CISM: Certified Information Security Manager

Implementing security controls after deployment often requires retrofitting an existing system, changing established architecture and configurations, retesting functionality, and potentially disrupting operations. Security is more effectively built into the design and development phases.

Enforcing standard system configurations based on secure configuration benchmarks hardens servers by disabling unnecessary services, applying secure settings, and reducing common misconfigurations that attackers can exploit. Monitoring, logging, and host-based IDS provide detection or investigation capabilities but do not prevent the underlying vulnerabilities from being exposed.

Business continuity planning starts by identifying critical business processes so the organization can assess their disruption impact and establish recovery priorities. Recovery strategies, resource requirements, and application recovery objectives follow from that analysis.

Effective risk treatment requires the implementation of corrective actions or other selected measures to address identified risk. Risk is managed to an acceptable level rather than necessarily eliminated.

Acceptance of residual risk for a business use that does not comply with security policy requires authorization by senior business management, because that level is accountable for accepting risk to organizational operations. Security, compliance, and risk officers provide assessment, oversight, or advice rather than assuming the business risk. NIST describes authorization as a senior-official decision to explicitly accept organizational risk.