Plans are only useful if they’re tested. In this episode, we explore the various methods for testing business continuity and disaster recovery plans—including walkthroughs, simulations, functional tests, and tabletop exercises. We discuss how to design tests, involve key stakeholders, and evaluate performance without disrupting operations. You’ll learn how testing helps uncover weaknesses in coordination, communication, and recovery capabilities. For CISSPs, facilitating and analyzing these exercises is crucial to strengthening organizational resilience and ensuring plans work under real-world conditions.

When disaster strikes, organizations must restore operations quickly—and with minimal data loss. This episode focuses on Disaster Recovery Planning (DRP), particularly the metrics used to guide recovery strategies: Recovery Time Objective (RTO) and Recovery Point Objective (RPO). We explain how to define recovery priorities, select appropriate backup and failover solutions, and develop DR plans that meet business expectations. You’ll also learn about recovery site options, communication planning, and regular testing. CISSPs must understand DRP as part of a broader resilience strategy tied to business continuity.

The reliability of evidence hinges on how it’s handled. In this episode, we dive deeper into the principles and techniques for acquiring and preserving digital evidence. Topics include imaging storage media, capturing memory dumps, recording live sessions, and documenting every step in the collection process. We also address how to avoid contamination, preserve timestamps, and ensure repeatability for court presentation. CISSPs must ensure that any evidence collected during investigations—whether by internal teams or third-party experts—is done with integrity and according to accepted forensic procedures.

Preserving and analyzing digital evidence requires precision, consistency, and legal awareness. This episode explores the fundamentals of digital forensics—from identifying and collecting evidence to maintaining a documented chain of custody. We discuss volatile data acquisition, imaging tools, hashing for integrity verification, and timeline reconstruction. You’ll also learn about legal standards that govern admissibility and the responsibilities of forensic investigators. CISSPs don’t have to be deep forensic experts, but they must understand how to support investigations and preserve evidence in a defensible manner.

Incidents are inevitable, and how you respond can determine the scale of impact. In this episode, we walk through the phases of incident management—preparation, identification, containment, eradication, recovery, and lessons learned. We explain how to build an incident response plan, assemble a response team, and establish escalation protocols. You’ll also learn how to coordinate with legal, PR, and law enforcement when necessary. Incident management is a high-priority domain for CISSPs because it brings together technical expertise, process discipline, and communication under pressure.

Capturing events is only the beginning—making sense of them is where the real value lies. This episode covers how organizations collect, normalize, and correlate logs from various systems and devices using Security Information and Event Management (SIEM) platforms. We discuss the components of a SIEM, alert tuning, and the use of correlation rules to detect complex threat patterns. You'll learn how SIEMs enhance visibility, speed up investigations, and support compliance with standards like HIPAA and PCI DSS. CISSPs must understand how to use logging and SIEM tools to build proactive and resilient detection capabilities.

Security operations are built on consistency, structure, and clear documentation. In this episode, we explore the daily tasks that keep cybersecurity programs running—such as log reviews, system checks, user access reviews, and patch verification. We explain how operational procedures and checklists reduce errors, promote accountability, and streamline incident response. You’ll also learn how to align these routines with compliance requirements and best practices. CISSPs are expected to understand how standard operating procedures (SOPs) and continuous monitoring form the backbone of an effective and auditable security operations center (SOC).

Vendors and service providers often have privileged access to your data and systems—making them a potential weak link. This episode focuses on third-party risk management, including how to evaluate a vendor's security posture before and after engagement. We cover due diligence checklists, contract clauses, security questionnaires, and ongoing monitoring practices. You'll also learn about shared responsibility models and how to manage risks across cloud, SaaS, and supply chain relationships. CISSPs must ensure that third-party access is governed with the same rigor as internal controls.

Security is not a one-time event—it’s a continuous process. In this episode, we explore how continuous monitoring helps organizations detect changes, uncover risks, and maintain compliance in dynamic environments. We discuss how to implement automated data collection, baseline comparison, and event correlation across networks, endpoints, cloud services, and applications. You'll also learn how feedback loops from incidents, audits, and testing drive program maturity. CISSPs must understand how to design, scale, and sustain continuous monitoring efforts that support real-time decision-making and operational resilience.

What gets measured gets managed—and security is no exception. This episode focuses on security metrics and key performance indicators (KPIs) that help organizations evaluate the effectiveness of their controls and programs. We cover types of metrics (operational, compliance, risk-based), how to design meaningful KPIs, and how to avoid common pitfalls like vanity metrics. You'll also learn how to tie metrics to business objectives and use them in dashboards and reports. CISSPs must understand how to measure what matters and use those insights to drive continuous improvement.