Our accelerated courses are available online
Join Now!

(ISC)2 - CISSP-ISSMP Information Systems Security Management Professional



Only 5 Days



Classroom / Online / Hybrid

Next date

Next date:

8.5.2023 (Monday)


The accelerated Information Systems Security Management Professional (ISSMP) is a CISSP who specializes in establishing, presenting and governing information security programs and demonstrates management and leadership skills. CISSP-ISSMPs direct the alignment of security programs with the organization’s mission, goals and strategies in order to meet enterprise financial and operational requirements in support of its desired risk position.

The broad spectrum of topics included in the CISSP-ISSMP Common Body of Knowledge (CBK®) ensure its relevancy across all disciplines in the field of information security management.

Upon completion of this course you will also learn:

  • Leadership and Business Management
  • Systems Lifecycle Management
  • Risk Management
  • Threat Intelligence and Incident Management
  • Contingency Management
  • Law, Ethics and Security Compliance Management

At the end of this course, you’ll achieve your CISSP-ISSMP Information Systems Security Management Professional certification.

Through Firebrand’s Lecture | Lab | Review methodology you’ll certify at twice the speed of traditional training and get access to courseware, learn from certified instructors, and train in a distraction-free environment.

40% faster

Distraction-free environment


The CISSP-ISSMP is ideal for those working in roles such as:

  • Chief information officer
  • Chief information security officer
  • Chief technology officer
  • Senior security executive

Four reasons why you should sit your course with Firebrand Training

  1. You'll be trained and certified faster. Learn more on this 5-day accelerated course. You'll get at least 12 hours a day of quality learning time in a distraction-free environment
  2. Your course is all-inclusive. One simple price covers all course materials, exams, accommodation and meals – so you can focus on learning
  3. Pass first time or train again for free. Your expert instructor will deliver our unique accelerated learning methods, allowing you to learn faster and be in the best possible position to pass first time. In the unlikely event that you don't, it's covered by your Certification Guarantee
  4. Study with an award-winning training provider. We've won the Learning and Performance Institute's "Training Company of the Year" three times. Firebrand is your fastest way to learn, with 134561 students saving more than one million hours since 2001


Seven reasons why you should sit your course with Firebrand Training

  1. Two options of training. Choose between residential classroom-based, or online courses
  2. You'll be certified fast. With us, you’ll be trained in record time
  3. Our course is all-inclusive. A one-off fee covers all course materials, exams**, accommodation* and meals*. No hidden extras.
  4. Pass first time or train again for free. This is our guarantee. We’re confident you’ll pass your course first time. But if not, come back within a year and only pay for accommodation, exams and incidental costs
  5. You’ll learn more. A day with a traditional training provider generally runs from 9am – 5pm, with a nice long break for lunch. With Firebrand Training you’ll get at least 12 hours/day quality learning time, with your instructor
  6. You’ll learn faster. Chances are, you’ll have a different learning style to those around you. We combine visual, auditory and tactile styles to deliver the material in a way that ensures you will learn faster and more easily
  7. You’ll be studying with the best. We’ve been named in Training Industry’s “Top 20 IT Training Companies of the Year” every year since 2010. As well as winning many more awards, we’ve trained and certified over 100,000 professionals
  • * For residential training only. Doesn't apply for online courses
  • ** Some exceptions apply. Please refer to the Exam Track or speak with our experts


CISSP-ISSMP Information Systems Security Management Professional

Domain 1: Leadership and Business Management

1.1 Establish security’s role in organizational culture, vision and mission

  • Define information security program vision and mission
  • Align security with organizational goals, objectives and values
  • Define security’s relationship to the overall business processes
  • Define the relationship between organizational culture and security

1.2 Align security program with organizational governance

  • Identify and navigate organizational governance structure
  • Validate roles of key stakeholders
  • Validate sources and boundaries of authorization
  • Advocate and obtain organizational support for security initiatives

1.3 Define and implement information security strategies

  • Identify security requirements from business initiatives
  • Evaluate capacity and capability to implement security strategies
  • Manage implementation of security strategies
  • Review and maintain security strategies
  • Prescribe security architecture and engineering theories, concepts and methods

1.4 Define and maintain security policy framework Determine applicable external standards

  • Determine applicable external standards
  • Determine data classification and protection requirements
  • Establish internal policies
  • Advocate and obtain organizational support for policies
  • Develop procedures, standards, guidelines and baselines
  • Ensure periodic review of security policy framework
  • Evaluate service management agreements (e.g., risk, financial)
  • Govern managed services (e.g., infrastructure, cloud services)
  • Manage impact of organizational change (e.g., mergers and acquisitions, outsourcing)
  • Ensure that appropriate regulatory compliance statements and requirements are included in contractual agreements
  • Monitor and enforce compliance with contractual agreements

1.5 Manage security requirements in contracts and agreements

1.6 Manage security awareness and training programs

  • Promote security programs to key stakeholders
  • Identify needs and implement training programs by target segment
  • Monitor and report on effectiveness of security awareness and training programs

1.7 Define, measure and report security metrics

  • Identify Key Performance Indicators (KPI)
  • Associate Key Performance Indicators (KPI) to the risk posture of the organization
  • Use metrics to drive security program development and operations

1.8 Prepare, obtain and administer security budget

  • Prepare and secure annual budget
  • Adjust budget based on evolving risks and threat landscape
  • Manage and report financial responsibilities

1.9 Manage security programs

Define roles and responsibilities

  • Determine and manage team accountability
  • Build cross-functional relationships
  • Resolve conflicts between security and other stakeholders
  • Identify communication bottlenecks and barriers
  • Integrate security controls into human resources processes

1.10 Apply product development and project management principles

  • Incorporate security into project lifecycle
  • Identify and apply appropriate project management methodology
  • Analyze project time, scope and cost relationship

Domain 2: Systems Lifecycle Management

2.1 Manage integration of security into Systems Development Life Cycle (SDLC)

  • Integrate information security gates (decision points) and requirements into lifecycle
  • Implement security controls into system lifecycle
  • Oversee security configuration management (CM) processes

2.2 Integrate new business initiatives and emerging technologies into the security architecture

  • Integrate security into new business initiatives and emerging technologies
  • Address impact of new business initiatives on security posture

2.3 Define and oversee comprehensive vulnerability management programs (e.g., vulnerability scanning, penetration testing, threat analysis)

  • Identify, classify and prioritize assets, systems and services based on criticality to business
  • Prioritize threats and vulnerabilities
  • Manage security testing
  • Manage mitigation and/or remediation of vulnerabilities based on risk

2.4 Manage security aspects of change control

  • Integrate security requirements with change control process
  • Identify and coordinate with the stakeholders
  • Manage documentation and tracking
  • Ensure policy compliance (e.g., continuous monitoring)

Domain 3: Risk Management

3.1 Develop and manage a risk management program

  • Identify risk management program objectives
  • Communicate and agree on risk management objectives with risk owners and other stakeholders
  • Determine scope of organizational risk program
  • Identify organizational security risk tolerance/appetite
  • Obtain and verify organizational asset inventory
  • Analyze organizational risks
  • Determine countermeasures, compensating and mitigating controls
  • Perform cost-benefit analysis (CBA) of risk treatment options

3.2 Conduct risk assessments

  • Identify risk factors

    3.3 Manage security risks within the supply chain (e.g., supplier, vendor, third-party risk)

    • Identify supply chain security risk requirements
    • Integrate supply chain security risks into organizational risk management
    • Validate security risk control within the supply chain
    • Monitor and review the supply chain security risks

    Domain 4: Threat Intelligence and Incident Management

    4.1 Establish and maintain threat intelligence program

    • Aggregate threat data from multiple threat intelligence sources
    • Conduct baseline analysis of network traffic, data and user behavior
    • Detect and analyze anomalous behavior patterns for potential concerns
    • Conduct threat modeling
    • Identify and categorize an attack
    • Correlate related security event and threat data
    • Create actionable alerting to appropriate resources

    4.2 Establish and maintain incident handling and investigation program

    • Develop program documentation
    • Establish incident response case management process
    • Establish incident response team
    • Apply incident management methodologies
    • Establish and maintain incident handling process
    • Establish and maintain investigation process
    • Quantify and report financial and operational impact of incidents and investigations to stakeholders
    • Conduct root cause analysis (RCA)

    Domain 5: Contingency Management

    5.1 Facilitate development of contingency plans

    • Identify and analyze factors related to the Continuity of Operations Plan (COOP)
    • Identify and analyze factors related to the business continuity plan (BCP) (e.g., time, resources, verification)
    • Identify and analyze factors related to the disaster recovery plan (DRP) (e.g., time, resources, verification)
    • Coordinate contingency management plans with key stakeholders
    • Define internal and external crisis communications plans
    • Define and communicate contingency roles and responsibilities
    • Identify and analyze contingency impact on business processes and priorities
    • Manage third-party contingency dependencies
    • Prepare security management succession plan

    5.2 Develop recovery strategies

    • Identify and analyze alternatives
    • Recommend and coordinate recovery strategies
    • Assign recovery roles and responsibilities

    5.3 Maintain contingency plan, Continuity of Operations Plan (COOP), business continuity plan (BCP) and disaster recovery plan (DRP)

    • Plan testing, evaluation and modification
    • Determine survivability and resiliency capabilities
    • Manage plan update process

    5.4 Manage disaster response and recovery process

    • Declare disaster
    • Implement plan
    • Restore normal operations
    • Gather lessons learned
    • Update plan based on lessons learned

    Domain 6: Law, Ethics and Security Compliance Management

    6.1 Identify the impact of laws and regulations that relate to information security

    6.2 Adhere to the (ISC)2 Code of Ethics as related to management issues

    6.3 Validate compliance in accordance with applicable laws, regulations and industry best practices

    6.4 Coordinate with auditors and regulators in support of the internal and external audit processes

    6.5 Document and manage compliance exceptions

    • Identify and document compensating controls and workarounds
    • Report and obtain authorized approval of risk waiver

    Domain 6: Law, Ethics and Security Compliance Management

    • Identify applicable privacy laws
    • Identify legal jurisdictions the organization and users operate within (e.g., trans-border data flow)
    • Identify export laws
    • Identify intellectual property (IP) laws
    • Identify applicable industry regulations
    • Identify and advise on non-compliance risks
    • Inform and advise senior management
    • Evaluate and select compliance framework(s)
    • Implement the compliance framework(s)
    • Define and monitor compliance metrics
    • Plan
    • Schedule
    • Coordinate audit activities
    • Evaluate and validate findings
    • Formulate response
    • Validate implemented mitigation and remediation actions
  • Exam Track

    At the end of this accelerated course, you’ll sit the following exam at the Firebrand Training centre, covered by your Certification Guarantee:

    CISSP-ISSMP Information Systems Security Management Professional

    CISSP-ISSMP is in compliance with the stringent requirements of ANSI/ISO/IEC Standard 17024.

    Length of exam: 3 hours

    Number of items: 125 Multiple choice

    Passing grade: 700 out of 1000 points

    Domains Weight:

    1. 1. Leadership and Business Management 20%
    2. 2. Systems Lifecycle Management 18%
    3. 3. Risk Management 19%
    4. 4. Threat Intelligence and Incident Management 17%
    5. 5. Contingency Management 15%
    6. 6. Law, Ethics and Security Compliance Management 11%

    What's Included

    Your accelerated course includes:

    • Accommodation *
    • Meals, unlimited snacks, beverages, tea and coffee *
    • On-site exams **
    • Exam vouchers **
    • Practice tests **
    • Certification Guarantee ***
    • Courseware
    • Up-to 12 hours of instructor-led training each day
    • 24-hour lab access
    • Digital courseware **
    • * For residential training only. Accommodation is included from the night before the course starts. This doesn't apply for online courses.
    • ** Some exceptions apply. Please refer to the Exam Track or speak with our experts
    • *** Pass first time or train again free as many times as it takes, unlimited for 1 year. Just pay for accommodation, exams, and incidental costs.


    Before attending this accelerated course, you must be a CISSP in good standing and have two years cumulative paid work experience in one or more of the six domains of the CISSP-ISSMP CBK.

    Unsure whether you meet the prerequisites? Don’t worry. Your training consultant will discuss your background with you to understand if this course is right for you.


    Here's the Firebrand Training review section. Since 2001 we've trained exactly 134561 students and asked them all to review our Accelerated Learning. Currently, 96.51% have said Firebrand exceeded their expectations.

    Read reviews from recent accelerated courses below or visit Firebrand Stories for written and video interviews from our alumni.

    "This is the second training plus certification course I am doing with Firebrand and I have had a great experience. The instructor Richard M. on this CISSP course was great and extremely knowledgable, had a great sense of humour which helped to make this vast and dry topic very interesting. The logistics of the course were well arranged and the staff were extremely supportive, all of which goes towards a great trainee experience."
    J. M. . (8.8.2022 (Monday) to 13.8.2022 (Saturday))

    "It was an intense and pleasant experience."
    Anonymous (31.8.2020 (Monday) to 5.9.2020 (Saturday))

    "locked and loaded going in a week on-site course is the ideal method for an accelerated training"
    Anonymous (13.7.2020 (Monday) to 18.7.2020 (Saturday))

    "Very good training. The trainer was really good and an entertaining presenter that can spice up even the most tedious domain."
    Anonymous, Triodos Bank NV (13.7.2020 (Monday) to 18.7.2020 (Saturday))

    "Tough, Concentrated, Focused."
    Anonymous, ITMC AG (13.7.2020 (Monday) to 18.7.2020 (Saturday))

    Course Dates





    Book now

    21.11.2022 (Monday)

    25.11.2022 (Friday)

    Finished - Leave feedback



    27.3.2023 (Monday)

    31.3.2023 (Friday)

    Wait list



    8.5.2023 (Monday)

    12.5.2023 (Friday)

    Limited availability



    19.6.2023 (Monday)

    23.6.2023 (Friday)




    31.7.2023 (Monday)

    4.8.2023 (Friday)




    11.9.2023 (Monday)

    15.9.2023 (Friday)




    Latest Reviews from our students