Questions? Call 1.800.716.8955

Security

CISSP

Certified Information Systems Security Professional

The eight domains of information security, from risk management to software development security.

CISSP 0 of 64 read Start reading

Part AIntroduction

  1. A.1Part A: Introduction
  2. A.2Outline

Part BExam objectives

"% of exam" is each domain's share of questions in the exam outline this guide follows.

1Security and Risk Management15% of exam · 13 objectives
  1. 1.1Understand, adhere to, and promote professional ethics
  2. 1.2Understand and apply security concepts
  3. 1.3Evaluate and apply security governance principles
  4. 1.4Determine compliance requirements
  5. 1.5Understand legal and regulatory issues that pertain to information security in a holistic context
  6. 1.6Understand requirements for investigation types (i.e. administrative, criminal, civil, regulatory, industry standards)
  7. 1.7Develop, document, and implement security policy, standards, procedures, and guidelines
  8. 1.8Identify, analyze, and prioritize Business Continuity (BC) requirements
  9. 1.9Contribute to and enforce personnel security policies and procedures
  10. 1.10Understand and apply risk management concepts
  11. 1.11Understand and apply threat modeling concepts and methodologies
  12. 1.12Apply Supply Chain Risk Management (SCRM) concepts
  13. 1.13Establish and maintain a security awareness, education, and training program
2Asset Security10% of exam · 6 objectives
  1. 2.1Identify and classify information and assets
  2. 2.2Establish information and asset handling requirements
  3. 2.3Provision resources securely
  4. 2.4Manage data lifecycle
  5. 2.5Ensure appropriate asset retention (End of Life (EOL), End of Support (EOS))
  6. 2.6Determine data security controls
3Security Architecture and Engineering13% of exam · 9 objectives
  1. 3.1Research, implement and manage engineering processes using secure design principles
  2. 3.2Understand the fundamental concepts of security models (Biba, Star Model, Bell-LaPadula)
  3. 3.3Select controls based upon systems security requirements
  4. 3.4Understand security capabilities of information systems (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)
  5. 3.5Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements
  6. 3.6Select and determine cryptographic solutions
  7. 3.7Understand methods of cryptanalytic attacks
  8. 3.8Apply security principles to site and facility design
  9. 3.9Design site and facility security controls
4Communication and Network Security13% of exam · 3 objectives
  1. 4.1Implement secure design principles in network architectures
  2. 4.2Secure network components
  3. 4.3Implement secure communication channels according to design
5Identity and Access Management13% of exam · 6 objectives
  1. 5.1Control physical and logical access to assets
  2. 5.2Manage identification and authentication of people, devices, and services
  3. 5.3Integrate identity as a third-party service
  4. 5.4Implement and manage authorization mechanisms
  5. 5.5Manage the identity and access provisioning lifecycle
  6. 5.6Implement authentication systems
6Security Assessment and Testing12% of exam · 5 objectives
  1. 6.1Design and validate assessment, test, and audit strategies
  2. 6.2Conduct security control testing
  3. 6.3Collect security process data (e.g., technical and administrative)
  4. 6.4Analyze test output and generate report
  5. 6.5Conduct or facilitate security audits
7Security Operations13% of exam · 15 objectives
  1. 7.1Understand and comply with investigations
  2. 7.2Conduct logging and monitoring activities
  3. 7.3Perform Configuration Management (CM) (provisioning, baselining, automation)
  4. 7.4Apply foundational security operations concepts
  5. 7.5Apply resource protection techniques
  6. 7.6Conduct incident management
  7. 7.7Operate and maintain detective and preventative measures
  8. 7.8Implement and support patch and vulnerability management
  9. 7.9Understand and participate in change management processes
  10. 7.10Implement recovery strategies
  11. 7.11Implement Disaster Recovery (DR) processes
  12. 7.12Test Disaster Recovery Plans (DRP)
  13. 7.13Participate in Business Continuity (BC) planning and exercises
  14. 7.14Implement and manage physical security
  15. 7.15Address personnel safety and security concerns
8Software Development Security11% of exam · 5 objectives
  1. 8.1Understand and integrate security in the Software Development Life Cycle (SDLC)
  2. 8.2Identify and apply security controls in development environments
  3. 8.3Assess the effectiveness of software security
  4. 8.4Assess security impact of acquired software
  5. 8.5Define and apply secure coding guidelines and standards