Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by BCS
Exam Format
Registration
Validity
Skills this practice test covers
- Define core terms such as information assurance, risk appetite and the ISMS.
- Take a risk through identification, analysis, treatment and review.
- Place policies, standards, procedures and guidelines in a security governance structure.
- List the threats to a system with a framework such as STRIDE or attack trees.
- Place security checks into each stage of a DevSecOps pipeline.
- Plan incident response and disaster recovery, and keep digital evidence admissible.
Explore related topics
CISMP exam content
9 domains · 19 topics · 111 questions
Information Security Principles10%12 questions
This domain sets the vocabulary for the rest of the syllabus: assets, threats, vulnerabilities, risk, identity and governance. It also covers why security matters to a business model, and the main terms and principles of privacy law.
Skills tested
- Define information assurance, risk appetite and risk tolerance, with an example of each.
- Tell identity, authentication and authorization apart.
- Explain how security costs are balanced against the risk they reduce.
- Apply GDPR terms, such as data controller and data processor, to a short case.
Questions by topic
- Terms and concepts of information security management7
- Personal data privacy legislation5
Information Risk15%15 questions
Information Risk is about how an organization finds, values and treats risk to its information. Candidates follow the risk management lifecycle from identification and analysis through treatment, communication and review.
Skills tested
- Value tangible and intangible information assets and record risks in a risk register.
- Sort controls into categories such as directive, deterrent, detective and corrective.
- Compare qualitative and quantitative risk analysis methods.
- Choose a risk treatment option and explain why it fits the risk appetite.
Questions by topic
- Key components of risk management7
- Risk management lifecycle8
Information Security Frameworks15%16 questions
Security needs owners, rules and checks, and this domain covers how they are set up. Candidates describe roles and policies, the information security charter, audits and compliance reporting, and the standards and frameworks an organization can adopt.
Skills tested
- Describe typical information and cyber security roles, including the CISO.
- Explain what an information security charter contains and why policy needs regular review.
- Outline how security audits check and report compliance status.
- Describe baseline controls, configuration management and change control.
- Compare frameworks and schemes such as Cyber Essentials and the CIS 18 Critical Security Controls.
Questions by topic
- Organisational structure and policy for information security5
- Security standards, procedures and frameworks6
- Information security governance and information assurance5
Security Operations15%18 questions
This domain looks at security from the operations side. It covers security architecture and its technical components, threat modeling, ways to find and rate vulnerabilities, and the common attacks that operations teams face.
Skills tested
- Explain architecture ideas such as defence in depth.
- List threats to a system with a framework such as STRIDE or attack trees.
- Rate vulnerabilities with CVE identifiers and CVSS scores.
- Tell ethical hacking, penetration testing and red teaming apart.
- Recognize common attacks, such as denial of service and DNS tunneling, from how they behave.
Questions by topic
- Threat modelling7
- Security architecture and operations6
- Vulnerability management5
The Security Lifecycle and DevSecOps10%13 questions
This domain follows information and systems through their life and asks where security belongs at each stage. It covers testing, software security, shadow IT and supply chain risk, then the DevSecOps pipeline and Agile development.
Skills tested
- Name the stages of the information lifecycle and a security concern at each one.
- Explain how shadow IT creates unmanaged data sources and applications.
- Explain why Cybersecurity Supply Chain Risk Management (C-SCRM) matters for bought-in software.
- Place security checks in each stage of the DevSecOps pipeline.
- Explain secure by design and the key concepts of Agile development.
Questions by topic
- DevSecOps6
- Information security lifecycle management7
Technical Security15%14 questions
A security manager must understand the technology being protected. This domain covers networks, protocols, cloud computing and containers, and how to secure infrastructure, from web servers and home working to encryption and public key infrastructure.
Skills tested
- Recognize network topologies, network types and common protocols.
- Compare cloud deployment models and their security considerations.
- Describe containers and their common vulnerabilities.
- Secure mobile computing, home working and BYOD.
- Explain encryption models, public key infrastructures and practical uses of cryptography.
Questions by topic
- Networks and network security8
- Securing IT infrastructure6
Physical and Environmental Security5%6 questions
One of the two smallest domains, it covers the controls that protect sites, equipment and media. Candidates describe access monitoring, intruder alerts, clear desk and clear screen rules, and secure disposal.
Skills tested
- Describe controls for entering physical sites and for monitoring that access.
- Explain clear screen and clear desk policies.
- Plan secure disposal of documents, equipment and devices that retain digital data.
Questions by topic
- Common physical security controls6
Disaster Recovery and Digital Forensics10%13 questions
This domain covers what happens after something goes wrong. Candidates describe incident response, plan and test disaster recovery, and follow the principles of digital forensics, including the chain of custody.
Skills tested
- Classify and prioritize security incidents, and know when to involve law enforcement.
- Link disaster recovery plans to risk assessment and impact analysis.
- Explain why plans need documentation, testing and secure off-site storage of vital material.
- Collect and preserve digital evidence so that it stays admissible.
Questions by topic
- Disaster recovery4
- Digital forensics5
- Incident response4
Emerging and Growing Technologies5%4 questions
The other small domain covers the security concerns of new and growing technologies. They include AI and machine learning, IoT, blockchain, 5G, quantum computing, big data, social media, and operational technology.
Skills tested
- Describe the risks that AI and machine learning bring, including AI-powered attacks.
- Explain why quantum computing threatens current encryption.
- Identify security concerns in IoT, OT and industrial control systems.
Questions by topic
- Security concerns of emerging technologies4
Requirements
- No formal prerequisites: BCS sets no entry requirements for CISMP.
- Recommended: basic working IT knowledge and an awareness of the issues around security controls.
- Recommended: a good standard of written English.
- Recommended: the approved book, Information Security Management Principles (4th Edition).
About the CISMP exam
CISMP gives people who manage information security a broad base in its principles, from risk and governance to incident response. Its nine domains also cover security operations, DevSecOps, physical security, digital forensics and emerging technologies. The syllabus includes privacy law too: the GDPR and the UK Data Protection Act 2018. There are no entry requirements. Passing earns the BCS Foundation Certificate in Information Security Management Principles, which does not expire.
The PlanetCert practice test has the most questions in Security Operations, one of four domains that share the largest weight on the exam. Explanations help most where two terms sound alike, such as risk appetite and risk tolerance, or a data controller and a data processor. Flashcard Mode suits the definitions in Information Security Principles and Physical and Environmental Security. Brainy AI Assistant can work through an annual loss expectancy (ALE) calculation step by step, or explain how the STRIDE model sorts threats.
How to earn the certification
- Earns
- BCS Foundation Certificate in Information Security Management PrinciplesFoundation
The certificate does not expire.
- After
- PCIRM BCS Practitioner Certificate in Information Risk Management
A practitioner certificate that takes the Information Risk domain much further.
- PC-DP BCS Practitioner Certificate in Data Protection
A practitioner certificate for staff who handle personal data under data protection law.
- PC-FOI BCS Practitioner Certificate in Freedom of Information
A practitioner certificate for staff who answer freedom of information requests.
- PCIRM BCS Practitioner Certificate in Information Risk Management
How to prepare for CISMP
- 1
Read the approved book by domain
BCS approves Information Security Management Principles (4th Edition) for this syllabus. Read it one domain at a time and list each term the syllabus names.
- 2
Work out a few risks by hand
Invent three risks for a small business and calculate the annual loss expectancy for each. Record them in a risk register with an owner, a treatment and a review date.
- 3
Compare the frameworks on one page
Make a table of the frameworks and schemes the syllabus names, such as Cyber Essentials and the CIS 18 Critical Security Controls. Note what each one covers and who uses it.
- 4
Drill look-alike terms in Flashcard Mode
Many questions turn on one word, such as authentication against authorization, or a data controller against a data processor. Drill these pairs until each one is quick to explain.
- 5
Finish with timed CISMP runs
Take the CISMP practice test in Timed Mode once every domain has been read. Review each miss, and ask Brainy AI Assistant to explain the idea behind it in plain words.
Start a timed CISMPrun
Who CISMP is for
- IT staff who are moving into information security, risk or compliance roles.
- Managers who need a working grasp of how security is governed and run.
- Data protection and audit staff who need the wider security picture.
Typical job titles: Information security analyst · Information security officer · IT risk analyst · Compliance officer · IT manager
CISMP glossary
18 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Annual Loss Expectancy (ALE)
- The yearly cost estimate for a risk: the loss from one event multiplied by how many times a year the event is expected.
- Business impact analysis (BIA)
- A study of how losing each business function would hurt the organization, used to set recovery priorities.
- Chain of custody
- The documented trail of everyone who collected, held or moved an item of evidence, which keeps it admissible.
- Clear desk policy
- A rule that staff leave no papers or removable media on their desks when they are away.
- Common Vulnerability Scoring System (CVSS)
- An open method that scores how severe a vulnerability is, on a scale from 0 to 10.
- Cyber Essentials
- A UK government-backed certification scheme for a set of basic technical security controls.
- Cybersecurity Supply Chain Risk Management (C-SCRM)
- Managing the security risks that come from the suppliers, products and services an organization depends on.
- Data controller
- Under the GDPR, the organization that decides why and how personal data is processed.
- Data processor
- Under the GDPR, an organization that processes personal data on behalf of a data controller.
- Defence in depth
- Layering several independent controls, so that an attacker who gets past one control still meets another.
- DevSecOps
- Development, security and operations working as one team, with security checks built into each stage of delivery.
- Information assurance
- Confidence that information stays accurate, available and protected, built through planned measures across an organization.
- Information Security Management System (ISMS)
- The policies, processes and controls an organization runs as one system to manage information security.
- Red teaming
- An exercise in which a team acts as a real attacker to test people, processes and technology together.
- Risk appetite
- The amount and type of risk an organization is willing to accept to reach its goals.
- Risk register
- A living record of each known risk, with its owner, its assessed level and the treatment chosen for it.
- Risk tolerance
- How far a specific risk may move from the risk appetite before the organization must act.
- Shadow IT
- Applications, devices or data sources that staff use without the approval or knowledge of the IT or security team.
Related practice tests
- AIDBABCS Advanced International Diploma in Business Analysis
- TM12BCS Certified Tester Advanced Level (2012)
- EC-AIBCS Essentials Certificate in Artificial Intelligence
- FC-AgileBCS Foundation Certificate in Agile
- FC-ACDBCS Foundation Certificate in Architecture Concepts and Domains