CISSP - Certified Information Systems Security Professional

Domain 1: Security and Risk Management

1.1 Understand, adhere to, and promote professional ethics

1.2 Understand and apply security concepts

1.3 Evaluate and apply security governance principles

1.4 Understand legal, regulatory, and compliance issues related to information security in a holistic context

1.5 Understand requirements for investigation types (e.g., administrative, criminal, civil, regulatory, and industry standards)

1.6 Develop, document, and implement security policies, standards, procedures, and guidelines

1.7 Identify, analyze, evaluate, prioritize, and implement Business Continuity (BC) requirements

1.8 Contribute to and enforce personnel security policies and procedures

1.9 Understand and apply risk management concepts

1.10 Understand and apply threat modeling concepts and methodologies

1.11 Apply Supply Chain Risk Management (SCRM) concepts

1.12 Establish and maintain a security awareness, education, and training program

Domain 2: Asset Security

2.1 Identify and classify information and assets

2.2 Determine requirements for information and asset handling

2.3 Securely provision information and assets

2.4 Manage the data lifecycle

2.5 Ensure appropriate asset retention and lifecycle requirements (e.g., End of Life – EOL, End of Support)

2.6 Determine data security controls and compliance requirements

Domain 3: Security Architecture and Engineering

3.1 Research, implement, and manage engineering processes using secure design principles

3.2 Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)

3.3 Select controls based on system security requirements

3.4 Understand the security capabilities of Information Systems (IS)

3.5 Assess and mitigate vulnerabilities in security architectures, designs, and solution components

3.6 Select and specify cryptographic solutions

3.7 Understand cryptanalytic attack methods

3.8 Apply security principles to facility and site design

3.9 Design site and facility security controls

3.10 Manage the information system lifecycle

Domain 4: Communication and Network Security

4.1 Apply secure design principles in network architectures

4.2 Secure network components

4.3 Implement secure communication channels according to design requirements

Domain 5: Identity and Access Management (IAM)

5.1 Control physical and logical access to assets

5.2 Design identification and authentication strategies (e.g., people, devices, and services)

5.3 Use federated identity with a third-party service

5.4 Implement and manage authorization mechanisms

5.5 Manage the identity and access provisioning lifecycle

5.6 Implement authentication systems

Domain 6: Security Assessment and Testing

6.1 Design and validate assessment, testing, and audit strategies

6.2 Conduct security control testing

6.3 Collect security process data (e.g., technical and administrative)

6.4 Analyze test results and prepare reports

6.5 Conduct or facilitate security audits

Domain 7: Security Operations

7.1 Understand and comply with investigation requirements

7.2 Conduct logging and monitoring activities

7.3 Perform Configuration Management (CM) (e.g., provisioning, establishing baselines, and automation)

7.4 Apply fundamental security operations concepts

7.5 Implement resource protection

7.6 Perform incident management

7.7 Operate and maintain detection and preventive measures

7.8 Implement and support patch and vulnerability management

7.9 Participate in and understand change management processes

7.10 Implement recovery strategies

7.11 Implement Disaster Recovery (DR) processes

7.12 Test Disaster Recovery Plans (DRP)

7.13 Participate in Business Continuity (BC) planning and exercises

7.14 Implement and manage physical security

7.15 Address personnel safety and security concerns

Domain 8: Software Development Security

8.1 Understand and integrate security within the Software Development Life Cycle (SDLC)

8.2 Identify and implement security controls in software development ecosystems

8.3 Assess the effectiveness of software security

8.4 Assess the security impact of acquired software

8.5 Define and implement secure coding guidelines and standards