- Trap
- Assigning direction-setting decisions to the security manager, who sits on the management side.
-
Senior management commitment
Visible support and resources from executives, which give the security program authority across business units.
- Remember
- Lack of senior management support is the root cause behind many stalled programs in CISM scenarios.
- Tested as
- Appears as the MOST important success factor for a strategy or program.
- Trap
- Selecting more awareness training or tools when the scenario shows leadership is not backing the program.
-
Current state, desired state and gap analysis
The strategy compares where security is today (often measured on a maturity scale) with where it needs to be to support the business, and the gap drives the roadmap.
- Remember
- You cannot plan a roadmap before you know both endpoints.
- Tested as
- FIRST-step questions on strategy development often point to assessing the current state.
- Trap
- Jumping to control selection before defining the desired state.
-
Accountability vs. responsibility
Accountability is ownership of the outcome and stays with the owner; responsibility for doing the work can be delegated.
- Remember
- An owner can delegate tasks but not accountability.
- Tested as
- Drives who-should questions on risk acceptance, classification and policy exceptions.
- Trap
- Thinking that outsourcing a function also transfers accountability for its security.
-
Information security steering committee
A cross-functional group of senior business representatives that prioritizes security initiatives and resolves conflicts between business units.
- Remember
- Its value is business representation and buy-in, not technical depth.
- Tested as
- Appears as the best forum to resolve competing priorities or approve strategy.
- Trap
- Staffing it mainly with IT and security people, which defeats its purpose.
-
Business case
A structured justification for an investment that sets out the problem, options, costs, benefits, risks and alignment to objectives.
- Remember
- Executives approve value and risk reduction stated in business terms.
- Tested as
- Tested when an initiative lacks funding or must be prioritized.
- Trap
- Presenting vulnerability counts or technical severity as the main argument.
-
Risk appetite and risk tolerance
Appetite is the broad amount of risk the enterprise is willing to accept in pursuit of its objectives; tolerance is the acceptable deviation around a specific objective or level.
- Remember
- Senior management or the board sets appetite; the security manager works within it.
- Tested as
- Strategy and risk-response answers must stay within stated appetite.
- Trap
- Treating appetite as something the security team defines from threat data.
-
Maturity models
Scales such as the capability levels used in COBIT, or CMMI-style levels, that describe how defined, measured and optimized a process is.
- Remember
- Maturity measures process capability and is used to express current and desired state.
- Tested as
- Used to describe a target state or measure strategic progress.
- Trap
- Aiming for the highest maturity level everywhere instead of the level the business needs.
-
Legal and regulatory requirements
External obligations such as privacy laws, breach notification rules and contractual clauses that must be identified and built into policy.
- Remember
- Identify and interpret with legal counsel first; then map to controls.
- Tested as
- FIRST-step questions when an organization enters a new market or signs a new contract.
- Trap
- Letting compliance requirements become the whole strategy.
-
RACI matrix
A chart that marks each role as responsible, accountable, consulted or informed for each activity.
- Remember
- Each activity should have exactly one accountable role.
- Tested as
- Offered as the BEST way to remove confusion over roles in a program.
- Trap
- Assigning accountability to several roles, which recreates the ambiguity.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Governance vs. management vs. operations
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Governance | Board and senior management evaluate options, set direction and risk appetite and monitor performance. | Decides what the enterprise wants from security and why. | Expecting the security manager to set risk appetite. |
| Management | The information security manager and functional managers plan, build and run the program within that direction. | Decides how objectives are achieved and reports results upward. | Choosing a management action when the scenario lacks direction from governance. |
| Operations | Teams and custodians run day-to-day controls such as patching, monitoring and access provisioning. | Executes defined procedures rather than making policy decisions. | Picking an operational fix in a question that asks about a governance gap. |
Strategy vs. policy vs. standard vs. procedure
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Strategy | Long-term plan for reaching a desired security state that supports business objectives. | Sets direction and priorities; changes with business goals. | Writing policies before a strategy defines what they should achieve. |
| Policy | High-level statement of management intent and expectations, approved by senior management. | Mandatory and broad; rarely changes. | Putting technology-specific settings in a policy, which forces frequent rewrites. |
| Standard | Mandatory, specific requirement that makes a policy measurable, such as a minimum encryption strength. | Changes as technology changes, while the policy stays stable. | Treating a standard as optional guidance. |
| Procedure | Step-by-step instructions to carry out a standard or policy. | Operational and owned by the teams doing the work. | Asking senior management to approve every procedure. |
Risk appetite vs. risk tolerance vs. risk capacity
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Risk appetite | Broad amount of risk the enterprise is willing to accept in pursuit of value. | Set by the board or senior management as a strategic statement. | Assuming the security team calculates it. |
| Risk tolerance | Acceptable variation around a specific objective or threshold. | Narrower and more operational than appetite. | Using tolerance and appetite as synonyms. |
| Risk capacity | The maximum loss the enterprise could absorb before failing to survive or meet obligations. | An objective limit; appetite should sit below it. | Setting appetite equal to capacity, which leaves no margin. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Fix the findings first
- What candidates pick
- Remediating open audit findings immediately when a new manager arrives.
- Why it looks right
- Audit findings feel urgent and measurable, and fixing them shows quick progress.
- Why it's wrong
- Without knowing business objectives and the current state, remediation may target the wrong priorities and cannot be defended as part of a strategy.
Clue to watch for A new role, no documented strategy and a FIRST stem point to understanding the business and current state.
-
The expert should decide
- What candidates pick
- Letting the information security manager accept a residual risk or approve an exception.
- Why it looks right
- The security manager understands the risk better than anyone else in the scenario.
- Why it's wrong
- Risk acceptance belongs to the business owner or senior management who own the affected objectives; the manager advises and documents.
Clue to watch for Words such as accept, approve or exception signal an accountability question.
-
Compliance as the strategy
- What candidates pick
- Making regulatory compliance the primary goal of the security strategy.
- Why it looks right
- Regulations carry penalties and give a clear, auditable target.
- Why it's wrong
- Compliance is one requirement within a strategy that must support business objectives; a compliance-only program can miss material risks.
Clue to watch for A stem asking what the strategy should PRIMARILY support or be aligned with.
-
Policy before strategy
- What candidates pick
- Drafting a full policy set as the first step of a new program.
- Why it looks right
- Policies are tangible and commonly requested by auditors.
- Why it's wrong
- Policies express management intent, which comes from a strategy linked to business goals; writing them first produces documents with no agreed direction.
Clue to watch for The organization lacks both a strategy and policies, and the stem asks what to do FIRST.
-
Technical severity sells the budget
- What candidates pick
- Resubmitting a rejected proposal with more vulnerability data and threat intelligence.
- Why it looks right
- More evidence seems to strengthen the argument.
- Why it's wrong
- Executives fund value and business risk reduction; more technical detail does not address why the case failed.
Clue to watch for Management rejected or deferred a request, and the stem asks for the BEST way to gain approval.
-
Outsourcing transfers accountability
- What candidates pick
- Assuming a provider is accountable for protecting outsourced data.
- Why it looks right
- The contract names the provider as responsible for operating the service.
- Why it's wrong
- Responsibility for tasks can move to the provider, but accountability for the data and its protection stays with the organization.
Clue to watch for A breach at a provider and a question about who is ultimately accountable.
Answer framework
Use this sequence when a governance scenario offers both business-level and technical answers.
- Identify the business objective, regulation or contract the scenario puts at stake before reading the options.
- Decide whether the question is about direction, accountability, funding or execution, and match the level of the answer to it.
- Prefer the option that establishes understanding first, such as current state, requirements or stakeholder goals, when the stem says FIRST.
- Assign decisions to the role that owns the outcome: board or senior management for appetite and policy, business owners for their risk.
- Eliminate answers that skip governance by jumping straight to tools, technical fixes or enforcement without management support, then choose between the remaining options by asking which one the board would recognize as serving the business.
Practice question
Want more like this? The CISM practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with Part A before strategy. Learn the governance-versus-management split and the roles of the board, steering committee, business owners and security manager, because nearly every Domain 1 answer turns on who should act. Then add legal, regulatory and contractual requirements and the effect of culture, which are the inputs and constraints a strategy must respect.
Next, study Part B as one connected chain: business objectives lead to a desired state, the gap with the current state leads to a roadmap, and the roadmap leads to business cases, budgets and resources. Practice explaining each link aloud. The most underestimated area is the business case: candidates know the term but cannot say what makes management approve one, which is value and risk reduction stated in business language.
Frameworks deserve a focused session rather than memorization of every control. Know what COBIT, ISO/IEC 27001 and 27002 and the NIST Cybersecurity Framework are for and that each is tailored, not adopted wholesale.
Afterwards, practice FIRST and BEST questions in timed sets. For every miss, write down whether you chose an answer at the wrong level (technical instead of governance) or the wrong role. That pattern log is the fastest way to correct the manager's mindset before moving on to Domain 2.
FAQ
Why does a domain worth only 17% matter so much?
Its reasoning is reused across the exam: alignment with business objectives, senior management ownership and accountability decide many answers in risk, program and incident questions too.
What kind of questions does Domain 1 use?
Mostly short business scenarios with FIRST, BEST or MOST important stems, where several options are reasonable and you choose the one at the right level and with the right owner.
Do I need to memorize COBIT or ISO/IEC 27001 in detail?
You need to know what each framework is for, how ISO/IEC 27001 differs from 27002 and why frameworks are tailored. Clause-by-clause recall is not the focus of this outline.
What is the difference between a strategy and a policy?
A strategy is the long-term plan to reach a desired state that supports business goals. A policy is a high-level statement of management intent that the strategy calls for, which standards and procedures then make specific.
Who accepts risk in CISM scenarios?
The business owner or senior management whose objectives are affected. The security manager assesses, recommends and reports, and documents the acceptance.
How long should I spend on this domain?
Our planning estimate is about 30–40 hours within a 200-hour plan. Spend extra time if you come from a technical role and tend to pick hands-on answers.
How does Domain 1 connect to the other domains?
Domain 2 uses its risk appetite and ownership rules, Domain 3 turns its strategy and policies into a program, and Domain 4 depends on the authority and escalation paths governance defines.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Certified in Risk and Information Systems Control Same subject: Domain 1: Governance (26%)
- Certified Information Systems Auditor Same subject: Domain 2: Governance and Management of IT (18%)
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 1 knowledge
Check whether you can pick the governance-level answer and the right accountable role under time pressure, using questions built around strategy, frameworks and business cases.