C | CISO

Domain 1: Governance, Risk, Compliance

Domain 2: Information Security Controls and Audit Management

Domain 3: Security Program Management & Operations

Domain 4: Information Security Core Competencies

Domain 5: Strategic Planning, Finance, Procurement, and Third-Party Management

To earn the C|CISO, every applicant must pass the exam covering all 5 C|CISO domains, regardless of experience in each domain. The exam consists of 150 multiple-choice questions administered over a two-and-a-half-hour period. The questions on the exam require extensive thought and evaluation. There are three cognitive levels tested on the C|CISO exam: Level 1 Knowledge: This cognitive level of questions is used to recall memorized facts. This is the most basic cognitive level rarely accepted on certifications as it merely recognizes the candidate’s ability to memorize information. It can be effectively used when asking for basic definitions, standards or any concrete fact. Level 2 Application: This cognitive level of questions is used to identify the candidate’s ability to understand the application of a given concept. It differs from Knowledge based questions in the sense that it requires the understanding and correct applicability of a given concept – not just the concept itself. This type of question often quires additional context before the actual question is provided in the stem. Level 3 Analysis: This cognitive level of questions is used to identify the candidate’s ability to identify and resolve a problem given a series of variables and context. Analysis questions differ greatly from Application based questions in the sense that they require not only the applicability of a concept but also how a concept, given certain constraints, can be used to solve a problem.