Privacy, Risk & Compliance

The CMMC Certified Professional role sits at the entry point to formal CMMC assessment work. It requires more than recognizing cybersecurity terminology because candidates need to understand the CMMC ecosystem, model structure, assessment expectations, professional conduct, evidence, and the responsibilities of organizations seeking certification. The credential establishes the foundation required before someone progresses toward the Certified CMMC Assessor path. ISACA CCP is the current CMMC Certified Professional credential. ISACA now serves as the authorized CAICO for CMMC training, examination, and certification, while The Cyber AB continues important ecosystem and marketplace…

Incident management becomes a governance problem long before an alert is created. Organizations need agreed severity definitions, decision rights, evidence expectations, communications paths, continuity dependencies, and review obligations before responders are under pressure. That is the shared ISACA lens across management, audit, and emerging AI-security responsibilities: incidents must be handled as controlled business events rather than isolated technical failures. The ISACA CISM, CISA, and AAISM credentials emphasize different roles, but all benefit from clear incident governance. As of October 28, 2026, CISM still uses its prior outline, with the updated…

Information-systems audit planning is the discipline of turning a broad concern into a defensible examination. The auditor has to know what objective is being assessed, which risks make the work important, what criteria define acceptable control, what evidence can support a conclusion, and how much testing is enough. Weak planning creates one of two failures: an audit that collects large amounts of data without answering a clear question, or an audit that reaches a strong-sounding conclusion from evidence that was too narrow. The direct ISACA CISA target is the relevant…

AI governance becomes useful when an organization can answer five questions without improvising: which AI systems exist, who is allowed to make which decisions, what controls apply at each stage, what evidence supports those decisions, and what happens when the system or its context changes. Policies and frameworks matter, but they do not govern anything by themselves. An operating model turns principles into accountable work. IAPP’s AIGP body of knowledge and training curriculum span AI foundations, responsible principles, laws and standards, risk management, development governance, and deployment governance. AI governance…

An AI risk assessment is useful only if someone can follow its reasoning from the system context to the final decision. Labels such as low, medium, or high risk are not evidence. A defensible assessment defines what is being evaluated, which harms matter, who may be affected, what controls exist, how those controls were tested, what uncertainty remains, and who accepted the residual risk. IAPP’s AIGP curriculum explicitly includes AI risk management, development governance, and deployment assessment. The IAPP AIGP tests those governance decisions; assessment quality depends on scope, evidence…

Privacy by design for AI begins before model training and continues after deployment. AI systems can copy, transform, infer, retain, retrieve, and expose personal information in ways that are difficult to see from a traditional application data-flow diagram. Treating privacy as a launch-time checklist misses the architectural decisions that determine what data enters the system, what the model can memorize or infer, what users can retrieve, and how information is removed when the purpose ends. IAPP’s AIGP body of knowledge explicitly includes privacy-law intersections and governance of data collection and…

Information security governance is the mechanism that turns business priorities into security decisions that can be owned, funded, measured, and challenged. ISACA credentials approach that problem from different professional angles. CISM emphasizes security strategy and program leadership, CISA evaluates governance and management through an assurance lens, and AAISM extends governance into AI security programs. The common thread is accountability: someone must have authority to make decisions, evidence to judge whether controls work, and metrics that show whether security supports the enterprise rather than merely consuming resources. This governance treatment is…

Security risk management is useful only when it changes decisions. A risk register that lists threats but does not influence investment, architecture, vendor choices, exceptions, or business priorities is documentation rather than management. ISACA’s credentials approach risk from complementary angles: CISM emphasizes management and treatment, CISA evaluates risk and controls through governance and assurance, and AAISM applies the same discipline to AI systems, data, vendors, and emerging threats. The risk discussion keeps a shared ISACA lens while remaining distinct from CISSP-oriented security-risk governance and from a CISM-only domain guide. The…

CISA approaches governance from an auditor’s viewpoint. The question is not whether an organization can describe an IT strategy or point to a governance committee. The auditor needs to determine whether decision rights, policies, resources, architecture, risk management, vendor oversight, and performance reporting actually support enterprise objectives and produce evidence that can withstand challenge. The current CISA assigns 18 percent to Governance and Management of IT. That domain covers laws and standards, organizational structure, IT strategy, policies and practices, enterprise architecture, enterprise risk management, privacy and data governance, resource management,…

CISA Domain 4 asks whether technology operations can deliver reliable service and recover when ordinary controls are not enough. It joins daily operational disciplines—assets, capacity, incidents, change, patching, logging, service levels, and databases—with business-impact analysis, backup, continuity, and disaster recovery. That combination reflects an auditor’s real job: operational weakness and resilience weakness are often different stages of the same failure chain. The current CISA assigns 26 percent to Information Systems Operations and Business Resilience. This domain asks auditors to evaluate whether operations and recovery practices support organizational objectives, using evidence…

Know Your Customer and customer due diligence are often treated as onboarding tasks, but effective due diligence follows the relationship throughout its lifecycle. The purpose is not simply to collect identification documents. It is to establish who the customer is, who ultimately owns or controls the relationship, why the relationship exists, what activity is expected, what risk factors are present, and what additional evidence is needed when risk is higher. The current CAMS includes KYC, CDD, enhanced due diligence, customer risk assessment, beneficial ownership, source-of-funds/source-of-wealth concepts, PEP and sanctions considerations,…

Transaction monitoring is one of the places where an anti-financial-crime program becomes operational. Policy may define risk appetite and customer due diligence may establish an expected profile, but monitoring has to detect when actual activity no longer fits that expectation. For CAMS candidates, the useful mental model is not “a system raises an alert.” It is a controlled process that turns risk hypotheses into scenarios, scenarios into alerts, and alerts into defensible decisions. The current CAMS treats transaction monitoring as part of the wider control environment rather than an isolated…

Sanctions compliance sits beside AML controls but asks a different first question. AML programs often investigate whether activity may represent proceeds of crime or suspicious behavior; sanctions controls ask whether the organization is prohibited or restricted from dealing with a person, entity, jurisdiction, activity, vessel, asset, or transaction under applicable regimes. The operational challenge is translating changing legal restrictions into reliable screening, due diligence, escalation, and blocking or reporting decisions. For the CAMS, sanctions should be understood as part of the broader anti-financial-crime control environment. Current ACAMS sanctions training emphasizes…

Information security governance is the mechanism that makes security accountable to the enterprise rather than leaving it as a collection of technical activities. It connects business objectives, risk appetite, legal and contractual obligations, security strategy, investment, decision rights, policies, and measurable results. That management perspective is central to CISM. As of October 5, 2026, the current CISM assigns 17% to Information Security Governance. ISACA has announced a new outline effective November 3, 2026, where Governance becomes 18% and the updated material adds more emphasis on enterprise architecture and information security…

Information security risk management in CISM is not a vulnerability-remediation exercise. It is a management process for identifying uncertainty that matters to the enterprise, understanding its business effect, assigning ownership, choosing a response, and monitoring whether the resulting risk remains acceptable. Technical findings are inputs to that process, not the process itself. As of October 5, 2026, the current CISM assigns 20% to Information Security Risk Management. ISACA has announced a revised outline effective November 3, 2026; the risk-management domain remains 20%, and candidates testing on or after that date…