1. First Principles of Information Security Management

Before any domain content, you need the lens CISM views every question through. This phase builds two ideas that everything else in this guide rests on: what security is actually protecting (the CIA triad), and whose job it is to make the trade-offs (the manager, not the engineer).