ISACA · CISM
Policies, standards, procedures, and guidelines
CISM · Lesson 11 of 20 · 1:21:04
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: the hierarchy of security documents, what makes a good policy, how policies are written and approved, and how they are communicated and maintained. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- Stonebridge’s access control policy lists the exact password settings for each system, and must be rewritten every time a system changes. What is the best fix?
- A Stonebridge manager writes a document that recommends, but does not require, a way to choose strong passphrases. What type of document is this?
- An audit finds that most Stonebridge employees have never opened the acceptable use policy, which was approved two years ago. What should the security manager do first?