Certified Chief Information Security Officer (CCISO)

Certification for Cisco CCNA

Exam 200-301 Cisco Certified Network Associate – Objectives

Training Options

Online Training
Live in-class Instructor Led Training
Virtual Instructor Led Training
Blended with Labs

Course Advisor

Exam & Certification

Exam Description

There are three cognitive levels tested on the CCISO exam but only two tested on the EISM exam:

Level 1 – Knowledge: This cognitive level of questions is used to recall memorized facts. This is the most basic cognitive level rarely accepted on certifications as it merely recognizes the candidate’s ability to memorize information. It can be effectively used when asking for basic definitions, standards or any concrete fact. This level appears on both the CCISO and EISM exam.
Level 2 – Application: This cognitive level of questions is used to identify the candidate’s ability to understand the application of a given concept. It differs from Knowledge based questions in the sense that it requires the understanding and correct applicability of a given concept – not just the concept itself. This type of question often quires additional context before the actual question is provided in the stem. This level appears on both the CCISO and EISM exam.
Level 3 – Analysis: This cognitive level of questions is used to identify the candidate’s ability to identify and resolve a problem given a series of variables and context. Analysis questions differ greatly from Application based questions in the sense that they require not only the applicability of a concept but also how a concept, given certain constrain can be used to solve a problem. This level appears on the CCISO and not on the EISM exam.

Passing Score

In order to maintain the high integrity of our certifications exams, EC-Council Exams are provided in multiple forms (I.e. different question banks). Each form is carefully analyzed through beta testing with an appropriate sample group under the purview of a committee of subject matter experts that ensure that each of our exams not only has academic rigor but also has “real world” applicability. We also have a process to determine the difficulty rating of each question. The individual rating then contributes to an overall “Cut Score” for each exam form. To ensure each form has equal assessment standards, cut scores are set on a “per exam form” basis. Depending on which exam form is challenged, cut scores can range from 60% to 78%.

Exam Details

Number of Questions: 150

Test Duration: 2.5 Hours

Test Format: Multiple Choice

Test Delivery: ECC Exam Portal

Prerequisites

Minimum Requirements

In order to qualify to sit for the CCISO Exam without taking any training, candidates must have five years of experience in each of the 5 CCISO domains verified via the Exam Eligibility Application.

To sit for the exam after taking training, candidates must have five years of experience in three of the five CCISO Domains verified via the Exam Eligibility Application.

Waivers for the CCISO are available to Self-Study Candidates

Domain	Professional Certification Waivers	Education Waivers
1. Governance and Risk Management	CGEIT, CRISC 2 – years	Ph.D. Information Security – 3 years, MS Information Security Management, MS Information Security Engineering – 2 years, BS Information Security – 2 years
2. Information Security Controls, Compliance, and Audit Management	CISA, CISM – 2 years	Ph.D. Information Security – 3 years, MS Information Security Management, MS Information Security Engineering – 2 years, BS Information Security – 2 years
3. Security Program Management & Operations	PMP, ITIL, PM in IT Security – 2 years	Ph.D. Information Security – 3 years, MS Information Security or MS Project Management – 2 years, BS Information Security – 2 years
4. Information Security Core Competencies	CISSP, LPT, E\|DRP, CIPP, MBCP – 2 years	Ph.D. Information Security – 3 years, MS Information Security – 2 years, BS Information Security – 2 years
5. Strategic Planning, Finance, Procurement, and Vendor Management	None	CPA, MBA, M. Fin. – 3 years

Download Curriculum

Module1: Manage Azure identities and governance

Module2: Implement and manage storage

Module3: Deploy and manage Azure compute resources

Module4: Configure and manage virtual networking

Module5: Monitor and back up Azure resources

Get Started

Module1: Manage Azure identities and governance

Module2: Implement and manage storage

Module3: Deploy and manage Azure compute resources

Module4: Configure and manage virtual networking

Module5: Monitor and back up Azure resources

Certified Chief Information Security Officer (CCISO)

Overview

About the Program

EC-Council’s CCISO Program has certified leading information security professionals around the world. A core group of high-level information security executives, the CCISO Advisory Board, contributed by forming the foundation of the program and outlining the content that would be covered by the exam, body of knowledge, and training. Some members of the Board contributed as authors, others as exam writers, others as quality assurance checks, and still others as trainers. Each segment of the program was developed with the aspiring CISO in mind and looks to transfer the knowledge of seasoned professionals to the next generation in the areas that are most critical in the development and maintenance of a successful information security program.

The Certified CISO (CCISO) program is the first of its kind training and certification program aimed at producing top-level information security executives. The CCISO does not focus solely on technical knowledge but on the application of information security management principles from an executive management point of view. The program was developed by sitting CISOs for current and aspiring CISOs.

In order to sit for the CCISO exam and earn the certification, candidates must meet the basic CCISO requirements. Candidates who do not yet meet the CCISO requirements but are interested in information security management can pursue the EC-Council Information Security Management (EISM) certification.

Domain 1 - Governance and Risk Management

1. Define, Implement, Manage, and Maintain an Information Security Governance Program

1.1. Form of Business Organization
1.2. Industry
1.3. Organizational Maturity

2. Information Security Drivers

3. Establishing an information security management structure

3.1. Organizational Structure
3.2. Where does the CISO fit within the organizational structure
3.3. The Executive CISO
3.4. Nonexecutive CISO

4. Laws/Regulations/Standards as drivers of Organizational Policy/Standards/Procedures

5. Managing an enterprise information security compliance program

6. Introduction to Risk Management

3.1. Organizational Structure
3.2. Where does the CISO fit within the organizational structure
3.3. The Executive CISO
3.4. Nonexecutive CISO

Domain 2 - Information Security Controls, Compliance, and Audit Management

1. Information Security Controls

1.1. Identifying the Organization’s Information Security Needs
1.1.1. Identifying the Optimum Information Security Framework
1.1.2. Designing Security Controls
1.1.3. Control Lifecycle Management
1.1.4. Control Classification
1.1.5. Control Selection and Implementation
1.1.6. Control Catalog
1.1.7. Control Maturity
1.1.8. Monitoring Security Controls
1.1.9. Remediating Control Deficiencies
1.1.10. Maintaining Security Controls
1.1.11. Reporting Controls
1.1.12. Information Security Service Catalog

2. Compliance Management

2.1. Acts, Laws, and Statutes
2.1.1. FISMA
2.2. Regulations
2.2.1. GDPR
2.3. Standards
2.3.1. ASD—Information Security Manual
2.3.2. Basel III
2.3.3. FFIEC
2.3.4. ISO 00 Family of Standards
2.3.5. NERC-CIP
2.3.6. PCI DSS
2.3.7. NIST Special Publications
2.3.8. Statement on Standards for Attestation Engagements No. 16 (SSAE 16)

3. Guidelines, Good and Best Practices

3.1. CIS
3.1.1. OWASP

4. Audit Management

4.1. Audit Expectations and Outcomes
4.2. IS Audit Practices
4.2.1. ISO/IEC Audit Guidance
4.2.2. Internal versus External Audits
4.2.3. Partnering with the Audit Organization
4.2.4. Audit Process
4.2.5. General Audit Standards
4.2.6. Compliance-Based Audits
4.2.7. Risk-Based Audits
4.2.8. Managing and Protecting Audit Documentation
4.2.9. Performing an Audit
4.2.10. Evaluating Audit Results and Report
4.2.11. Remediating Audit Findings
4.2.12. Leverage GRC Software to Support Audits

5. Summary

1. Information Security Controls

1.1. Identifying the Organization’s Information Security Needs
1.1.1. Identifying the Optimum Information Security Framework
1.1.2. Designing Security Controls
1.1.3. Control Lifecycle Management
1.1.4. Control Classification
1.1.5. Control Selection and Implementation
1.1.6. Control Catalog
1.1.7. Control Maturity
1.1.8. Monitoring Security Controls
1.1.9. Remediating Control Deficiencies
1.1.10. Maintaining Security Controls
1.1.11. Reporting Controls
1.1.12. Information Security Service Catalog

2. Compliance Management

2.1. Acts, Laws, and Statutes
2.1.1. FISMA
2.2. Regulations
2.2.1. GDPR
2.3. Standards
2.3.1. ASD—Information Security Manual
2.3.2. Basel III
2.3.3. FFIEC
2.3.4. ISO 00 Family of Standards
2.3.5. NERC-CIP
2.3.6. PCI DSS
2.3.7. NIST Special Publications
2.3.8. Statement on Standards for Attestation Engagements No. 16 (SSAE 16)

3. Guidelines, Good and Best Practices

3.1. CIS
3.1.1. OWASP

4. Audit Management

4.1. Audit Expectations and Outcomes
4.2. IS Audit Practices
4.2.1. ISO/IEC Audit Guidance
4.2.2. Internal versus External Audits
4.2.3. Partnering with the Audit Organization
4.2.4. Audit Process
4.2.5. General Audit Standards
4.2.6. Compliance-Based Audits
4.2.7. Risk-Based Audits
4.2.8. Managing and Protecting Audit Documentation
4.2.9. Performing an Audit
4.2.10. Evaluating Audit Results and Report
4.2.11. Remediating Audit Findings
4.2.12. Leverage GRC Software to Support Audits

5. Summary

Domain 3 - Security Program Management & Operations

1. Program Management

2. Operations Management

2.1. Establishing and Operating a Security Operations (SecOps) Capability
2.2. Security Monitoring and Security Information and Event Management (SIEM)
2.3. Event Management
2.4. Incident Response Model
2.4.1. Developing Specific Incident Response Scenarios
2.5. Threat Management
2.6. Threat Intelligence
2.6.1. Information Sharing and Analysis Centers (ISAC)
2.7. Vulnerability Management
2.7.1. Vulnerability Assessments
2.7.2. Vulnerability Management in Practice
2.7.3. Penetration Testing
2.7.4. Security Testing Teams
2.7.5. Remediation
2.8. Threat Hunting

3. Summary

Domain 4 - Information Security Core Competencies

1. Access Control

1.1. Authentication, Authorization, and Auditing
1.2. Authentication
1.3. Authorization
1.4. Auditing
1.5. User Access Control Restrictions
1.6. User Access Behavior Management
1.7. Types of Access Control Models
1.8. Designing an Access Control Plan
1.9. Access Administration

2. Physical Security

2.1. Designing, Implementing, and Managing Physical Security Program
2.1.1. Physical Risk Assessment
2.2. Physical Location Considerations
2.3. Obstacles and Prevention
2.4. Secure Facility Design
2.4.1. Security Operations Center
2.4.2. Sensitive Compartmented Information Facility
2.4.3. Digital Forensics Lab
2.4.4. Datacenter
2.5. Preparing for Physical Security Audits

3. Network Security

3.1. Network Security Assessments and Planning
3.2. Network Security Architecture Challenges
3.3. Network Security Design
3.4. Network Standards, Protocols, and Controls
3.4.1. Network Security Standards
3.4.2. Protocols

4. Certified Chief

4.1.1. Network Security Controls
4.2. Wireless (Wi-Fi) Security
4.2.1. Wireless Risks
4.2.2. Wireless Controls
4.3. Voice over IP Security

5. Endpoint Protection

6. Application Security

6.1. Secure SDLC Model
6.2. Separation of Development, Test, and Production Environments
6.3. Application Security Testing Approaches
6.4. DevSecOps
6.5. Waterfall Methodology and Security
6.6. Agile Methodology and Security
6.7. Other Application Development Approaches
6.8. Application Hardening
6.9. Application Security Technologies
6.10. Version Control and Patch Management
6.11. Database Security
6.12. Database Hardening
6.13. Secure Coding Practices

7. Encryption Technologies

7.1. Encryption and Decryption
7.2. Cryptosystems
7.2.1. Blockchain
7.2.2. Digital Signatures and Certificates
7.2.3. PKI
7.2.4. Key Management
7.3. Hashing
7.4. Encryption Algorithms
7.5. Encryption Strategy Development
7.5.1. Determining Critical Data Location and Type
7.5.2. Deciding What to Encrypt
7.5.3. Determining Encryption Requirements
7.5.4. Selecting, Integrating, and Managing Encryption Technologies

8. Virtualization Security

8.1. Virtualization Overview
8.2. Virtualization Risks
8.3. Virtualization Security Concerns
8.4. Virtualization Security Controls
8.5. Virtualization Security Reference Model

9. Cloud Computing Security

9.1. Overview of Cloud Computing
9.2. Security and Resiliency Cloud Services
9.3. Cloud Security Concerns
9.4. Cloud Security Controls
9.5. Cloud Computing Protection Considerations

10. Transformative Technologies

10.1. Artificial Intelligence
10.2. Augmented Reality
10.3. Autonomous SOC
10.4. Dynamic Deception
10.5. Software-Defined Cybersecurity

11. Summary

Domain 5 - Strategic Planning, Finance, Procurement and Vendor Management

1. Strategic Planning

1.1. Understanding the Organization
1.1.1. Understanding the Business Structure
1.1.2. Determining and Aligning Business and Information Security Goals
1.1.3. Identifying Key Sponsors, Stakeholders, and Influencers
1.1.4. Understanding Organizational Financials
1.2. Creating an Information Security Strategic Plan
1.2.1. Strategic Planning Basics
1.2.2. Alignment to Organizational Strategy and Goals
1.2.3. Defining Tactical Short, Medium, and Long-Term Information Security Goals
1.2.4. Information Security Strategy Communication
1.2.5. Creating a Culture of Security

2. Designing, Developing, and Maintaining an Enterprise Information Security Program

2.1. Ensuring a Sound Program Foundation
2.2. Architectural Views
2.3. Creating Measurements and Metrics
2.4. Balanced Scorecard
2.5. Continuous Monitoring and Reporting Outcomes
2.6. Continuous Improvement
2.7. Information Technology Infrastructure Library (ITIL) Continual Service Improvement (CSI)

3. Understanding the Enterprise Architecture (EA)

3.1. EA Types
3.1.1. The Zachman Framework
3.1.2. The Open Group Architecture Framework (TOGAF)
3.1.3. Sherwood Applied Business Security Architecture (SABSA)
3.1.4. Federal Enterprise Architecture Framework (FEAF)

4. Finance

4.1. Understanding Security Program Funding
4.2. Analyzing, Forecasting, and Developing a Security Budget
4.2.1. Resource Requirements
4.2.2. Define Financial Metrics
4.2.3. Technology Refresh
4.2.4. New Project Funding
4.2.5. Contingency Funding
4.3. Managing the information Security Budget
4.3.1. Obtain Financial Resources
4.3.2. Allocate Financial Resources
4.3.3. Monitor and Oversight of Information Security Budget
4.3.4. Report Metrics to Sponsors and Stakeholders
4.3.5. Balancing the Information Security Budget

5. Procurement

5.1. Procurement Program Terms and Concepts
5.1.1. Statement of Objectives (SOO)
5.1.2. Statement of Work (SOW)
5.1.3. Total Cost of Ownership (TCO)
5.1.4. Request for Information (RFI)
5.1.5. Request for Proposal (RFP)
5.1.6. Master Service Agreement (MSA)
5.1.7. Service Level Agreement (SLA)
5.1.8. Terms and Conditions (T&C)
5.2. Understanding the Organization’s Procurement Program
5.2.1. Internal Policies, Processes, and Requirements
5.2.2. External or Regulatory Requirements
5.2.3. Local Versus Global Requirements
5.3. Procurement Risk Management
5.3.1. Standard Contract Language

6. Vendor Management

6.1. Understanding the Organization’s Acquisition Policies and Procedures
6.1.1. Procurement Life cycle
6.2. Applying Cost-Benefit Analysis (CBA) During the Procurement Process5
6.3. Vendor Management Policies
6.4. Contract Administration Policies
6.4.1. Service and Contract Delivery Metrics
6.4.2. Contract Delivery Reporting
6.4.3. Change Requests
6.4.4. Contract Renewal
6.4.5. Contract Closure
6.5. Delivery Assurance
6.5.1. Validation of Meeting Contractual Requirements
6.5.2. Formal Delivery Audits
6.5.3. Periodic Random Delivery Audits
6.5.4. Third-Party Attestation Services (TPRM)

7. Summary

Certified Chief Information Security Officer (CCISO)