The 11pm call

The alert fires at 11pm. Unauthorized access detected on a production server.

Two people get called. One is the security analyst. One is the security manager.

The analyst's job: contain the incident. Identify the entry point. Isolate the affected system. Preserve the logs. Start the forensic process.

The manager's job starts in a completely different place.

Who needs to be notified, and in what order? Legal, compliance, the board, customers, regulators? Which notifications are legally required and within what timeframe? What's the business impact of taking the affected system offline versus leaving it running while the investigation continues? Who's authorized to make that call?

Is this a reportable breach under GDPR, CCPA, or the industry regulations that apply to this organization? If it is, the clock is already running.

What does the communication to customers look like, who approves it, and when does it go out? What happens to the contracts that depend on the system that's now offline?

The analyst is asking: what happened and how do we stop it?

The manager is asking: what are the consequences and how do we manage them?

Both questions matter. They require completely different training.

Most security professionals are trained on the first question. Threat analysis, technical controls, incident response procedures, forensic methodology. These are teachable, testable, and most certification paths cover them well.

The second set of questions is where careers stall.

Not because security professionals can't answer them. Because nobody trained them to think that way. The jump from "here's what happened technically" to "here's what this means for the organization, its obligations, its customers, and its leadership" is a different skill entirely.

CISM is built for that gap. Not technical security, but security management: how to build programs that account for business impact, regulatory obligation, and stakeholder communication before an incident happens, not during it.

The professionals who can answer both sets of questions are the ones who move into leadership roles. The ones who can only answer the first set stay in the roles they're in.

Our next CISM Bootcamp runs September 8-11. Four days with our instructors covering everything ISACA tests. You also get full access to the CISM MasterClass if you prefer to study at your own pace.

P.S. Prefer to study on your own schedule? Our CISM MasterClass covers the same material with full flexibility.

Best,
The DestCert Team