ISACA · CISM
Awareness, training, and external services
CISM · Lesson 15 of 20 · 1:44:21
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: security awareness and training, measuring behavior, managing third parties, fourth and nth parties in the supply chain, and monitoring external services. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- 98% of Stonebridge’s employees completed their training, but they still click on phishing simulations as often as last year. What does this show?
- Stonebridge’s call center provider stores call recordings with a cloud company that Stonebridge has never heard of. What should Stonebridge’s contract require?
- A critical cloud provider refuses to share any audit report, and the contract has no right to audit. What should the security manager do first?