The program is where strategy becomes capability. Part A — the highest-weight domain — builds the foundation: the program charter and architecture, and the controls framework that turns risk decisions into working safeguards.
Domain 3 is the largest on the exam at 33% — the security manager’s core job. A program is not a pile of tools; it is a chartered, resourced, and architected capability that executes the strategy. Part A covers how the program is established — its charter, scope, architecture, and resources — and the language of controls: their objectives, types, and categories, how to select them on a risk basis, and the foundational principles (least privilege, separation of duties, defense in depth) that make a control set coherent rather than a collection of point fixes.
Learning Objectives
By the end of this lesson you will be able to…
Establish a security program with a charter, scope, objectives, and a mandate aligned to strategy. Bloom: Create
Plan program architecture and resources — people, budget, tools, and roles. Bloom: Create
Classify controls by objective, type (preventive/detective/corrective), and category (administrative/technical/physical). Bloom: Apply
Select controls on a risk basis using frameworks, baselines, and defense in depth. Bloom: Evaluate
Apply least privilege, separation of duties, and need-to-know across the control set. Bloom: Apply
Key Terms
Program & controls vocabulary
👈 Tap a card to flip it. Domain 3 is a third of the exam — own this language.
Lesson Content
Study the material
1
The Security Program & Its Charter
Objective 1 · program charter
A security program is the chartered, resourced capability that executes the strategy and keeps risk within appetite. It begins with a charter — senior-management authorization that defines the program’s mandate, scope, objectives, authority, and reporting lines. Without that mandate, the manager has responsibility but no authority.
The charter answers: what is in scope, what the program must achieve, who it reports to, and what authority it carries.
Program objectives trace directly back to the security strategy and the business’s risk appetite.
Senior-management sponsorship is essential — it confers authority and signals tone at the top.
The program integrates with the enterprise (IT, legal, HR, risk), not as a silo.
💡 Exam TipWhen asked what to do first when establishing a security program, the answer is usually to obtain senior-management support and a charter/mandate — authority and alignment precede tools, controls, and hiring.
2
Program Architecture & Resources
Objective 2 · architecture and resources
Architecture is how the program’s people, processes, and technology fit together to deliver the strategy, sequenced into a roadmap. Resourcing it — budget, staffing, and tooling — is a management discipline in its own right; an under-resourced program fails regardless of strategy.
Roadmap: prioritized initiatives with owners, milestones, and dependencies, derived from the gap analysis.
Resources: justify budget in business terms, build the right skill mix, and decide build-vs-buy and in-house-vs-outsource.
Roles & responsibilities: define them clearly (often with a RACI) so accountability is unambiguous.
Integration: embed security into enterprise processes (change, procurement, HR) rather than bolting it on.
🔎 In practice
A manager inherits a toolset bought piecemeal with no roadmap. The right move is to step back to the strategy and architecture — map tools to control objectives and gaps — rather than buying yet another product to plug a symptom.
3
Control Fundamentals
Objective 3 · classifying controls
Controls are the safeguards that meet objectives and reduce risk. The CISM expects fluency in classifying them — by function (what they do in time relative to an event) and by category (their nature).
Control type
Purpose
Example
Preventive
Stop an incident before it happens
Access control, MFA, encryption, segregation
Detective
Identify that an incident is occurring/occurred
Logging, monitoring, IDS, reviews, audits
Corrective
Restore and remediate after an incident
Backups/restore, patching, incident response
Deterrent
Discourage an actor from attempting
Warning banners, visible cameras, policy
Compensating
Alternative when the primary control isn’t feasible
Extra monitoring where MFA can’t be deployed
Controls are classified by when they act on a threat: deterrent and preventive controls work before the event to lower likelihood; detective, corrective, and recovery controls work after it to limit impact. A compensating control stands in when the ideal control isn’t feasible.
💡 Exam TipAlso know the three categories: administrative (policy/training), technical/logical (encryption/access), and physical (locks/guards). A complete program uses all three — technology alone is never sufficient.
📚
Explore furtherCybersecurity Controls, Cryptography, and Access Control — interactive modules on control families, on encryption and PKI as protective controls, and on authentication and authorization.
In asymmetric encryption the keys are a linked pair: anyone can encrypt with the recipient’s public key, but only the matching private key — which never leaves the recipient — can decrypt. The exam’s recurring finding isn’t weak math, it’s weak key management.
4
Selecting Controls
Objective 4 · selecting controls
Controls are chosen to meet objectives that trace to risk — never adopted because they are popular or because a vendor pitched them. Selection is risk-based and cost-effective, drawn from frameworks and applied in layers.
Start from the control objective (the risk to reduce), then choose the control that meets it proportionately.
Use framework catalogues (ISO 27002, NIST 800-53) and baselines to ensure completeness and consistency.
Apply defense in depth — layered, independent controls so one failure isn’t catastrophic.
Weigh cost against the risk reduced; a control should not cost more than the risk it mitigates.
🔎 In practice
Asked to ‘add the latest AI security tool,’ the manager first asks which control objective and risk it serves. If an existing layer already meets that objective, the spend is hard to justify — risk, not novelty, drives selection.
Try it — why the control set is layers, not a pile of tools
Defense in depth is math, not a slogan. Toggle each layer and watch the chance an attack gets all the way through — because each independent layer only has to be passed, the breach probability is the layers multiplied together. No single control is trusted alone, and raising the threat weakens every layer at once.
Interactive · adjust & explore
Your control set
Each layer blocks a share of attacks. Stack them.
40% · Moderate
A stronger adversary slips past every layer more easily.
Control layers — click to toggle
The odds
Layers active
—
Best single layer
—
Attacks blocked
—
Breach probability
—
——Toggle layers to see the odds change.
How far an attack gets
Of 100 attacks, the red line is the share still alive after each layer — it drops as layers compound, and each new layer removes less than the last (diminishing returns).
🔎 In practice
Two management lessons fall out of the math: no single control is trusted alone (which is why an auditor looks for at least two independent layers), and because prevention is never 100%, a mature program pairs preventive layers with detection and response so a failure is caught, not fatal.
5
Foundational Control Principles
Objective 5 · control principles
A handful of principles keep a control set coherent and are tested repeatedly. They are management principles as much as technical ones — the manager designs the program around them.
Least privilege: minimum access necessary, limiting blast radius from error or compromise.
Separation of duties: no single person can complete a sensitive transaction alone, deterring fraud and unilateral error.
Need-to-know: access to information is limited to those whose role requires it, independent of clearance level.
Defense in depth: layered, independent controls across people, process, and technology. (applied under fire in Lesson 6 — incident response)
Defense in depth layers independent controls around the asset — policy and people on the outside, then physical, network, host, and application controls around the data at the core. No single layer is trusted alone; an attacker must defeat every layer, so one failure never exposes the asset.
💡 Exam TipLeast privilege limits how much access; separation of duties splits who can do a task; need-to-know limits which information is visible. Don’t conflate them — the exam tests the distinctions.
Scored Knowledge Check
Test your program judgment
Eight questions on building the program and selecting controls. Answer as the manager who runs the program, not the engineer who configures a box.