CISA Certified Information Systems Auditor Study Guide

Chapter 7Information Security Management

THE CERTIFIED INFORMATION SYSTEMS AUDITOR (CISA) OBJECTIVES REPRESENT 26% OF THE MATERIAL COVERED ON THE EXAM AND INCLUDE:

• Domain 5: Protection of Information Assets

• A. Information Asset Security and Control
  •  1. Information Asset Security Frameworks, Standards, and Guidelines
  •  2. Privacy Principles
  •  5. Network and End-Point Security
  •  6. Data Classification
  •  7. Data Encryption and Encryption-Related Techniques
  •  8. Public Key Infrastructure (PKI)
  •  9. Web-Based Communication Techniques
  • 10. Virtualized Environments
  • 11. Mobile, Wireless, and Internet-of-Things (IoT) Devices
• B. Security Event Management
  •  1. Security Awareness Training and Programs
  •  2. Information System Attack Methods and Techniques
  •  3. Security Testing Tools and Techniques
  •  4. Security Monitoring Tools and Techniques
  •  5. Incident Response Management
  •  6. Evidence Collection and Forensics
• Supporting Tasks
  • 11. Evaluate IT management and monitoring of controls.
  • 29. Evaluate the organization’s information security and privacy policies and practices.
  • 34. Evaluate the information security program to determine its effectiveness and alignment with the organization’s strategies and objectives.
  • 35. Perform technical security testing to identify potential threats and vulnerabilities.

The topics in this chapter and Chapter 8 “Identity and Access Management,” combine to cover Domain 5 of the CISA exam, which represents 26 percent of the CISA examination.

Information ...