Certified: The ISC(2) ISSMP Audio Course

About Certified: The ISC(2) ISSMP Audio Course

Certified: The ISC(2) ISSMP Certification Audio Course is an audio-first study program for experienced security professionals who are ready to step into security management leadership. If you already understand core security concepts and you now need to lead programs, influence stakeholders, and make decisions that hold up under pressure, this course is built for you. It’s designed for practitioners moving into manager, lead, architect, or program roles, and for leaders who want a structured path toward the ISSMP credential without living in a textbook. You’ll hear the “why” behind common management choices, not just the definitions, so you can connect the exam objectives to the work you do in real organizations. Across Certified: The ISC(2) ISSMP Certification Audio Course, you’ll learn how security managers plan, govern, and run security programs in a way that aligns to business goals. We break down governance and policy, program and project management, risk management and metrics, incident and crisis leadership, and the day-to-day realities of building and sustaining a security team. Everything is taught in a clear spoken format, with tight explanations, practical framing, and examples that are easy to picture without needing slides. Because it’s audio-first, you can learn during commutes, workouts, or between meetings, turning small pockets of time into steady progress. What makes Certified: The ISC(2) ISSMP Certification Audio Course different is that it treats the ISSMP as a leadership exam, not a vocabulary test. You’ll get the mental models that help you choose the best answer when multiple options seem plausible, along with the language and reasoning patterns that show up in management-level questions. Success here means more than finishing episodes—it means you can explain tradeoffs, defend decisions, and map security work to outcomes a business cares about. By the end, you should feel comfortable translating strategy into execution, communicating risk clearly, and approaching the ISSMP with a calm, methodical plan.

Publisher

Jason Edwards

Category

education · technology

Language

en

Explicit

No

First episode

22 Feb 2026

Latest episode

22 Feb 2026

Latest episodes

120 episodes in the feed.

1. 

   22 Feb 2026

   Episode 119 — Obtain Authorized Risk Waivers With Proper Approval and Traceable Records

   This episode teaches how to obtain authorized risk waivers with proper approval and traceable records, because ISSMP scenarios frequently hinge on who can accept risk, what evidence must exist, and how to ensure waivers do not become invisible risk debt. You will learn how risk waivers differ from operational exceptions, how to confirm decision authority and delegated limits, and how to document the risk statement, impacts, likelihood drivers, compensating controls, and time bounds so the waiver can be reviewed and revoked if conditions change. Scenarios include approving a vendor exception for a critical service, waiving a control requirement for a short-term launch, and accepting residual risk when remediation is not feasible, emphasizing the need for governance-aligned approvals and audit-ready evidence. Best practices include formal review cadence, monitoring of waiver conditions, and clear ownership for remediation planning, while troubleshooting covers “shadow waivers,” missing executive signatures, and waivers that outlive their rationale. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.

2. 

   22 Feb 2026

   Episode 118 — Document Compliance Exceptions With Controls, Workarounds, and Risk Context

   This episode explains how to document compliance exceptions with the controls, workarounds, and risk context needed to remain defensible, because ISSMP often tests whether you understand that exceptions must be governed, time-bounded, and evidence-supported rather than informal permission slips. You will learn how to define the exact requirement being excepted, the scope and duration, the business rationale, the residual risk statement, and the compensating controls that reduce exposure while the exception exists. Scenarios include legacy systems that cannot meet baseline requirements, vendor limitations that constrain logging or encryption, and urgent business timelines that require phased control adoption, showing how exception documentation protects both governance and operational clarity. Best practices include specifying owners, review cadence, termination criteria, and monitoring indicators, while troubleshooting covers vague exceptions, missing approvals, and exceptions that spread beyond their intended scope. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.

3. 

   22 Feb 2026

   Episode 117 — Monitor and Validate Remediation Actions Until Risk Is Truly Reduced

   This episode teaches how to monitor and validate remediation actions until risk is truly reduced, which ISSMP emphasizes because remediation is not complete when a ticket is closed, but when control performance and evidence prove the weakness is no longer present. You will learn how to track remediation by risk tier, define acceptance criteria and validation tests, and ensure owners deliver durable fixes that survive normal change activity. We apply this to scenarios like patch remediation that regresses after updates, access governance improvements that are inconsistently applied, and logging gaps that reappear during platform changes, showing how to build verification routines that detect backsliding. Best practices include remediation dashboards with aging and blockage visibility, periodic sampling for evidence quality, and escalation paths for stalled actions, while troubleshooting covers optimistic status reporting, resource constraints, and “temporary compensating controls” that become permanent. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.

Contact Certified: The ISC(2) ISSMP Audio Course

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.