ISACA · CISM
Testing, metrics, and reporting
CISM · Lesson 14 of 20 · 1:38:35
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: how to test controls, security program metrics, dashboards for each audience, and reporting to senior leadership. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- Stonebridge’s auditors select 25 user accounts removed last year, and check that each one was removed within one day of the departure. What are they testing?
- Stonebridge’s monthly board report lists the number of firewall rules, scans run, and alerts handled. What is the main weakness of this report?
- A Stonebridge metric shows that the click rate in phishing simulations fell from 20% to 5% over a year. How should the security manager report it to the board?