ISACA · CISM
Requirements and roles
CISM · Lesson 2 of 20 · 9:26
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: the three sources of security requirements (legal, regulatory, and contractual), how to follow a changing regulatory landscape, the security roles in the organization, from the board to data owners, and accountability with a RACI chart. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- Stonebridge accepts card payments on its customer portal, so it must follow PCI DSS. For Stonebridge, what kind of requirement is PCI DSS?
- Stonebridge’s billing team asks for access to customer payment data, for a new analyst. Who should approve the access?
- Two business units at Stonebridge disagree about which security projects should be funded first. Which body is best placed to resolve the conflict?