What is CISSM?

CISSM generally refers to Certified Information Systems Security Manager, a cybersecurity and information-security management-focused certification or training program. The primary purpose of CISSM is to help professionals understand how to Manage, Protect, and Govern an Organization’s Information Systems and Cybersecurity Environment. While certifications such as CEH mainly focus on ethical hacking and understanding how attackers identify and exploit vulnerabilities, CISSM is more focused on the Management, Planning, Governance, Risk Management, Policies, Security Controls, and Overall Protection of Information Systems.

An information security manager has an important role in an organization because modern businesses depend heavily on computers, networks, servers, cloud services, databases, applications, and digital information. These systems can be exposed to threats such as malware, ransomware, phishing, unauthorized access, data theft, insider threats, network attacks, and misconfiguration. CISSM-related training helps professionals understand how to identify these risks and develop appropriate security strategies to reduce them.

One of the major areas of CISSM is Information Security Management. This involves creating and maintaining a structured security program for an organization. A security manager needs to understand what information and systems are important, what threats could affect them, what vulnerabilities exist, and what security controls should be implemented. The manager also needs to ensure that security policies are properly documented and followed by employees.

Another important area is Risk Management. No organization can eliminate every cybersecurity risk completely. Instead, security managers identify risks, analyze their potential impact, determine their likelihood, and prioritize them. For example, a company may have a database containing customer information. If that database is compromised, it could cause financial loss, legal problems, reputational damage, and loss of customer trust. A security manager must therefore determine the appropriate controls to protect that database.

CISSM also focuses on Security Policies and Procedures. An organization should have clear rules explaining how employees should use company computers, passwords, email, internet access, mobile devices, cloud services, and sensitive information. Security policies can also define procedures for account management, access control, backup, incident reporting, remote access, and acceptable use of company resources.

Access control is another important concept. Not every employee should have access to every system or piece of information. A security manager may implement the principle of least privilege, where users receive only the permissions required to perform their jobs. For example, an accounting employee may need access to financial applications but may not need administrative access to network infrastructure.

CISSM also involves incident management and response. Even organizations with strong security controls can experience cybersecurity incidents. A security manager must help establish an incident-response plan that defines what should happen when an incident occurs. This can include identifying the incident, containing the affected systems, investigating the cause, removing the threat, recovering systems, and documenting the incident.

Another important topic is business continuity and disaster recovery. Organizations need to be prepared for events such as ransomware attacks, hardware failures, power outages, natural disasters, accidental data deletion, or major network failures. Security management therefore includes planning for backups, recovery procedures, redundant systems, and alternative infrastructure so that critical business operations can continue.

CISSM also introduces concepts related to Security Governance and Compliance. Organizations often need to follow internal security policies, industry requirements, contracts, and applicable laws or regulations. A security manager helps ensure that the organization’s security practices are properly documented, monitored, and aligned with its business requirements.

Security Awareness is another major part of information security management. Employees can become an organization’s weakest security point if they are not properly trained. For example, an employee may accidentally click a phishing link, use a weak password, share confidential information, or install unauthorized software. Security managers therefore help create awareness programs and training so employees understand common cybersecurity risks.

CISSM is also related to Security Architecture and Controls. A security manager should understand technologies such as firewalls, VPNs, intrusion detection and prevention systems, endpoint security, antivirus/EDR, identity and access management, encryption, network segmentation, logging, monitoring, and backup systems. The manager does not necessarily need to configure every device personally, but should understand what each technology does and how it contributes to the organization’s security strategy.

For example, consider a company with 500 employees, multiple offices, servers, Wi-Fi networks, cloud applications, and a database. A CISSM-oriented security professional would help determine how users should authenticate, how network access should be controlled, how sensitive data should be protected, how logs should be monitored, how backups should be maintained, how incidents should be handled, and how security risks should be reported to management.

CISSM is therefore more Management-Oriented than purely technical hacking certifications. A CEH professional may focus on finding vulnerabilities and understanding attack techniques, while an information security manager focuses on questions such as: What are our biggest risks? What security controls do we need? What policies should we implement? How much security investment is required? How do we respond to an incident? How do we protect critical business information?

For someone working in networking, system administration, firewall management, server administration, or IT infrastructure, learning information security management can be very useful. It provides a broader understanding of how technical security technologies fit into an organization’s overall security strategy.