C CISO- Certified Chief Information Security Officer

Duration

4 days

Overview

Certification: C|CISO Certified Chief Information Security Officer

(1 year exam voucher-redeem option)

The globally renowned Chief Certified Information Security Officer (C|CISO) program, spearheaded by EC-Council, has truly revolutionized the capabilities of senior information security professionals worldwide. With unwavering dedication, ECCouncil harnessed the collective wisdom of a select group of esteemed senior information security executives within our esteemed C|CISO Advisory Board. This exceptional panel of seasoned professionals meticulously crafted the program’s bedrock, delineating the comprehensive content encapsulated in the C|CISO exam, the body of knowledge, and the training program. Through their invaluable expertise, EC-Council has empowered countless CISOs to excel in the realm of information security.

Members of the Board contributed as authors, exam writers, and instructors. They also provided continuous quality assurance through periodic materials reviews. Each segment of the C|CISO Program was developed in order to move a security professional’s career into the realm of executive leadership.

Through the C|CISO program, EC-Council will transfer the knowledge of seasoned professionals to you, the next generation of leadership, by focusing on the most critical competencies required to develop and maintain a successful information security portfolio. The C|CISO program is a first-of-its-kind training and certification course that aims to produce cybersecurity executives of the highest caliber and ethics. The C|CISO curriculum—developed by seasoned CISOs for current and aspiring CISOs—takes an executive management viewpoint that incorporates both information security management principles and general technical knowledge.

Professional experience is required for entry into this certification program. Candidates must meet the basic C|CISO requirements in order to take the certification examination.

Target Audience

The C|CISO certification is designed for information security professionals who want to advance their careers as a CISO or other executive-level security career path. In the C|CISO program, cybersecurity leaders hone their knowledge and learn how to integrate information security initiatives with needs of the business, aligning to the critical goals and objectives of an organization. Existing CISOs are also encouraged to participate in this program to strengthen their security program knowledge, understand current technology principles, and sharpen their business acumen.

C|CISO Certification Exam Eligibility

To take the C|CISO examination, candidates must provide proof that they have 5 years of experience in at least 3 of the 5 domains. They can take the exam without additional training if they have 5 years of experience in 5 of the C|CISO domains. If they have less than 5 years in 5 domains, but 5 or more years in 3 domains, they are required to take the training to qualify for the exam.

Experience waivers are available for some industry-accepted credentials and higher education within the field of information security. Waivers can be used for a maximum of 3 years of experience for each domain. Please see the chart (below) for additional information.

Upon passing the C|CISO exam, candidates will receive their C|CISO certificate and associated community privileges. The C|CISO certification is valid for 3 years from the date of issuance. After 3 years, members must adhere to the certification renewal policy as outlined in the ECCouncil Continuing Education (ECE) requirements.

Candidates who do not meet 5 years of experience in 3 of the C|CISO domains, but have 2 or more years of experience in at least 1 domain (or currently hold any one of the CISSP, CISM, CISA certifications) can participate in the Associate C|CISO program.

Candidates participating in the Associate C|CISO will have the opportunity to attend the same training as our C|CISO candidates, and learn the job requirements of a security executive so they can plan their careers to meet their career goals of security industry leadership.

C|CISO training is mandatory for all Associate C|CISO candidates prior to taking the Associate C|CISO examination.

C|CISO Exam Details

Associate C|CISO Exam Details

Topics Covered in C|CISO

The five C|CISO domains bring together the components required for a C-level information security position. The C|CISO curriculum combines security risk management, controls, audit management, security program management and operations, governance, information security core concepts, strategic planning, finance, and vendor management—all of which are vital for leading a highly successful information security program.

The five C|CISO domains align with the NICE Workforce Framework for Cybersecurity, a national resource that categorizes and describes cybersecurity work and roles, including common job duties and skills needed to perform specific tasks. In addition to outlining 33 specialty areas and 52 work roles, the NICE Framework defines seven highly important cybersecurity functions:

Course Outline

Domain 1 Governance and Risk Management

• 1. Define, Implement, Manage, and Maintain an Information Security Governance Program

1.1. Form of Business Organization

1.2. Industry

1.3. Organizational Maturity

• 2. Information Security Drivers
• 3. Establishing an information security management structure

3.1. Organizational Structure

3.2. Where does the CISO fit within the organizational structure

3.3. The Executive CISO

3.4. Nonexecutive CISO

• 4. Laws/Regulations/Standards as drivers of Organizational Policy/Standards/Procedures
• 5. Managing an enterprise information security compliance program

5.1. Security Policy

5.1.1. Necessity of a Security Policy

5.1.2. Security Policy Challenges

5.2. Policy Content

5.2.1. Types of Policies

5.2.2. Policy Implementation

5.3. Reporting Structure

5.4. Standards and best practices

5.5. Leadership and Ethics

5.6. EC-Council Code of Ethics

• 6. Introduction to Risk Management

Domain 2: Information Security Controls, Compliance, and Audit Management

• 1. Information Security Controls

1.1. Identifying the Organization’s Information Security Needs

1.1.1. Identifying the Optimum Information Security Framework

1.1.2. Designing Security Controls

1.1.3. Control Lifecycle Management

1.1.4. Control Classification

1.1.5. Control Selection and Implementation

1.1.6. Control Catalog

1.1.7. Control Maturity

1.1.8. Monitoring Security Controls

1.1.9. Remediating Control Deficiencies

1.1.10. Maintaining Security Controls

1.1.11. Reporting Controls

1.1.12. Information Security Service Catalog

• 2. Compliance Management

2.1. Acts, Laws, and Statutes

2.1.1. FISMA

2.2. Regulations

2.2.1. GDPR

2.3. Standards

2.3.1. ASD—Information Security Manual

2.3.2. Basel III

2.3.3. FFIEC

2.3.4. ISO 00 Family of Standards

2.3.5. NERC-CIP

2.3.6. PCI DSS

2.3.7. NIST Special Publications

2.3.8. Statement on Standards for Attestation Engagements No. 16 (SSAE 16)

• 3. Guidelines, Good and Best Practices

3.1. CIS

3.1.1. OWASP

• 4. Audit Management

4.1. Audit Expectations and Outcomes

4.2. IS Audit Practices

4.2.1. ISO/IEC Audit Guidance

4.2.2. Internal versus External Audits

4.2.3. Partnering with the Audit Organization

4.2.4. Audit Process

4.2.5. General Audit Standards

4.2.6. Compliance-Based Audits

4.2.7. Risk-Based Audits

4.2.8. Managing and Protecting Audit Documentation

4.2.9. Performing an Audit

4.2.10. Evaluating Audit Results and Report

4.2.11. Remediating Audit Findings

4.2.12. Leverage GRC Software to Support Audits

• 5. Summary

Domain 3: Security Program Management & Operations

• 1. Program Management

1.1. Defining a Security Charter, Objectives, Requirements, Stakeholders, and Strategies

1.1.1. Security Program Charter

1.1.2. Security Program Objectives

1.1.3. Security Program Requirements

1.1.4. Security Program Stakeholders

1.1.5. Security Program Strategy Development

1.2. Executing an Information Security Program

1.3. Defining and Developing, Managing and Monitoring the Information Security Program

1.3.1. Defining an Information Security Program Budget

1.3.2. Developing an Information Security Program Budget

1.3.3. Managing an Information Security Program Budget

1.3.4. Monitoring an Information Security Program Budget

1.4. Defining and Developing Information Security Program Staffing Requirements

1.5. Managing the People of a Security Program

1.5.1. Resolving Personnel and Teamwork Issues

1.5.2. Managing Training and Certification of Security Team Members

1.5.3. Clearly Defined Career Path

1.5.4. Designing and Implementing a User Awareness Program

1.6. Managing the Architecture and Roadmap of the Security Program

1.6.1. Information Security Program Architecture

1.6.2. Information Security Program Roadmap

1.7. Program Management and Governance

1.7.1. Understanding Project Management Practices

1.7.2. Identifying and Managing Project Stakeholders

1.7.3. Measuring the Effectives of Projects

1.8. Business Continuity Management (BCM) and Disaster Recovery Planning (DRP)

1.9. Data Backup and Recovery

1.10. Backup Strategy

1.11. ISO BCM Standards

1.11.1. Business Continuity Management (BCM)

1.11.2. Disaster Recovery Planning (DRP)

1.12. Continuity of Security Operations

1.12.1. Integrating the Confidentiality, Integrity and Availability (CIA) Model

1.13. BCM Plan Testing

1.14. DRP Testing

1.15. Contingency Planning, Operations, and Testing Programs to Mitigate Risk and Meet Service Level Agreements (SLAs)

1.16. Computer Incident Response

1.16.1. Incident Response Tools

1.16.2. Incident Response Management

1.16.3. Incident Response Communications

1.16.4. Post-Incident Analysis

1.16.5. Testing Incident Response Procedures

1.17. Digital Forensics

1.17.1. Crisis Management

1.17.2. Digital Forensics Life Cycle

• 2. Operations Management

2.1. Establishing and Operating a Security Operations (SecOps) Capability

2.2. Security Monitoring and Security Information and Event Management (SIEM)

2.3. Event Management

2.4. Incident Response Model

2.4.1. Developing Specific Incident Response Scenarios

2.5. Threat Management

2.6. Threat Intelligence

2.6.1. Information Sharing and Analysis Centers (ISAC)

2.7. Vulnerability Management

2.7.1. Vulnerability Assessments

2.7.2. Vulnerability Management in Practice

2.7.3. Penetration Testing

2.7.4. Security Testing Teams

2.7.5. Remediation

2.8. Threat Hunting

• 3. Summary

Domain 4: Information Security Core Competencies

• 1. Access Control

1.1. Authentication, Authorization, and Auditing

1.2. Authentication

1.3. Authorization

1.4. Auditing

1.5. User Access Control Restrictions

1.6. User Access Behavior Management

1.7. Types of Access Control Models

1.8. Designing an Access Control Plan

1.9. Access Administration

• 2. Physical Security

2.1. Designing, Implementing, and Managing Physical Security Program

2.1.1. Physical Risk Assessment

2.2. Physical Location Considerations

2.3. Obstacles and Prevention

2.4. Secure Facility Design

2.4.1. Security Operations Center

2.4.2. Sensitive Compartmented Information Facility

2.4.3. Digital Forensics Lab

2.4.4. Datacenter

2.5. Preparing for Physical Security Audits

• 3. Network Security

3.1. Network Security Assessments and Planning

3.2. Network Security Architecture Challenges

3.3. Network Security Design

3.4. Network Standards, Protocols, and Controls

3.4.1. Network Security Standards

3.4.2. Protocols

• 4. Certified Chief

4.1.1. Network Security Controls

4.2. Wireless (Wi-Fi) Security

4.2.1. Wireless Risks

4.2.2. Wireless Controls

4.3. Voice over IP Security

• 5. Endpoint Protection

5.1. Endpoint Threats

5.2. Endpoint Vulnerabilities

5.3. End User Security Awareness

5.4. Endpoint Device Hardening

5.5. Endpoint Device Logging

5.6. Mobile Device Security

5.6.1. Mobile Device Risks

5.6.2. Mobile Device Security Controls

5.7. Internet of Things Security (IoT)

5.7.1. Protecting IoT Devices

• 6. Application Security

6.1. Secure SDLC Model

6.2. Separation of Development, Test, and Production Environments

6.3. Application Security Testing Approaches

6.4. DevSecOps

6.5. Waterfall Methodology and Security

6.6. Agile Methodology and Security

6.7. Other Application Development Approaches

6.8. Application Hardening

6.9. Application Security Technologies

6.10. Version Control and Patch Management

6.11. Database Security

6.12. Database Hardening

6.13. Secure Coding Practices

• 7. Encryption Technologies

7.1. Encryption and Decryption

7.2. Cryptosystems

7.2.1. Blockchain

7.2.2. Digital Signatures and Certificates

7.2.3. PKI

7.2.4. Key Management

7.3. Hashing

7.4. Encryption Algorithms

7.5. Encryption Strategy Development

7.5.1. Determining Critical Data Location and Type

7.5.2. Deciding What to Encrypt

7.5.3. Determining Encryption Requirements

7.5.4. Selecting, Integrating, and Managing Encryption Technologies

• 8. Virtualization Security

8.1. Virtualization Overview

8.2. Virtualization Risks

8.3. Virtualization Security Concerns

8.4. Virtualization Security Controls

8.5. Virtualization Security Reference Model

• 9. Cloud Computing Security

9.1. Overview of Cloud Computing

9.2. Security and Resiliency Cloud Services

9.3. Cloud Security Concerns

9.4. Cloud Security Controls

9.5. Cloud Computing Protection Considerations

• 10. Transformative Technologies

10.1. Artificial Intelligence

10.2. Augmented Reality

10.3. Autonomous SOC

10.4. Dynamic Deception

10.5. Software-Defined Cybersecurity

• 11. Summary

Domain 5: Strategic Planning, Finance, Procurement and Vendor Management

• 1. Strategic Planning

1.1. Understanding the Organization

1.1.1. Understanding the Business Structure

1.1.2. Determining and Aligning Business and Information Security Goals

1.1.3. Identifying Key Sponsors, Stakeholders, and Influencers

1.1.4. Understanding Organizational Financials

1.2. Creating an Information Security Strategic Plan

1.2.1. Strategic Planning Basics

1.2.2. Alignment to Organizational Strategy and Goals

1.2.3. Defining Tactical Short, Medium, and Long-Term Information Security Goals

1.2.4. Information Security Strategy Communication

1.2.5. Creating a Culture of Security

• 2. Designing, Developing, and Maintaining an Enterprise Information Security Program

2.1. Ensuring a Sound Program Foundation

2.2. Architectural Views

2.3. Creating Measurements and Metrics

2.4. Balanced Scorecard

2.5. Continuous Monitoring and Reporting Outcomes

2.6. Continuous Improvement

2.7. Information Technology Infrastructure Library (ITIL) Continual Service Improvement (CSI)

• 3. Understanding the Enterprise Architecture (EA)

3.1. EA Types

3.1.1. The Zachman Framework

3.1.2. The Open Group Architecture Framework (TOGAF)

3.1.3. Sherwood Applied Business Security Architecture (SABSA)

3.1.4. Federal Enterprise Architecture Framework (FEAF)

• 4. Finance

4.1. Understanding Security Program Funding

4.2. Analyzing, Forecasting, and Developing a Security Budget

4.2.1. Resource Requirements

4.2.2. Define Financial Metrics

4.2.3. Technology Refresh

4.2.4. New Project Funding

4.2.5. Contingency Funding

4.3. Managing the information Security Budget

4.3.1. Obtain Financial Resources

4.3.2. Allocate Financial Resources

4.3.3. Monitor and Oversight of Information Security Budget

4.3.4. Report Metrics to Sponsors and Stakeholders

4.3.5. Balancing the Information Security Budget

• 5. Procurement

5.1. Procurement Program Terms and Concepts

5.1.1. Statement of Objectives (SOO)

5.1.2. Statement of Work (SOW)

5.1.3. Total Cost of Ownership (TCO)

5.1.4. Request for Information (RFI)

5.1.5. Request for Proposal (RFP)

5.1.6. Master Service Agreement (MSA)

5.1.7. Service Level Agreement (SLA)

5.1.8. Terms and Conditions (T&C)

5.2. Understanding the Organization’s Procurement Program

5.2.1. Internal Policies, Processes, and Requirements

5.2.2. External or Regulatory Requirements

5.2.3. Local Versus Global Requirements

5.3. Procurement Risk Management

5.3.1. Standard Contract Language

• 6. Vendor Management

6.1. Understanding the Organization’s Acquisition Policies and Procedures

6.1.1. Procurement Life cycle

6.2. Applying Cost-Benefit Analysis (CBA) During the Procurement Process5

6.3. Vendor Management Policies

6.4. Contract Administration Policies

6.4.1. Service and Contract Delivery Metrics

6.4.2. Contract Delivery Reporting

6.4.3. Change Requests

6.4.4. Contract Renewal

6.4.5. Contract Closure

6.5. Delivery Assurance

6.5.1. Validation of Meeting Contractual Requirements

6.5.2. Formal Delivery Audits

6.5.3. Periodic Random Delivery Audits

6.5.4. Third-Party Attestation Services (TPRM)

• 7. Summary

Programme scope, delivery arrangements and suitability are confirmed during enquiry.