| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 15.5 - Security Management Processes & Collecting Security Process Data
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series covers the ongoing management routines from Domain 6 that keep a security program honest — the recurring reviews and measurements that catch quiet control drift early and turn oversight into a habit rather than an afterthought.
What this episode covers
- Security management reviews — the feedback loop that gives leadership oversight and deters insider abuse.
- Log reviews — centralizing data in a SIEM, synchronizing clocks, and scrutinizing privileged-user activity.
- Account management reviews — confirming permissions match entitlements via full checks or truly random samples.
- Backup verification — inspecting results, checking integrity values, and restoring files to prove recovery works.
- Training and awareness — initial and recurring training, plus phishing simulations that measure whether it sticks.
- Key performance and risk indicators — dashboards that turn scattered metrics into one honest program pulse.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
Why do security management reviews matter?
Management reviews form the feedback loop that watches over the whole security program. They give leadership real oversight, discourage insiders from abusing their access because someone is clearly watching, and generate valuable data that feeds other security tasks. Each review should follow a standard process and end with formal management approval.
How should organizations review their logs?
Centralize log data with a security information and event management (SIEM) platform, which gathers logs from devices and applications and automates much of the routine work. Every system’s clock must be synchronized so events from different sources line up on one timeline, and managers should review logs of sensitive actions to make sure privileged users are not abusing their power.
What is an account management review?
It verifies that users hold only the permissions they are supposed to, with no unauthorized additions. A thorough approach compares who actually has access against who should, though its cost usually limits it to privileged accounts; otherwise a truly random sample is checked. If administrators pick the sample or use loaded criteria, entire pockets of error will be missed.
How do you verify that backups and continuity controls actually work?
By testing them rather than trusting them. Managers should periodically inspect backup results by checking logs, verifying integrity values, or actually restoring a file to prove the backup works, and recovery and continuity controls should be tested regularly. An untested backup is only a promise, not a safety net.
How do you measure a security program’s health at a glance?
Track a handful of key indicators over time, such as the number of open vulnerabilities, how long they take to fix, how many accounts have been compromised, and how often audit findings recur. Gather them onto a dashboard posted where managers and the security team see it regularly, turning scattered data into a single pulse reading for the program.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 15.5 - Security Management Processes & Collecting Security Process Data.