CISA 100 Days Study Plan InfosecTrain.pdf

© Aswini Srinath
Day Range Topics/Activities Details
Day 1–7 ISACA CRM - Domain 1
Cover the concepts in-depth with reference materials and
personal notes.
Day 8–10
ISACA QAE database for
Domain 1
Practice questions and analyze wrong answers to improve
understanding.
Day 11–17 ISACA CRM - Domain 2 Study all key areas and take notes for quick revisions.
Day 18–21
Domain 2
Solve domain-specific questions and focus on weak areas.
Go through the syllabus in detail and highlight important
topics.
Day 29–32
Domain 3
Complete practice questions and review explanations for
incorrect answers.
Dedicate more time to this domain as it requires deeper
understanding.
Day 47–51
Domain 4
Focus on domain-specific ISACA questions to enhance
problem-solving skills.
Day 52–65 ISACA CRM - Domain 5 Cover theoretical and practical concepts thoroughly.
Day 66–70
Domain 5
Practice, review, and solidify concepts through Q&A analysis.
Day 71–75 Domain 1 Revision Review personal notes, CRM materials, and past mistakes.
Day 76–80 Domain 2 Revision Consolidate key points, address gaps, and refine knowledge.
Day 81–85 Domain 3 Revision
Strengthen understanding by revisiting weak topics and
questions.
Day 86–90 Domain 4 Revision Refresh all content, focusing on key challenges.
Day 91–95 Domain 5 Revision Recap and prepare for final assessments on this domain.
Day 96–97 Revision Material Go through summaries, flashcards, and quick review guides.
Day 98–100 Mock Tests
Take full-length mock exams and review performance for
final adjustments.
Study Plan for CISA preparation for 100 days

© Aswini Srinath
Day 1/100 - CISA preparation
Study Plan: Auditing Standards and Business Processes
Time: 60 minutes
Introduction to Auditing Standards and Ethics (25 minutes)
Review ISACA IS audit and assurance standards (ISAS).
Explore ISACA IS audit and assurance guidelines.
Familiarize yourself with the ISACA Code of Professional Ethics.
Understand the purpose and scope of the Information Technology Assurance Framework (ITAF).
Understanding Business Processes (25 minutes)
Define the IS Internal Audit Function and its role in evaluating and improving business processes.
Explore how business processes are audited within the IS internal audit function.
Identify key components of effective management of IS audit function.
Understand IS audit resource management and its importance in achieving audit objectives.
Review and Summary (5 minutes)
Summarize key points covered during the study session.
Review any areas of confusion or difficulty encountered during the study session.
Make a note of topics to revisit in future study sessions.

© Aswini Srinath
Day 2/100 - CISA preparation
Time - 60 minutes
Introduction (5 minutes)
Briefly review the topics you'll be covering in this study session.
Understand the importance of business processes and IS audit management in ensuring organizational efficiency and security.
Business Processes (10 minutes)
Define what business processes are and why they are essential for organizations.
Explore examples of common business processes (e.g., procurement, sales, inventory management).
Discuss the significance of optimizing business processes for efficiency and effectiveness.
Management of IS Audit Function and IS Audit Resource Management (10 minutes)
Understand the responsibilities of managing the IS audit function within an organization.
Learn about the key aspects of IS audit resource management, including personnel, technology, and budget allocation.
Discuss strategies for effectively managing IS audit resources to ensure optimal audit performance.
Audit Planning (10 minutes)
Define audit planning and its significance in the audit process.
Explore the steps involved in audit planning, including scope definition, risk assessment, and objective setting.
Discuss the importance of thorough audit planning in ensuring the success of an audit engagement.
Effect of Laws and Regulations on IS Audit Planning (10 minutes)
Understand how laws and regulations impact IS audit planning.
Identify common laws and regulations relevant to IS audit, such as GDPR, HIPAA, and SOX.
Discuss how compliance requirements influence the scope, objectives, and approach of IS audit engagements.
Business Process Applications and Controls (10 minutes)
Explore how business processes are supported by technology through applications.
Discuss the importance of implementing controls within business process applications to mitigate risks.
Identify common controls used to safeguard data, ensure accuracy, and maintain integrity within business processes.
Types of Controls and Control Objectives (5 minutes)
Define different types of controls, including preventive, detective, corrective, and compensating controls.
Discuss the objectives of controls, such as preventing unauthorized access, detecting anomalies, and correcting errors.
Understand how control objectives guide the selection and implementation of control measures.
Review and Recap (5 minutes)
Summarize the key points covered in each topic.
Reflect on any areas that need further clarification or review.
Plan for future study sessions to reinforce understanding and address any gaps in knowledge.

© Aswini Srinath
Duration: 60 minutes
1. Types of Controls (15 minutes)
1.3.2 Evaluation of Control Environment (5 minutes)
- Understand the concept of control environment.
- Learn how to evaluate the control environment.
1.3.3 General Controls (5 minutes)
- Study the types and significance of general controls.
- Understand how general controls contribute to overall control effectiveness.
1.3.4 IS Specific Controls (5 minutes)
- Explore the specific controls related to information systems.
- Understand the importance of IS-specific controls in ensuring information security.
2. Risk-Based Auditing (25 minutes)
1.4.1 Audit Risk and Materiality (10 minutes)
- Learn about audit risk and its components.
- Understand the concept of materiality in auditing.
1.4.2 Risk Assessment (15 minutes)
- Study the process of risk assessment in auditing.
- Understand how to identify, assess, and respond to risks in an audit context.
3. Review and Recap (10 minutes)
- Spend the last 10 minutes reviewing key concepts from each topic.
- Summarize the main points and ensure understanding of the material.
- Use flashcards or summary notes to reinforce key information.
Study Tips:
- Take short breaks if needed to maintain focus.
- Use active learning techniques such as summarizing concepts in your own words or teaching
the material to someone else.
- Practice with sample questions or case studies related to each topic to solidify understanding.
- Make use of visual aids like diagrams or charts to help grasp complex concepts.

© Aswini Srinath
Study Plan: Risk-Based Auditing and Audit Project Management
Risk-Based Auditing (20 minutes)
Audit Risk and Materiality (5 minutes)
F Understand the concept of audit risk and its significance in the audit process.
Risk Assessment and risk assessment techniques (10 minutes)
F Explore the process of risk assessment in auditing, including identification, analysis, and evaluation of risks.
F Learn various techniques used in risk assessment, such as interviews, questionnaires, and historical data analysis.
Risk Analysis (5 minutes)
F Delve into the methods of risk analysis, including quantitative and qualitative approaches.
Types of Audits and Assessments (15 minutes)
F Understand different types of audits and assessments, including financial audits, operational audits, compliance audits, and IT audits.
F Explore the objectives and methodologies of each type of audit.
Audit Project Management (25 minutes)
Audit Objectives (10 minutes)
F Define audit objectives and their alignment with organizational goals.
Audit Phases (10 minutes)
F Identify the various phases of an audit, including planning, fieldwork, and reporting.
Minimum Skills to Develop an Audit Program (5 minutes)
F Learn the essential skills required to develop an effective audit program, such as communication, analytical thinking, and attention to detail.
Review and Practice (5 minutes)
F Take 5 minutes to review key concepts from each section.
F Spend the remaining 5 minutes practicing with sample questions or scenarios related to risk-based auditing and audit project management.
F Summarize the key takeaways from the study session.
F Identify any areas that need further review or clarification.

© Aswini Srinath
Study Plan: Audit Project Management and sampling methodology
1. Audit Programs (10 minutes)
Definition and purpose of audit programs
Components of audit programs: objectives, procedures, responsibilities
Importance of audit programs in ensuring systematic and thorough audits
2. Audit Work Papers (10 minutes)
Explanation of audit work papers and their significance in audit engagements
Types of audit work papers: planning documents, testing documents, evidence, and their respective purposes
Best practices for maintaining and organizing audit work papers
3. Fraud, Irregularities, and Illegal Acts (15 minutes)
Understanding fraud, irregularities, and illegal acts in the context of auditing
Auditor's responsibilities and duties concerning the detection and reporting of fraud, irregularities, and illegal acts
Techniques and methods for identifying potential fraud risks and irregularities during audits
4. Compliance Versus Substantive Testing (10 minutes)
Clear distinction between compliance testing and substantive testing
Objectives and procedures of compliance testing, focusing on verifying adherence to policies, laws, and regulations
Objectives and procedures of substantive testing, emphasizing the examination of account balances and transactions for material misstatements
5. Sampling - Sampling Risk (15 minutes)
Introduction to sampling methodologies in auditing
Explanation of sampling risk and its implications on audit conclusions
Strategies for reducing sampling risk, such as appropriate sample size determination and selection methods

© Aswini Srinath
Day 6/100
Study Plan: Audit evidence collection techniques and data analytics
"Success is neither magical nor mysterious. Success is the natural consequence of consistently applying basic fundamentals"
1. Interviewing and Observing Personnel in Performance of Their Duties (15 minutes)
Explanation of the importance of interviewing and observing personnel in the audit process
Techniques for conducting effective interviews, including preparing questions and active listening
Strategies for observing personnel in their duties to gather relevant audit evidence
2. Computer-assisted Audit Techniques (CAATs) (15 minutes)
Introduction to Computer-assisted Audit Techniques (CAATs) and their role in audit procedures
Types of CAATs: data extraction and analysis tools, audit software, etc.
Benefits and challenges of using CAATs in audits
3. Continuous Auditing and Monitoring (15 minutes)
Definition and significance of continuous auditing and monitoring in modern audit practices
Explanation of how continuous auditing differs from traditional audit approaches
Benefits of continuous auditing and monitoring, including real-time risk detection and mitigation
4. Continuous Auditing Techniques (15 minutes)
Overview of continuous auditing techniques, such as data analytics, automated testing, and exception reporting
Implementation considerations for continuous auditing, including data integration and system compatibility
Case studies or examples illustrating the application of continuous auditing techniques in various industries

© Aswini Srinath
Day 7 /100
Study Plan: Audit evidence collection techniques and data analytics
"Consistency is the true foundation of trust. Either keep your promises or do not make them."
1. Communicating Audit Results (10 minutes)
Review the importance of effectively communicating audit results to stakeholders.
Understand the key elements of a successful communication strategy in audit.
2. Audit Report Objectives (10 minutes)
Define the objectives of an audit report.
Discuss why clear and concise objectives are crucial for effective audit reporting.
3. Audit Report Structure and Contents (10 minutes)
Examine the typical structure of an audit report.
Identify the essential contents that should be included in an audit report.
4. Audit Documentation (10 minutes)
Understand the purpose and importance of audit documentation.
Review best practices for maintaining comprehensive audit documentation.
5. Follow-up Activities (5 minutes)
Explore the significance of follow-up activities after completing an audit.
Discuss methods for tracking and ensuring the implementation of audit recommendations.
6. Types of IS Audit Reports (5 minutes)
Learn about different types of information systems (IS) audit reports.
Understand the unique features and purposes of each type.
7. Quality Assurance and Improvement of the Audit Process (10 minutes)
Explore the concept of quality assurance in auditing.
Discuss strategies for improving the audit process, such as control self-assessment and integrated auditing.
Allocate the remaining time for a quick review of all the topics covered to reinforce your understanding. You can also use
any extra time to focus more on areas where you feel you need additional clarification or practice. Remember to take
short breaks if needed to maintain focus and retention during your study session.

© Aswini Srinath
Day 8 /100
Study Plan: Practice first 50 questions in the ISACA Question & Answer database - Domain 1
"The expert in anything was once a beginner."
1. Time Management (5 minutes):
Spend the first 5 minutes reviewing the structure of the ISACA Q&A database.
Familiarize yourself with the types of questions and the format they are presented in.
Quickly skim through the first 10 questions to understand the level of difficulty and the topics covered.
2. Focused Practice (45 minutes):
Allocate about 45 minutes to solve as many questions as possible.
Set a timer for roughly 1 minute per question to maintain pace.
Prioritize answering questions based on your confidence level and the time required for each question.
For questions you find challenging, mark them for review and move on to the next one.
Avoid spending too much time on any single question. If you're unsure, make an educated guess and flag it for review.
3. Review and Analysis (10 minutes):
Once you've completed all 50 questions or when the time is up, spend the remaining 10 minutes reviewing your answers.
Start with the questions you flagged for review and carefully reconsider your choices.
Analyze why you may have answered incorrectly and review the related concepts or topics.
Make note of any patterns or areas where you consistently struggle and plan additional study time for those topics.
4. Reflection and Revision (5 minutes):
Reflect on your performance during the practice session.
Identify any weaknesses or gaps in your knowledge.
Consider adjusting your study plan to allocate more time to areas where you need improvement.
Make a note of any questions you found particularly challenging or concepts you need to revisit before your next practice session.

© Aswini Srinath
Day 9 /100
Study Plan: Practice 51 to 100 questions in the ISACA Question & Answer database - Domain 1
“Work hard in silence, let your success be your noise.”

© Aswini Srinath
Day 10 /100
"Believe you can and you're halfway there."
1. Setting Up (10 minutes)
Gather all necessary materials: ISACA CISA QAE database, notebook, pen, and a quiet study space.
Clear distractions from your environment.
Quickly review key concepts and formulas relevant to the CISA exam.
3. Practice Session an review (45 minutes)
Start by tackling the last 50 questions in the ISACA CISA QAE database.
Answer each question to the best of your ability, marking any that you find particularly challenging or unsure about.
Go through the questions you marked as challenging or got wrong.
Analyze why you chose the incorrect answer and understand the rationale behind the correct answer.
Take notes on key concepts or areas where you need further review.
4. Reinforcement (5 minutes)
Review your notes from the practice session, focusing on areas of weakness.
Use additional study materials or resources to reinforce your understanding of these topics.
5. Cool Down (5 minutes)
Reflect on your study session and identify any strategies that worked well or areas for improvement.
Plan how you will adjust your study approach for future sessions based on your observations.
Remember, consistency is key when preparing for exams. Try to incorporate regular study sessions into your routine leading up to the
exam date. Good luck!

© Aswini Srinath
Day 11 /100
Study Plan: Domain 2 - Governance and IT Strategy
“Work hard in silence, let your success be your noise.”
1. Governance and IT Strategy (10 minutes)
Define Governance and IT Strategy.
Understand the relationship between governance and IT strategy.
Explore the importance of aligning IT strategy with business goals.
2. Enterprise Governance of Information and Technology (EGIT) (10 minutes)
Define EGIT and its components.
Understand the principles of EGIT.
Explore the benefits of implementing EGIT in an organization.
3. Good Practices for EGIT (10 minutes)
Study industry best practices for EGIT.
Understand how these practices contribute to effective EGIT.
4. Audit’s Role in EGIT (5 minutes)
Explore the role of audit in evaluating EGIT effectiveness.
Understand how audits help ensure compliance and identify areas for improvement in EGIT.
5. Information Security Governance (10 minutes)
Define Information Security Governance.
Study the principles and objectives of Information Security Governance.
Explore the importance of Information Security Governance in protecting organizational assets.
6. Information Systems Strategy and Strategic Planning (10 minutes)
Define Information Systems Strategy.
Understand the role of strategic planning in developing Information Systems Strategy.
Explore the steps involved in strategic planning for information systems.
7. Business Intelligence Data Governance (5 minutes)
Define Business Intelligence Data Governance.
Understand the importance of data governance in business intelligence.
Explore strategies for implementing effective data governance in business intelligence projects.
Quickly review key concepts from each topic.
Summarize the main takeaways and connections between the topics.
Explore frameworks such as COBIT (Control Objectives for Information and Related Technologies) and ITIL
This study plan is structured to provide a balanced overview of each topic within the allotted time frame. Feel free to
adjust the durations based on your familiarity with the topics and the depth of study required.

© Aswini Srinath
Day 12 /100
Study Plan: IT Governance and Organizational Structure
1. Introduction and Overview (5 minutes)
Briefly review the overall scope and importance of IT governance and organizational structure.
Highlight key concepts and objectives you aim to understand during the study session.
2. Understanding Organizational Structure (10 minutes)
Define organizational structure and its significance in managing IT functions.
Explore different types of organizational structures commonly found in IT environments (e.g., functional, matrix, project-based).
3. Roles and Responsibilities of Senior Management and Boards of Directors (10 minutes)
Study the roles and responsibilities of senior management within an organization, focusing on their involvement in IT governance.
Understand the functions and responsibilities of boards of directors, particularly in relation to IT strategy and oversight.
4. IT Governing Committees (10 minutes)
Understand the role of these committees in decision-making and governance processes.
5. Segregation of Duties Within IT (10 minutes)
Learn about segregation of duties (SoD) within IT environments and its importance in preventing fraud and ensuring accountability.
Explore different types of SoD controls and their implementation in IT governance.
6. Auditing IT Governance Structure and Implementation (10 minutes)
Discuss the importance of auditing IT governance structures and practices.
Understand the process of reviewing documentation related to IT governance and identifying areas for improvement.
7. Recap and Review (5 minutes)
Summarize key points covered during the study session.
Reflect on any areas that need further clarification or study.
8. Practice and Application (5 minutes - optional)
If time allows, engage in a brief quiz or review questions related to the topics covered.
Apply concepts to real-world scenarios or case studies to reinforce understanding.
Examine the purpose and composition of IT governing committees, such as the strategy committee, steering committee, and IT
security standards committee.
Remember to take short breaks if needed to maintain focus and retention. Adjust the time allocation based on your familiarity with the
topics and your preferred learning pace. Happy studying!

© Aswini Srinath
Day 13 /100
Enterprise Risk Management (ERM)
Developing a Risk Management Program
Risk Management Process
Step 1: Asset Identification
5 minutes: Understand the process of identifying assets within an organization, including tangible and intangible assets.
Step 2: Evaluation of Threats and Vulnerabilities to Assets
10 minutes: Delve into methods for identifying and assessing threats and vulnerabilities that could impact the identified assets.
Step 3: Evaluation of the Impact
5 minutes: Learn how to assess the potential impact or consequences of identified risks on the organization's objectives and assets.
Step 4: Calculation of Risk
5 minutes: Study the process of calculating risk by considering the likelihood and impact of identified risks.
Step 5: Evaluation of and Response to Risk
5 minutes: Explore strategies for evaluating and prioritizing risks, as well as developing and implementing appropriate response plans.
Risk Analysis Methods
5 minutes: Familiarize yourself with different risk analysis methods, including qualitative, semiquantitative, and quantitative approaches.
Qualitative Analysis Methods
5 minutes: Understand qualitative analysis methods, such as risk matrices, scenario analysis, and expert judgment.
Semiquantitative Analysis Methods
5 minutes: Begin by understanding the concept of ERM, its importance in business, and how it differs from traditional risk management approaches.
10 minutes: Explore the key components of developing a risk management program, including establishing objectives, identifying stakeholders, defining risk
criteria, and allocating resources.
10 minutes: Break down the risk management process into its five steps: Asset Identification, Evaluation of Threats and Vulnerabilities to Assets, Evaluation
of the Impact, Calculation of Risk, and Evaluation of and Response to Risk.

© Aswini Srinath
5 minutes: Explore semiquantitative methods like risk scoring and heat maps, which combine qualitative and quantitative elements.
Quantitative Analysis Methods
5 minutes: Learn about quantitative analysis methods, including probabilistic risk assessment, Monte Carlo simulation, and decision trees.
Review and Recap
5 minutes: Take the last few minutes to review key concepts, clarify any doubts, and summarize what you've learned during the session.
This study plan should help you cover the essential topics related to Enterprise Risk Management and the risk management process within a 60-minute
timeframe. Adjust the time allocation based on your familiarity with the topics and the level of detail you wish to explore.

© Aswini Srinath
Day 14 /100
1. Maturity Models (15 minutes)
Overview of Maturity Models
Understanding the Capability Maturity Model Integration (CMMI)
Key components and levels of CMMI
Examples of industries where CMMI is commonly applied
2. Initiating, Diagnosing, Establishing, Acting and Learning (IDEAL) Model (10 minutes)
Introduction to the IDEAL Model
Understanding each phase: Initiating, Diagnosing, Establishing, Acting, and Learning
Importance and benefits of applying the IDEAL Model in organizational improvement
3. Laws, Regulations, and Industry Standards Affecting the Organization (10 minutes)
Overview of relevant laws, regulations, and industry standards
Examples of regulatory bodies and standards-setting organizations
Understanding the impact of compliance on organizational operations
4. Governance, Risk, and Compliance (GRC) (10 minutes)
Definition and importance of Governance, Risk, and Compliance (GRC)
Key components of GRC framework
Relationship between governance, risk management, and compliance
5. Impact of Laws, Regulations, and Industry Standards on IS Audit (5 minutes)
How laws, regulations, and industry standards influence IS audit practices
Compliance requirements for IS audits
Case studies or examples demonstrating the impact of regulations on IS audits
6. IT Resource Management and Value of IT (5 minutes)
Understanding IT resource management and its significance
Value proposition of IT within organizations
Linking IT investments to business value
7. Implementing IT Portfolio Management (5 minutes)
Introduction to IT portfolio management
Key steps in implementing IT portfolio management processes
Benefits of effective IT portfolio management
8. IT Portfolio Management Versus Balanced Scorecard (5 minutes)
Differentiating between IT portfolio management and balanced scorecard approaches
Understanding how these methodologies complement each other
Examples of using both approaches in IT governance
9. IT Management Practices (5 minutes)
Overview of common IT management practices
Importance of IT management in organizational success
Case studies or examples illustrating effective IT management practices
10. Review and Summary (5 minutes)
Recap of key concepts covered in each topic
Identify any areas for further review or clarification
End with a brief summary of the importance of understanding these topics in the context of Information
Systems and IT governance.

© Aswini Srinath
Day 15 /100
Study Plan: Human Resource Management and organisational change management
1. Introduction (5 minutes)
2. Hiring (7 minutes)
3. Employee Handbook (5 minutes)
4. Promotion Policies (4 minutes)
5. Training (8 minutes)
6. Scheduling and Time Reporting (4 minutes)
7. Terms and Conditions of Employment (5 minutes)
8. During Employment (4 minutes)
9. Employee Performance Evaluations (6 minutes)
10. Required Vacations (3 minutes)
11. Termination Policies (5 minutes)
12. Organizational Change Management (4 minutes)
Spend 5 minutes reviewing employment contracts, terms of employment, benefits, and other conditions offered to
employees.
Allocate 4 minutes to understand employee relations, performance management, disciplinary actions, and employee
engagement strategies.
Dedicate 6 minutes to learn about performance appraisal methods, feedback mechanisms, goal setting, and
performance improvement plans.
Spend 3 minutes understanding vacation policies, accrual rates, approval processes, and the importance of time off
for employee well-being.
Allocate 5 minutes to review termination procedures, exit interviews, severance packages, and legal considerations
when terminating employees.
Dedicate 4 minutes to understand scheduling processes, time tracking systems, and legal requirements related to
overtime and breaks.
Spend the first 5 minutes reviewing an overview of Human Resource Management (HRM) and its importance in
organizational success.
Allocate 7 minutes to understand the hiring process, including recruitment strategies, job analysis, selection
methods, and legal considerations.
Dedicate 5 minutes to learn about the purpose, content, and importance of an employee handbook in
communicating company policies and expectations.
Spend 4 minutes understanding how promotion policies are structured, including criteria for promotion, promotion
paths, and the role of performance evaluation.
Allocate 8 minutes to explore training methods, training needs assessment, development programs, and evaluating
training effectiveness.

© Aswini Srinath
After each segment, take a moment to summarize the key points and make any notes or highlight areas you want to
revisit for further understanding. Adjust the time allocated for each topic based on your familiarity and the
complexity of the material. Happy studying!
Dedicate 4 minutes to understand the principles of change management, communication strategies, resistance
management, and implementing organizational changes effectively.

© Aswini Srinath
Day 16 /100
Study Plan: Human Resource Management and organisational change management
Financial Management Practices (15 minutes)
5 minutes: Introduction to financial management practices in the context of Information Systems (IS).
5 minutes: Understanding IS budgets: Importance, components, and allocation strategies.
5 minutes: Case studies or examples illustrating effective financial management practices in IS.
Information Security Management (15 minutes)
5 minutes: Overview of information security management principles and frameworks.
5 minutes: Recent trends and challenges in information security management.
IT Service Provider Acquisition and Management (15 minutes)
5 minutes: Introduction to IT service provider acquisition and management.
5 minutes: Outsourcing practices and strategies: Types of outsourcing, benefits, and challenges.
5 minutes: Industry standards, benchmarking, and their significance in IT service provider management.
Outsourcing and Third-party Audit Reports (10 minutes)
5 minutes: Understanding outsourcing and its implications for businesses.
Cloud Governance (5 minutes)
5 minutes: Overview of cloud governance: Principles, policies, and best practices.
Governance in Outsourcing (5 minutes)
5 minutes: Importance of governance in outsourcing relationships.
5 minutes: Key aspects of governance frameworks for effective outsourcing management.
5 minutes: Key components of information security management, including risk assessment, access control,
and incident response.
5 minutes: Importance of third-party audit reports in outsourcing: Assurance, compliance, and risk
mitigation.
Feel free to adjust the time allocated to each topic based on your familiarity and comfort level with the
material. Additionally, consider incorporating practice questions or quizzes to reinforce your understanding of
the topics.

© Aswini Srinath
Day 17 /100
Study Plan: IT Service Management
Briefly review the importance of IT service management in ensuring efficient and effective IT operations.
Highlight the key areas to be covered in this study session.
Capacity and Growth Planning (10 minutes)
Define capacity planning and growth planning in the context of IT service management.
Discuss the importance of anticipating and managing capacity requirements.
Explore strategies for capacity and growth planning, including scalability and forecasting techniques.
Third-party Service Delivery Management (10 minutes)
Define third-party service delivery management and its significance in IT service management.
Discuss the challenges and benefits associated with outsourcing IT services to third-party providers.
Explore best practices for managing third-party service delivery, including vendor selection, contract management, and service level agreements (SLAs).
Monitoring and Review of Third-party Services (10 minutes)
Explain the importance of monitoring and reviewing third-party services to ensure compliance with SLAs and quality standards.
Discuss key performance indicators (KPIs) and metrics for evaluating third-party service performance.
Explore tools and techniques for monitoring and reviewing third-party services, such as service level monitoring tools and performance dashboards.
Managing Changes to Third-party Services (10 minutes)
Discuss the challenges and risks associated with implementing changes to third-party services.
Explore change management processes and procedures for managing changes to third-party services.
Highlight the importance of communication and collaboration between internal teams and third-party providers during change management activities.
Service Improvement and User Satisfaction (10 minutes)
Discuss the concept of service improvement and its role in enhancing user satisfaction.
Explore methodologies and frameworks for continuous service improvement, such as ITIL's continual service improvement (CSI) approach.
Highlight the importance of soliciting feedback from users and stakeholders to identify areas for improvement.
IT Performance Monitoring and Reporting (5 minutes)
Define IT performance monitoring and its importance in assessing the effectiveness of IT operations.
Discuss the role of performance optimization in maximizing IT efficiency and effectiveness.
Introduce critical success factors for IT performance monitoring and reporting.
IT Balanced Scorecard (5 minutes)
Define the IT balanced scorecard and its significance in aligning IT activities with organizational objectives.
Discuss the key perspectives of the IT balanced scorecard, including financial, customer, internal process, and learning and growth perspectives.
Highlight the role of the IT balanced scorecard in driving performance improvement and strategic decision-making.
Quality Assurance and Quality Management of IT (5 minutes)
Define quality assurance and quality management in the context of IT service management.
Discuss the importance of ensuring quality throughout the IT service lifecycle.
Explore quality assurance and quality management processes and best practices.

© Aswini Srinath
Conclusion (5 minutes)
Summarize the key concepts covered in the study session.
Encourage further exploration of the topics through additional reading and practical application.
Reflect on how the knowledge gained can be applied to real-world IT service management scenarios.

© Aswini Srinath
Day 18 /100
Study Plan: Practice first 35 questions in the ISACA Question & Answer database - Domain 2
2.
Focused Practice (45 minutes):

© Aswini Srinath
Day 19 /100

© Aswini Srinath
Day 20 /100

© Aswini Srinath
Day 21 /100

© Aswini Srinath
Day 22 /100
Study Plan: Project Governance and Management
1. Introduction (5 minutes):
Briefly review the overall scope of project management practices and its significance in various domains.
2. Project Management Practices (5 minutes):
Understand the core principles and best practices involved in project management.
3. Project Management Structure (5 minutes):
Explore different organizational structures for project management, such as functional, matrix, and projectized structures.
4. Project Management Roles and Responsibilities (5 minutes):
Identify key roles and responsibilities within a project team, including project manager, stakeholders, sponsors, and team members.
5. Project Management Techniques (5 minutes):
Review various project management techniques such as Gantt charts, critical path method, and PERT charts.
6. Portfolio/Program Management (5 minutes):
Understand the concepts of portfolio and program management, including their roles in managing multiple projects.
7. Project Management Office, Project Portfolio Database (5 minutes):
Learn about the functions and benefits of a Project Management Office (PMO) and project portfolio databases in managing projects effectively.
8. Project Benefits Realization (5 minutes):
Explore the importance of realizing project benefits and strategies for achieving them.
9. Project Initiation (5 minutes):
Understand the steps involved in project initiation, including defining project objectives, scope, and stakeholders.
10. Project Objectives (5 minutes):
Review the process of setting SMART (Specific, Measurable, Achievable, Relevant, Time-bound) project objectives.
11. Project Planning (5 minutes):
Learn about the various components of project planning, including scope, schedule, budget, and risk management.
12. Information System Development Project Cost Estimation (5 minutes):
Understand the techniques and methods used for estimating project costs, specifically in information system development projects.
13. Software Size Estimation (5 minutes):
Explore different methods of estimating software size, such as lines of code and function points.
14. Function Point Analysis (5 minutes):
Learn about the function point analysis technique used for estimating the size and complexity of software systems.
15. Cost Budgets and Software Cost Estimation (5 minutes):
Understand the process of creating cost budgets for projects and techniques for estimating software costs accurately.
16. Scheduling and Establishing the Time Frame (5 minutes):
Review the importance of scheduling in project management and methods for establishing realistic time frames for project activities.
17. Project Execution (5 minutes):
Understand the activities involved in project execution, including resource allocation, task management, and monitoring progress.

© Aswini Srinath
Day 23 /100
Study Plan: Project Management and System Development
Time Allocation:
Introduction and Overview: 5 minutes
Project Controlling and Monitoring: 15 minutes
Project Closing: 5 minutes
IS Auditor’s Role in Project Management: 5 minutes
Business Case and Feasibility Analysis: 10 minutes
System Development Methodologies: 20 minutes
Session Breakdown:
1. Introduction and Overview (5 minutes):
Briefly review the main objectives of project management and system development.
Understand the importance of project controlling, monitoring, closing, and the role of IS auditors.
2. Project Controlling and Monitoring (15 minutes):
Explore the management of scope changes, resource usage, and risk in project management.
Take notes on key concepts, techniques, and tools used in project controlling and monitoring.
3. Project Closing (5 minutes):
Review the key activities involved in project closing.
Understand the importance of project closure for ensuring project success and customer satisfaction.
4. IS Auditor’s Role in Project Management (5 minutes):
Learn about the responsibilities of IS auditors in project management.
Understand how IS auditors contribute to project success and risk management.
5. Business Case and Feasibility Analysis (10 minutes):
Study the IS auditor’s role in business case development.
Understand the components of a business case and the importance of feasibility analysis.
6. System Development Methodologies (20 minutes):
Explore different system development life cycle (SDLC) models and their characteristics.
Tips:
Take brief notes as you study each topic to reinforce your understanding.
Use visual aids such as diagrams or charts to help you understand complex concepts.
After completing each section, try to summarize the key points in your own words to ensure comprehension.
Allocate more time to topics that you find challenging or need more clarification on.
Review each phase of the SDLC, including feasibility study, requirements definition, software selection and
acquisition, design, configuration, development, final testing and implementation, and post-implementation review.
Feel free to adjust the time allocation based on your preferences and study pace. Good luck with your studies! Let me
know if you need further assistance.

© Aswini Srinath
24/Jan/1900 Day 24 /100
Briefly review the topics you'll cover in this session.
Set your learning objectives for each topic.
2. IS Auditor’s Role in SDLC Project Management (10 minutes)
Understand the role of an IS auditor in SDLC project management.
Identify the key responsibilities and activities of an IS auditor in this context.
Take notes on key concepts and potential audit considerations.
3. Software Development Methods (15 minutes)
Explore various software development methods:
Prototyping—Evolutionary Development
Rapid Application Development
Agile Development
Object-oriented System Development
Component-based Development
Web-Based Application Development
Software Reengineering
Reverse Engineering
DevOps
Business Process Reengineering and Process Change
Understand the principles, advantages, and disadvantages of each method.
Compare and contrast different methods to gain a holistic understanding.
4. System Development Tools and Productivity Aids (25 minutes)
Learn about system development tools and productivity aids:
Computer-aided Software Engineering (CASE)
Code Generators
Fourth-generation Languages (4GLs)
Understand how these tools and aids facilitate the software development process.
Consider the impact of these tools on productivity, quality, and security.
Review examples and case studies to illustrate the use of these tools in practice.
Reflect on your understanding and identify any areas that require further clarification.
Plan any follow-up study or practice to reinforce your learning.

© Aswini Srinath
Day 25 /100
Study Plan: SDLC and Control Identification and Design
Infrastructure Development/Acquisition Practices (10 minutes)
Overview of infrastructure development/acquisition practices
Importance of infrastructure planning and implementation
Key considerations in infrastructure acquisition
Project Phases of Physical Architecture Analysis (5 minutes)
Introduction to physical architecture analysis
Overview of project phases involved in physical architecture analysis
Understanding the importance of each phase
Planning Implementation of Infrastructure (10 minutes)
Strategies for planning the implementation of infrastructure
Considerations for successful infrastructure implementation
Best practices for infrastructure planning
Hardware/Software Acquisition (5 minutes)
Distinction between hardware and software acquisition
Factors to consider in hardware and software procurement
Importance of compatibility and scalability in acquisition decisions
Acquisition Steps (5 minutes)
Step-by-step process of hardware and software acquisition
Pre-acquisition planning and assessment
Acquisition negotiation and contracting
IS Auditor’s Role in Hardware Acquisition (5 minutes)
Responsibilities of an IS auditor in hardware acquisition
Audit considerations during hardware procurement
Ensuring compliance and risk management in hardware acquisition
System Software Acquisition (5 minutes)
Overview of system software acquisition process
Evaluating system software options
Ensuring compatibility and security in system software acquisition
Integrated Resource Management Systems (5 minutes)
Understanding integrated resource management systems
Benefits of integrated resource management
Key components and functionalities of integrated resource management systems
IS Auditor’s Role in Software Acquisition (5 minutes)
Responsibilities of an IS auditor in software acquisition
Audit considerations during software procurement
Ensuring compliance, security, and value in software acquisition
Control Identification and Design (5 minutes)
Importance of control identification and design in information systems
Overview of control frameworks and standards
Principles of effective control design
Input/Origination Controls (5 minutes)
Definition and importance of input/origination controls
Types of input controls and their functionalities
Implementing input controls to mitigate risks
Input Authorization (5 minutes)
Understanding input authorization processes
Role of authorization in data integrity and security
Implementing effective input authorization controls
Batch Controls and Balancing (5 minutes)
Overview of batch processing and its significance
Batch control mechanisms and techniques
Importance of balancing in batch processing
Error Reporting and Handling (5 minutes)
Importance of error reporting and handling mechanisms
Types of errors in information systems
Designing effective error reporting and handling procedures

© Aswini Srinath
Day 26 /100
Study Plan: Domain 3 - SDLC and Control Identification and Design
Briefly review the topics to be covered in the study session.
Set clear goals for the session.
2. Processing Procedures and Controls (10 minutes)
Define processing procedures and controls.
Discuss the importance of these procedures in ensuring accurate and reliable data processing.
3. Data Validation and Editing Procedures (5 minutes)
Explain the purpose of data validation and editing procedures.
Discuss common techniques and methods used for data validation and editing.
4. Processing Controls (5 minutes)
Define processing controls and their role in data processing.
Discuss different types of processing controls (e.g., input controls, processing controls, output controls).
5. Data File Control Procedures (5 minutes)
Explain data file control procedures.
Discuss techniques for maintaining data integrity and security.
6. Output Controls (5 minutes)
Define output controls and their significance.
Discuss methods for ensuring the accuracy, completeness, and confidentiality of output data.
7. Application Controls (5 minutes)
Define application controls.
Discuss their role in ensuring the integrity and security of applications.
8. IS Auditor’s Role in Reviewing Application Controls (5 minutes)
Explain the role of an IS auditor in reviewing application controls.
Discuss common audit techniques and procedures.
9. User Procedures (5 minutes)
Define user procedures.
Discuss their importance in ensuring efficient system utilization and data accuracy.
10. Decision Support System (DSS) Overview (5 minutes)
Define Decision Support System (DSS) and its purpose.
Discuss the characteristics and components of a DSS.
11. Design and Development of DSS (5 minutes)
Discuss the process of designing and developing a DSS.
Highlight key considerations in DSS design.
12. Implementation and Use of DSS (5 minutes)
Explain the implementation process of a DSS.
Discuss best practices for effectively using a DSS.
13. Risk Factors in DSS Implementation (5 minutes)
Identify common risk factors associated with DSS implementation.
Discuss strategies for mitigating these risks.
14. Implementation Strategies (5 minutes)
Discuss different implementation strategies for DSS.
Compare and contrast their advantages and disadvantages.
15. Assessment and Evaluation of DSS (5 minutes)
Explain the importance of assessing and evaluating a DSS.
Discuss methods for evaluating the effectiveness and efficiency of a DSS.
16. DSS Common Characteristics Review (5 minutes)
Recap the common characteristics of a DSS.
Summarize key points covered in the study session.

© Aswini Srinath
Day 27 /100
Study Plan: Testing methodologies and testing classifications
Briefly review the topics you'll be covering.
Set clear goals for what you want to achieve in this study session.
Testing Methodologies (10 minutes)
Define testing methodologies and their importance in software development.
Discuss various testing methodologies such as Agile testing, Waterfall testing, and DevOps testing.
Highlight the advantages and disadvantages of each methodology.
Testing Classifications - Other Types of Testing (10 minutes)
Explore different types of testing beyond traditional functional testing, such as performance testing, security testing, and usability testing.
Discuss the importance of each type of testing in ensuring software quality.
Provide examples of when each type of testing is appropriate.
Software Testing (10 minutes)
Dive deeper into software testing processes, including test planning, test case design, test execution, and defect tracking.
Discuss the role of software testers in the development lifecycle and their responsibilities.
Highlight common challenges and best practices in software testing.
Data Integrity Testing (5 minutes)
Define data integrity testing and its significance in ensuring the accuracy and reliability of data.
Discuss techniques and strategies for conducting data integrity testing, such as data validation, data reconciliation, and data verification.
Application Systems Testing - Automated Application Testing (10 minutes)
Introduce automated application testing and its benefits in improving testing efficiency and reliability.
Discuss popular automated testing tools and frameworks, such as Selenium, Appium, and TestComplete.
Provide examples of automated testing scenarios and how they can be implemented.
IS Auditor’s Role in Information Systems Testing (5 minutes)
Explain the role of an IS auditor in information systems testing, including assessing controls, identifying risks, and ensuring compliance with regulations.
Discuss the skills and knowledge required for IS auditors to effectively perform testing activities.
Highlight the importance of collaboration between IS auditors and other stakeholders in the testing process.
Configuration and Release Management (5 minutes)
Define configuration and release management and their roles in software development and deployment.
Discuss best practices for managing configurations and releases effectively, including version control, change management, and release automation.
System Migration, Infrastructure Deployment, and Data Conversion (5 minutes)
Introduce the concepts of system migration, infrastructure deployment, and data conversion in the context of IT projects.
Discuss the challenges and considerations involved in each process, such as data compatibility, downtime, and resource allocation.
Highlight the importance of careful planning and testing to ensure successful migrations, deployments, and conversions.
Conclusion (5 minutes)
Summarize the key points covered in the study session.
Reflect on what you've learned and how you can apply it to your work or studies.
Identify any areas that need further exploration or clarification for future study sessions.

© Aswini Srinath
28/Jan/1900 Day 28 /100
Briefly review the overall objectives and importance of system implementation and change management.
2. System Implementation Planning (10 minutes)
Understand the key components of implementation planning.
Identify critical success factors for successful system implementation.
3. System Change Procedures and Program Migration Process (15 minutes)
Study the procedures involved in system change.
Explore the steps and best practices in the program migration process.
4. End-user Training (10 minutes)
Examine the significance of end-user training in system implementation.
Understand different approaches and techniques for effective end-user training.
5. System Software Implementation (10 minutes)
Learn about the process of system software implementation.
Identify common challenges and strategies for successful system software implementation.
6. Certification/Accreditation (5 minutes)
Review the importance of certification and accreditation in system implementation.
Understand the criteria and process involved in certification/accreditation.
7. Post-implementation Review and IS Auditor’s Role (5 minutes)
Explore the role of IS auditors in post-implementation review.
Understand the objectives and processes involved in post-implementation review.
Reflect on any areas that need further clarification or study.
This study plan allows for focused learning on each topic within a 60-minute timeframe. Adjust the time
allocation based on your familiarity with the topics and individual learning pace.

© Aswini Srinath
Day 29 /100
Study Plan: Practice first 50 questions from ISACA QAE database

© Aswini Srinath
Day 30 /100
Study Plan: Practice 50 to 100 questions from ISACA QAE database

© Aswini Srinath
31/Jan/1900 Day 31 /100

© Aswini Srinath
Day 32 /100

© Aswini Srinath
02/Feb/1900 Day 33 /100
Read through the introduction of Part A to understand the context and scope of the topics.
2. Common Technology Components (15 minutes)
Computer Hardware Components and Architectures (5 minutes)
Study the different input/output components of computer hardware.
Learn about the various types of computers (e.g., desktops, laptops, servers) and their architectures.
Common Enterprise Back-end Devices (5 minutes)
Understand the purpose and functionality of common enterprise back-end devices such as servers, routers, and switches.
Universal Serial Bus (5 minutes)
Learn about the Universal Serial Bus (USB) and its significance in connecting peripherals to computers.
3. Risk and Security Controls (20 minutes)
Risk Related to USBs (5 minutes)
Identify the potential risks associated with the use of USB devices, including data breaches, malware infections, and unauthorized data transfers.
Security Controls Related to USBs (5 minutes)
Explore security measures and best practices for mitigating USB-related risks, such as encryption, device control policies, and endpoint security solutions.
Applications of RFID (5 minutes)
Discover the various applications of Radio Frequency Identification (RFID) technology in industries like retail, logistics, and healthcare.
Risk Associated With RFID (5 minutes)
Understand the security and privacy risks associated with RFID technology, including data interception, unauthorized tracking, and counterfeiting.
Security Controls for RFID (5 minutes)
Learn about security mechanisms and protocols designed to protect RFID systems and data, such as encryption, access controls, and RFID shielding.
4. Review and Practice (15 minutes)
Review key concepts from each subsection.
Test your understanding by answering practice questions or scenarios related to the topics covered.
Summarize the main points to reinforce your learning.

© Aswini Srinath
Day 34 /100
Study Plan: Domain 4 - Asset management
0-5 minutes: Introduction
Quickly review the outline of the study plan.
Set a timer for each section to ensure you stick to the schedule.
5-20 minutes: Hardware Maintenance Program
Spend 10 minutes reading about hardware monitoring procedures.
Spend 5 minutes summarizing key points and creating flashcards for memorization.
Spend the remaining 5 minutes reviewing any notes or materials you already have on hardware maintenance programs.
20-30 minutes: IT Asset Management
Allocate 10 minutes to read about IT asset management principles and practices.
Spend 5 minutes jotting down key concepts or questions you have.
Use the remaining 5 minutes to search for any additional resources or articles related to IT asset management for further understanding.
30-40 minutes: Job Scheduling and Production Process Automation
Dedicate 15 minutes to studying job scheduling software and its importance in production process automation.
Spend 5 minutes brainstorming examples of job scheduling software and their applications.
Use the remaining 10 minutes to review any related materials or notes you have on this topic.
40-50 minutes: System Interfaces
Invest 15 minutes in understanding the risks associated with system interfaces.
Spend 5 minutes creating a mind map or diagram illustrating security issues in system interfaces.
Use the remaining 5 minutes to review any control measures associated with system interfaces.
50-60 minutes: Recap and Review
Spend the last 10 minutes recapping what you've learned in each section.
Quickly review your flashcards or notes from earlier in the study session.
Take note of any areas you feel less confident in and make a plan to revisit them in future study sessions.

© Aswini Srinath
#########
Study Plan: Domain 4 - EUC, data governance and system performance management
End-user Computing (15 minutes)
Overview: Understand the concept of end-user computing and its importance in organizations.
Key Concepts: Familiarize yourself with the role of end-user computing devices, software applications, and user involvement in IT systems.
Examples: Review real-world examples of end-user computing technologies and their impact on business operations.
Challenges: Identify common challenges associated with end-user computing, such as security concerns and compatibility issues.
Data Governance (15 minutes)
Definition: Define data governance and its significance in managing and protecting organizational data assets.
Data Management: Explore the various aspects of data management, including data storage, retrieval, and manipulation.
Data Quality: Learn about the importance of data quality assurance techniques and tools in ensuring accurate and reliable data.
Data Life Cycle: Understand the stages of the data life cycle, from creation to disposal, and the importance of managing data throughout its lifespan.
Systems Performance Management (15 minutes)
IS Architecture and Software: Gain insights into information systems architecture and software components, including databases, applications, and middleware.
Operating Systems: Review the fundamentals of operating systems, including their roles, functions, and types.
Software Control Features or Parameters: Learn about the various control features and parameters available in software systems for optimizing performance and
resource utilization.
Software Integrity Issues: Explore common software integrity issues, such as bugs, vulnerabilities, and malware threats.
Activity Logging and Reporting Options: Understand the importance of activity logging and reporting in monitoring system performance and detecting anomalies.
Operating System Reviews: Familiarize yourself with techniques for conducting operating system reviews to assess performance, security, and reliability.
Summarize Key Points: Take a few minutes to review and summarize the key concepts covered in each topic.
Identify Areas for Further Study: Reflect on any areas that require further study or clarification.
Practice Questions: Attempt a few practice questions or scenarios related to the topics covered to reinforce your understanding.
Plan for Future Sessions: Determine which topics you'd like to focus on in future study sessions and create a plan for further exploration.
Feel free to adjust the time allocation for each topic based on your familiarity and comfort level with the material. Happy studying!

© Aswini Srinath
Day 36 /100
Study Plan: Domain 4 - ACS, Capacity management, Problem and release management
Introduction (5 minutes):
Briefly skim through the topics you're going to cover.
Set specific goals for what you aim to learn or understand during this study session.
Access Control Software, Data Communications Software, Utility Programs (15 minutes):
Spend 5 minutes on each topic, understanding the basic concepts, purpose, and examples of each type of software.
Jot down key points or create flashcards for quick reference.
Software Licensing Issues and Source Code Management (15 minutes):
Allocate 7 minutes for understanding software licensing issues, including types of licenses and their implications.
Capacity Management (10 minutes):
Spend 5 minutes understanding the concept of capacity management in IT, including its objectives and processes.
Use the remaining 5 minutes to explore examples or case studies related to capacity management.
Problem and Incident Management (15 minutes):
Spend 5 minutes on each sub-topic.
Start with Problem Management, understanding its purpose and basic processes.
Review and Summary (5 minutes):
Quickly summarize the key points you've learned during this study session.
Reflect on any areas that need further clarification or practice.
Additional Tips:
Take short breaks between each topic to keep your mind fresh.
Engage actively with the material by asking yourself questions or creating mental associations.
Consider using visual aids or diagrams to enhance your understanding of complex concepts.
Remember, the key to effective studying is consistency and active engagement with the material. Good luck with your studies!
Spend the remaining 8 minutes on source code management, focusing on version control systems like Git, SVN, etc. Understand
the importance and basic functionality.
Move on to the Process of Incident Handling, focusing on detection, documentation, control, resolution, and reporting of
abnormal conditions.

© Aswini Srinath
Day 37 /100
Study Plan: Domain 4 - Change, Configuration, Release, and Patch Management, network management
0-5 minutes: Introduction
Briefly skim through the topics to get an overview of what will be covered.
5-15 minutes: Support/Help Desk (4.8.4)
Spend 10 minutes reading about Support/Help Desk, understanding its importance in IT operations, and the role it plays in resolving user issues and providing technical assistance.
15-25 minutes: Network Management Tools (4.8.5)
Dedicate 10 minutes to learn about Network Management Tools, focusing on their functions, types, and how they contribute to the management and optimization of
network resources.
25-35 minutes: Problem Management Reporting Reviews (4.8.6)
Allocate 10 minutes to understand Problem Management Reporting Reviews, including their purpose, process, and how they help in identifying and addressing recurring IT issues.
35-45 minutes: Change, Configuration, Release, and Patch Management (4.9)
Spend 10 minutes exploring Change, Configuration, Release, and Patch Management, grasping their individual roles in ensuring the stability, security, and agility of IT systems
and services.
45-50 minutes: IT Service Level Management Overview (4.10)
Use 5 minutes to get an overview of IT Service Level Management, including its importance in aligning IT services with business objectives and ensuring customer satisfaction.
50-60 minutes: Dive into Service Level Agreements (4.10.1)
Dedicate the remaining 10 minutes to delve into Service Level Agreements, understanding their components, creation process, and their role in defining the quality of IT services
delivered to customers.

© Aswini Srinath
Day 38 /100
Study Plan: Domain 4 - Database management
1. DBMS Architecture (15 minutes)
Overview of DBMS architecture
Detailed DBMS Metadata Architecture
Understanding the Data Dictionary/Directory System
2. Database Structure (15 minutes)
Understanding the basic structure of a database
Different types of database models (relational, hierarchical, network, etc.)
Discussing the importance of data modeling
3. Database Controls (15 minutes)
Introduction to database controls
Types of database controls (e.g., access control, integrity control, concurrency control)
Importance of database controls in maintaining data integrity and security
4. Object-oriented Database Management System (OODBMS) (15 minutes)
Introduction to OODBMS
Understanding the concepts of objects, classes, and inheritance in OODBMS
Advantages and disadvantages of OODBMS compared to traditional relational databases

© Aswini Srinath
Day 39 /100
Study Plan: Domain 4 - Business Resilience, BIA, back-up, storage and restoration
Briefly review the overall concept of business resilience and its importance in modern organizations.
2. Business Impact Analysis (10 minutes)
Read through the section on Business Impact Analysis (BIA).
Understand the purpose of BIA and its significance in identifying critical business functions.
Take notes on the classification of operations and criticality analysis.
3. System Resiliency (15 minutes)
Study the subsection on Application Resiliency and Disaster Recovery Methods.
Learn about different methods for ensuring application resiliency and disaster recovery.
Focus on key concepts such as failover, redundancy, and load balancing.
4. Telecommunication Networks Resiliency (10 minutes)
Read about Telecommunication Networks Resiliency and Disaster Recovery Methods.
Understand the importance of resilient telecommunication networks in ensuring business continuity.
Take note of common disaster recovery methods for telecommunication networks.
5. Data Backup, Storage, and Restoration (20 minutes)
Dive into the section on Data Backup, Storage, and Restoration.
Learn about the importance of data storage resiliency and disaster recovery methods.
Study different backup and restoration techniques, including offsite library controls, media backup, and documentation backup.
and documentation backup.
Familiarize yourself with various types of backup devices and media.
Quickly review the key points from each topic.
Summarize the main concepts covered in the study session.
Identify any areas that require further clarification or review.

© Aswini Srinath
Day 40 /100
Study Plan: Domain 4 - back-up schemes
1. Introduction to Backup Procedures (5 minutes)
Briefly introduce the importance of periodic backup procedures.
Explain why backup rotation is necessary for data protection.
2. Frequency of Rotation (10 minutes)
Discuss the concept of backup rotation frequency.
Explain how often backups should be performed based on data criticality and business needs.
Provide examples of different rotation schedules (daily, weekly, monthly).
3. Types of Media and Documentation Rotated (10 minutes)
Introduce different types of backup media (e.g., tapes, disks, cloud storage).
Discuss the pros and cons of each type of media.
Explain the importance of documenting backup procedures and rotations.
4. Backup Schemes (15 minutes)
Define full backup, incremental backup, and differential backup.
Discuss the advantages and disadvantages of each backup scheme.
Provide examples of scenarios where each backup scheme is appropriate.
5. Method of Rotation (10 minutes)
Explain different methods of backup rotation (e.g., Grandfather-Father-Son, Tower of Hanoi).
Discuss the benefits and challenges of each rotation method.
Provide examples to illustrate how each rotation method works.
6. Record Keeping for Offsite Storage (10 minutes)
Emphasize the importance of maintaining accurate records for offsite storage.
Discuss what information should be included in backup records.
Explain how proper record-keeping facilitates disaster recovery processes.
Encourage self-assessment and reflection on the topics covered.
Provide additional resources for further study if needed.

© Aswini Srinath
Day 41 /100
Study Plan: Domain 4 - Business Continuity Planning
1. Introduction to Business Continuity Planning (5 minutes)
Briefly overview what business continuity planning entails and its importance in ensuring the resilience of organizations.
2. IT Business Continuity Planning (10 minutes)
Define IT business continuity planning and its significance in maintaining critical IT functions during disruptive events.
Understand key components of IT continuity planning, such as data backup, disaster recovery, and system redundancy.
3. Disasters and Other Disruptive Events (10 minutes)
Explore various types of disruptive events, including natural disasters, cyber-attacks, and pandemics.
Discuss the impact of these events on business operations and the importance of preparedness.
4. Pandemic Planning (10 minutes)
Focus specifically on pandemic planning, considering recent events and their implications for businesses.
5. Dealing With Damage to Image, Reputation, or Brand (5 minutes)
Discuss the significance of brand reputation and strategies for managing and mitigating damage during crisis situations.
Explore case studies or examples illustrating effective reputation management strategies.
6. Unanticipated/Unforeseeable Events (5 minutes)
Understand the challenges associated with unanticipated events and the importance of flexibility in business continuity planning.
Discuss adaptive strategies for responding to unforeseeable circumstances.
7. Business Continuity Planning Process (5 minutes)
Emphasize the iterative nature of the process and the need for regular updates and revisions.
8. Business Continuity Policy (5 minutes)
Define the purpose and components of a business continuity policy, highlighting its role in guiding organizational resilience efforts.
Discuss key elements to consider when formulating a business continuity policy.
9. Business Continuity Planning Incident Management (5 minutes)
Explore the importance of effective incident management in minimizing the impact of disruptive events.
Discuss the role of incident response teams, communication protocols, and escalation procedures.
10. Development of Business Continuity Plans (5 minutes)
Review the process of developing comprehensive business continuity plans tailored to specific organizational needs and risks.
Discuss best practices for plan development, including stakeholder involvement, scenario-based planning, and documentation.
Outline the steps involved in the business continuity planning process, including risk assessment, plan development,
testing, and maintenance.
Examine strategies for pandemic preparedness, including remote work arrangements, health and safety protocols, and
communication plans.

© Aswini Srinath
Day 42 /100
Study Plan: Domain 4 - Business Continuity Planning
1. Introduction to Other Issues in Plan Development (5 minutes)
Briefly read through the key points of 4.15.7.
Highlight or take notes on important concepts and terms.
2. Components of a Business Continuity Plan (15 minutes)
Key Decision-making Personnel:
Understand the roles and responsibilities of key decision-makers in a business continuity plan.
Backup of Required Supplies:
Learn about the importance of having backup supplies and resources for business continuity.
Insurance:
Explore how insurance plays a role in mitigating risks and supporting business continuity efforts.
3. Understanding Plan Testing (15 minutes)
Specifications:
Learn about the criteria and specifications used to test a business continuity plan.
Test Execution:
Understand the process of executing tests to evaluate the effectiveness of a business continuity plan.
Documentation of Results:
Explore the importance of documenting test results accurately for analysis and improvement.
4. Results Analysis and Plan Maintenance (15 minutes)
Results Analysis:
Learn how to analyze the results of plan testing to identify strengths, weaknesses, and areas for improvement.
Plan Maintenance:
Understand the importance of regularly updating and maintaining a business continuity plan to ensure its
effectiveness over time.
5. Business Continuity Management Good Practices (10 minutes)
Review key good practices for business continuity management.
Take note of any additional tips or recommendations provided in the material.
Reflect on any areas that need further clarification or review.
7. Quiz or Self-Assessment (5 minutes)
Test your understanding with a brief quiz or self-assessment.
Identify any areas where you may need to review further.

© Aswini Srinath
Day 43 /100
Study Plan: Domain 4 - Business Continuity and Auditing
Time Allocation:
Summary of Business Continuity: 25 minutes
Auditing Business Continuity: 25 minutes
Review and Recap: 10 minutes
Session Breakdown:
1. Summary of Business Continuity (25 minutes)
Overview of Business Continuity Planning (5 minutes)
Understanding the Components of a Business Continuity Plan (10 minutes)
Importance of Business Continuity in Risk Management (5 minutes)
Methods for Developing and Maintaining Business Continuity Plans (5 minutes)
2. Auditing Business Continuity (25 minutes)
Introduction to Auditing Business Continuity (5 minutes)
Key Steps in Auditing Business Continuity (10 minutes)
Reviewing the Business Continuity Plan (5 minutes)
Evaluation of Prior Test Results (2 minutes)
Evaluation of Offsite Storage (2 minutes)
Evaluation of Security at the Offsite Facility (1 minute)
Quick Recap of Key Concepts Covered (5 minutes)
Addressing Any Unanswered Questions or Areas of Confusion (3 minutes)
Planning Next Steps for Further Study or Practice (2 minutes)
Study Tips:
Break down the topics into smaller subtopics for easier comprehension.
Use visual aids such as diagrams or flowcharts to understand the processes involved.
Take short breaks if needed to maintain focus and prevent burnout.
Engage actively with the material by summarizing key points in your own words.
Test yourself periodically to reinforce learning and identify areas that need further review.

© Aswini Srinath
Day 44 /100
Study Plan: Disaster Recovery Plans
1. Introduction to Disaster Recovery Plans (5 minutes)
Read an overview of what disaster recovery plans (DRPs) are and why they are important in IT infrastructure.
2. Recovery Point Objective and Recovery Time Objective (10 minutes)
Understand the concepts of Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
Take notes on how these objectives are defined and how they influence disaster recovery planning.
3. Recovery Strategies (10 minutes)
Learn about different recovery strategies such as data backup, redundancy, failover, and offsite storage.
Understand the advantages and disadvantages of each strategy.
4. Recovery Alternatives (5 minutes)
Explore alternative recovery options such as hot, warm, and cold sites.
Understand when each alternative is appropriate based on business needs and budget constraints.
5. Contractual Provisions (5 minutes)
Review the importance of contractual provisions in disaster recovery planning.
Understand how contracts with vendors and service providers can impact disaster recovery efforts.
6. Procuring Alternative Hardware (5 minutes)
Learn about the process of procuring alternative hardware for disaster recovery purposes.
Understand considerations such as compatibility, cost, and lead time.
7. Development of Disaster Recovery Plans (10 minutes)
Study the components of an IT disaster recovery plan (IT DRP), including contents, scenarios, and recovery procedures.
Take notes on the organization and assignment of responsibilities within a DRP.
Quickly review the key concepts covered in each section.
Consolidate your understanding by summarizing the main points in your own words.

© Aswini Srinath
Day 45 /100
Study Plan: DRP testing methods
Briefly review the concepts of disaster recovery and the importance of testing disaster recovery plans.
2. Disaster Recovery Testing Methods (20 minutes)
Define disaster recovery testing methods.
Explore various types of tests such as:
Walkthroughs
Tabletop exercises
Functional tests
Full-scale tests
Understand the purpose and benefits of each type of test.
Take notes on key points and examples for each testing method.
3. Test Results (10 minutes)
Learn about the importance of documenting and analyzing test results.
Understand how test results help identify weaknesses and improve disaster recovery plans.
Review sample test results and discuss their implications.
4. Invoking Disaster Recovery Plans (20 minutes)
Define the process of invoking disaster recovery plans.
Understand the triggers that initiate the invocation of a disaster recovery plan.
Learn about the roles and responsibilities of key personnel during plan invocation.
Review case studies or scenarios illustrating the process of invoking disaster recovery plans.
Take note of critical steps and considerations during plan invocation.
5. Review and Reflection (5 minutes)
Reflect on any questions or areas that need further clarification.
Identify any additional resources or practice exercises to reinforce understanding.
Additional Tips:
Break down the topics into smaller subtopics for easier comprehension.
Use visual aids such as diagrams or flowcharts to illustrate concepts.
Engage in active learning by asking questions and seeking clarification as you study.
Consider practicing scenario-based exercises to apply theoretical knowledge to real-world situations.
Allocate time for review and reinforcement to solidify your understanding of the topics.

© Aswini Srinath
Day 46 /100

© Aswini Srinath
Day 47 /100

© Aswini Srinath
Day 48 /100

© Aswini Srinath
Day 49 /100

© Aswini Srinath
Day 50 /100

© Aswini Srinath
Day 51 /100
Study Plan: Information Asset Security Frameworks, Standards, and Guidelines
1. Introduction to Information Asset Security Frameworks (5 minutes)
Brief overview of what an information asset security framework is.
Importance of having frameworks, standards, and guidelines for managing information security.
2. Auditing the Information Security Management Framework (10 minutes)
Understanding the process of auditing the information security management framework.
Key components of an audit:
Reviewing written policies, procedures, and standards.
Formal security awareness and training.
Data ownership and responsibilities.
Documented authorizations.
3. Roles and Responsibilities (15 minutes)
Data Ownership:
Define data ownership and its importance.
Roles of data owners and data custodians.
Security Administrator:
Responsibilities and duties.
New IT Users and Data Users:
Their roles in information security.
Terminated Employee Access:
Procedures for revoking access upon termination.
4. Security Standards and Baselines (20 minutes)
Security Baselines:
Definition and purpose.
Examples of security baselines.
Access Standards:
Understanding access control standards.
Importance of implementing access controls.
5. Recap and Practice (10 minutes)
Quick recap of the key points covered in each section.
Practice questions or scenarios to reinforce understanding.
Clarify any doubts or questions.
6. Conclusion (5 minutes)
Summarize the key takeaways from the study session.
Plan for further study or revision if necessary.

© Aswini Srinath
Day 52 /100
Study Plan: Privacy Principles and Physical Access and Environmental Controls
Segment 1: Privacy Principles (20 minutes)
5.2 Privacy Principles
Read through the section on Privacy Principles (5 minutes)
Take notes on key concepts and principles (5 minutes)
Review any relevant examples or case studies (5 minutes)
Summarize the main points and ensure understanding (5 minutes)
Segment 2: Audit Considerations for Privacy (20 minutes)
5.2.1 Audit Considerations for Privacy
Study the audit considerations for privacy (5 minutes)
Identify different types of audits and their purposes (5 minutes)
Understand the importance of privacy audits in compliance (5 minutes)
Review best practices for conducting privacy audits (5 minutes)
Segment 3: Physical Access and Environmental Controls (20 minutes)
5.3 Physical Access and Environmental Controls
Read through the section on Physical Access and Environmental Controls (5 minutes)
Differentiate between managerial, technical, and physical controls (5 minutes)
Understand control monitoring and its effectiveness (5 minutes)
Review environmental exposures and the corresponding controls (5 minutes)
Summarize the key points and make connections between concepts (5 minutes)
Tips:
Break down each section into smaller subtopics to make it easier to digest.
Use visual aids such as diagrams or charts to understand complex concepts.
Take short breaks in between segments to maintain focus and avoid burnout.

© Aswini Srinath
22/Feb/1900 Day 53 /100
Study Plan: Privacy Principles and Physical Access and Environmental Controls
0-5 minutes: Introduction and Overview
Briefly review the topics you'll cover during this study session.
5-15 minutes: Identity and Access Management (IAM) Overview
Read through the key concepts of IAM, including the importance of managing system access and permissions.
Understand the difference between mandatory and discretionary access controls.
15-25 minutes: Information Security and External Parties
Learn about the risks associated with external parties and how they can impact information security.
Understand the importance of addressing security concerns when dealing with customers and third parties.
25-35 minutes: Logical Access
Dive into logical access and its significance in controlling access to resources.
Identify common logical access exposures and learn how to mitigate them.
Familiarize yourself with the paths of logical access within an enterprise's IT environment.
35-50 minutes: Access Control Software
Explore different types of access control software and their functionalities.
Understand how access control software helps in managing system access and permissions effectively.
50-60 minutes: Recap and Review
Review any areas where you may need further clarification or practice.

© Aswini Srinath
Day 54 /100
Study Plan: IAAA, Single sign on, biometrics
Topic 1: Identification and Authentication
Introduction to identification and authentication (5 minutes)
Understanding the importance of identification and authentication in cybersecurity (5 minutes)
Different methods of identification and authentication (10 minutes)
Authentication factors (something you know, have, or are) (10 minutes)
Topic 2: Logon IDs and Passwords
Features of passwords (5 minutes)
Good practices for creating and managing passwords (10 minutes)
Importance of strong and unique passwords (5 minutes)
Topic 3: Token Devices and One-time Passwords
Understanding token devices and their role in authentication (5 minutes)
One-time passwords: definition and usage (5 minutes)
Advantages and disadvantages of token devices and one-time passwords (5 minutes)
Topic 4: Biometrics
Introduction to biometrics (5 minutes)
Physically oriented biometrics (types and examples) (10 minutes)
Behavior-oriented biometrics (types and examples) (10 minutes)
Management of biometrics: security and privacy considerations (5 minutes)
Topic 5: Single Sign-on (SSO)
Understanding Single Sign-on (SSO) and its benefits (5 minutes)
How SSO works and its implementation (10 minutes)
Security considerations and challenges with SSO (5 minutes)
Examples of SSO solutions (5 minutes)
Review and Summary
Review key concepts from each topic (5 minutes)
Summarize main takeaways and key points (5 minutes)

© Aswini Srinath
Day 55 /100
Study Plan: Logical Access Security and Audit Logging
1. Authorization Issues (5 minutes)
Understand the concept of authorization and its importance in security.
Learn about common authorization issues and how to mitigate them.
2. Access Control Lists (10 minutes)
Define Access Control Lists (ACLs) and their role in controlling access to resources.
Study different types of ACLs (e.g., discretionary, mandatory) and their implementations.
3. Logical Access Security Administration (10 minutes)
Explore best practices for administering logical access security.
Understand the process of user provisioning, deprovisioning, and access review.
4. Remote Access Security (7 minutes)
Learn about remote access security measures such as VPNs, multi-factor authentication, and secure protocols.
Understand the risks associated with remote access and how to mitigate them.
5. Audit Logging in Monitoring System Access (8 minutes)
Understand the importance of audit logging in monitoring system access.
Learn about the components of effective audit logging systems and their configuration.
6. Access Rights to System Logs (5 minutes)
Study the importance of access rights management for system logs.
Learn how to configure access controls to ensure the integrity and confidentiality of logs.
7. Tools for Audit Trail Analysis (5 minutes)
Explore various tools available for analyzing audit trails and system logs.
Understand the features and capabilities of popular audit trail analysis tools.
8. Cost Considerations (5 minutes)
Learn about the cost factors associated with implementing and maintaining logical access security and audit logging.
Understand how to perform cost-benefit analysis and make informed decisions.
9. Naming Conventions for Logical Access Controls (5 minutes)
Study the importance of naming conventions in organizing and managing logical access controls.
Learn about best practices for naming conventions and their implementation.
10. Federated Identity Management (5 minutes)
Define federated identity management and its benefits.
Understand how federated identity management systems work and their use cases.
11. Auditing Logical Access (5 minutes)
Explore the process of auditing logical access and its importance in maintaining security.
Learn about audit methodologies and techniques for auditing logical access controls.
12. Familiarization With the IT Environment (5 minutes)
Review the IT environment you'll be working in, including infrastructure, applications, and security policies.
Identify potential areas of improvement in logical access security and audit logging.

© Aswini Srinath
Day 56 /100
Study Plan: Access Paths, Data Leakage, and Network Security
1. Assessing and Documenting the Access Paths (10 minutes)
Understand the importance of assessing and documenting access paths in ensuring security.
2. Interviewing Systems Personnel (7 minutes)
Understand the purpose of interviewing systems personnel in the context of security assessment.
3. Reviewing Reports From Access Control Software (7 minutes)
4. Reviewing Application Systems Operations Manual (6 minutes)
5. Data Leakage and Data Leak Prevention (10 minutes)
Define data leakage and its impact on organizational security.
6. Network Infrastructure (5 minutes)
Define IS network infrastructure and its components.
Learn about the different layers of network infrastructure and their roles in ensuring security.
7. Enterprise Network Architectures (5 minutes)
Understand enterprise network architectures and their design principles.
8. Types of Networks (5 minutes)
Study different types of networks, including LANs, WANs, MANs, and WLANs.
Understand their characteristics, advantages, and security considerations.
9. Network Services (5 minutes)
Learn about common network services, such as DNS, DHCP, FTP, and HTTP.
Understand their functions and potential security risks.
10. Network Standards and Protocols (5 minutes)
Study network standards and protocols, including TCP/IP, SNMP, SSL/TLS, and IPSec.
Understand their roles in ensuring interoperability and security in network communications.
Explore data leak prevention strategies and technologies, including encryption, data loss prevention
(DLP) solutions, and user education.
Learn about common network architectures, such as client-server, peer-to-peer, and hybrid
architectures.
Learn methods for assessing access paths, including interviewing system personnel and reviewing
reports from access control software.
Learn effective interview techniques to gather relevant information about access paths and security
measures.
Learn how to interpret and analyze these reports to identify potential vulnerabilities and unauthorized
access.
Understand the significance of reports generated by access control software in identifying security
issues.
Understand the importance of reviewing the application systems operations manual in assessing
security controls.
Learn how to extract relevant information about access paths, authentication mechanisms, and data
protection measures from the manual.

© Aswini Srinath
Day 57 /100
Study Plan: Access Paths, Data Leakage, and Network Security
1. OSI Architecture (10 minutes)
Briefly review the OSI model's seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application.
Understand the purpose and functions of each layer.
2. Application of the OSI Model in Network Architectures (10 minutes)
Explore how the OSI model is applied in various network architectures.
Understand how different layers interact in local area networks (LANs), wide area networks (WANs), and virtual private networks (VPNs).
3. Local Area Network (LAN) (10 minutes)
Define what a LAN is and its typical characteristics.
Study LAN topologies, such as bus, ring, and star.
Understand LAN protocols like Ethernet and Wi-Fi.
4. Wide Area Network (WAN) (10 minutes)
Define what a WAN is and how it differs from LAN.
Explore technologies used in WANs, such as leased lines, MPLS, and ATM.
Study WAN protocols like PPP and HDLC.
5. Virtual Private Networks (VPNs) (10 minutes)
Define what a VPN is and its importance in modern networking.
Study different types of VPNs, including site-to-site VPNs and remote access VPNs.
Understand VPN protocols like IPsec, SSL/TLS, and PPTP.
6. TCP/IP and Its Relation to the OSI Reference Model (10 minutes)
Explore the TCP/IP protocol suite.
Compare and contrast TCP/IP with the OSI model.
Understand how TCP/IP protocols map to the OSI layers.
7. Network Administration and Control (5 minutes)
Learn about network administration tasks, including configuration, monitoring, and troubleshooting.
Understand the role of network control in managing network resources and access.
8. Network Performance Metrics (5 minutes)
Study various metrics used to measure network performance, such as latency, throughput, and jitter.
Understand how network performance impacts user experience and productivity.
9. Applications in a Networked Environment (5 minutes)
Explore common applications used in networked environments, such as email, web browsing, and file sharing.
Understand the role of protocols like HTTP, SMTP, and FTP in supporting these applications.
10. On-demand Computing (5 minutes)
Define on-demand computing and its benefits.
Study cloud computing and its relation to network architecture.
Understand how on-demand computing is changing the landscape of network infrastructure.

© Aswini Srinath
Day 58 /100
Study Plan: Network Security and Data Encryption
1. Introduction to Network Infrastructure Security (5 minutes)
Define network infrastructure security.
Understand the importance of client-server security.
Discuss internet security controls and their significance in protecting network infrastructure.
2. Firewall Security Systems (10 minutes)
Explain the role of firewall security systems in network protection.
Differentiate between types of firewalls (e.g., packet-filtering, application-layer, stateful inspection).
Explore how firewalls enforce security policies and control traffic flow.
3. Development and Authorization of Network Changes (10 minutes)
Understand the process of developing and authorizing network changes.
Discuss the importance of change management in maintaining network security.
Learn about best practices for implementing and testing network changes.
4. Shadow IT (5 minutes)
Define shadow IT and its implications for network security.
Identify common causes of shadow IT within organizations.
Discuss strategies for managing and mitigating shadow IT risks.
5. Data Classification (5 minutes)
Define data classification and its role in data security.
Discuss the importance of categorizing data based on sensitivity and confidentiality.
Explore different data classification schemes and methodologies.
6. Data Encryption and Encryption-related Techniques (15 minutes)
Introduce the key elements of encryption systems.
Explain symmetric key cryptographic systems, including algorithms like AES.
Discuss public (asymmetric) key cryptographic systems, such as RSA.
Provide an overview of quantum cryptography and its potential impact on encryption.
Explore digital signatures and their role in verifying the authenticity of digital messages.
Explain the concept of a digital envelope and its use in secure message transmission.
7. Review and Practice (10 minutes)
Recap key concepts covered in the study session.
Solve practice questions or scenarios related to network security and data encryption.
Discuss any challenging topics or questions and seek clarification.
Summarize the main takeaways from the study session.
Reflect on areas of strength and areas needing further review.
Plan for future study sessions or revision on specific topics.

© Aswini Srinath
Day 59 /100
Study Plan: Cryptography, PKI
Briefly review the overall structure of the topics you're about to study.
Set clear learning objectives for the session.
2. Applications of Cryptographic Systems (15 minutes)
Spend 5 minutes reviewing the concept of cryptographic systems.
Allocate 5 minutes each to study the following applications:
Transport Layer Security (TLS): Understand its role in securing communications over a computer network.
IP Security (IPsec): Learn about its protocols and how it ensures secure communication over Internet Protocol (IP) networks.
Secure Shell (SSH): Explore its use for secure remote access and secure file transfers.
Secure Multipurpose Internet Mail Extensions (S/MIME): Understand its role in securing email communications.
3. Public Key Infrastructure (PKI) (10 minutes)
Spend 5 minutes understanding the basics of PKI, including its components and functions.
Allocate 5 minutes to delve into PKI's applications and its importance in ensuring secure communication and authentication.
4. Web-based Communication Technologies (15 minutes)
Spend 5 minutes reviewing the concept of web-based communication technologies.
Allocate 5 minutes each to study the following topics:
Voice-over IP (VoIP): Understand its principles and how it enables voice communication over the Internet.
VoIP Security Issues: Learn about the security challenges and vulnerabilities associated with VoIP systems.
Private Branch Exchange (PBX): Understand its role in business telecommunications.
PBX Risk: Explore the potential security risks associated with PBX systems.
PBX Audit: Learn about the importance of auditing PBX systems for security and compliance purposes.
5. Recap and Review (10 minutes)
Spend 5 minutes summarizing the key points covered in each topic.
Allocate the remaining 5 minutes for a quick review of any concepts that require further clarification or reinforcement.
Reflect on what you've learned during the study session.
Identify any areas that need additional focus or clarification.
Plan your next steps for further study or practice.

© Aswini Srinath
Day 60 /100
Study Plan: Email Security Issues, Peer-to-peer Computing, IM, and Cloud Computing, Virtual environments
Provide a brief overview of the topics to be covered.
2. Email Security Issues, Peer-to-peer Computing, Instant Messaging, Social Media, and Cloud Computing (20 minutes)
Spend 4 minutes on each sub-topic to get an overview:
Email Security Issues: Understand common threats and vulnerabilities in email communication and methods to mitigate them.
Peer-to-peer Computing: Learn about the architecture, applications, and associated security risks of peer-to-peer networks.
Instant Messaging: Explore the security challenges and best practices for securing instant messaging platforms.
Social Media: Understand the security risks associated with social media usage and strategies to protect personal and organizational data.
Cloud Computing: Learn about cloud computing models, security concerns, and best practices for securing data and applications in the cloud.
3. Virtualized Environments (15 minutes)
4. Mobile, Wireless, and Internet-of-things (IoT) Devices (20 minutes)
Spend 5 minutes each on the following sub-topics:
Bring Your Own Device (BYOD): Learn about the benefits and risks of BYOD policies and strategies to implement effective security controls.
5. Summary and Review (5 minutes)
Reflect on any challenging concepts or areas that require further study.
Spend 7 minutes understanding the key risk areas in virtualized environments, including hypervisor vulnerabilities, resource isolation, and data
breaches.
Allocate 8 minutes to explore typical controls used to mitigate risks in virtualized environments, such as network segmentation, access controls,
encryption, and vulnerability management.
Mobile Computing: Understand the security challenges associated with mobile devices, including data loss, malware, and insecure
communications.
Internet Access on Mobile Devices: Explore the security considerations for mobile device connectivity to Wi-Fi networks, cellular networks, and
VPNs.

© Aswini Srinath
Day 61 /100
Study Plan: Wireless Networks, IoT
Briefly overview the topics to be studied.
2. Wireless Networks (15 minutes)
Spend 5 minutes understanding the basics of Wireless Wide Area Networks (WWAN) and Wireless Local Area Networks (WLAN).
Allocate 5 minutes to learn about security protocols such as WEP and Wi-Fi Protected Access (WPA/WPA2) used in WLANs.
Dedicate 5 minutes to explore Wireless Personal Area Networks (WPAN), Ad Hoc Networks, and their security considerations.
3. Public Global Internet Infrastructure (10 minutes)
Spend 5 minutes understanding the structure and components of the public global internet infrastructure.
Allocate 5 minutes to discuss the importance of securing critical internet infrastructure to ensure reliable and secure communication worldwide.
4. Wireless Security Threats and Risk Mitigation (15 minutes)
Spend 5 minutes identifying common wireless security threats such as eavesdropping, rogue access points, and denial-of-service attacks.
Allocate 5 minutes to discuss risk mitigation strategies including encryption, authentication protocols, intrusion detection systems, and security awareness training.
Dedicate the remaining 5 minutes to review case studies or real-world examples of wireless security breaches and their impact.
5. Internet of Things (IoT) (15 minutes)
Spend 5 minutes understanding the concept and significance of the Internet of Things (IoT).
Allocate 5 minutes to explore security challenges associated with IoT devices, including privacy concerns, data breaches, and device vulnerabilities.
Dedicate 5 minutes to discuss strategies for securing IoT devices and networks, such as network segmentation, device authentication, and firmware updates.
6. Summary and Review (5 minutes)
Reflect on any challenging concepts or areas that require further study.

© Aswini Srinath
Day 62 /100
Study Plan: Security Awareness Training and Programs, internet attack techniques
1. Security Awareness Training and Programs (10 minutes)
Overview:
Importance of security awareness.
Objectives of security awareness training.
Key Points to Study:
Components of effective security awareness programs.
Methods for delivering security awareness training.
Role of organizational culture in security awareness.
Examples of security awareness best practices.
2. Information System Attack Methods and Techniques (20 minutes)
Fraud Risk Factors (5 minutes):
Definition and types of fraud in the context of information systems.
Examples of fraud risk factors.
Importance of fraud detection and prevention.
Computer Crime Issues and Exposures (5 minutes):
Common types of computer crimes.
Impact of computer crimes on organizations.
Legal and ethical implications of computer crimes.
Internet Threats and Security (10 minutes):
Network Security Threats:
Definition and types (e.g., unauthorized access, data interception).
Examples and case studies.
Passive Attacks vs. Active Attacks:
Differences and examples of each.
Countermeasures against passive and active attacks.
Causal Factors for Internet Attacks:
Motivations behind internet attacks.
Factors contributing to vulnerabilities.
3. Malware (20 minutes)
Overview of Malware (5 minutes):
Definition and types (virus, worm, Trojan, ransomware).
Characteristics and behaviors of malware.

© Aswini Srinath
Controls and Countermeasures (10 minutes):
Virus and Worm Controls:
Preventative measures.
Detection and response strategies.
Management Procedural Controls (5 minutes):
Policies and procedures for malware prevention and response.
Incident response plans.
Technical Controls (5 minutes):
Anti-malware Software Implementation Strategies:
Features and capabilities of anti-malware tools.
Integration with existing IT infrastructure.
Targeted Attacks (5 minutes):
Characteristics of targeted attacks.
Strategies for defending against targeted attacks.
Summary and Review (10 minutes)
Recap the main points covered in each section.
Identify any areas that need further study or clarification.
Make notes of key concepts and definitions.
Additional Tips:
Use Resources Efficiently: Refer to textbooks, online resources, and lecture notes for deeper understanding.
Practice Questions: If available, attempt practice questions or scenarios related to the topics covered.
Review Regularly: Plan short review sessions to reinforce learning periodically.

© Aswini Srinath
Day 63 /100
Study Plan:Security Testing Tools and Techniques, Network Penetration Tests
1. Security Testing Tools and Techniques (25 minutes)
Testing Techniques for Common Security Controls (10 minutes):
Terminal Cards and Keys:
Definition and use in access control systems.
Security implications and vulnerabilities.
Terminal Identification (5 minutes):
Methods and technologies for terminal identification.
Importance in secure access management.
Logon IDs and Passwords (5 minutes):
Best practices for managing logon IDs and passwords.
Techniques for strengthening authentication processes.
Controls Over Production Resources (5 minutes):
Overview of production resource control mechanisms.
Security considerations and risk mitigation strategies.
Logging and Reporting of Computer Access Violations (5 minutes):
Importance of logging and reporting in security incident management.
Techniques for detecting and responding to access violations.
2. Network Penetration Tests (10 minutes)
Overview (5 minutes):
Definition and objectives of network penetration testing.
Types of penetration testing methodologies.
Techniques and Tools (5 minutes):
Common tools and frameworks used in network penetration testing.
Steps involved in conducting a penetration test.
3. Threat Intelligence (10 minutes)
Definition and Importance (5 minutes):
Role of threat intelligence in cybersecurity.
Sources of threat intelligence information.
Application and Integration (5 minutes):
How threat intelligence is used in security operations.
Integration of threat intelligence into security management processes.

© Aswini Srinath
4. Security Monitoring Tools and Techniques (15 minutes)
Intrusion Detection Systems (IDS) (5 minutes):
Features:
Functionality and capabilities of IDS.
Types of detections (signature-based vs. anomaly-based).
Limitations (5 minutes):
Challenges and constraints of IDS technology.
Strategies to mitigate limitations.
Policy (5 minutes):
Importance of policies in IDS deployment and operation.
Compliance and regulatory considerations.
Intrusion Prevention Systems (IPS), Honeypots, and Honeynets (5 minutes):
IPS (2 minutes):
Role of IPS in network security.
Comparison with IDS.
Honeypots and Honeynets (3 minutes):
Purpose and deployment strategies.
Benefits and risks associated with honeypots and honeynets.
Security Information and Event Management (SIEM) (5 minutes):
Overview (2 minutes):
Definition and components of SIEM.
Functionality in security operations.
Full Network Assessment Reviews (3 minutes):
Importance of comprehensive network assessments.
Techniques used in full network assessments.
Summary and Review (5 minutes)
Recap the main points covered in each section.
Identify any areas that need further study or clarification.
Make notes of key concepts and definitions.
Additional Tips:
Use Resources Efficiently: Refer to textbooks, online resources, and practical labs if available.
Practice Scenarios: Try to apply the concepts learned through practical scenarios or simulations.
Review Regularly: Plan short review sessions to reinforce learning periodically.

© Aswini Srinath
Day 64 /100
Study Plan: IRM, ECF
Read through the overview of Incident Response Management (IRM) and Evidence Collection and Forensics (ECF).
Identify key terms and concepts that will be covered in the study session.
2. Incident Response Management (IRM) (15 minutes)
Overview and Steps: Spend 5 minutes reviewing the steps involved in Incident Response Management (preparation, identification, containment, eradication,
recovery, lessons learned).
Case Studies: Allocate 5 minutes to read brief case studies or scenarios related to IRM and understand how these steps are applied.
Key Principles: Use the remaining 5 minutes to summarize the key principles of IRM, such as rapid response, communication protocols, and incident documentation.
3. Evidence Collection and Forensics (ECF) Overview (10 minutes)
Introduction: Spend 5 minutes understanding the importance of Evidence Collection and Forensics in cybersecurity and legal contexts.
Types of Evidence: Dedicate 5 minutes to categorize and briefly describe the types of evidence commonly encountered in digital forensics (e.g., physical, digital
4. Computer Forensics (10 minutes)
Processes: Allocate 5 minutes to review the processes involved in Computer Forensics (data protection, data acquisition, imaging, extraction, interrogation,
ingestion/normalization).
Tools and Techniques: Use the remaining 5 minutes to explore common tools and techniques used in Computer Forensics, such as forensic imaging software
and data recovery methods.
5. Protection of Evidence and Chain of Custody (15 minutes)
Importance: Spend 5 minutes understanding why protection of evidence and maintaining chain of custody are critical in forensic investigations.
Processes: Allocate 5 minutes to review the processes involved in protecting evidence and maintaining chain of custody (e.g., documenting evidence,
securing storage, logging access).
Legal Considerations: Use the remaining 5 minutes to summarize legal considerations related to evidence handling and chain of custody in different jurisdictions.
6. Summary and Reflection (5 minutes)
Summary: Quickly summarize the main points covered in IRM and ECF.
Reflection: Identify any areas where you need further clarification or study.

© Aswini Srinath
Day 71 to 76
Duration: 60 minutes each day
Study Plan:
- Practice 251 to 285 questions in ISACA QAE database for domain 5
- Domain 1 Revision - Personal notes, CRM revision, review of wrong answers

CISA 100 Days Study Plan InfosecTrain.pdf

CISA 100 Days Study Plan InfosecTrain.pdf

More Related Content

Similar to CISA 100 Days Study Plan InfosecTrain.pdf

More from infosec train

Recently uploaded

CISA 100 Days Study Plan InfosecTrain.pdf