Vendor and third-party risk as a programme workstream - SkilBrill

Skip to content

Home
Courses
About
Contact
Blog
- Freshers

Search for:

Home - Lessons - CISM Certification Training (ISACA) - M3 — Information Security Program - Vendor and third-party risk as a programme workstream

CISM Certification Training (ISACA) Vendor and third-party risk as a programme workstream

CISM Certification Training (ISACA)

0% Completed

M1 — Information Security Governance

What governance is and how it differs from management

Aligning security objectives to business objectives explicitly

Organisational structure: reporting lines and where security sits

Policies, standards and the difference in enforcement weight

Legal, regulatory and contractual drivers, including DPDP for India

Security strategy, roadmap and the artefacts that prove direction

M2 — Information Security Risk Management

Risk context: asset, threat, vulnerability and likelihood stated plainly

Risk identification and risk register discipline

Analysis: qualitative versus quantitative, and what each can defend

Treatment: accept, avoid, mitigate, transfer and the decision record

Risk appetite, tolerance and how they change a decision in the room

Risk monitoring, review cadence and communicating movement

M3 — Information Security Program

Scoping the programme: what is in, what is explicitly out

Resource planning: people, budget, tools and the trade they imply

Control selection justified by risk rather than by benchmark

Programme measurement: metrics that change behaviour

Change management and integrating security into business change

Vendor and third-party risk as a programme workstream

M4 — Incident Management

Building the capability before the incident arrives

Classification, triage and the decision to declare

Roles, escalation and the chain of command under pressure

Containment and recovery as business decisions with a clock on them

Communication: regulators, customers, board and staff, in what order

Post-incident review and the follow-through that prevents recurrence

M5 — Metrics, Assurance and Reporting

Choosing measures that answer a management question

Leading versus lagging indicators and their honest limits

Control assurance: testing, attestation and independent review

Maturity models used as a roadmap rather than a trophy

Board reporting: risk movement in a page, not a tool inventory

Connecting incidents, audits and risk movement into one story

M6 — Building the Security Organisation

Roles, spans of control and when to hire versus contract

Competence, training plans and succession for key positions

Security awareness as a measured programme with outcomes

Operating model options: centralised, federated and hybrid

Working with legal, HR, audit and engineering without friction

Culture: how security becomes a shared responsibility

M7 — Control Strategy and Assurance

Prevent, detect, respond and recover as a balanced portfolio

Compensating controls and when they are genuinely acceptable

Framework mapping: ISO 27001, NIST CSF and what mapping does not prove

Independent assessment, penetration testing and audit inputs

Exception management: who approves, for how long, with what risk

Turning findings into backlog the business will fund

M8 — Capstone: Practice Exams and Exam-Day Strategy

A full timed practice exam under real conditions

Scoring by domain to isolate judgement gaps from recall gaps

ISACA answer style: the management answer, not the technical one

Scenario stems where the technical fix is the wrong choice

Exam-day time budget and review pass order

A two-week revision plan built from the domain scores

Announcements Course Info

Global Trusted Software Training Partner Since 2022

SkilBrill Training Institute delivers industry-focused technology education that bridges the gap between academic learning and real-world demands. Our structured programs combine foundational theory with practical application, ensuring every graduate is confident and job-ready from day one.

Learn More About Us

© 2026 SkilBrill Training Institute. All Rights Reserved. Privacy Policy Terms Refunds Outcomes

📞 Enroll Now

Start Your Journey

Fill in your details and our team will get back to you within 24 hours

Please enable JavaScript in your browser to complete this form.

Full Name *

Email *

Course Interested In *

Mode of Course *