Expected CIS-SPM Exam Topics, as suggested by ServiceNow :

• Module 1: Information Security Governance: This section of the exam delves into security management concepts and principles, examining organizational structures and roles in security. It also covers developing and implementing security policies, standards, and procedures.
• Module 2: Regulatory Compliance and Legal Issues: This section addresses risk management and risk assessment methodologies, including threat modeling and vulnerability assessment. It also explores various risk mitigation strategies.
• Module 3: Asset Security: This section focuses on information and asset classification, data security controls, privacy protection measures, and intellectual property protection.
• Module 4: Security Architecture and Engineering: This section examines security models and design principles, system and application security, as well as cryptography and key management.
• Module 5: Communication and Network Security: This section covers network architecture and design, secure communication protocols, wireless network security, and strategies to defend against network attacks.
• Module 6: Identity and Access Management: This section explores authentication methods and technologies, authorization and access control models, and the identity management lifecycle.
• Module 7: Security Operations: In this section, the focus is on security monitoring and analytics, incident response and management, forensics and investigations, and patch and vulnerability management.
• Module 8: Software Development Security: This section emphasizes securing the software development lifecycle, including application security testing, code review, secure coding practices, and third-party software management.
• Module 9: Security Assessment and Testing: This section focuses on security audit principles and methodologies, penetration testing techniques, and the use of security metrics and reporting.
• Module 10: Privacy Management: This section covers privacy principles and regulations, privacy impact assessments, data protection techniques, and the concepts of privacy by design.