Certified Chief Information Security Officer (CCISO) Training Course

Domain 1: Governance and Risk Management

1. Define, Implement, Manage, and Maintain an Information Security Governance Program for Government

• 1.1. Form of Business Organization
• 1.2. Industry
• 1.3. Organizational Maturity

2. Information Security Drivers for Government

3. Establishing an Information Security Management Structure for Government

• 3.1. Organizational Structure
• 3.2. Role of the CISO within the Organizational Structure
• 3.3. The Executive CISO
• 3.4. Non-Executive CISO

4. Laws, Regulations, and Standards as Drivers of Organizational Policy, Standards, and Procedures for Government

5. Managing an Enterprise Information Security Compliance Program for Government

• 5.1. Security Policy
• 5.1.1. Necessity of a Security Policy for Government
• 5.1.2. Challenges in Implementing a Security Policy for Government
• 5.2. Policy Content for Government
• 5.2.1. Types of Policies for Government
• 5.2.2. Implementation of Security Policies for Government
• 5.3. Reporting Structure for Government
• 5.4. Standards and Best Practices for Government
• 5.5. Leadership and Ethics in Government
• 5.6. EC-Council Code of Ethics for Government

6. Introduction to Risk Management for Government

• 3.1. Organizational Structure for Government
• 3.2. Role of the CISO within the Organizational Structure for Government
• 3.3. The Executive CISO in Government
• 3.4. Non-Executive CISO in Government

Domain 2: Information Security Controls, Compliance, and Audit Management for Government

1. Information Security Controls for Government

• 1.1. Identifying the Organization’s Information Security Needs for Government
• 1.1.1. Identifying the Optimum Information Security Framework for Government
• 1.1.2. Designing Security Controls for Government
• 1.1.3. Control Lifecycle Management for Government
• 1.1.4. Control Classification for Government
• 1.1.5. Control Selection and Implementation for Government
• 1.1.6. Control Catalog for Government
• 1.1.7. Control Maturity for Government
• 1.1.8. Monitoring Security Controls for Government
• 1.1.9. Remediating Control Deficiencies for Government
• 1.1.10. Maintaining Security Controls for Government
• 1.1.11. Reporting Controls for Government
• 1.1.12. Information Security Service Catalog for Government

2. Compliance Management for Government

• 2.1. Acts, Laws, and Statutes for Government
• 2.1.1. Federal Information Security Modernization Act (FISMA)
• 2.2. Regulations for Government
• 2.2.1. General Data Protection Regulation (GDPR)
• 2.3. Standards for Government
• 2.3.1. Australian Signals Directorate—Information Security Manual (ASD-ISM)
• 2.3.2. Basel III
• 2.3.3. Federal Financial Institutions Examination Council (FFIEC)
• 2.3.4. ISO 27000 Family of Standards for Government
• 2.3.5. North American Electric Reliability Corporation—Critical Infrastructure Protection (NERC-CIP)
• 2.3.6. Payment Card Industry Data Security Standard (PCI DSS) for Government
• 2.3.7. National Institute of Standards and Technology Special Publications (NIST SPs) for Government
• 2.3.8. Statement on Standards for Attestation Engagements No. 16 (SSAE 16) for Government

3. Guidelines, Good Practices, and Best Practices for Government

• 3.1. Center for Internet Security (CIS)
• 3.1.1. Open Web Application Security Project (OWASP)

4. Audit Management for Government

• 4.1. Audit Expectations and Outcomes for Government
• 4.2. Information Systems Audit Practices for Government
• 4.2.1. ISO/IEC Audit Guidance for Government
• 4.2.2. Internal versus External Audits for Government
• 4.2.3. Partnering with the Audit Organization for Government
• 4.2.4. Audit Process for Government
• 4.2.5. General Audit Standards for Government
• 4.2.6. Compliance-Based Audits for Government
• 4.2.7. Risk-Based Audits for Government
• 4.2.8. Managing and Protecting Audit Documentation for Government
• 4.2.9. Performing an Audit for Government
• 4.2.10. Evaluating Audit Results and Reporting for Government
• 4.2.11. Remediating Audit Findings for Government
• 4.2.12. Leveraging Governance, Risk, and Compliance (GRC) Software to Support Audits for Government

5. Summary for Government

Domain 3: Security Program Management & Operations for Government

1. Program Management for Government

• 1.1. Defining a Security Charter, Objectives, Requirements, Stakeholders, and Strategies for Government
• 1.1.1. Security Program Charter for Government
• 1.1.2. Security Program Objectives for Government
• 1.1.3. Security Program Requirements for Government
• 1.1.4. Security Program Stakeholders for Government
• 1.1.5. Security Program Strategy Development for Government
• 1.2. Executing an Information Security Program for Government
• 1.3. Defining, Developing, Managing, and Monitoring the Information Security Program for Government
• 1.3.1. Defining an Information Security Program Budget for Government
• 1.3.2. Developing an Information Security Program Budget for Government
• 1.3.3. Managing an Information Security Program Budget for Government
• 1.3.4. Monitoring an Information Security Program Budget for Government
• 1.4. Defining and Developing Information Security Program Staffing Requirements for Government
• 1.5. Managing the People of a Security Program for Government
• 1.5.1. Resolving Personnel and Teamwork Issues in Government
• 1.5.2. Managing Training and Certification of Security Team Members for Government
• 1.5.3. Clearly Defined Career Path for Government
• 1.5.4. Designing and Implementing a User Awareness Program for Government
• 1.6. Managing the Architecture and Roadmap of the Security Program for Government
• 1.6.1. Information Security Program Architecture for Government
• 1.6.2. Information Security Program Roadmap for Government
• 1.7. Program Management and Governance for Government
• 1.7.1. Understanding Project Management Practices for Government
• 1.7.2. Identifying and Managing Project Stakeholders in Government
• 1.7.3. Measuring the Effectiveness of Projects for Government
• 1.8. Business Continuity Management (BCM) and Disaster Recovery Planning (DRP) for Government
• 1.9. Data Backup and Recovery for Government
• 1.10. Backup Strategy for Government
• 1.11. ISO BCM Standards for Government
• 1.11.1. Business Continuity Management (BCM) for Government
• 1.11.2. Disaster Recovery Planning (DRP) for Government
• 1.12. Continuity of Security Operations for Government
• 1.12.1. Integrating the Confidentiality, Integrity, and Availability (CIA) Model in Government
• 1.13. BCM Plan Testing for Government
• 1.14. DRP Testing for Government
• 1.15. Contingency Planning, Operations, and Testing Programs to Mitigate Risk and Meet Service Level Agreements (SLAs) for Government
• 1.16. Computer Incident Response for Government
• 1.16.1. Incident Response Tools for Government
• 1.16.2. Incident Response Management for Government
• 1.16.3. Incident Response Communications for Government
• 1.16.4. Post-Incident Analysis for Government
• 1.16.5. Testing Incident Response Procedures for Government
• 1.17. Digital Forensics for Government
• 1.17.1. Crisis Management in Government
• 1.17.2. Digital Forensics Life Cycle for Government

2. Operations Management for Government

• 2.1. Establishing and Operating a Security Operations (SecOps) Capability for Government
• 2.2. Security Monitoring and Security Information and Event Management (SIEM) for Government
• 2.3. Event Management for Government
• 2.4. Incident Response Model for Government
• 2.4.1. Developing Specific Incident Response Scenarios for Government
• 2.5. Threat Management for Government
• 2.6. Threat Intelligence for Government
• 2.6.1. Information Sharing and Analysis Centers (ISAC) for Government
• 2.7. Vulnerability Management for Government
• 2.7.1. Vulnerability Assessments for Government
• 2.7.2. Vulnerability Management in Practice for Government
• 2.7.3. Penetration Testing for Government
• 2.7.4. Security Testing Teams for Government
• 2.7.5. Remediation for Government
• 2.8. Threat Hunting for Government

3. Summary for Government

Domain 4: Information Security Core Competencies for Government

1. Access Control for Government

• 1.1. Authentication, Authorization, and Auditing for Government
• 1.2. Authentication for Government
• 1.3. Authorization for Government
• 1.4. Auditing for Government
• 1.5. User Access Control Restrictions for Government
• 1.6. User Access Behavior Management for Government
• 1.7. Types of Access Control Models for Government
• 1.8. Designing an Access Control Plan for Government
• 1.9. Access Administration for Government

2. Physical Security for Government

• 2.1. Designing, Implementing, and Managing a Physical Security Program for Government
• 2.1.1. Physical Risk Assessment for Government
• 2.2. Physical Location Considerations for Government
• 2.3. Obstacles and Prevention for Government
• 2.4. Secure Facility Design for Government
• 2.4.1. Security Operations Center (SOC) for Government
• 2.4.2. Sensitive Compartmented Information Facility (SCIF) for Government
• 2.4.3. Digital Forensics Lab for Government
• 2.4.4. Datacenter for Government
• 2.5. Preparing for Physical Security Audits for Government

3. Network Security for Government

• 3.1. Network Security Assessments and Planning for Government
• 3.2. Network Security Architecture Challenges for Government
• 3.3. Network Security Design for Government
• 3.4. Network Standards, Protocols, and Controls for Government
• 3.4.1. Network Security Standards for Government
• 3.4.2. Protocols for Government

4. Certified Chief for Government

• 4.1.1. Network Security Controls for Government
• 4.2. Wireless (Wi-Fi) Security for Government
• 4.2.1. Wireless Risks for Government
• 4.2.2. Wireless Controls for Government
• 4.3. Voice over IP Security for Government

5. Endpoint Protection for Government

• 5.1. Endpoint Threats for Government
• 5.2. Endpoint Vulnerabilities for Government
• 5.3. End User Security Awareness for Government
• 5.4. Endpoint Device Hardening for Government
• 5.5. Endpoint Device Logging for Government
• 5.6. Mobile Device Security for Government
• 5.6.1. Mobile Device Risks for Government
• 5.6.2. Mobile Device Security Controls for Government
• 5.7. Internet of Things (IoT) Security for Government
• 5.7.1. Protecting IoT Devices for Government

6. Application Security for Government

• 6.1. Secure Software Development Life Cycle (SDLC) Model for Government
• 6.2. Separation of Development, Test, and Production Environments for Government
• 6.3. Application Security Testing Approaches for Government
• 6.4. DevSecOps for Government
• 6.5. Waterfall Methodology and Security for Government
• 6.6. Agile Methodology and Security for Government
• 6.7. Other Application Development Approaches for Government
• 6.8. Application Hardening for Government
• 6.9. Application Security Technologies for Government
• 6.10. Version Control and Patch Management for Government
• 6.11. Database Security for Government
• 6.12. Database Hardening for Government
• 6.13. Secure Coding Practices for Government

7. Encryption Technologies for Government

• 7.1. Encryption and Decryption for Government
• 7.2. Cryptosystems for Government
• 7.2.1. Blockchain for Government
• 7.2.2. Digital Signatures and Certificates for Government
• 7.2.3. Public Key Infrastructure (PKI) for Government
• 7.2.4. Key Management for Government
• 7.3. Hashing for Government
• 7.4. Encryption Algorithms for Government
• 7.5. Encryption Strategy Development for Government
• 7.5.1. Determining Critical Data Location and Type for Government
• 7.5.2. Deciding What to Encrypt for Government
• 7.5.3. Determining Encryption Requirements for Government
• 7.5.4. Selecting, Integrating, and Managing Encryption Technologies for Government

8. Virtualization Security for Government

• 8.1. Virtualization Overview for Government
• 8.2. Virtualization Risks for Government
• 8.3. Virtualization Security Concerns for Government
• 8.4. Virtualization Security Controls for Government
• 8.5. Virtualization Security Reference Model for Government

9. Cloud Computing Security for Government

• 9.1. Overview of Cloud Computing for Government
• 9.2. Security and Resiliency in Cloud Services for Government
• 9.3. Cloud Security Concerns for Government
• 9.4. Cloud Security Controls for Government
• 9.5. Cloud Computing Protection Considerations for Government

10. Transformative Technologies for Government

• 10.1. Artificial Intelligence (AI) for Government
• 10.2. Augmented Reality (AR) for Government
• 10.3. Autonomous Security Operations Center (SOC) for Government
• 10.4. Dynamic Deception for Government
• 10.5. Software-Defined Cybersecurity for Government

11. Summary for Government

Domain 5: Strategic Planning, Finance, Procurement, and Vendor Management for Government

1. Strategic Planning for Government

• 1.1. Understanding the Organization for Government
• 1.1.1. Understanding the Business Structure for Government
• 1.1.2. Determining and Aligning Business and Information Security Goals for Government
• 1.1.3. Identifying Key Sponsors, Stakeholders, and Influencers for Government
• 1.1.4. Understanding Organizational Financials for Government
• 1.2. Creating an Information Security Strategic Plan for Government
• 1.2.1. Strategic Planning Basics for Government
• 1.2.2. Alignment to Organizational Strategy and Goals for Government
• 1.2.3. Defining Tactical Short, Medium, and Long-Term Information Security Goals for Government
• 1.2.4. Information Security Strategy Communication for Government
• 1.2.5. Creating a Culture of Security in Government

2. Designing, Developing, and Maintaining an Enterprise Information Security Program for Government

• 2.1. Ensuring a Sound Program Foundation for Government
• 2.2. Architectural Views for Government
• 2.3. Creating Measurements and Metrics for Government
• 2.4. Balanced Scorecard for Government
• 2.5. Continuous Monitoring and Reporting Outcomes for Government
• 2.6. Continuous Improvement for Government
• 2.7. Information Technology Infrastructure Library (ITIL) Continual Service Improvement (CSI) for Government

3. Understanding the Enterprise Architecture (EA) for Government

• 3.1. EA Types for Government
• 3.1.1. The Zachman Framework for Government
• 3.1.2. The Open Group Architecture Framework (TOGAF) for Government
• 3.1.3. Sherwood Applied Business Security Architecture (SABSA) for Government
• 3.1.4. Federal Enterprise Architecture Framework (FEAF) for Government

4. Finance for Government

• 4.1. Understanding Security Program Funding for Government
• 4.2. Analyzing, Forecasting, and Developing a Security Budget for Government
• 4.2.1. Resource Requirements for Government
• 4.2.2. Define Financial Metrics for Government
• 4.2.3. Technology Refresh for Government
• 4.2.4. New Project Funding for Government
• 4.2.5. Contingency Funding for Government
• 4.3. Managing the Information Security Budget for Government
• 4.3.1. Obtain Financial Resources for Government
• 4.3.2. Allocate Financial Resources for Government
• 4.3.3. Monitor and Oversight of the Information Security Budget for Government
• 4.3.4. Report Metrics to Sponsors and Stakeholders in Government
• 4.3.5. Balancing the Information Security Budget for Government

5. Procurement for Government

• 5.1. Procurement Program Terms and Concepts for Government
• 5.1.1. Statement of Objectives (SOO) for Government
• 5.1.2. Statement of Work (SOW) for Government
• 5.1.3. Total Cost of Ownership (TCO) for Government
• 5.1.4. Request for Information (RFI) for Government
• 5.1.5. Request for Proposal (RFP) for Government
• 5.1.6. Master Service Agreement (MSA) for Government
• 5.1.7. Service Level Agreement (SLA) for Government
• 5.1.8. Terms and Conditions (T&C) for Government
• 5.2. Understanding the Organization’s Procurement Program for Government
• 5.2.1. Internal Policies, Processes, and Requirements for Government
• 5.2.2. External or Regulatory Requirements for Government
• 5.2.3. Local Versus Global Requirements for Government
• 5.3. Procurement Risk Management for Government
• 5.3.1. Standard Contract Language for Government

6. Vendor Management for Government

• 6.1. Understanding the Organization’s Acquisition Policies and Procedures for Government
• 6.1.1. Procurement Life Cycle for Government
• 6.2. Applying Cost-Benefit Analysis (CBA) During the Procurement Process for Government
• 6.3. Vendor Management Policies for Government
• 6.4. Contract Administration Policies for Government
• 6.4.1. Service and Contract Delivery Metrics for Government
• 6.4.2. Contract Delivery Reporting for Government
• 6.4.3. Change Requests for Government
• 6.4.4. Contract Renewal for Government
• 6.4.5. Contract Closure for Government
• 6.5. Delivery Assurance for Government
• 6.5.1. Validation of Meeting Contractual Requirements for Government
• 6.5.2. Formal Delivery Audits for Government
• 6.5.3. Periodic Random Delivery Audits for Government
• 6.5.4. Third-Party Attestation Services (TPRM) for Government

7. Summary for Government