ISACA CISM hands-on labs
Risk register and control sheets: rate the risk, choose the treatment, name the owner and leave a record an auditor can test.
36 labs you run in the browser: 11 guided, 17 assisted, 7 challenge, 1 capstone. About 5 hours of authored lab time. 1 opens to any signed-in account without a lab grant.
36
labs
11
guided
steps in order
8
goal only
challenge and capstone
1
free tasters
signed-in, no grant
What you practise
Exam facts and study plan- Risk register and control sheets· you click36 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Keep the evidence before the rebuild
Free tasterGuided · Quick · 5 min · Risk register and control sheets
During containment the analyst rebuilt the file server so finance could close the month. The disk was wiped before anyone captured it, so nobody knows how the loader arrived…
incident responseevidence preservationcontainmenteradication before recovery
Record a control that has not been tested in a year
ProGuided · Quick · 5 min · Risk register and control sheets
The programme review found a gap in the awareness work. The phishing simulation last ran fourteen months ago, so two of the nine business units have never been tested…
control testingprogram managementrisk registerevidence
Record a written acceptance for the shop floor printer
ProGuided · Quick · 5 min · Risk register and control sheets
The label printer on the packing line runs firmware the vendor stopped updating in 2024. Replacement is budgeted for next year and the line cannot stop before then…
risk acceptancerisk appetitemonitoringrisk register
Put the credential stuffing wave on the register
ProGuided · Quick · 6 min · Risk register and control sheets
Two competitors in the same market lost customer accounts to the same stuffing list last month. The customer portal here still accepts a password and nothing else…
emerging riskthreat landscapeauthentication controlsrisk register
Register the AI assistant that staff already use
ProGuided · Quick · 6 min · Risk register and control sheets
Claims handlers discovered a free AI assistant that summarises long documents, and by the time the security team heard about it forty people had an account…
information classificationacceptable useshadow ITcontrol mapping
Stop the reconciliation spreadsheet that holds card numbers
ProGuided · Quick · 6 min · Risk register and control sheets
Each month finance exports the settlement report and pastes full card numbers into a workbook so refunds can be matched. The workbook sits on a shared drive with no label…
information classificationinformation life cycleasset ownershiphandling rules
Put a name against the analytics platform risk
ProGuided · Quick · 7 min · Risk register and control sheets
The finance analytics platform has no accountable business owner. Requests for change arrive from three teams, access is granted by whoever asks loudest…
risk ownershiproles and responsibilitiesgovernancerisk register
Record the escalation that did not happen
ProGuided · Quick · 7 min · Risk register and control sheets
A ransomware near miss last month was contained in forty minutes, which the post incident review praised. What the review also found is that nobody told the insurer or the regulator contact…
incident responseescalationcontainmentcontrol ownership
Register the customer message nobody approved
ProGuided · Quick · 7 min · Risk register and control sheets
When the card payment gateway failed for four hours in June, the support team wrote its own customer message and posted it…
incident communicationsescalationpre approved wordingrisk register
Score and treat a supplier risk
ProGuided · Quick · 8 min · Risk register and control sheets
Payroll runs out of one supplier's hosted export. The register entry has sat unrated since the contract was signed, and the audit committee meets on Thursday…
likelihoodimpactrisk treatmentcontrol mapping
Bring the print chain and the exit plan into the register
ProGuided · In-depth · 34 min · Risk register and control sheets
Payslips for twelve thousand staff are printed by a payroll bureau that subcontracts the print run to a shop in another country. Nobody in the group has met the shop…
third party riskfourth party visibilityconcentration riskrisk treatment
Open one route for the phishing reports
ProAssisted · Quick · 5 min · Risk register and control sheets
Reporting collapsed to four percent this quarter. Staff still forward suspicious mail to the security mailbox…
security awarenessreporting behaviourcontrol operationdiagnosis before retraining
Put the security committee back on the real line
ProAssisted · Quick · 5 min · Risk register and control sheets
The security steering committee was formed last spring and reports to the security team that runs it. Its decisions on the logging upgrade and on the warehouse system exception sit in its…
security governancereporting linesdecision rightscommittee oversight
Sort events before the next bad morning
ProAssisted · Quick · 5 min · Risk register and control sheets
Every event pages the same eight people, from a lost laptop to a stopped payment run. Last month the on call engineer started with a laptop ticket while the payment service was down…
incident response planseverity classificationescalationon call rota
Close a vendor tunnel that the contract no longer needs
ProAssisted · Quick · 6 min · Risk register and control sheets
The support contract changed in March. The vendor now receives a signed weekly extract and no longer needs a standing tunnel into the core database. The tunnel still exists…
risk registerrisk treatmentavoidancecontrol mapping
Give the board a number that shows repeat findings
ProAssisted · Quick · 6 min · Risk register and control sheets
The board pack has twelve slides of activity counts and no measure of whether anything improved. The same four audit findings have come back three years running…
programme metricsboard reportingrepeat findingscontrol mapping
Put an untested recovery plan on the risk register
ProAssisted · Quick · 6 min · Risk register and control sheets
The order database recovery plan has been walked through twice on paper and never restored from an archive…
recovery testingrecovery time objectiverisk registerincident readiness
Record the portal that skipped the architecture review
ProAssisted · Quick · 6 min · Risk register and control sheets
A supplier delivered the new customer portal in eleven weeks, and the architecture board first saw the design after it went live…
enterprise architecturesecurity architecture reviewdesign gaterisk register
Register the library nobody can find
ProAssisted · Quick · 6 min · Risk register and control sheets
The scanner flagged a critical vulnerability in a logging library on Tuesday. By Thursday the team had a patch and no idea where to apply it. Forty services run in the estate…
control deficiencyasset inventoryvulnerability managementrisk register
Score one broker that every system trusts
ProAssisted · Quick · 6 min · Risk register and control sheets
The architecture review of the login chain found one identity broker in one region. Every application trusts it, from the intranet to the payment console…
security architecturetrust boundariessingle point of failureidentity design
Score the plant outage nobody costed
ProAssisted · Quick · 6 min · Risk register and control sheets
The plant risk review reused the office template. Downtime is scored two, because office staff can work from laptops…
risk assessmentimpact analysisscope and assumptionsoperational technology
Move the financial side of a risk
ProAssisted · Quick · 7 min · Risk register and control sheets
A ransomware event that stops the order desk for a week is on the register. Finance has now placed a cyber policy with a deductible…
risk transferthird party riskresidual risk
Put a breach notice deadline in the payroll contract
ProAssisted · Quick · 7 min · Risk register and control sheets
A payroll processor lost a file of bank details last spring. The security team learned about it from a customer tweet nine days later…
third party riskcontract termsbreach notificationmonitoring
Register the acceptance that went past the appetite line
ProAssisted · Quick · 7 min · Risk register and control sheets
The customer portal still lets a driver track a delivery with an order number and a postcode. In March a team lead marked the risk as accepted…
risk appetiteescalationdelegated authorityrisk register
Register the clock nobody owns
ProAssisted · Quick · 7 min · Risk register and control sheets
A new rule requires the company to tell its regulator about a material incident within 24 hours of becoming aware of it. The response plan was written before the rule existed…
regulatory obligationsroles and responsibilitiesincident reportingrisk register
Register backups that the domain can reach
ProAssisted · Quick · 8 min · Risk register and control sheets
The tabletop exercise produced one uncomfortable finding. The backup server replicates from production every night and accepts domain administrator credentials…
ransomware readinessbackup isolationrecovery testingrisk register
The renewal pack for a supplier that never named its subprocessor
ProAssisted · In-depth · 28 min · Risk register and control sheets
The platform supplier renews in June and the procurement pack goes to the audit committee three weeks before that. Three entries in the register have never been scored…
risk assessmentrisk treatmentthird and fourth party riskcontract clauses
Settle three entries before the audit committee
ProAssisted · In-depth · 30 min · Risk register and control sheets
The audit committee meets on Thursday and the register still carries three entries from the control test programme with no score and no response…
emerging riskrisk assessmentrisk treatmentcontrol ownership
Decide again on the reporting database nobody owns
ProChallenge · Quick · 5 min · Risk register and control sheets
In 2024 the register recorded the customer reporting database as mitigated. The control it named was never built. Two reports still run from it…
risk treatmenttreatment reviewdecommissioningrisk register
Decide on a fix that costs more than the loss
ProChallenge · Quick · 5 min · Risk register and control sheets
The conveyor controller runs firmware the vendor stopped updating. The controller has no route to the internet and sits behind the plant firewall. Replacing it means rebuilding the line…
risk treatmentcost benefitcompensating controldocumented acceptance
Fix the patch number the board and operations both quote
ProChallenge · Quick · 5 min · Risk register and control sheets
The board pack says 97 percent of critical patches are applied. The operations report for the same month says 61 percent. Both are correct. One counts a patch from the day it is released…
metric definitionmanagement reportingdata ownershiprisk register
Classify the data before the marketing tool goes live
ProChallenge · Quick · 6 min · Risk register and control sheets
A marketing analytics tool ingests customer email addresses and order history from a nightly feed. Nobody has classified that data, so nobody has decided which standards apply to it…
data classificationprogramme scoperisk registercontrol mapping
Fix the restore target the team can pass
ProChallenge · Quick · 6 min · Risk register and control sheets
The board pack has shown one hundred percent restore tests passed for eight quarters. The test restores a four gigabyte configuration store. The billing database has never been restored…
programme metricsmetric definitionmanagement reportingmetric gaming
Record the gap between the strategy and the money
ProChallenge · Quick · 6 min · Risk register and control sheets
The three year security strategy promises staff awareness training, ninety day log retention and an annual penetration test…
security strategybudget alignmentgovernance frameworkrisk register
Register the launch plan with no security line
ProChallenge · Quick · 6 min · Risk register and control sheets
The plan to open a sales office in a new country is eight weeks from go live. It names legal, tax, hiring and a launch date…
business alignmentsecurity strategybusiness caselaunch gate
Close the actions two incident reviews left open
ProCapstone · In-depth · 32 min · Risk register and control sheets
Two outages hit the order line this year. Each one produced a review, a report and a list of actions. The March list lives in a spreadsheet that one analyst keeps on her own drive…
post incident reviewcorrective action trackingdetection coveragerisk acceptance
Where to go next
Every certification with labsCISM lab questions
There are 36 labs: 11 guided, 17 assisted, 7 challenge, 1 capstone. Together they carry about 5 hours of authored lab time, and 1 free taster lab.
Practise CISM the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.