Rule Atlas
ISO/IEC 27001: Establishing Information Security Strategy: PSPG & Compliance
Under ISO/IEC 27001 (ISACA / ISO/IEC 27001 / NIST CSF), establishing Information Security Strategy: PSPG & Compliance establishes the authoritative rules tested on the ISACA CISM. Mastering the hierarchy of policies, standards, procedures, and guidelines (PSPG) and ensuring robust legal, regulatory, and contractual compliance for effective information security governance. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISM blueprint.
Core Statutory Concepts
| Type of Compliance | Description | Examples | Impact on CISM |
|---|---|---|---|
| Legal | Laws and statutes enacted by governmental bodies. Mandatory for organizations operating within specific jurisdictions or industries. | GDPR (EU), CCPA (California), HIPAA (healthcare), Sarbanes-Oxley Act (SOX) (public companies) | Requires mapping legal provisions to security controls and ensuring auditability. |
| Regulatory | Rules and regulations issued by governmental agencies or industry bodies to enforce laws. Often provide more specific guidance than laws. | PCI DSS (payment card industry), FERC/NERC (critical infrastructure), SEC regulations (financial) | Demands detailed understanding of sector-specific rules; often includes reporting requirements and audit cycles. |
| Contractual | Obligations agreed upon with third parties (customers, vendors, partners) through contracts, SLAs, or business agreements. | NDAs, BAA (HIPAA), data processing agreements, supply chain security clauses | Necessitates due diligence on third parties, integrating contractual requirements into internal PSPG, and demonstrating adherence. |
A newly appointed CISM is tasked with establishing a robust information security strategy for a growing enterprise. This strategy must clearly articulate management's direction and commitment to protecting information assets. What is the foundational element that formally establishes the high-level directives for information security within the organization?
Practitioner Application: Establishing Information Security Strategy: PSPG & Compliance
You've just been appointed CISO of a rapidly growing tech startup. The CEO expects a comprehensive information security program to be established within six months, covering everything from employee behavior to data handling, and ensuring compliance with GDPR, SOC 2, and upcoming industry-specific regulations. You realize that a strong governance framework is the bedrock, but where do you start with defining the rules, and how do you ensure adherence across a dynamic organization while meeting diverse compliance mandates? The exam will test your ability to prioritize and structure these foundational elements.
- Effective information security governance relies on a well-defined hierarchy of documented directives. These direct the organization's approach to managing information security risks and ensuring business objectives are met. The CISM role requires understanding the distinct purpose and relationship of Policies, Standards, Procedures, and Guidelines (PSPG).
- Policy: A high-level, mandatory statement of management's intent and expectations regarding information security. It outlines what must be achieved and why. Policies are driven by legal, regulatory, and business requirements. For example, an 'Acceptable Use Policy' or 'Data Classification Policy'. Standard: A mandatory specification for technologies, processes, or configurations that supports a policy. Standards define how policies are to be implemented consistently across the organization. For example, a standard might specify encryption algorithms or minimum password complexity. Procedure: A detailed, step-by-step instruction for performing a specific task or process. Procedures explain how to achieve a standard or policy requirement. They are often department-specific and ensure repeatable, consistent execution. For example, a 'Procedure for Incident Response Handling' or 'Procedure for Employee Onboarding/Offboarding'. Guideline: A non-mandatory recommendation or best practice that suggests how to achieve a policy, standard, or procedure. Guidelines offer flexibility and are useful in situations where strict adherence isn't practical or where innovation is encouraged. For example, 'Guidelines for Secure Remote Work'.
Common ISACA CISM Distractors on ISO/IEC 27001
- 1PSPG Hierarchy: Policies (what/why) > Standards (how to comply) > Procedures (step-by-step how-to) > Guidelines (recommendations).
- 2Mandatory PSPG: Policies, Standards, and Procedures are mandatory; Guidelines are advisory.
- 3Compliance Drivers: Identify and differentiate between legal, regulatory, and contractual obligations.
- 4CISM Perspective: Always prioritize actions that establish, review, or enforce the governance framework over purely technical solutions.
- 5Iterative Process: PSPG development and compliance management are continuous processes requiring regular review, communication, and updates.
Frequently Asked Questions: ISO/IEC 27001
What is the core rule under ISO/IEC 27001 (Establishing Information Security Strategy: PSPG & Compliance)?
Under ISO/IEC 27001 (ISACA / ISO/IEC 27001 / NIST CSF), establishing Information Security Strategy: PSPG & Compliance establishes the authoritative rules tested on the ISACA CISM. Mastering the hierarchy of policies, standards, procedures, and guidelines (PSPG) and ensuring robust legal, regulatory, and contractual compliance for effective information security governance. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISM blueprint.
How is ISO/IEC 27001 tested on the ISACA CISM?
PSPG Hierarchy: Policies (what/why) > Standards (how to comply) > Procedures (step-by-step how-to) > Guidelines (recommendations). Mandatory PSPG: Policies, Standards, and Procedures are mandatory; Guidelines are advisory.
Where can I practice ISACA CISM questions on Establishing Information Security Strategy: PSPG & Compliance?
Test yourself instantly with the free playable ISACA CISM question on this page, or launch VoraPrep's full ISACA CISM adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cism.