CISM Readiness: Security Management at the Executive Level
Signature Course No. 511 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's CISM Readiness: Security Management at the Executive Level course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
The credited answer is usually the manager's answer. CISM is not a test of whether you can configure a control, read a packet, or name a cipher. It is a test of whether you can govern a security programme the way a security executive governs one. A technically elegant fix that no business owner approved, that costs more than the risk it retires, or that solves the incident in front of you while blinding the organisation to the next one, loses to a plainer answer that protects the business, respects who decides, and can be governed.
It starts with the manager's answer. Concept 1 teaches the four marks directly: the move protects the business outcome, not the asset; it respects ownership; it is proportionate; and it can be governed. The remaining seventeen concepts give you the substance that judgment operates on — governance and risk first, then the programme and the incident.
It works in two movements. First, Module 1 — Governance and Risk: The Manager's Ground — work through Concepts 1–9, finishing with The Governance Charter and Risk Decision Pack; then, Module 2 — Programme and Incident: Running Security Like an Executive — work through Concepts 10–18, finishing with The Programme and Incident Readiness Plan.
Both capstones produce real artifacts — a governance charter and risk decision pack for the running case: the ownership rule applied at Vantage Mutual, the strategy derived and its chairs assigned, the three governing risks translated into board statements, their treatments decided with residuals owned and dated, and the one-page evidence summary; and a complete programme and incident readiness plan: the year's roadmap sequenced by governance logic, the layered control set and governed vendor surface, the budget cased in separated kinds of value, the incident capability prepared with authority agreed in advance, and the proof — targets, a timed test, indicators, and the improvement loop.
The honesty standard is part of the course. Readiness is not a guarantee — no course can promise a pass, and this one does not. The course contains no examination items: every scenario is invented for teaching and resembles the examination in shape only. And it holds its fence: management judgment only — no audit procedure, no register craft in depth, no engineering design — because the credential certifies the manager, not the technician.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
CISM Readiness: Security Management at the Executive Level is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning delivers.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with the last significant security decision you influenced. Whose business outcome was at stake, who actually made the decision, and were those the same person? When you last recommended a control, did you compare its technical strength, or its cost against the risk it retired? And think of a time speed felt like the whole job — what did the speed cost that nobody priced at the time? Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Governance Charter and Risk Decision Pack for Module 1 and The Programme and Incident Readiness Plan for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
The manager's answer decides. Every scenario in this course — on the examination and in the job — offers a technical answer and a manager's answer. Checking any candidate against the four marks, in order, before comparing technical merits is the habit every concept practices from a different angle.
Module 1 builds the ground. The manager's answer itself; governance as ownership — the business owns the risk; strategy derived from the business plan and its appetite; accountability assigned without gaps or doubled chairs; risk assessed as a decision process and expressed in business language a board can act on; treatments chosen deliberately among accept, mitigate, transfer, and avoid; metrics that govern rather than decorate; and compliance held apart from posture.
Module 2 runs the programme. The programme built as a business — roadmap, priorities, and the case for money; controls selected by proportion and governed through their lifecycle; people, process, and vendors held inside the same discipline; the budget defended and value proven in separated kinds; operations run through policy, exceptions, and continuous improvement; and incident management led as a business process — prepared before the event, decided by impact during it, recovered and proved after it.
And it holds its boundary throughout. The technical crafts — audit procedure, the risk practitioner's register craft, engineering depth — are taught in their own seats on this shelf. This course is the management layer: what you do about such things when you are accountable for the programme — whether to fund them, how to govern them, who owns their risk, and how you know they are working.
What you will learn
- Choose the manager's answer: in any security scenario, identify the move a security executive would defend — business-protecting, ownership-respecting, governable — over the move a technician would reach for
- State and apply the governance rule of ownership: the business owns risk, the board and senior management set appetite, and the security function advises, enables, and reports — never silently absorbs
- Align a security strategy to business goals and risk appetite, and show the line from a business objective to a security initiative without breaking it
- Assign accountability cleanly — roles, decision rights, and segregation — so no material risk sits unowned and no decision sits in two chairs
- Assess risk and express it in business language: likelihood, business impact, appetite, and tolerance a board can act on
- Choose a risk treatment deliberately — accept, mitigate, transfer, or avoid — with an honest business case, a named owner, and a review date
- Govern with metrics: select the small set of indicators that show whether risk is inside appetite and whether the programme is working, and report them without cosmetics
- Distinguish compliance from resilience, meet external duties without mistaking the audit result for the security posture
- Build and run the programme as a business — roadmap, controls chosen proportionately, people and vendors governed, budget defended, value proven — and lead incident management as a business process from preparation to tested recovery
Everything in the course
- All 18 concepts of CISM Readiness: Security Management at the Executive Level, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Governance Charter and Risk Decision Pack and The Programme and Incident Readiness Plan
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for security managers preparing at the executive level
Security managers and aspiring security executives preparing for the CISM examination — who already have technical grounding and need the management judgment the examination actually samples; and experienced practitioners moving into governance, risk, and programme roles, whose next promotion depends on thinking in business impact, ownership, and appetite rather than in tickets and tools.
Managers in adjacent functions — risk, compliance, operations, internal audit liaison roles — who sit in security decisions and need to understand how a security executive frames them, without crossing into audit or engineering territory themselves.
Returning candidates — who have sat the examination before and recognised, in the room, that their answers were technically sound and managerially wrong. This course assumes working experience in information security or a closely related function; it does not teach security fundamentals, and it will not slow down to explain what a firewall or an access review is.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with The Manager's Answer
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
CISM Readiness: Security Management at the Executive Level is Signature Course No. 511. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.