CISSP
Domain 1 · 16%
Security and Risk Management
The heaviest-weighted domain, and the one everything else hangs off: what security is trying to protect, how an organization decides how much risk it will tolerate, and the governance structure that turns that decision into enforceable policy.
CIA triad and its inverse
- Confidentiality — only authorized parties see the data. Broken by disclosure.
- Integrity — data and systems are accurate and unaltered except by authorized action. Broken by alteration.
- Availability — authorized parties can access data and systems when needed. Broken by destruction (or denial).
ISC2 also frames the opposite as DAD — Disclosure, Alteration, Destruction — useful for reasoning backward from an incident to which triad property failed. Related properties worth keeping straight: authenticity (the data/subject is what it claims to be), non-repudiation (a party can't credibly deny an action), and accountability (actions trace to an identity).
Governance structure
Top-down, decreasing in generality and increasing in specificity:
- Policy — high-level management intent, mandatory, technology-agnostic.
- Standard — mandatory, specific requirements (e.g. "AES-256 for data at rest").
- Guideline — recommended, discretionary best practice.
- Procedure — mandatory, step-by-step instructions to meet a standard.
- Baseline — a minimum level of security a system must meet.
Security should report high enough in the org chart to be independent of IT operations — a recurring exam theme is spotting conflict-of-interest reporting lines.
Risk management
The core loop: identify assets and threats, analyze likelihood and impact, decide a treatment, monitor.
- Risk treatments — mitigate (reduce), transfer (insurance, contract), avoid (stop the activity), accept (formally, with sign-off).
- Qualitative analysis — relative ranking (low/medium/high), fast, subjective, good for a first pass.
- Quantitative analysis — assigns dollar values:
SLE(Single Loss Expectancy) = Asset Value × Exposure FactorALE(Annualized Loss Expectancy) = SLE ×ARO(Annualized Rate of Occurrence)- A control is worth buying if its annual cost is less than the ALE it removes.
- Residual risk — what's left after controls are applied; total risk is what exists with no controls at all.
Business continuity and disaster recovery
- BIA (Business Impact Analysis) — identifies critical functions and the cost of their disruption; the foundation everything else is built on.
- MTD (Maximum Tolerable Downtime) — the longest a function can be down before the business doesn't survive it.
- RTO (Recovery Time Objective) — target time to restore a function; must be ≤ MTD.
- RPO (Recovery Point Objective) — maximum acceptable data loss, measured in time (drives backup frequency).
- WRT (Work Recovery Time) — time to get the recovered system back to full production use, after RTO.
Legal, regulatory, and compliance landscape
Know the shape, not just the names: GDPR (EU, personal data, extraterritorial reach), HIPAA (US healthcare PHI), PCI DSS (contractual, not law — payment card data), SOX (US public company financial reporting controls), GLBA (US financial institutions). Distinguish civil law, criminal law, administrative/regulatory law, and customary law as legal system types, and due care (the standard a reasonable person would apply) from due diligence (the research done before acting).
Threat modeling and supply chain
STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is the standard exam-recognized threat modeling taxonomy. Third-party/supply chain risk covers vendor due diligence, SLAs, right-to-audit clauses, and the fact that your risk posture is only as strong as your weakest supplier.
Personnel security and the Code of Ethics
Hiring controls (background checks, NDAs), termination procedures, separation of duties and mandatory vacation as fraud-detection controls, and least privilege vs. need-to-know (the latter is more granular — you can have the clearance level and still not need the specific data). The (ISC)² Code of Ethics has four canons, in priority order: protect society, the common good, necessary public trust and confidence, and the infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service to principals; advance and protect the profession.