CISSP Domain Review
Working review notes across the eight-domain CBK, general information security knowledge organized by domain. See the study blueprint for the weighted domain map.
1. Security and Risk Management
CIA triad, governance, risk analysis (SLE/ALE/ARO), BCP/DR, compliance landscape, threat modeling, the Code of Ethics.
16%2. Asset Security
Classification, data roles, data states, the data lifecycle, remanence and NIST 800-88 sanitization, baselines.
10%3. Security Architecture and Engineering
Bell-LaPadula, Biba, Clark-Wilson, Common Criteria, TCB, cryptography fundamentals, secure design principles, physical security.
13%4. Communication and Network Security
OSI/TCP-IP, firewalls and IDS/IPS, IPsec/TLS/SSH, segmentation, wireless security, remote access.
13%5. Identity and Access Management (IAM)
AAA, authentication factors, DAC/MAC/RBAC/ABAC, the identity lifecycle, SAML/OAuth/OIDC, privileged access.
13%6. Security Assessment and Testing
Vulnerability scans vs. pentests, red/blue/purple teams, black/white/gray box, SAST/DAST/SCA, metrics.
12%7. Security Operations
Investigations and chain of custody, SIEM, the incident management lifecycle, control types, BCP/DR operations.
13%8. Software Development Security
SDLC models, DevSecOps, secure coding and the OWASP Top 10, database security, SBOM and supply-chain risk.
10%