中钢协考试包括哪些内容?

Providing industry-standard audit services to assist organizations in protecting and controlling information systems, Domain-1 affirms your credibility to offer conclusions on the state of an organization’s IS/IT security, 风险和控制解决方案.

This domain confirms to stakeholders your abilities to identify critical issues and recommend enterprise-specific practices to support and safeguard the governance of information and related technologies.

Domains 3 and 4 offer proof not only of your competency in IT 控制, 还包括你对IT与业务之间关系的理解.

Domains 3 and 4 offer proof not only of your competency in IT 控制, 还包括你对IT与业务之间关系的理解.

网络安全 now touches virtually every information systems role, 理解它的原理, 最佳实践和陷阱是领域5的主要焦点.

1. Plan an audit to determine whether information systems are protected, 控制, 并为组织提供价值. 
2. Conduct audits in accordance with IS audit standards and a risk based IS audit strategy. 
3. 在审计过程中应用项目管理方法. 
4. 沟通并收集审核进度反馈, 发现, 结果, 和利益相关者的建议. 
5. Conduct post-audit follow up to evaluate whether identified risk has been sufficiently addressed. 
6. 利用数据分析工具加强审计流程. 
7. Evaluate the role and/or impact of automatization and/or decision-making systems for an organization.  
8. Evaluate audit processes as part of quality assurance and improvement programs. 
9. Evaluate the IT strategy for alignment with the organization's strategies and objectives. 
10. Evaluate the effectiveness of IT governance structure and IT organizational structure. 
11. Evaluate the organization's management of IT policies and practices, 包括遵守法律和法规要求. 
12. Evaluate IT resource and project management for alignment with the organization's strategies and objectives. 
13. Evaluate the organization's enterprise risk management (ERM) program. 
14. Determine whether the organization has defined ownership of IT risk, 控制, and standards. 
15. Evaluate the monitoring and reporting of IT key performance indicators (KPIs) and IT key risk indicators (KRIs). 
16. Evaluate the organization's ability to continue business operations. 
17. Evaluate the organization's storage, backup, and restoration policies and processes. 
18. Evaluate whether the business cases related to information systems meet business objectives. 
19. Evaluate whether IT vendor selection and contract management processes meet business, 法律, 以及监管要求. 
20. 评估供应链的IT风险因素和完整性问题.
21. Evaluate 控制 at all stages of the information systems development life cycle. 
22. Evaluate the readiness of information systems for implementation and migration into production. 
23. Conduct post-implementation reviews of systems to determine whether project deliverables, 控制, 并且满足了要求. 
24. Evaluate whether effective processes are in place to support end users. 
25. Evaluate whether IT service management practices align with organizational requirements. 
26. Conduct periodic review of information systems and enterprise architecture (EA) to determine alignment with organizational objectives.
27. Evaluate whether IT operations and maintenance practices support the organization's objectives. 
28. 评估组织的数据库管理实践. 
29. 评估组织的数据治理计划. 
30. 评估公司的隐私保护计划. 
31. Evaluate data classification practices for alignment with the organization's data governance program, 隐私保护程序, 适用的外部要求. 
32. Evaluate the organization's problem and incident management program. 
33. Evaluate the organization's change, configuration, release, and patch management programs. 
34. 评估组织的日志管理程序. 
35. Evaluate the organization's policies and practices related to asset life cycle management. 
36. Evaluate risk associated with shadow IT and end-user computing (EUC) to determine effectiveness of compensating 控制. 
37. 评估组织的信息安全计划. 
38. Evaluate the organization's threat and vulnerability management program. 
39. Utilize technical security testing to identify potential vulnerabilities. 
40. 评估逻辑, 物理, 并进行环境控制以验证机密性, 完整性, 以及信息资产的可用性. 
41. 评估组织的安全意识培训计划. 
42. Provide guidance to the organization in order to improve the quality and control of information systems. 
43. Evaluate potential opportunities and risks associated with emerging technologies, 规定, 以及行业惯例.