CISA quick review

Memory hook: Audit the greatest exposure; preserve the right to disagree.

Must remember

An audit charter establishes purpose, authority and responsibility. Organizational independence and individual objectivity let auditors report findings without inappropriate influence. Disclose conflicts and avoid auditing controls for which you recently held operational responsibility without suitable safeguards. Advisory work must not quietly turn the auditor into the control owner.

Plan from the organization’s objectives, critical processes, obligations and assessed risk. Define scope, criteria, resources and timing, considering prior findings and change. A risk-based audit plan is not simply a rotation that gives every system equal attention. Reassess when a major acquisition, incident or platform change alters exposure.

Distinguish financial, operational, compliance, integrated and specialized technology reviews by their objectives. Preventive controls aim to stop unwanted events; detective controls reveal them; corrective controls support recovery. General IT controls such as access/change management influence many applications, while application controls address specific processing.

Agree factual scope and logistics without letting auditees veto unfavorable conclusions. Manage the audit as a project with evidence milestones and quality review. Communicate significant limitations promptly: an inability to obtain logs can limit assurance even when no incident is found.

Choose under exam pressure

Traps

• Management owns controls; audit provides independent evaluation.
• No detected problem is not proof that risk is absent.

Practise this topic

Memory hook: Sufficient quantity, appropriate quality, traceable conclusion.

Must remember

Evidence must be relevant, reliable and sufficient for the objective. Inquiry alone is usually weaker than corroborated records, observation or reperformance. Observation proves what happened while observed, not necessarily the entire audit period. Evaluate source integrity and completeness before relying on an export or dashboard.

Compliance/control testing checks whether controls operated as designed; substantive testing examines transactions or outcomes directly. Attribute sampling estimates a control-deviation rate; variable sampling addresses numerical values. Statistical methods support quantified sampling risk; judgmental selection can target risk but does not automatically support population-wide statistical conclusions.

Verify the population, period and selection method. Sample size depends on tolerable deviation/error, expected deviation and desired assurance, not only population size. Data analytics can examine larger populations for duplicates, gaps, unusual timing or rule violations, but false positives and incomplete source data still require investigation. AI-generated audit explanations need independent evidence.

A finding connects condition, criteria, cause and effect/risk, then recommends proportionate action. Validate factual accuracy with management while preserving independent judgment. Assign an owner and target date; report material matters to the proper governance level. Follow-up verifies remediation or authorized risk acceptance, rather than accepting a status label as proof.

Choose under exam pressure

Traps

• A large sample of an incomplete population can still mislead.
• An exception is not automatically fraud.

Practise this topic

Memory hook: Protect people; understand the business; assign the risk owner.

Must remember

For management scenarios, establish the business objective, scope, authority and acceptable risk before selecting a product. That does not mean delaying urgent safety or containment actions while conducting a lengthy committee review. Read whether the question asks for the first action, strongest control or long-term program improvement.

Professional ethics prioritize the public interest and trust, lawful and honest conduct, competent service to principals and the profession's development. Conflicting instructions require escalation through appropriate authority; employment does not justify unlawful conduct. Due care is reasonable protective action; due diligence is the continuing investigation and verification supporting that care.

Business owners accept residual risk; security specialists analyze and advise. Governance sets direction and accountability; management implements it. Frameworks serve different purposes: NIST CSF organizes outcomes, ISO 27001 specifies an information-security management system, COBIT addresses enterprise governance of information/technology, and SABSA connects security architecture to business attributes. PCI DSS addresses its defined payment-data environment; FedRAMP concerns assessment/authorization of relevant US federal cloud offerings. Choose by scope and need rather than assuming one framework replaces law.

Personnel controls span lawful screening, agreements, onboarding, transfer, monitoring and termination. Separation of duties reduces single-person abuse; job rotation and mandatory absence can expose concealed activity. Contractors, acquisitions and divestitures require the same deliberate review of inherited identities, data and obligations.

Threat modeling starts with assets, data flows and trust boundaries. STRIDE helps examine spoofing, tampering, repudiation, disclosure, denial of service and privilege escalation; attack trees break a goal into paths. Models guide controls and abuse tests, then evolve with the system.

AI adoption adds data provenance, privacy, output verification and delegated-action risks. Decide who owns model/use-case risk and how outcomes will be monitored, rather than treating a vendor promise as assurance.

Choose under exam pressure

Traps

• “Think like a manager” does not mean ignore immediate human safety.
• Compliance certification does not transfer the organization’s accountability.

Practise this topic

Memory hook: Fund the capability, assign an owner, test the result.

Must remember

Build a roadmap from current-state gaps to target outcomes, with dependencies, staffing, budget and milestones. Integrate security into procurement, development, HR and operations instead of relying on a separate review at the end. Asset inventory and classification identify what needs protection and who can decide its handling.

Select preventive, detective and corrective controls with operational feasibility in mind. Test design effectiveness and operating effectiveness separately: a well-written access-review procedure may never be followed. Retain evidence, address exceptions and verify remediation. Compensating controls require demonstrable coverage of the original risk, not just convenient substitution.

Awareness programs address broad behavior; role-specific training prepares people such as developers, administrators and responders. Measure demonstrated behavior and exposure reduction alongside completion. A high training-attendance rate can coexist with unsafe credential handling.

Supplier due diligence examines criticality, data access, security practices, continuity, subcontractors and exit options. Contracts define responsibilities, incident notification, audit rights, service levels and secure data return/deletion. Review assurance-report scope, period and exceptions, including customer responsibilities. Ongoing monitoring is necessary because a supplier’s condition can change after onboarding.

KPIs track performance, KRIs signal changing exposure, and control indicators show whether safeguards operate. Choose measures with thresholds, owners, trend context and a decision they support. Report unresolved exceptions and accepted risks honestly. A lower incident count could reflect weaker detection rather than improved security.

Choose under exam pressure

Traps

• Certification badges do not eliminate supplier risk.
• A metric without an action threshold may become decorative reporting.

Practise this topic

Memory hook: Build the control into the path that ships code.

Must remember

Security starts in requirements and design, continues through implementation/testing and remains necessary during operation and retirement. Waterfall, Agile and DevSecOps change delivery organization, not the need for risk decisions. Maturity models assess repeatability and capability; they do not certify that a particular application is vulnerability-free.

Define abuse cases and trust boundaries before coding. Use server-side authorization for every protected object/action, parameterized queries, context-appropriate output encoding, bounds checking, safe memory patterns and structured error handling. Client-side validation improves usability but is not a trusted enforcement point. Prevent secrets from entering source code, build logs and artifacts.

Secure the development ecosystem: repositories, branch protections, reviewers, build runners, dependencies, artifact registries, signing keys and deployment identities. Separate build from approval/deployment authority where needed. An SBOM inventories components; provenance records how an artifact was produced; signatures establish integrity and issuer within a trust system. None alone proves the software has no vulnerability.

Use SAST, DAST, SCA and appropriate manual review at complementary stages. Verify fixes with regression and abuse tests. Threat modeling and architecture review catch issues that scanners may miss. Purchased, open-source, SaaS and custom software all require risk assessment, support/patch obligations and exit planning.

AI-enabled development and applications add untrusted generated code, prompt injection, sensitive-data leakage, model supply-chain risks and excessive agent permissions. Treat generated output as untrusted; validate code and data before use. Retrieval authorization must follow the user's permissions, and tool execution needs explicit, narrow authority. Monitor model/application changes as production changes.

Assess software security with meaningful outcomes: escaped defects, time to remediate, verified control coverage and supply-chain integrity. A pipeline that merely runs a scanner without acting on results is not effective assurance.

Choose under exam pressure

Traps

• Open source is not automatically safe or unsafe.
• A signed malicious artifact remains malicious.

Practise this topic

Memory hook: Prepare authority before the crisis; recover the business, not just servers.

Must remember

Define incident categories, severity criteria, decision rights and escalation paths before an incident. Train a cross-functional team including security, IT, business owners, legal/privacy and communications as appropriate. Tabletop exercises test coordination; technical exercises test execution. Neither alone proves the whole response works.

A business impact analysis identifies critical activities, dependencies and disruption effects. RTO targets recovery duration; RPO targets tolerable data loss. Business continuity keeps essential operations functioning; disaster recovery restores supporting technology. An incident-response plan coordinates security handling and must align with both.

During an event, validate evidence, classify impact and activate the appropriate response. Containment limits harm; eradication removes causes; recovery restores trusted operation. Preserve evidence and action records under the authorized process. Management decisions may balance evidence preservation with urgent safety/continuity needs; follow established authority and expert advice.

Communicate verified facts to the right audience. Notification obligations depend on circumstances and applicable rules; involve the responsible specialists rather than inventing a universal reporting deadline. Protect sensitive investigative details and avoid speculative public statements.

After restoration, monitor for recurrence, confirm business acceptance and conduct a blameless but accountable review. Update controls, playbooks, training and risk assessments. Restoring a vulnerable backup without fixing the entry path can restart the same incident.

Choose under exam pressure

Traps

• Incident containment is not the same as complete recovery.
• A backup restore test does not replace a full continuity exercise.

Practise this topic

Memory hook: Trace objectives to decisions, owners and evidence.

Must remember

Evaluate whether IT strategy supports business strategy, with accountable decision bodies, resource allocation and performance oversight. Governance sets direction and monitors outcomes; management plans and operates within that direction. A committee name alone does not establish effective oversight.

Review enterprise architecture for coherent business, data, application and technology relationships. Uncontrolled exceptions can create duplicated capability and fragile dependencies. Policies, standards and procedures should be approved, communicated, current and enforced. Compare written intent with observed practice.

Data owners classify information and approve appropriate use; custodians implement handling; users follow requirements. Privacy governance includes purpose, minimization, retention, access and disposal. An inventory should connect systems, datasets, owners and criticality so risk decisions are not made from unknown assets.

Assess vendor selection, contracts, assurance and exit arrangements, including subcontractors and concentration risk. Evaluate resource capacity, skills, cost and quality management. KPIs measure performance, while KRIs help expose rising risk. Board reporting should disclose meaningful exceptions and trends rather than only favorable activity counts.

Choose under exam pressure

Traps

• An approved policy is not proof of enforcement.
• Outsourcing a service does not outsource all accountability.

Practise this topic

Memory hook: Authorize the need, build controls in, reconcile the move.

Must remember

Review the business case, feasibility, sponsorship and success measures before focusing on technical implementation. Assess whether the delivery method fits uncertainty, regulation and risk. Security, privacy, auditability and acceptance criteria belong in requirements, not only in a final penetration test.

Inspect separation between development, testing and production responsibilities, source control, approvals, testing and artifact integrity. Agile and DevOps require suitable controls adapted to frequent delivery; they do not justify unrestricted production changes. Emergency changes need controlled authorization and timely retrospective review.

System testing checks integrated behavior, user acceptance checks business requirements, and security/performance/recovery tests address different risks. Independent evidence and realistic test data matter. The business owner accepts business readiness; the auditor assesses the adequacy of the process and evidence rather than becoming the release owner.

For migration, examine mapping rules, completeness, accuracy, duplicates, rejected records and reconciliation totals. A successful file copy does not prove a correct conversion. Evaluate parallel, pilot, phased or direct cutover with rollback feasibility and business tolerance. Post-implementation review compares actual benefits, controls and defects with the approved case.

Choose under exam pressure

Traps

• User acceptance does not replace security or recovery testing.
• A rollback plan is useful only if data and dependencies can actually be restored.

Practise this topic

Memory hook: A completed job is not necessarily a correct business result.

Must remember

Review scheduled processing for authorized definitions, dependencies, restart handling, completion and exception escalation. Interface controls should validate completeness, accuracy, duplicate detection and rejected transactions. Reprocessing must not duplicate business effects. Logs need synchronized time, protected retention and appropriate access.

Asset/configuration records should reflect deployed reality. Change, patch and release processes manage different aspects of modification; check approvals, testing, rollback and emergency review. Capacity/availability monitoring must connect technical thresholds to service requirements. Incident management restores service; problem management addresses underlying causes.

End-user spreadsheets and shadow IT can perform critical calculations without formal development controls. Assess access, formula/version integrity, input validation, backups and ownership proportionate to business impact. A tool’s small size does not make its financial or operational risk small.

Database controls include least privilege, integrity constraints, transaction consistency, backups, recovery tests and monitoring of privileged changes. Replication can reproduce corruption; historical recovery remains important. Evaluate BIA-derived priorities, RTO/RPO, dependencies and exercises across business continuity and disaster recovery. An SLA is a commitment, not proof the service actually met it.

Choose under exam pressure

Traps

• Job exit code zero does not prove data completeness.
• A backup report is weaker than a successful representative restore test.

Practise this topic

Memory hook: Encrypt for secrecy; sign for origin; hash for comparison.

Must remember

Symmetric encryption uses a shared secret and is efficient for bulk data. Asymmetric cryptography uses a key pair for operations such as signatures or key establishment. TLS combines authenticated negotiation with efficient symmetric protection; it does not encrypt with a certificate as though the certificate were a secret key.

Hashing produces a digest without a decryption operation. Password storage needs a suitable salted password-hashing/key-derivation function with work cost; a fast unsalted hash is unsuitable. A salt is unique nonsecret input preventing identical passwords from sharing the same stored result. An HMAC uses a secret key to authenticate a message; a plain hash alone does not prove origin.

Digital signatures use a private signing key and public verification key. Encryption for a recipient and signing as a sender are different operations. PKI binds public keys to identities through certificates and trusted issuers. Validate chain, hostname/SAN, dates, intended use and revocation information such as CRLs/OCSP. A CSR requests issuance; a CA signs the certificate.

Key management includes generation, distribution, storage, access, rotation, revocation, backup and destruction. HSMs protect key operations; TPMs support device-bound measurements and key protection. Losing an encryption key without recovery can make intact backups unusable.

Tokenization replaces sensitive values with references, often using a protected mapping service. Masking obscures displayed data. Steganography hides the existence of a message; encryption hides meaning. Blockchain links records using cryptography and consensus but does not guarantee that input data was true.

Protect data in transit, at rest and in use with controls suited to each state. Cryptographic erase depends on effective key destruction and the absence of surviving usable key copies.

Choose under exam pressure

Traps

• Base64 is encoding, not encryption.
• A valid certificate does not prove the business behind a site is honest.

Practise this topic

Memory hook: Reduce exposure; separate trust; inspect the right layer.

Must remember

Security responsibility changes across IaaS, PaaS and SaaS. Customers retain responsibilities for their data, identities and configuration even when infrastructure is managed. Virtual machines share a hypervisor; containers normally share the host kernel. Isolation, patching and image provenance remain important.

Segment systems by sensitivity and function: user networks, guests, servers, management, IoT and operational technology. A screened subnet/DMZ hosts externally reachable services while restricting movement inward. Air gaps and logical isolation differ; removable media and maintenance paths can still introduce risk. Industrial systems prioritize safety and availability, so patching may require controlled maintenance and compensating safeguards.

Choose fail-open versus fail-closed behavior according to safety and availability requirements. A load balancer improves distribution/availability; it is not a substitute for authentication. Secure management interfaces separately from application traffic, prefer encrypted protocols and restrict administrative access.

Wireless protection includes WPA3 or appropriate enterprise authentication, secure onboarding, guest isolation and removal of legacy protocols. An evil twin imitates a legitimate network; validate the authentication server certificate in enterprise Wi-Fi rather than accepting any certificate prompt.

IaC makes configuration repeatable but also makes a bad template repeatable. Review plans, scan configurations, protect state and control deployment credentials.

Choose under exam pressure

Traps

• A VPN does not make the endpoint trustworthy.
• Containers are not equivalent to separate hardware trust boundaries.

Practise this topic