Certified Chief Information Security Officer (CCISO) Training Course

Domain 1 Governance and Risk Management

1. Define, Implement, Manage, and Maintain an Information Security Governance Program for Government

• 1.1. Form of Business Organization
• 1.2. Industry
• 1.3. Organizational Maturity

2. Information Security Drivers

3. Establishing an Information Security Management Structure

• 3.1. Organizational Structure
• 3.2. Position of the CISO within the Organizational Structure
• 3.3. The Executive CISO
• 3.4. Nonexecutive CISO

4. Laws, Regulations, and Standards as Drivers of Organizational Policy, Standards, and Procedures

5. Managing an Enterprise Information Security Compliance Program

• 5.1. Security Policy
• 5.1.1. Necessity of a Security Policy
• 5.1.2. Challenges in Implementing a Security Policy
• 5.2. Policy Content
• 5.2.1. Types of Policies
• 5.2.2. Implementation of Policies
• 5.3. Reporting Structure
• 5.4. Standards and Best Practices
• 5.5. Leadership and Ethics
• 5.6. EC-Council Code of Ethics

6. Introduction to Risk Management

• 3.1. Organizational Structure
• 3.2. Position of the CISO within the Organizational Structure
• 3.3. The Executive CISO
• 3.4. Nonexecutive CISO

Domain 2 Information Security Controls, Compliance, and Audit Management

1. Information Security Controls

• 1.1. Identifying the Organization’s Information Security Needs
• 1.1.1. Identifying the Optimum Information Security Framework
• 1.1.2. Designing Security Controls
• 1.1.3. Control Lifecycle Management
• 1.1.4. Control Classification
• 1.1.5. Control Selection and Implementation
• 1.1.6. Control Catalog
• 1.1.7. Control Maturity
• 1.1.8. Monitoring Security Controls
• 1.1.9. Remediating Control Deficiencies
• 1.1.10. Maintaining Security Controls
• 1.1.11. Reporting Controls
• 1.1.12. Information Security Service Catalog

2. Compliance Management

• 2.1. Acts, Laws, and Statutes
• 2.1.1. FISMA
• 2.2. Regulations
• 2.2.1. GDPR
• 2.3. Standards
• 2.3.1. ASD—Information Security Manual
• 2.3.2. Basel III
• 2.3.3. FFIEC
• 2.3.4. ISO 00 Family of Standards
• 2.3.5. NERC-CIP
• 2.3.6. PCI DSS
• 2.3.7. NIST Special Publications
• 2.3.8. Statement on Standards for Attestation Engagements No. 16 (SSAE 16)

3. Guidelines, Good and Best Practices

• 3.1. CIS
• 3.1.1. OWASP

4. Audit Management

• 4.1. Audit Expectations and Outcomes
• 4.2. IS Audit Practices
• 4.2.1. ISO/IEC Audit Guidance
• 4.2.2. Internal versus External Audits
• 4.2.3. Partnering with the Audit Organization
• 4.2.4. Audit Process
• 4.2.5. General Audit Standards
• 4.2.6. Compliance-Based Audits
• 4.2.7. Risk-Based Audits
• 4.2.8. Managing and Protecting Audit Documentation
• 4.2.9. Performing an Audit
• 4.2.10. Evaluating Audit Results and Report
• 4.2.11. Remediating Audit Findings
• 4.2.12. Leveraging GRC Software to Support Audits

5. Summary

Domain 3 Security Program Management & Operations

1. Program Management

• 1.1. Defining a Security Charter, Objectives, Requirements, Stakeholders, and Strategies
• 1.1.1. Security Program Charter
• 1.1.2. Security Program Objectives
• 1.1.3. Security Program Requirements
• 1.1.4. Security Program Stakeholders
• 1.1.5. Security Program Strategy Development
• 1.2. Executing an Information Security Program for Government
• 1.3. Defining and Developing, Managing, and Monitoring the Information Security Program
• 1.3.1. Defining an Information Security Program Budget
• 1.3.2. Developing an Information Security Program Budget
• 1.3.3. Managing an Information Security Program Budget
• 1.3.4. Monitoring an Information Security Program Budget
• 1.4. Defining and Developing Information Security Program Staffing Requirements
• 1.5. Managing the People of a Security Program
• 1.5.1. Resolving Personnel and Teamwork Issues
• 1.5.2. Managing Training and Certification of Security Team Members
• 1.5.3. Clearly Defined Career Path
• 1.5.4. Designing and Implementing a User Awareness Program
• 1.6. Managing the Architecture and Roadmap of the Security Program
• 1.6.1. Information Security Program Architecture
• 1.6.2. Information Security Program Roadmap
• 1.7. Program Management and Governance
• 1.7.1. Understanding Project Management Practices
• 1.7.2. Identifying and Managing Project Stakeholders
• 1.7.3. Measuring the Effectiveness of Projects
• 1.8. Business Continuity Management (BCM) and Disaster Recovery Planning (DRP)
• 1.9. Data Backup and Recovery
• 1.10. Backup Strategy
• 1.11. ISO BCM Standards
• 1.11.1. Business Continuity Management (BCM)
• 1.11.2. Disaster Recovery Planning (DRP)
• 1.12. Continuity of Security Operations
• 1.12.1. Integrating the Confidentiality, Integrity, and Availability (CIA) Model
• 1.13. BCM Plan Testing
• 1.14. DRP Testing
• 1.15. Contingency Planning, Operations, and Testing Programs to Mitigate Risk and Meet Service Level Agreements (SLAs)
• 1.16. Computer Incident Response
• 1.16.1. Incident Response Tools
• 1.16.2. Incident Response Management
• 1.16.3. Incident Response Communications
• 1.16.4. Post-Incident Analysis
• 1.16.5. Testing Incident Response Procedures
• 1.17. Digital Forensics
• 1.17.1. Crisis Management
• 1.17.2. Digital Forensics Life Cycle

2. Operations Management

• 2.1. Establishing and Operating a Security Operations (SecOps) Capability for Government
• 2.2. Security Monitoring and Security Information and Event Management (SIEM)
• 2.3. Event Management
• 2.4. Incident Response Model
• 2.4.1. Developing Specific Incident Response Scenarios
• 2.5. Threat Management
• 2.6. Threat Intelligence
• 2.6.1. Information Sharing and Analysis Centers (ISAC)
• 2.7. Vulnerability Management
• 2.7.1. Vulnerability Assessments
• 2.7.2. Vulnerability Management in Practice
• 2.7.3. Penetration Testing
• 2.7.4. Security Testing Teams
• 2.7.5. Remediation
• 2.8. Threat Hunting

3. Summary

Domain 4 Information Security Core Competencies

1. Access Control

• 1.1. Authentication, Authorization, and Auditing for Government
• 1.2. Authentication
• 1.3. Authorization
• 1.4. Auditing
• 1.5. User Access Control Restrictions
• 1.6. User Access Behavior Management
• 1.7. Types of Access Control Models
• 1.8. Designing an Access Control Plan for Government
• 1.9. Access Administration

2. Physical Security

• 2.1. Designing, Implementing, and Managing a Physical Security Program for Government
• 2.1.1. Physical Risk Assessment
• 2.2. Physical Location Considerations
• 2.3. Obstacles and Prevention
• 2.4. Secure Facility Design
• 2.4.1. Security Operations Center
• 2.4.2. Sensitive Compartmented Information Facility
• 2.4.3. Digital Forensics Lab
• 2.4.4. Datacenter
• 2.5. Preparing for Physical Security Audits

3. Network Security

• 3.1. Network Security Assessments and Planning
• 3.2. Network Security Architecture Challenges
• 3.3. Network Security Design
• 3.4. Network Standards, Protocols, and Controls
• 3.4.1. Network Security Standards
• 3.4.2. Protocols

4. Certified Chief

• 4.1.1. Network Security Controls
• 4.2. Wireless (Wi-Fi) Security
• 4.2.1. Wireless Risks
• 4.2.2. Wireless Controls
• 4.3. Voice over IP Security

5. Endpoint Protection

• 5.1. Endpoint Threats
• 5.2. Endpoint Vulnerabilities
• 5.3. End User Security Awareness for Government
• 5.4. Endpoint Device Hardening
• 5.5. Endpoint Device Logging
• 5.6. Mobile Device Security
• 5.6.1. Mobile Device Risks
• 5.6.2. Mobile Device Security Controls
• 5.7. Internet of Things Security (IoT)
• 5.7.1. Protecting IoT Devices for Government

6. Application Security

• 6.1. Secure SDLC Model
• 6.2. Separation of Development, Test, and Production Environments
• 6.3. Application Security Testing Approaches
• 6.4. DevSecOps for Government
• 6.5. Waterfall Methodology and Security
• 6.6. Agile Methodology and Security
• 6.7. Other Application Development Approaches
• 6.8. Application Hardening
• 6.9. Application Security Technologies
• 6.10. Version Control and Patch Management for Government
• 6.11. Database Security
• 6.12. Database Hardening
• 6.13. Secure Coding Practices for Government

7. Encryption Technologies

• 7.1. Encryption and Decryption
• 7.2. Cryptosystems
• 7.2.1. Blockchain
• 7.2.2. Digital Signatures and Certificates for Government
• 7.2.3. PKI
• 7.2.4. Key Management for Government
• 7.3. Hashing
• 7.4. Encryption Algorithms
• 7.5. Encryption Strategy Development for Government
• 7.5.1. Determining Critical Data Location and Type
• 7.5.2. Deciding What to Encrypt
• 7.5.3. Determining Encryption Requirements
• 7.5.4. Selecting, Integrating, and Managing Encryption Technologies for Government

8. Virtualization Security

• 8.1. Virtualization Overview
• 8.2. Virtualization Risks
• 8.3. Virtualization Security Concerns
• 8.4. Virtualization Security Controls for Government
• 8.5. Virtualization Security Reference Model

9. Cloud Computing Security

• 9.1. Overview of Cloud Computing for Government
• 9.2. Security and Resiliency in Cloud Services
• 9.3. Cloud Security Concerns
• 9.4. Cloud Security Controls for Government
• 9.5. Cloud Computing Protection Considerations for Government

10. Transformative Technologies

• 10.1. Artificial Intelligence for Government
• 10.2. Augmented Reality for Government
• 10.3. Autonomous SOC for Government
• 10.4. Dynamic Deception for Government
• 10.5. Software-Defined Cybersecurity for Government

11. Summary

Domain 5 Strategic Planning, Finance, Procurement, and Vendor Management

1. Strategic Planning

• 1.1. Understanding the Organization for Government
• 1.1.1. Understanding the Business Structure
• 1.1.2. Determining and Aligning Business and Information Security Goals for Government
• 1.1.3. Identifying Key Sponsors, Stakeholders, and Influencers for Government
• 1.1.4. Understanding Organizational Financials for Government
• 1.2. Creating an Information Security Strategic Plan for Government
• 1.2.1. Strategic Planning Basics
• 1.2.2. Alignment to Organizational Strategy and Goals for Government
• 1.2.3. Defining Tactical Short, Medium, and Long-Term Information Security Goals for Government
• 1.2.4. Information Security Strategy Communication for Government
• 1.2.5. Creating a Culture of Security for Government

2. Designing, Developing, and Maintaining an Enterprise Information Security Program for Government

• 2.1. Ensuring a Sound Program Foundation for Government
• 2.2. Architectural Views for Government
• 2.3. Creating Measurements and Metrics for Government
• 2.4. Balanced Scorecard for Government
• 2.5. Continuous Monitoring and Reporting Outcomes for Government
• 2.6. Continuous Improvement for Government
• 2.7. Information Technology Infrastructure Library (ITIL) Continual Service Improvement (CSI) for Government

3. Understanding the Enterprise Architecture (EA)

• 3.1. EA Types for Government
• 3.1.1. The Zachman Framework for Government
• 3.1.2. The Open Group Architecture Framework (TOGAF) for Government
• 3.1.3. Sherwood Applied Business Security Architecture (SABSA) for Government
• 3.1.4. Federal Enterprise Architecture Framework (FEAF) for Government

4. Finance

• 4.1. Understanding Security Program Funding for Government
• 4.2. Analyzing, Forecasting, and Developing a Security Budget for Government
• 4.2.1. Resource Requirements for Government
• 4.2.2. Define Financial Metrics for Government
• 4.2.3. Technology Refresh for Government
• 4.2.4. New Project Funding for Government
• 4.2.5. Contingency Funding for Government
• 4.3. Managing the Information Security Budget for Government
• 4.3.1. Obtain Financial Resources for Government
• 4.3.2. Allocate Financial Resources for Government
• 4.3.3. Monitor and Oversight of Information Security Budget for Government
• 4.3.4. Report Metrics to Sponsors and Stakeholders for Government
• 4.3.5. Balancing the Information Security Budget for Government

5. Procurement

• 5.1. Procurement Program Terms and Concepts for Government
• 5.1.1. Statement of Objectives (SOO) for Government
• 5.1.2. Statement of Work (SOW) for Government
• 5.1.3. Total Cost of Ownership (TCO) for Government
• 5.1.4. Request for Information (RFI) for Government
• 5.1.5. Request for Proposal (RFP) for Government
• 5.1.6. Master Service Agreement (MSA) for Government
• 5.1.7. Service Level Agreement (SLA) for Government
• 5.1.8. Terms and Conditions (T&C) for Government
• 5.2. Understanding the Organization’s Procurement Program for Government
• 5.2.1. Internal Policies, Processes, and Requirements for Government
• 5.2.2. External or Regulatory Requirements for Government
• 5.2.3. Local Versus Global Requirements for Government
• 5.3. Procurement Risk Management for Government
• 5.3.1. Standard Contract Language for Government

6. Vendor Management

• 6.1. Understanding the Organization’s Acquisition Policies and Procedures for Government
• 6.1.1. Procurement Life Cycle for Government
• 6.2. Applying Cost-Benefit Analysis (CBA) During the Procurement Process for Government
• 6.3. Vendor Management Policies for Government
• 6.4. Contract Administration Policies for Government
• 6.4.1. Service and Contract Delivery Metrics for Government
• 6.4.2. Contract Delivery Reporting for Government
• 6.4.3. Change Requests for Government
• 6.4.4. Contract Renewal for Government
• 6.4.5. Contract Closure for Government
• 6.5. Delivery Assurance for Government
• 6.5.1. Validation of Meeting Contractual Requirements for Government
• 6.5.2. Formal Delivery Audits for Government
• 6.5.3. Periodic Random Delivery Audits for Government
• 6.5.4. Third-Party Attestation Services (TPRM) for Government

7. Summary