Introduction to establishing and maintaining an information security governance framework and supporting processes. This module covers setting the foundation for a security program: aligning security strategy with business objectives, understanding organizational culture and legal/regulatory requirements, defining security policies, standards and procedures, and establishing governance metrics and reporting. By the end of Domain 1, you’ll be able to develop high-level security strategies and governance structures that provide oversight and direction for enterprise security

Deep dive into risk management practices. You will learn how to identify information assets and evaluate associated risks, threats, and vulnerabilities. Topics include conducting risk assessments, performing risk analysis and impact evaluations, determining risk appetite, and recommending risk treatment options (mitigation, acceptance, transference, avoidance). We also discuss implementing controls to mitigate risk and ongoing risk monitoring and reporting to stakeholders. This domain ensures you can build and run a risk management program to prioritize and address security risks systematically.

This is the largest domain, focusing on building and managing the information security program itself. You’ll learn how to create a security program roadmap, design security architecture (tools, solutions, and processes) to protect the organization, and implement security controls across various domains (access control, network security, application security, etc.). The module covers resource management, developing security teams, training and awareness programs, and integration of security into business processes. We emphasize management tasks like control monitoring, performance evaluation, and reporting the effectiveness of the security program. After this domain, you will be capable of running an enterprise security program end-to-end – from design through execution and improvement.

The final domain prepares you to establish and maintain incident response capabilities. Key topics include incident response planning (preparing policies and procedures for incident handling), detection and triage of security events, incident containment strategies, eradication and recovery techniques, and post-incident activities like forensic analysis and lessons learned . Business continuity (BCP) and disaster recovery (DRP) planning are also discussed as they relate to incident management and organizational resilience. By mastering Domain 4, you’ll be ready to lead the response to security breaches or disruptions, minimizing damage and recovering operations in line with business requirements.