TISAX® Professional

Module 1 - Audit Processes for Information Systems

1.1 Planning

• IS Audit Standards, Audit Guidelines, and Ethical Codes

• Types of Controls for Business Processes

• Risk-Based Audit Planning

• Types of Audits and Assessments

1.2 Execution

• Audit Project Management

• Sampling Methodology

• Techniques for Collecting Audit Evidence

• Data Analysis

• Reporting and Communication Techniques

• Quality Assurance and Improvement of the Audit Process

Module 2 - Governance and Management of IT

2.1 IT Governance and IT Strategy

• IT-Related Frameworks

• IT Standards, Policies, and Procedures

• Organizational Structure

• Enterprise Architecture

• Enterprise Risk Management

• Maturity Models

• Laws, Regulations, and Industry Standards Affecting the Organization

2.2 IT Management

• IT Resource Management

• Acquisition and Management of IT Service Providers

• Monitoring and Reporting of IT Performance

• Quality Assurance and Quality Management of IT

Module 3 - Acquisition, Development, and Implementation of Information Systems

3.1 Acquisition and Development of Information Systems

• Project Control and Management

• Business Case and Feasibility Analysis

• System Development Methods

• Identification and Design of Controls

3.2 Implementation of Information Systems

• Test Methods

• Configuration and Release Management

• System Migration, Infrastructure Provisioning, and Data Conversion

• Post-Implementation Review

Module 4 - Information Systems Operations and Business Resilience

4.1 Information Systems Operations

• Common Technology Components

• IT Asset Management

• Order Planning and Automation of Production Processes

• System Interfaces

• End-User Computing

• Data Governance

• Management of System Performance

• Incident and Problem Management

• Change, Configuration, Release, and Patch Management

• IT Service Level Management and Database Management

4.2 Business Resilience

• Business Impact Analyses

• System Resilience

• Data Backup, Storage, and Recovery

• Business Continuity Plan

• Disaster Recovery Plan

Module 5 - Protection of Information Assets

5.1 Standards and Guidelines for Information Resource Security

• Principles of Data Protection

• Physical Access and Environmental Controls

• Identity and Access Management

• Network and Endpoint Security

• Data Classification

• Data Encryption and Encryption Techniques

• Public Key Infrastructure

• Web-Based Communication Technologies

• Virtualized Environments

• Mobile, Wireless, and Internet of Things Devices

5.2 Security Event Management

• Training and Programs to Promote Security Awareness

• Attack Methods and Techniques for Information Systems

• Tools and Techniques for Security Testing

• Tools and Techniques for Security Monitoring

• Incident Response Management

• Evidence Preservation and Forensics