ISMP Information Security Management Professional based on ISO/IEC 27001 Exam Topics and Questions

This topic sets the frame for everything else on the exam. It asks you to think about information security from two directions at once: the organisation that owns and classifies information, and the external parties it depends on or serves. Where candidates lose ground here is in the governance and outsourcing questions, where the right move is rarely obvious and depends on reading the scenario carefully rather than applying a generic principle.

– Why information has business value and what that means for managing it

Not all information is equal, and the exam expects you to act on that distinction. Assets differ in sensitivity, criticality, and the consequences of their loss or corruption. Knowing how to distinguish types of information by business value lets you prioritise controls proportionately rather than uniformly, which is what ISO/IEC 27001 actually demands.

The management system angle matters here too. A management system for information security is not a technical platform; it is a structured set of policies, processes, roles, and reviews that an organisation operates continuously. The exam tests whether you understand what makes such a system function as a system, including how its components relate to each other and to business objectives, rather than whether you can recite a definition.

– Governance when the boundary of the organisation extends outward

Outsourcing shifts accountability without eliminating it. When services move to a supplier, the customer organisation retains governance obligations, and the exam probes exactly where those obligations sit. You need to be able to explain why information governance does not stop at the contract boundary, and to recommend a supplier on the basis of the security controls they can demonstrate, not just on cost or capability.

The supplier side of this relationship is equally testable. Service management processes each carry security aspects, and the exam expects you to distinguish which aspects belong to which process rather than treating service management as a single undifferentiated area. Compliance support rounds out this group: understanding what it means to support compliance activities, as distinct from owning them, is a practical distinction the exam draws on in scenario questions.

How Information security perspectives is tested

At 10%, this topic produces a small number of items, but they tend to be scenario-based and require you to apply a perspective rather than recall a fact. A typical item places you in a customer or supplier role and asks what action or recommendation follows from the governance or compliance situation described. Items reward the candidate who reads the role in the scenario carefully: whether you are acting as the customer assessing a supplier, or as the supplier supporting a compliance obligation, changes which option is strongest.

The classification of information by business value also appears in items where the trap is treating all information as equally sensitive. Candidates who default to maximum protection for everything, or who ignore the outsourcing governance thread entirely, tend to lose marks here. The stronger approach is to match the level of control to the value and context of the asset, and to recognise that governance obligations travel with the data even when delivery does not.

After the framing work of the first topic, risk management is where the exam starts demanding calculation and judgment together. At 30% of the total marks, this is the topic most likely to decide your result. The syllabus moves from analysis principles through quantifying and classifying risks on specific assets, to selecting and justifying controls, to handling whatever risk remains after controls are applied. Each of those steps is individually testable, and the connections between them are tested too.

– Analysing and quantifying risk

Risk analysis on this exam is not a conceptual exercise. You are expected to identify which assets carry risk given their classification, then calculate a risk value from the components the ISO/IEC 27001 framework provides. The calculation items are among the most mechanical on the paper, but candidates still lose marks by misidentifying what counts as an asset or by confusing the input variables. Getting the analytical principles clear first makes the calculation steps follow logically.

Identifying risks for classified assets means linking threat and vulnerability to a specific asset category, not to a generic system. The exam often presents a scenario with several assets of different classifications and expects you to isolate which ones are actually at risk from a described threat. Precision here matters: a broad answer that covers everything scores no better than a wrong one.

– Selecting and applying controls

Once risks are quantified, the exam moves to control selection, and this is where the CIA triad becomes directly actionable. You need to categorise controls by whether they address confidentiality, integrity, or availability, and then choose among them based on where in the incident cycle a given control operates: before an incident, during it, or after. Those are different decisions, and the exam tests both.

Guidelines for applying controls are not interchangeable. The exam expects you to match a guideline to the situation it governs rather than apply a single framework to every scenario. Candidates who treat control selection as a checklist rather than a contextual judgment tend to pick options that are plausible but misaligned with the incident stage or the CIA dimension at stake.

– Residual risk and communicating decisions

No set of controls eliminates all risk, and the exam takes that seriously. You need to distinguish between the four standard risk strategies, including acceptance, and apply them to scenarios where the residual risk after controls is still meaningful. Accepting risk is not the same as ignoring it, and the exam draws that line deliberately.

Producing a business case for a control and producing a risk analysis report are both tested as practical skills, not as theoretical outputs. A business case item asks you to justify a control in terms the organisation's decision-makers would act on. A report item asks you to present findings in a way that supports a decision. Both reward candidates who understand the audience for each document and frame the information accordingly, rather than presenting technical detail for its own sake.

How Risk management is tested

Thirty percent of the exam sits here, so expect this topic to account for roughly a third of your items. The range of demand is wide: some items are calculation-based and reward accuracy; others are scenario judgments that reward applying the right risk strategy to a described situation. Candidates who have only studied the concepts without practising the calculation steps find the quantitative items costly.

The most common loss of marks comes from conflating risk identification with risk calculation, or from choosing a control that addresses the wrong CIA dimension for the scenario given. Control selection items are particularly tricky because multiple options may be technically valid controls; the strongest option is the one aligned to the incident cycle stage described in the scenario. Business case and report items reward candidates who can shift register from technical to managerial language. Producing numbers is not enough; framing them for a decision-maker is what those items are testing.

This topic carries the majority of the exam. Everything in the first two topics feeds into this one: the governance framing, the risk analysis, the control selection logic all reappear here as implementation questions. The syllabus splits controls into three families, and the exam tests each family differently. Organisational controls demand process knowledge and writing judgment; technological controls demand conceptual clarity about architecture and services; physical and people controls demand practical recommendation skills.

– Policies, procedures and the human organisation

Writing policies and procedures is a practical skill on this exam, not a theoretical one. Items in this area ask you to distinguish what belongs in a policy from what belongs in a procedure, and to identify gaps or errors in a described document. The distinction matters because a policy sets direction while a procedure specifies action, and conflating them is a mistake the exam constructs traps around.

Roles and responsibilities for information security must be implemented, not just described. The exam expects you to understand who owns what, how accountability is assigned, and what happens when a role is absent or unclear. Incident handling and awareness campaigns are both tested as activities you would design and run, not as concepts you would explain. An awareness campaign item might ask you to choose the approach most likely to change behaviour in a described organisational context, which is a judgment call that requires knowing what awareness programmes actually do.

– Business continuity as an organisational control

Business continuity planning sits within the organisational controls family on this syllabus, and the exam treats it as a support and testing activity rather than a design-from-scratch exercise. You are expected to know what supporting the development of a BCP involves and what a test of that plan is meant to demonstrate.

The testing angle is important. A BCP test is not just a rehearsal; it is a mechanism for identifying gaps between the plan and operational reality. Items in this area often describe a test scenario and ask what conclusion should be drawn or what action should follow. Candidates who treat BCP as a documentation exercise rather than an operational one tend to pick options that are procedurally correct but practically incomplete. The exam rewards the candidate who understands what a test is actually for.

– Technology: architecture, services and infrastructure

The technological controls sub-topics are tested at the level of purpose and rationale, not at the level of technical configuration. You are not expected to configure a firewall or design a PKI; you are expected to explain why a security architecture exists, what security services it provides, and why specific elements of the IT infrastructure matter from a security standpoint.

The distinction between a security architecture and a security service is worth being precise about. An architecture defines structure and relationships; a service delivers a capability. The exam constructs items where the two are easy to conflate, and the strongest option is the one that stays within the correct category. Infrastructure elements, such as network segmentation, logging, or identity management components, are tested in terms of what security property they protect rather than how they are implemented.

– Physical access and the employment life cycle

Physical controls and people controls are grouped together in the syllabus, and the exam treats them as recommendation tasks. You are presented with a scenario describing a physical environment or an employment situation and asked to recommend controls appropriate to it. Generic answers score poorly; the strongest option is calibrated to the specifics of the scenario.

Physical access controls span entry management, zoning, and visitor handling, among other areas. The exam expects you to match the control to the sensitivity of the area being protected. People controls across the employment life cycle cover pre-employment screening, onboarding, role changes, and departure. Each stage carries different risks and calls for different controls. Candidates who treat the employment life cycle as a single undifferentiated period tend to recommend controls that are correct in principle but misaligned to the stage described in the scenario.

How Information security controls is tested

At 60%, this topic dominates the exam. Most of your items will come from here, spread across all three control families. The organisational controls sub-topics tend to produce scenario-based items that ask you to write, recommend, or evaluate. The technological controls sub-topics tend to produce items that test your understanding of purpose and boundary. The physical and people controls sub-topics tend to produce recommendation items where the scenario detail determines the answer.

The most frequent source of lost marks is applying a control from the wrong family or the wrong stage. A physical access recommendation in an IT infrastructure context, or an awareness campaign proposed where a policy change is what the scenario calls for, are both traps the exam sets deliberately. Items reward candidates who read the scenario to identify which control family is relevant before evaluating the options. Business continuity items reward candidates who distinguish between plan development and plan testing as distinct activities with distinct outputs. Working across all three families in practice, rather than studying them sequentially, is the preparation approach that matches how the exam actually behaves.