2.1 Manage integration of security into Systems Development Life Cycle (SDLC) 

» Integrate information security gates (decision points) and requirements into lifecycle 

» Implement security controls into system lifecycle 

» Oversee security configuration management (CM) processes 

2.2 Integrate new business initiatives and emerging technologies into the security architecture 

» Integrate security into new business initiatives and emerging technologies 

» Address impact of new business initiatives on security posture 

2.3 Define and oversee comprehensive vulnerability management programs 

(e.g., vulnerability scanning, penetration testing, threat analysis) 

» Identify, classify and prioritize assets, systems and services based on criticality to business 

» Prioritize threats and vulnerabilities 

» Manage security testing 

» Manage mitigation and/or remediation of vulnerabilities based on risk 

2.4 Manage security aspects of change control 

» Integrate security requirements with change control process 

» Identify and coordinate with the stakeholders 

» Manage documentation and tracking 

» Ensure policy compliance (e.g., continuous monitoring) 

3.1 Develop and manage a risk management program 

» Identify risk management program objectives 

» Communicate and agree on risk management objectives with risk owners and other stakeholders 

» Determine scope of organizational risk program 

» Identify organizational security risk tolerance/appetite 

» Obtain and verify organizational asset inventory 

» Analyze organizational risks 

» Determine countermeasures, compensating and mitigating controls 

» Perform cost-benefit analysis (CBA) of risk treatment options 

3.2 Conduct risk assessments 

» Identify risk factors 

3.3 Manage security risks within the supply chain (e.g., supplier, vendor, third-party risk) 

» Identify supply chain security risk requirements 

» Integrate supply chain security risks into organizational risk management 

» Validate security risk control within the supply chain 

» Monitor and review the supply chain security risks

4.1 Establish and maintain threat intelligence program 

» Aggregate threat data from multiple threat intelligence sources 

» Conduct baseline analysis of network traffic, data and user behavior 

» Detect and analyze anomalous behavior patterns for potential concerns 

» Conduct threat modeling 

» Identify and categorize an attack 

» Correlate related security event and threat data 

» Create actionable alerting to appropriate resources 

4.2 Establish and maintain incident handling and investigation program 

» Develop program documentation 

» Establish incident response case management process 

» Establish incident response team 

» Apply incident management methodologies 

» Establish and maintain incident handling process 

» Establish and maintain investigation process 

» Quantify and report financial and operational impact of incidents and investigations to stakeholders 

» Conduct root cause analysis (RCA) 

5.1 Facilitate development of contingency plans 

» Identify and analyze factors related to the Continuity of Operations Plan (COOP) 

» Identify and analyze factors related to the business continuity plan (BCP) (e.g., time, resources, verification) 

» Identify and analyze factors related to the disaster recovery plan (DRP) (e.g., time, resources, verification) 

» Coordinate contingency management plans with key stakeholders 

» Define internal and external crisis communications plans 

» Define and communicate contingency roles and responsibilities 

» Identify and analyze contingency impact on business processes and priorities 

» Manage third-party contingency dependencies 

» Prepare security management succession plan 

5.2 Develop recovery strategies 

» Identify and analyze alternatives 

» Recommend and coordinate recovery strategies 

» Assign recovery roles and responsibilities 

5.3 Maintain contingency plan, Continuity of Operations Plan (COOP), business continuity 

plan (BCP) and disaster recovery plan (DRP) 

» Plan testing, evaluation and modification 

» Determine survivability and resiliency capabilities 

» Manage plan update process 

5.4 Manage disaster response and recovery process 

» Declare disaster 

» Implement plan 

» Restore normal operations 

» Gather lessons learned 

» Update plan based on lessons learned 

6.1 Identify the impact of laws and regulations that relate to information security 

» Identify applicable privacy laws 

» Identify legal jurisdictions the organization and 

users operate within (e.g., trans-border data flow) 

» Identify export laws 

» Identify intellectual property (IP) laws 

» Identify applicable industry regulations 

» Identify and advise on non-compliance risks 

6.2 Adhere to the (ISC)2 Code of Ethics as related to management issues 

6.3 Validate compliance in accordance with applicable laws, regulations and industry 

best practices 

» Inform and advise senior management 

» Evaluate and select compliance framework(s) 

» Implement the compliance framework(s) 

» Define and monitor compliance metrics 

6.4 Coordinate with auditors and regulators in support of the internal and external 

audit processes 

» Plan 

» Schedule 

» Coordinate audit activities 

» Evaluate and validate findings 

» Formulate response 

» Validate implemented mitigation and remediation actions 

6.5 Document and manage compliance exceptions 

» Identify and document compensating controls and workarounds 

» Report and obtain authorized approval of risk waiver