Table Of ContentAll-In-One/ CISM® Certifed Inormation Security Manager All-in-One Exam Guide / Gregory / 831-9 / FM
Blind Folio:i
ALL IN ONE
CISM
®
Certified Information
Security Manager
E X A M G U I D E
Second Edition
00-FM.indd 1 25/08/22 4:10 PM
All-In-One/ CISM® Certifed Inormation Security Manager All-in-One Exam Guide / Gregory / 831-9 / FM
Blind Folio:ii
This page intentionally left blank
00-FM.indd 2 25/08/22 4:10 PM
All-In-One/ CISM® Certifed Inormation Security Manager All-in-One Exam Guide / Gregory / 831-9 / FM
Blind Folio:iii
ALL IN ONE
CISM
®
Certified Information
Security Manager
E X A M G U I D E
Second Edition
Peter H. Gregory
New York Chicago San Francisco
Athens London Madrid Mexico City
Milan New Delhi Singapore Sydney Toronto
McGraw Hill is an independent entity rom ISACA® and is not afliated with ISACA in any manner. Tis study/training guide and/ormaterial
is not sponsored by, endorsed by, or afliated with ISACA in any manner. Tis publication and accompanying media may be used in assisting
students to prepare or Te CISM exam. Neither ISACA nor McGraw Hill warrants that use o this publication and accompanying media will
ensure passing any exam.
00-FM.indd 3 25/08/22 4:10 PM
Copyright © 2023 by McGraw Hill. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no
part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system,
without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and
executed in a computer system, but they may not be reproduced for publication.
ISBN: 978-1-26-426832-0
MHID: 1-26-426832-7
The material in this eBook also appears in the print version of this title: ISBN: 978-1-26-426831-3,
MHID: 1-26-426831-9.
eBook conversion by codeMantra
Version 1.0
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trade-
marked name, we use names in an editorial fashion only, and to the benet of the trademark owner, with no intention of infringe-
ment of the trademark. Where such designations appear in this book, they have been printed with initial caps.
McGraw Hill eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate
training programs. To contact a representative, please visit the Contact Us page at www.mhprofessional.com.
Information has been obtained by McGraw Hill from sources believed to be reliable. However, because of the possibility of hu-
man or mechanical error by our sources, McGraw Hill, or others, McGraw Hill does not guarantee the accuracy, adequacy, or
completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such
information.
TERMS OF USE
This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work
is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy ofthe
work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit,
distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent.You
may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to
use the work may be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES
OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED
FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK
VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, IN-
CLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICU-
LAR PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work
will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its
licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or forany
damages resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through
the work. Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special,
punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been
advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such
claim or cause arises in contract, tort or otherwise.
All-In-One/ CISM® Certifed Inormation Security Manager All-in-One Exam Guide / Gregory / 831-9 / FM
Blind Folio:v
o Rebekah, the love o my lie.
00-FM.indd 5 25/08/22 4:10 PM
All-In-One/ CISM® Certifed Inormation Security Manager All-in-One Exam Guide / Gregory / 831-9 / FM
Blind Folio:vi
This page intentionally left blank
00-FM.indd 6 25/08/22 4:10 PM
All-In-One/ CISM® Certifed Inormation Security Manager All-in-One Exam Guide / Gregory / 831-9 / FM
Blind Folio:vii
ABOUT THE AUTHOR
Peter H. Gregory, CISM, CISA, CRISC, CDPSE, CISSP, CIPM, DRCE, CCSK,
is a 30-year career technologist and a security leader in a regional telecommunications
company. He has been developing and managing inormation security management
programs since 2002 and has been leading the development and testing o secure I
environments since 1990. Peter has also spent many years as a sotware engineer and
architect, systems engineer, network engineer, and security engineer.
Peter is the author o more than 50 books about inormation security and technology,
includingSolaris Security, CIPM Certified Information Privacy Manager All-in-One Exam
Guide, and CISA Certified Information Systems Auditor All-in-One Exam Guide. He has
spoken at numerous industry conerences, including RSA, Interop, (ISC)² Security
Congress, ISACA CACS, SecureWorld Expo, West Coast Security Forum, IP3, Source
Conerence, Society or Inormation Management, the Washington echnology Industry
Association, and InraGard. Interviews o Peter appear in SC Magazine, U.S. News &
World Report, CNET News, SearchSecurity, Information Security Magazine, CIO, The
Seattle Times,andForbes.
Peter serves on advisory boards or cybersecurity education programs at the University
o Washington and the University o South Florida. He was the lead instructor or nine
years in the University o Washington certiicate program in applied cybersecurity, a
ormer board member o the Washington State chapter o InraGard, and a ounding
member o the Paciic CISO Forum. He is a 2008 graduate o the FBI Citizens’ Academy
and a member o the FBI Citizens’ Academy Alumni Association. Peter is an executive
member o the CyberEdBoard and the Forbes echnology Council.
Peter resides with his amily in Washington state and can be ound online at
www.peterhgregory.com.
About the Technical Editor
Jay Burke, CISSP, CISM, RBLP-, is a highly accomplished inormation security
proessional with more than 20 years o operational and executive experience across a
variety o industries.
Jay has worked with customers o dierent sizes and types to build, enhance, and
manage best-in-class cybersecurity programs. As an executive-level security proessional, he
has led detailed maturity assessments and acilitated executive workshops to assist CISOs
in maturing their cybersecurity programs. His practical experience includes engagements
addressing strategic consulting, project management, regulatory compliance (Sarbanes–
Oxley, PCI, NERC CIP, HIPAA, SOC 1 and SOC 2), and cybersecurity program devel-
opment leveraging ISO 27001/2, NIS 800-53, Cloud Security Alliance CCM, Shared
Assessments SIG, and Uniied Compliance Framework.
00-FM.indd 7 25/08/22 4:10 PM
All-In-One/ CISM® Certifed Inormation Security Manager All-in-One Exam Guide / Gregory / 831-9 / FM
Blind Folio:viii
Jay currently serves as the strategic service manager or enable, helping customers
gain visibility o cyber risk by leveraging the enable Cyber Exposure platorm while also
providing the executive suite and board o directors with insight to ocus on the issues
that matter most and make better strategic decisions. Additionally, Jay is a partner at Sage
Advisory, LLC, which helps young proessionals ind their voice in the workplace and
supports the SMB market in the cybersecurity space.
Disclaimer
None o the inormation in this book relects the security posture or practices o any
current or ormer employer or client.
00-FM.indd 8 25/08/22 4:10 PM
