ISC2 CISSP

Core security principles including confidentiality, integrity, availability, and defense in depth

Fundamental access control principles including least privilege, separation of duties, and need to know

• Understand, adhere to, and promote professional ethics

• Evaluate and apply security governance principles

• Understand and apply security concepts

Risk components and security boundaries

• Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

• Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)

• Develop, document, and implement security policy, standards, procedures, and guidelines

• Identify and classify information and assets

• Establish information and asset handling requirements
• Provision information and assets securely

• Manage data lifecycle

• Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)
• Determine data security controls and compliance requirements

• Understand and apply risk management concepts

Quantitative and qualitative risk analysis approaches

• Understand and apply threat modeling concepts and methodologies

STRIDE and DREAD threat modeling frameworks

• Apply Supply Chain Risk Management (SCRM) concepts

• Establish and maintain a security awareness, education, and training program

• Contribute to and enforce personnel security policies and procedures

Ongoing personnel security including acceptable use and offboarding

Fundamental cryptographic concepts including symmetric and asymmetric encryption and hashing

Digital signatures and public key infrastructure basics

• Select and determine cryptographic solutions

• Understand methods of cryptanalytic attacks

• Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)

Integrity-focused security models

• Research, implement and manage engineering processes using secure design principles

Advanced secure design principles including complete mediation and open design

• Understand security capabilities of Information Systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)

Hardware security modules and trusted platform modules

• Select controls based upon systems security requirements

• Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

Security patterns and anti-patterns in architecture

• Apply security principles to site and facility design

• Design site and facility security controls

OSI and TCP/IP models and network protocols

Routing and switching basics

• Apply secure design principles in network architectures

Zero trust and microsegmentation architectures

• Secure network components

VPN and network access control technologies

• Implement secure communication channels according to design

Channel security and wireless security

Authentication factors, identity proofing, credential management, and authentication strength

• Design identification and authentication strategy (e.g., people, devices, and services)
• Implement authentication systems

Single sign-on and device authentication

• Implement and manage authorization mechanisms

Attribute-based access control and authorization models

• Control physical and logical access to assets

• Manage the identity and access provisioning lifecycle

Access reviews and privilege creep management

• Federated identity with a third-party service

OAuth and OpenID Connect protocols

• Manage the information system lifecycle

System maintenance and disposal

• Understand and integrate security in the Software Development Life Cycle (SDLC)

• Define and apply secure coding guidelines and standards

Secure APIs and code review practices

• Identify and apply security controls in software development ecosystems

• Assess the effectiveness of software security

• Assess security impact of acquired software

• Apply foundational security operations concepts

• Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)

Automation tools and infrastructure as code

• Conduct logging and monitoring activities

Alerting and log retention strategies

• Apply resource protection

• Operate and maintain detection and preventative measures

Honeypots and deception technology

• Implement and support patch and vulnerability management

• Understand and participate in change management processes

• Design and validate assessment, test, and audit strategies

• Conduct security control testing

• Collect security process data (e.g., technical and administrative)

Technical and administrative data collection

• Analyze test output and generate report

• Conduct or facilitate security audits

• Conduct incident management

Forensics basics and incident communication

• Understand and comply with investigations

• Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements

• Participate in Business Continuity (BC) planning and exercises

• Implement Disaster Recovery (DR) processes

• Test Disaster Recovery Plans (DRP)

• Implement recovery strategies

• Implement and manage physical security

• Address personnel safety and security concerns

Travel security and workplace violence prevention