CISM Masterclass Essentials You Won't Find Anywhere Else!

0:00 hi team welcome to my session on coffee with PR and today we're going to discuss about CM your last minute guide I can assure you one thing it is a first kind of a video on YouTube which talk about all the four domains based on the news labus my name is PR and I'm taking a cism from last 10 year and when it come to success rate in last 10 year I maintained 99% and um for more information you can check my LinkedIn profile and if you're new to the channel do subscribe to the YouTube channel and click on the Bell icon to make sure you should not miss is the future videos on a similar topic so without wasting a time let's start with the first part thank [Music]

0:52 you okay so in cism we have a total four domains and full form of cism is certified information security manager now when talking about the cism so we have a domain one which is called information security governance because governance help you to build the foundation we're going to discuss in the further slide what is governance but for your information governance is all about set of operations Now set of operations are there which help you to conduct the information security risk management because when you want to implement any kind of a controls in the organization you have to do risk management based on risk management based on that we can Define the controls with the help of information security program because information Miss security program include all the controls what we have and make sure the controls are working effectively and all that if any issue comes in the control with the help of

1:38 inent management we can manage and whatever the Gap we identify we report back to the same to the board now this is the complete cycle we have so governance is a set of operation they're doing a risk assessment to identify gaps threats issues and based on that they organize the controls and information security program and once they implement the controls any kind of a program any kind of a challenge they basically face we can handle this change challenge with the help of inent management process and from the inent management process we get the reporting and everything by which we can able to improve the controls and that is how the cism has organized the four domains okay so in cism people say you have to think like a manager you know you don't you should not think like a practitioner so what is the definition of think like a manager see whenever you

2:24 answer any questions the first thing is that whenever you answer make sure you have to keep mon in your mind is you have to focus on business goals I'll give an example now according to you what is the best firewall need your suggestion in the comment box some people will say Polo Alto some will say 40 net but the best firewall is the one which meet the business requirement that is the mindset we need in so normally we have a two type profile in the company one is called as a practitioner and one is called as a professional so practitioner is the one who implement the solution and professional is the one who manage okay every organization start

3:09 with strategy then we have a tactical plan and then we have an operational plan now cism guy is basically come on this side professional he understand the business he understand the requirement he understand the Regulatory and based on that he will do the risk assessment and suggest the control and get the control implemented from the operation team that is how things works so professional is the one who understand the business analyze the requirement and practitioner is the one who implement the solution so in the cism you have to think like a professional okay there is no one solution which fix all the issues you have to understand that also understood that's that's basically the most important part now as I said when it come to cism okay you have to you have to focus

3:56 on business goals that's the first priority business goals like you know always align your answers with the organization objectives such as protecting assets ensuring compliance and more important enable the business continuity by end of the day you have to maintain the CIA but always remember one thing ultimate goal of any solution is to achieve the business objectives is it clear second we have a risk-based thinking risk-based thinking is very important so you have to prioritize risk management by identifying assessing mitigating risk in a way that you can able to balance the security need with business business operations in layment term I can say any kind of initiative you're doing in the organization when you hire anyone when you fire anyone you do risk assessment so risk based thinking you need to have in the system

4:41 let's say example you're dealing with multiple incidents with the limited resources so how you handle that you'll do first impact analysis or risk assessment to prioritize what is important and what is not the third important thing we call as a strategic alignment okay so you have to emphasis on how the information security supports the organizational strategy and you also need to check the goals rather than focusing only on technical controls so that is the first important thing you need to understand from the exam point of view so that is called as a think like a manager concept now second important thing you have to uh you can say you have to analyze the scenario holistically how so you need to consider stakeholders that is your first priority so you have to evaluate the scenarios from the perspective of employees Executives customer and Regulators okay

5:28 that's a one thing second is long-term implications you have to choose the answer that reflect the sustainable and scalable Solutions rather than short-term fixes example like ultimate goal of risk management is not to identify risk but reduce the risk to an acceptable level right so that's called as a long-term implication the third most important part is called as a compliance and governance so you have to incorporate all the regulatory requirement governance Frameworks and everything okay next is called as a um which is called as a um prioritize the actions based on a impact very very important now here we have a most important thing is required is critical thinking so you have to you know assess which actions provide the greatest value which reduce the most critical task you are to also need to consider Resource Management where you consider cost effective and

6:13 resource constraint when you're selecting a Solutions and then we have a inent response when you're handling the incidents in the exam questions focus on minimizing the business impact and restoring the operations efficiently ultimate goal of inant management is to reduce a risk to an acceptable level that's true so that that you have to check how you basically prioritize that okay always remember avoid all the technical over premises okay example like or over emphasis sorry like for example detailing firewall configuration is not required more focus on how far will enforce the policies second is when you're discussing the encryptions emphasis will be role on the achieving a confidentiality objective than the technical implementations so these are the basic steps is required for your understanding that you need to

6:59 follow follow okay now in the exam this keywords are very important the first keyword is best best use according to a particular situation example like you have created a security policies what is the best way to communicate the policies so answer is awareness training but when you're creating a pol created a policy the most important step is approval of management so difference is that best is focus on best appropriate and strategic Solutions among the several valid options all four options will be great but still we have to select the one one which can cover everything on the second part the word most is there most highlight the critical priority and highest impact example like what is the most important outcome of security governance or what is the most important requirement of successful security

7:45 governance the answer is basically C management approval without C management approval we can't do anything on top of it one more important is called as a in aligned with the business objective because if it's not aligned with the business objective management cannot approve that so keyword is most or second option is in the month of December most of the Indians or most of the people in India go to Goa so that's called critical priority highest impact but best to be stay at home according to the problem another keyword is basically called as a primary primary mean what is the first goal of this initiatives okay like what is the primary goal of your uh watching this video learning no learning is one of goal but ultimate goal or prime AR goal is to pass this exam right

8:31 so when you're doing any initiative you have to understand from this initiative what is a primary like primary goal of Incident Management reduce the impact primary goal of problem management drag the root cause so primary mean from this particular initiative what is the first thing I will achieve then last is called as a first first we use in that case when you're talking about sequence like what is the first step in the risk management what is a first step in the Bia what is the first step in this what is the first step in that whenever the question talking about sequence it mean the question talking about first and all that so you have to select answer accordingly sometime what happen is options are also combination example like what is the first step of the risk management answer is identifying risk but one also option is there is reduce risk to an acceptable level now this

9:17 option is an outcome of the question not a sequence but this option is the sequence of the question so this is how you need to validate the functions and for more information there's already a video I made on the C some think like manager do check that okay ultimate goal of this video is to give you the visibility about what is cover in cism so that's like primary objective of this video is not to teach you how to think like a manager but what is in cism so there's another video I have you can check that video okay so let's let's move to the first domain which is called as a domain one so before we start with actual thing let's understand the basics first so what what is governance okay so governance is like a

10:04 you know governing something or it is a it is basically a framework okay it is a framework for rules practice and process that guide how organization is managed and controll now if you take example of country like India let's say example of India okay so we have more than 25 States right so we have more than 25 States each state has their own belief system so country like India country like Pakistan country like Bangladesh country like us UA and all that so each and every stat each and every country has their their own belief systems and there are some different resources we have like people are there nature is there so everything need to be managed properly and to manage them they

10:50 need to create a rules okay they need to introduce law they need to manage them appropriately so they will form one system system that system is called as a governance if you take another example okay with the same context of India and India what happen is we have a ministers so we appoint ministers the minister create a law they create a department and then they manage them to create a value for us that is called as a governance even when your parents create a rules for you introduce a processes for you okay every day morning you have to wake up 9:00 10:00 you need to have a breakfast 11:00 you have to go to school come back so they creating a

11:35 policy which is called as a law for you they're creating a process how to follow that policy and by end of the day they're trying to create a discipline to give you the better life same like company in order to manage that company their resources everything they create a rule they create a practices and processes that guide how the organization is manage and control I want to show you one video okay so you get a visibility why governance is important so if you see this video you'll get a better

12:27 visibility he just Di directly jump into the car no parking nothing breaking a glass you can see the way of taking taxi it is against the law wherever you park you jump and you break the glass no one care even it is mentioned no helmet he's still wearing a helmet and now you see the entry tan so that is a perfect example of bad governance now understood so if they have a system if they have a law if they have some policies then nothing will be happening like that so that's why called governance ensure accountability transparency alignment with the goals and objective so it is like governance

13:13 which is a process of governing or overseeing the control and direction of something okay if country creating governance country governance if parenting creating a rule for their kids that is called parenting governance so now question is why governance matter in the organization okay so the first part why governance matter so why because the first biggest reason is direction see when you're talking about governance governance set the organization goals okay and they strategic directions just like family you know you have a family so family is something which set the goals okay set they set the goals they they set the you know the goals like they want to planning a vacation so or

13:59 they want to save for a new car or making sure kid do wells in a school so governance in an organization also set the goals and directions okay so if you take example this is the bank we have so this bank is doing offline business in Delhi or Melbourne offline business mean there's nothing online everyone has to go to bank and Avail the services now the bank understood they want expansion they need to introduce it so they have given instruction to CI plan the it function then CI get the information from a ceso ensure the security all these part of a strategic Direction so the family have a strategic direction to save money spend quality

14:45 time together or prioritize education same like the company basically have a strategic Direction okay this year this plan next year this plan and if the organization has appropriate strategy and everything that shows a good governance governance that's why governance matter second is called as an accountability see it ensure your decisions are made responsible with a clear and accountability at every level that's why if you notice in your company you have a racy metrics racy racy metric so someone is responsible someone is accountable someone is need to be consulted and informed okay so in a family same everyone has a responsibility so parent might manage the finance older kids might help with the you know and younger kids are responsible for their school work so

15:32 governance ensure everyone know their roles and it can be counted on so if anything happen for instance a family can quickly see who was supposed to do what hold them accountable so they have a visibility so accountability is very important the third important thing risk management in my further slide we discuss in detail so governance structure helps to identify assess and control the risk same like your family face risk too like managing expenses staying being safe or preparing for emergencies right so governance in a family involved planning for those risk like saving from unexpected expenses or having an emergency contacts or teaching kid about safety and this way risk are minimized now let's say example I'm getting every month salary of $10,000 suppose I have a kid I don't

16:17 have a kid but suppose I have a kid now he said today he need a PlayStation so I have to see my finance and I will see okay can I gift him a PlayStation in this budget and if I gift him PlayStation from this cause can I able to run my entire house understood so here I'm doing a RIS because I don't want if tomorrow buy and I have to face the consequences same like company when they go for new project and all that so project can give reward also but it can also give a liability a good company is the one a good governance is the one we do risk management because ultimately we have to reduce the risk and prepare for the surprises and last is called as a governance called compliance why governance matter in the organiz because of compliance so like example my father has

17:03 set the rules for me so I have to abide with that rule so I'm using a word called comply with the rule understood so family follow the rules right so compliance ensure we other to the law regulations and internal policy which protecting the organization from fines or reputational damage so compliance here like family follow the rules or maintain the harmony to ensure everyone well beinging like beted time limit on screen time or taking turns with responsib ility right like on the on the on the dinner time no phones so we have to comply with the rule rule was set under the governance so because if you see the word g RC governance risk management compliance so during a governance we set the rule and now we have to comply if we don't comply there is a risk right so

17:49 during a part of a building process they have ensured no one will basically take a phone during a dinner time and this is basically we have to comply right so compliance basically ensure you other to the specific things okay now question is overall why governance matter so in this example you notice right without governance family might struggle okay if you don't have a direction the family might struggle with you know unexpected goals confusion over the responsibility and conflict around a rule and by setting a goal and ensuring accountability we can prepare for risk and maintaining a rule and the family can build a healthy organized and supportive environment just as a governance does for the organization that is why governance matter today in the organization so let's discuss the

18:35 next part a key element of governance so the question is what are the key elements of the governance the first important element is policy and standard everyone has to wake up on time it's a law created by it's a policy or it's a rule of my house same like every system must be protected with the password that is a policy policy is nothing it is like a law of the company seem like policy which is cre for my house it's a law of my house but the standard is what time we have to wake up like policy say that we have to wake up on time but question is what is a Time 7:00 a.m. is the standard time it is for me and for my cousin so the first important component which is a foundation for any any company governance is policy so if you want to check the maturity of any company first ask for the

19:22 policy okay so governance include setting up the policy okay and standard that Define the expected behavior and operational practice and this these policies helps to establish what is allowed required or prohibited within the organization same like I said in family policy are like house rules such as no phones at dinner table or bedtime at 9:00 p.m. so these rules set clear expectation what is allowed or what is not and they help everyone understand what behaviors are expected to maintain Harmony at the home that is where any kind of an activity you want to introduce policy is the first step second important element is called roles so governance Define who is responsible for various activity so there should not be any surprises okay and this is something we document as a

20:07 decision within the organization and this ensure the accountability and Clarity so that everyone understand their duties from a Senior Management to the individual contributor so every family member has a specific role like parent may handle the finance grocery shoppings older kids will taking care of the trash or doing the dishes and so role make sure everyone know what they responsible and this reduce the confusion and making the family run smoothly that is why in your company you have a RAC Matrix third is that whatever the policy standard we have to follow it is followed by the procedures okay so on one side we are saying we have to go on bed 9:00 a.m. or 9:00 p.m. so what is a process what is a procedure or I have to set eight8 character password so what is a process what is a procedure so governance

20:53 outline the procedures that ensure consistent okay reliable and repeatable outcome so these process are specially important in the critical areas like Risk Management compliance and quality control I'll give an example so I the I have appointed a Dr coordinator Disaster Recovery coordinator he created a procedure or she created a procedure now in her absence or in his absence someone can follow the procedure blindly and that is called as a good governance so procedures are the one which generate the same results consistent results like procedures like processes in a family like routine such as getting ready for the school in the morning or each steps

21:39 is organize everyone wake up eat breakfast brushes their te teeth and get dressed so these routines helps the things to ensure in a predictable way so no one miss the school bus or forget their lunch that's why that's very important part the next thing is called as accountability and oversight so governance provide the mechanism to monitor the activities okay which is added to the policies and all that and this oversight bodies like board of directors or governance committee they review the report because if you ask me the overall function of governance is three so we have a governance part evaluate direct and monitor and this is my operation team when they work on that this is basically oversight by the board so board is the one who always get a reports on regular basis because by that

22:25 they get a visibility and it is very important to have that okay it is very important so same like you know we collecting a audits we doing an audits we review the reports and by this you can hold people accountable for their actions that's why when you face any Audits and all that you you know auditor give you the recommendation and then do the follow up okay that's that's an important part so accountability in a family mean making sure everyone does their part so parent check if if uh cleaning has been done properly or if homework is completed like you know I'm sure you also experiened that that's EX example of oversight next important thing a good governance is the one where whatever the strategy you have set whatever the initiative you have set it is aligned with the business goals for instances governance might ensure securitya

23:11 practices align with the business goals so that good security governance is the one which align with the business goals or family might have a goal like saving money or Vacations so making sure everyone eat healthier so governance helps to align daily activity with these goals understood so that is something is part of the function so these are the key components we have now now let's understand how the overall organization works in the functions okay so we going to discuss now type of governance so that give you the better visibility see when we talking about organization hierarchy so this is how the actual organization works so the first part is called as a CEO okay now before going to discuss this I want to discuss the hierarchy so

23:58 as I said governance is a set of operation okay so under the governance we have a important element let me change the color okay so under the governance we have first thing which is called as a corporate governance corporate governance corporate governance okay and corporate governance is the one who set the goal okay they are the one who set the goals and they are the one who set the direction hey guys we have to start new business we want to go digital so that is defined by the corporate governance now who is part of corporate governance

24:44 board and Senior Management they are the one who set the goals so let's say example we are doing offline business and now we want to do online business okay that is basically my goal so we have decided because right now we're doing offline banking so I want to start banking services in entire Melbourne and I want to do in Sydney example or I want to do in Delhi or I want to do in Mumbai so what happen is Corporate governance said that okay increase business increase sales and everything so then it is giving a direction to the IT team which is called as it governance they create policy they create procedures they introduce AI ML and all

25:31 that so this is basically driven by the CIO Chief Information officer so he so corporate governance given given a direction to it governance hey guys we want to go digital now support digital but make sure this digital should be secure we have one governance which is called as a information security governance they create their policy procedure and all that to protect the business and protect the it and protect the business so that's why say C CEO is the one who set the organization strategy we want to go digital fine CIO will ensure how the deel can support the goals ceso will ensure how the security can be achieve that then security manager create isms and all that then security admin is there who create a sock sop and this is how the security technical team operate on the local level so that is how the entire

26:17 hierarchy works so to understand better let's understand one by one each and every statement okay so first let's discuss about the corporate governance so I already explained you in the previous slide what is corporate governance so Foundation of GRC is Corporate governance because they are the one who said the thing so if you see the hierarchy according to corit corporate governance is the one who follow three thing e DM according to covid E stand for evaluate so they evaluate the legal requirement regulat requirement compliance requirement customer requirement in in my further slide we discussed how we arrange the sequence so they evaluating the market condition and they understood yes we have to go digital okay we have to go digital that is basically my need we

27:04 have so corporate governance understand that particular thing and then they basically giving a direction to the CIO okay so CIO is the one who drive the initiatives so now CIO got the direction so now what happen is C based on that create a strategy they create the Tactical plan they create operation plan and then so we have a evaluate direct CIO is the one who will do the planning building run and monitor but parall we also have a ceso ceso also doing a planning building run and monitor to make sure it can able to secure the business and provide the report and this is basically called as a

27:51 e DM evaluate direct and monitor and cesos and CI doing a PBR they creating their strategy that's called it governance they're doing their information security governance and corporate doing their function that called corporate governance so corporate governance set the Strategic objectives and it guide the ethical Behavior oversee the compliance with legal regulatory requirement so their major Focus will be on the board oversight they want executive to be accountable they want transparencies and they are actually accountable for anything what is happening in the organization so and but the challenge is basically balance ING profitability with the social and environmental responsibilities because they have to run the business also but also respect the culture and everything and they are the one who set the regulated landscape

28:38 and they follow the topd approach without governance we can't Implement anything remember that without governance we can't Implement anything so that is basically called as a corporate governance now second is called as a it governance they are the one who align the it strategy with corporate objectives as I said the bank has decided they want to go online right now they are the one who creating it strategy to ensure how can they go online so they are the one who managing a risk associate with the digal transformation and their focus area is how to allocate the resources how to create a performance metrics risk management and integrate with the business goals but challenges basically as the technology get changed today you can see there is a need of AI artificial intelligence machine learnings and all that so they have to see how can they

29:24 optimize the it Investments and everything now next is called as a information security governance see in some companies information security reports to it in some companies information security directly report to the board so here the information security governance ensure the protection of information asset through the policy standard and framework and their focus area will be data protection risk assessment insent response compliance and everything challenges as things getting change and all that growing balance is there so how to comply with legal regular how to maintain security is the most important part see when you document information security under the information security we have a cyber security so difference is cyber security is protecting a digital

30:11 assets and information security protect all type of assets all type of asset I repeat again information security protect all type of asset where cyber security protect digital assets if I have a laptop it has a data that will be protect under the cyber security I will keep this laptop in the physical Locker that come under the physical security okay and in the information security we have a three goals maintain the confidentiality integrity and availability like I want to make sure whatever the information we collect it will be protect from unauthorized disclosure it is a user who decid this information should be available to one person to this person apart from that if it's available to anyone else it's a breach of confidentiality whatever the information

30:57 we provide it must be accurate that is called integrity and third is it must be available whenever it required it is same like right you're sharing your secret with your friend and he told everyone will you trust him no so it's a breach of confidentiality you ask for some advice and he gives some wrong advice will you trust him again no that is a Integrity he said okay whenever you need I will be available and he was not available when you need that is availability so that is how the governance risk compliance and inform information security works in the organization now this is the summary okay so here you can see corporate governance set the Strategic objective for it okay they are the one so first is set the objectives said we also Define the

31:44 compliance requirement that we need to comply with the legal regulat requirement and then they basically expecting it risk assessment report from it but it get this assessment from the information security governance okay information security governance and it implement the security controls uh information security governance report to CIA on the it security metrix they do the risk assessment end to end to make sure things are working correctly so that they get a reports on regular basis and they also report the it performance so this is basically the overall type of governance now we're going to discuss about a day in a life of of a GRC analyst see in different different company the people does different different role okay in some company G C analyst mean doing doing an audit work

32:30 in some company GRC analyst is the one who does the risk assessment and the implementation of a control so let's understand the day of a life of a JC analyst so you get a visibility what kind of a role he does okay let's move to the next part so information security governance I can say if you're preparing for the cism domain one is very important I Know It cover only 177% but that is very important because when you're talking about the domain one okay it's very important for you to know the basics 17 person so approx you will get 25 questions from this and that is the best thing about isaka what they commit they follow if they say they give 25 question they really me it so this module

33:17 represent the um uh the combination of 25 questions okay that you need to know for the exam okay now before I want to start this section uh I want to discuss the basics of that so I don't want to directly start with the session so first I want to discuss about what is information security but as I said when you're preparing for this cism give proper attention to domain one because that is the base for the rest of the domain now here when you're talking about information security information security is always an outcome of confidentiality Integrity availability before we jump into CIA I want to discuss the basics of information security so we have a two things here one is called infosec and then we have a cyers

34:05 sec information security and cyber security cyber security is a part of information security so you can say information security is the umbrella so if I say I want to protect all type of assets then the answer is information security but if I want to protect only digital assets digital digital assets then answer is basically cyber security so let's understand with the example so we have a phone here this is my phone okay in the phone we have WhatsApp chats I have a image and all that so this is basically protect with the password 4digit pin that is called a cyber but I place this phone in a physical locker and I lock the phone with the particular key physical key that is

34:51 called as a physical security which part of information security now when I join as a SEO in any organization let's say example I join Bank okay now they're saying PR we want to create a value for the business and we are expecting information security create value for us definitely we create a value for the business how we make sure whatever the transactions are there it is only available to the respective customer so what is it meaning it mean we maintaining a confidentiality like this is the transaction it will be only available to the respective customer customer who basically own that account and if this information go outside of these two things so this is the bank this is the customer and if it go to any

35:37 third person it is a breach of confidentiality and how we achieve that with the help of encryptions access controls and all that second is whatever the transactions we are doing it should be processed without any error so we have to ensure the transaction should be done in a proper manner so we maintain the hashing and all that and third is that whenever the user want the website to be available it must be available that is called as availability and forget about that today we use this confidence CIA tried in a real life also example like this is my friend and I told him buddy this this is is a issue and don't tell anyone and he meant he makes sure he will not tell anyone but one day what happened he told some people and that break the trust because he doesn't maintain the confidentiality second thing is I ask

36:24 for the friend okay yeah how's your marriage life you know is a marriage is good and all that so he said yes his marriage is heaven and all that you should also get married so I trust his advice and I follow the advice and what happened is it's said I I really appreciate but I'm just giving example after that I don't get that friend so that is basically called as an Integrity he told mea whenever any issue happen I will be available I said okay and when I need him I called him buddy there's a fight happen you have to be there and after that he vanish that is called availability issue so same like in the organization if you fail to maintain the confidentiality if you fail to maintain the Integrity if you fail to maintain the availability then it will impact the business so your information security outcome is maintain the confidentiality integrity and availability and that's why we say for educate

37:10 protection for educate protection for information asset information security strategy is essential and that is the process we need to understand here now this is the process but before I jump into the process I want to explain you with the example see when we're talking about any organization right so we have a vision then we have a mission and then we create an information security strategy ISS information security strategy you need to understand the sequence okay information security strategy then information security strategy backed and support by the information security policy and then information security policy include in the information security program in the information security program the first thing we do risk management and based on that we enforce the controls so this is the

37:56 sequence you need to from exam point of view I repeat again vision of the company Mission of the company then we have a information security strategy based on information security strategy we create information security policy policy policy will be backed in support by the information security program because any kind of a program you want to introduce it should be backed and support by the policy so program when we create first thing we create a policy for that by end of the day policy is a part of program policy include in the program but to build the program you need a policy and when you implementing a controls all the controls come under the program which is include your Incident Management patch management everything everything part of information security program but when to implement how to implement which come with the risk management and you can see here organization has objective so organization has decided

38:43 they want to go they so right now the organization doing lot of offline business they're doing offline business but now they want to go Global okay they want to go Global and that is only possible when they do all the business with the help of website so now when they want to go by website and all that okay so the vision of the company is to provide dacial services sustainability and Mission is basically we set for the internal stakeholders so here we have a m Vision here we have a mission and now we creating an organization strategy organization strategies increase business increase customer and all that and then further it is divided in two parts one is called as a call maintained by

39:29 the CIO and one is maintained by the ceso and you are here you are here CI will ensure Cloud need to be there technology need to be there to support the dial business but make sure the business need to be run in Secure manner make make sure the technology need to be in Secure manner this is basically we have a ceso so ceso is the one first thing what he do he will create a information security strategy which cover your security objectives like protect the information maintain the trust and all that and based on that security strategy we develop the comprehensive policy and that is where we have a security policy policy talk about the controls and that controls is part of a program can you see that program so that something is basically there and program will be Implement with the help of risk management so that's why we say

40:17 organization inform the information security manager information security manager create information security statut that is basically cover your objectives and then based on objective we create a policy and policy is basically Define the controls for the security program and want to implement all the controls we need to do with the help of risk management you can see risk management provide the feedback based on that we update the program program Effectiveness we need to inform the information security manager and information security manager informed the management that is how it works so in this entire structure information security governance play a very important role okay so before that I want to disc discuss one more important point which give you the better visibility so this is the blank screen but it's okay see

41:03 when we talking about as a set we have a vision why we exist in this world that's called Vision we have a mission mission is basically the path and then we talk about the strategy the strategy is called as an organization strategy okay I will discuss further in detail all this pointer but right now I'm just covering a high level so organiz strategy is there and then organization strategy is further divid into the IT and information security strategy information security strategy driven by the SEO and it strategy driven by the I

41:51 CIO so this is called as a information security govern and this is called as it governance and this is is called as a corporate governance okay so that's how it works so ultimate goal of information security governance is to create a value okay ultimate goal of information security governance is to create a value so there's a question can be can be asked in the exam is what is the purpose of information security governance establish an effective information security program that align with the Enterprise goals protect asset and support the compliance that is a primary purpose so if you get any question talking about what is the purpose of information security governance is to make sure it should support the goals protect assets and support the compliance second is the focus will be of information so purpose is different focus is different focus is basically

42:37 what you're going to do so information security governance has outcome is risk management because it is not possible for me to protect all the asset with the same value so we the help of risk management we have to prioritize remember that okay we have to prioritize and through that prioritization you can able to optimize the resource same like you know it is not possible for you to read word by word line by line and remember everything to the last day of the exam so what you do you will create a strategy and in the strategy you create a program study program of two weeks and in that program the first thing you do risk management what is important what is not so with the help of that with the limited resource you try to optimize that and that limited resource you implement you do the performance measurement of that and more important you integrate with the Enterprise

43:22 business that is the purpose that is a focus of information security govern and by doing that this by doing this you are aligning the Enterprise goals protect the asset and support the compliance so what is the seesm context you have to remember so as a CM context one thing you need to understand here is information security program success rely on the strong alignment with Enterprise overall governance leadership support and structure approach without leadership support you can't Implement information security governance in the organization so always remember one thing without leadership support you can't Implement program without leadership support you can't implement the policy without leadership support you can't Implement any solutions but one important requirement to get the leadership support is that your information security strategy should be

44:09 integrated in align with the business objective if it's not been align with the business objective you can't get an approval on your program always remember okay that's a very important part now another important thing we need to understand here is yes this diagram it's very very important for you to know okay so this is the hierarchy we have okay now here you can see the first part is how so here this is the steps which talk about how to implement the information security in the organization okay it's very important now first thing and I'm going to explain with the when use case Okay so first thing is basically called as a determine the desire outcome see when you preparing for cism this is your current state and this is your desire State desire State you want to clear the exam current state where you stand so

44:56 it's not necessary you have to start from zero you can do Gap assessment and based on that you can able to prioritize okay and this is the same thing we're doing we determining a desire outcome so let's say example the leadership company is there of ABC or aspirants identify the high level outcome they want to achieve and these outcomes are like including the Safeguard of customer data meeting compliance requirement and reduce the risk of data breach compliance requirement is gdpr so what aspirants did aspirants here the outcome is like they want to achieve the 100% outcome of compliance with gdpr they want to achieve the zero day vulnerability and they want to ensure the availability of a Services okay so that something is the desire outcome they are expecting now for that what we did is we defined the

45:41 security objectives okay security objectives that something is part of the function now when we're talking about the security objectives is like you know you're translating the outcome into the measurable security objective on one side you're saying you want to a the 100% compliance right so now you will Define your security object like implement the encryption okay deploy 24 into 7 sock conduct the monthly vulnerability assessment that is called Define the security objectives and then you will see what is the current they have okay so see here I want to my goal is I want a 100% compliance okay I want a zero day vulnerabilities to be achieved like I don't want I don't want to have any kind of vulnerability and I want to to ensure

46:27 uninterrupted services so that is my outcome based on the outcome I have create a security objectives like implement the encryption um um in you know deploy 24 into 7 sock okay doing a vulnerability management create a policies and everything that's a security objective but do we have currently and this is basically I'm doing a determine the current state so I will assess the current security posture to understand the gap between the existing and desired State and for that I I will do Gap assessment identify what they have and BAS that I will identify the and doing the risk assessment okay like no encryption is implemented security monitoring is manual and vulnerability assessments are performed once a year okay I will do the deep Deep Gap analysis so I will identify the gap between the current state and desire state for example the Gap number one is

47:14 no encryption so we required implementing a full disk encryption no 24 into 7 monitoring so we required setting up the out sort so and third is perform the uh in infrequent vulnerability testing so we require increasing of the frequency that is basically perform the Gap analysis between the current state and desire State and then I will develop the strategy to close the gap this is how the plan how to address the identify Gap so like encrypting a sensor data partner with third party increase the vulnerability scan frequency to monthly that something is developed the strategy to close the gap and then I will create a road map for that I will break down the strategy into actionable step like I will do research of encryption tools encrypt the sensor data onboard the sock provider or automate the vulnerability scanning and then finally I will Define and develop the program with the

48:00 governance policy like I will establish the isms Define the instant response procedures and develop the third party management policy and then I will manage a program with the help of metric your entire cism is around this area only okay the entire cism is around this area only so we talk about lot of time GRC governance risk management so governance is set of um uh process by which we set the policy and ensure with business objective in my previous section you have seen how the governance work then we have a risk management risk management is all about identifying risk and everything so that we can able to treat the risk reduce risk to an acceptable level and finally we have a compliance compliance to the legal regul Regulatory and organization standard so let's say example in the previous video

48:46 Same Same example I've said is uh company when when you join any company you create a process you're creating a policies that's part of governance if you want to run any country you need to create law law created by the ministers and that shows the good governance parents creating a law parents creating a rules for your kids kids that's a governance right but to follow the process it's not possible for me to do everything so I will do risk management so governance do the risk assessment to identify prioritize so that so that they can able to comply with the legal regulatory requirement now when you're talking about in the isaka they follow kobit and kobit differentiate governance with management okay now here before I move to that I want to discuss the CIT example so in

49:33 kit we have one thing called e d m okay and governance so and another thing is called as a p b r m now what is the meaning let me explain you so when I say EDM EDM is driven by governance governance mean corporate governance here and pbrm is by the management management is CIO and ceso So Co in CIT they actually segregate the thin land difference between the governance and management so in layman term you can say governance is all about evaluating the need of the stakeholder evaluate the need of

50:20 regulatory giving a directions to the CI and Cesar and CI CES based on the plan build run and monitor and what are the metrics we have we provide to the management so this is one thing you need to know from exam perspective what so governance is the one who set the goals and management is the one who focus on execution so as a cism context you need to understand the distin distinction between the governance and management so in layman term you can say governance is like a ex corporate governance management who run the show management is the one who manage that particular show CIU and all that okay that's a very important part now when you're going for the cism it's very important for you to know the rules so one thing you need to understand is

51:06 these rules board board of directors one thing you need to remember they are the ultimately accountable for anything whatever happening in the organization so any question talking about who is ultimately accountable for security answer is board and Executives remember that information security manager is the one who develop communicate and manage the strategy and policy he's the one who developed the policy he's the one who developed the strategy but board is the one who approv those policies because it's a conflict of interest third is called a data owner so every company has a business owner who bring business to the organization even when you're sending a email Men You're creating a document you are the data owner so data owner ensure data security policy align with the organization needs and legal requirement now there is one more thing

51:52 we called as a committee committee okay one is called as a committee and one committee you need to know from exam point of view which is called as security steering committee SSC security steering committee now the difference between the committee and the board or management is committee is temporary when we executing any project for that we create a committee committee is basically the combination of the representative from the boards and operation team so in the cism committee is very important because they do the joint so example like security manager creates a policy he submit the policy to the committee committee has the team of all people technical functional

52:37 business they will share their Viewpoint about the policy from all the vertical see one thing is that if they review and approve it's a very good policy if they approve the strategy it's a very good thing because we getting a Viewpoint from all the people so many organization from the security steering committee consisting of stakeholders from many of the organization business units Department functions and principal locations and they may have a variety of responsibilities okay so if they approving anything it's a good thing okay because they getting a Viewpoint for everything so that's something you need to know from exam point of view okay another important thing we have a data owner and we have a Data customer let me explain with the example so this is your airport okay so you carry your baggage and you're traveling from Delhi

53:24 to Goa so you tell the airline team traveling from Delhi to Goa and my bag has some fragile items so you are you are the one who own the bags so same like you are the data owner Airline team are the one who ask about what is in a fragile and all that and you would inform them so Airline team is the one who manage that baggage on behalf of you so they are the data custodian so same like in the company Security administrator backup administrators they are the one are the data custodian and they protect data based on a data owner data owner is the one who follow the policy that is how the entire company works works but when you're talking about implementing a security governance the most important factor which Drive the information security governance is culture culture is very important now what is an example you join one organization okay there is no culture of

54:11 reporting an incident you join one more company example where you can see everyone is reporting the security issues you join one company where you can see no one follow the policy seriously and there is a one company who follow pass security policy seriously that's called the culture culture is the foundation for any organization okay you have a best Security Solutions you have a best security policy but if there's no good culture they will not follow that so organization culture impact the effectiveness of information security especially in the area of Teamworks norms and communication so very important you need to understand the biggest parameter which impact Security's culture so as a CM context

54:56 cism professional must ensure the roles are clearly defined okay and the culture support information security initiative so if you get any questions talking about what is the most important support for information security initiatives the answer is culture because culture include your leadership support culture include the people and everything okay now let's move to the next part so as I said if you want to build information security governance in the organization the first step is create a strategy strategy is very high level okay let's example this year my strategy is I want to implement sock for 2024 I want to implement VAP in 2025 27,1 2025 so I I'm talking about the high level requirement okay that's something documented in the strategy and a good strategy is the one

55:41 which align with the business so we follow some principles okay so the purpose of strategy is to define the objectives Define the goals and road map one thing you need to remember okay and the key objectives of the information security strategy is strategic alignment risk management value delivery and resource optimization and as a CM candidate you should know this so when I say I'm implementing information security in the organization or I saying okay they this company has a good security governance okay good security governance how can you say you have a good security governance so outcome of a good security governance is or outcome of a good um you know strategy is that the first most important part of your strategy should be aligned with the

56:28 business objective so if they give you question is what is the primary objective of security strategy option a strategic alignment option b risk management option C value delivery and resource optimization by end of the day by achieving this you're achieving this only ultimately your information security strategy should be aligned with the business objective and for that what we have to do is we have to do risk management see on one side your business is saying that with the $2,000 you you have to protect everything a good strategy is the one which align with this requirement but for that the first thing we have to do risk management risk management is very important because with the limited cost you have to implement the security and by doing risk management I'm creating a value delivery I'm I'm I'm I'm ensuring

57:14 the security Investments benefit the business right and last we can able to do that with the help of optimization of resource so you can see that outcome is to align with business for that we do risk management and that create a value why because with the help of limited resource I can able to manage everything so outcome of a good security strategy is this four or five outcomes so a good strategy as I said a good strategy is the one which clearly communicates its value include the metrics for performance measurement and it should be aligned with the business see when you're creating a security strategy you have to also understand the legal Regulatory and contractual requirement okay so one thing is that compliance

58:00 compliance is nothing it's all about Act of abiding I will give example okay let's say example this is the office which is in India and I highly recommend you can check my one governance fundamental video which also give you a good visibility about the governance so let's say example I join as a ceso so we have office in India okay they're doing a support EU operation so they're doing a support in European Union One of company one of country they're supporting is Germany okay so they have a sales team in India so need your reply in the comment box if you are doing a business in Europe what is the primary privacy regulation you have to follow the answer

58:45 is gdpr so you need to follow gdpr in gdpr so many articles are there it is is it possible for you to follow all the Articles the answer is no okay and if you tell the sales team hey guys have to be follow gdpr they will basically run away from the company because in gdpr we have more than more than 25 30 articles but what happen is we appoint the DPO data privacy officer he will interpret the gdpi requirement and then he tell the ceso okay buddy we need to implement this and that controls so we implement this and that controls on the second floor like USB access is block camera is enabled no one carry a smart pH so by creating a policy creating a strategy this is part of information security

59:31 governance okay you implement the controls on the second floor by that you comply with the gdpr comply is nothing it is all about Act of abiding so if this is the company and you're saying you have a good governance how can you demonstrate you comply with certification you compliance with ISO you compliance with everything so that's called as an outcome of a good governance okay and ensure the governance with the help of security functions so compliance is all about Act of biding okay Privacy Law is there gdpr and everything it's very important the difference between privacy and secrecy is privacy deal with individual information secrecy deal with organization sometime when you're creating a strategy and all that you also need to consider third party management you have to contract so should be contract to third party and

1:00:17 contract should include data protection requirement Clauses and audit right one thing you need to remember whenever you're dealing with the vendor make sure service level need to be documented and write to audit Clause should be there so both option is there select service level because without service level you can't do audit is it clear so whenever you're dealing with third party vendors make sure in the contract at the service levels without service level it is difficult for you to ensure the Quality Security and everything regulatory standards we have to follow so as a cism context you need to understand is understanding regulatory impact is critical because based on regulation only you create a security strategy okay now let's say example is you need to implement the itions On the Border network but because of regulator you can't intercept the data so your regulat requirement impact the strategy so if

1:01:03 you get any question around what is the biggest impact the security strategy the answer is regulations because we follow regulations regulation will not follow us understood So based on information security strategy we create a policy and policies we have to do based on the risk assessment see any kind of an activity you want to do you do the policy first okay so policy is a foundation we'll discuss in the further slide what is policy okay so when you're building information security program so what is the first step you create information security strategy then you create a policy and then you create a program same like isms you know isms is the program right but the foundation of the program is isms policy as per the Clause five so your program include multiple things the first thing is called risk

1:01:50 assessment risk management program security policies awareness training all these things inent Management program all these are part of a information security program development but the

…