ISACA · CISM
Governance and culture
CISM · Lesson 1 of 20 · 3:25
YouTube loads only after you press play. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: the difference between governance and management, how the purpose and culture of the organization shape security, the parts of an information security governance framework, and how security governance fits into corporate governance, with the board and senior management. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- Stonebridge wants to know who should set the direction for information security, and monitor whether it is achieved. According to COBIT, which group is responsible for governance?
- At Stonebridge, employees follow security policies only when someone is watching, and rarely report suspicious emails. What should the security manager address first?
- Stonebridge’s board is considering the acquisition of a smaller energy retailer. When should information security be considered?