Domains 1 and 2: security and risk management and asset security

With the mechanics of the credential behind us, the next five lessons tour the eight domains of the CISSP common body of knowledge. The goal is orientation, not mastery. For each domain you will learn what it covers, why it matters, which ideas recur across the exam and how it connects to the other domains. Later courses in this program devote a full course to each domain. This lesson covers Domain 1, Security and Risk Management, which carries the largest weighting at 16 % and sets the mindset for the whole exam, and Domain 2, Asset Security, at 10 %, which deals with identifying, classifying and protecting information and the assets that hold it.

Domain 1 at a glance

Domain 1 is the broadest domain and the one most closely tied to management. Its topics in the 2024 outline include professional ethics; security concepts such as confidentiality, integrity, availability, authenticity and non-repudiation; security governance; legal, regulatory and compliance issues; investigation types; policies, standards, procedures and guidelines; business continuity requirements; personnel security; risk management; threat modeling; supply chain risk management; and security awareness, education and training. Candidates from technical backgrounds often find this domain the hardest, because it asks them to think about organizations rather than systems.

Core security concepts

The foundation of the whole common body of knowledge is the CIA triad. Confidentiality means information is disclosed only to those authorized to see it. Integrity means information and systems are accurate, complete and protected from unauthorized change. Availability means information and systems are accessible to authorized users when needed. Two further concepts complete the picture: authenticity, meaning that data, communications and identities are genuine, and non-repudiation, meaning that a party cannot credibly deny having performed an action, such as sending a signed message.

Most security decisions involve trade-offs among these properties. Strong encryption improves confidentiality but can hurt availability if keys are lost. Strict change control protects integrity but can slow the response to an outage. A good security professional identifies which property matters most for a given asset and designs controls accordingly.

Governance, policy and due care

Security governance is the set of responsibilities and practices exercised by the board and senior management to give strategic direction to security, ensure objectives are met, manage risk appropriately and use resources responsibly. Governance aligns security with the organization's mission, goals and objectives. It is expressed through a hierarchy of documents. Policies are high-level statements of management intent, approved by senior leadership and mandatory. Standards specify mandatory technologies, configurations or levels of control that support policies. Procedures are detailed step-by-step instructions. Guidelines are recommended but optional practices. Baselines define minimum levels of security for a type of system.

Two legal ideas appear often. Due care means doing what a reasonable person would do in the circumstances: implementing appropriate controls. Due diligence means the ongoing effort to make sure those controls are actually working and to understand the risks: investigating, monitoring and verifying. Courts and regulators look for both when deciding whether an organization was negligent after an incident. Senior management is ultimately accountable for security, even when it delegates the work.

Law, regulation and privacy

Security professionals must understand the legal environment in which their organizations operate. This includes computer crime law, intellectual property (copyrights, trademarks, patents and trade secrets), import and export controls on technology such as encryption, contractual obligations, and above all privacy and data protection law. Because data crosses borders easily, international frameworks matter too. The European Union's General Data Protection Regulation (GDPR) applies to many organizations outside Europe that offer goods or services to people in the EU, and it has influenced privacy laws worldwide.

In the United States, privacy law is sector-based. HIPAA and the HITECH Act govern health information held by covered entities and business associates; the Gramm-Leach-Bliley Act (GLBA) governs financial institutions; FERPA covers education records; COPPA protects children's online data. The FTC enforces against unfair or deceptive practices. All fifty states have breach notification laws, and a growing number have comprehensive privacy laws, led by California's CCPA as amended by the CPRA. Public companies must also disclose material cybersecurity incidents under SEC rules adopted in 2023, and federal agencies follow FISMA.

Risk management

Risk management is the heart of Domain 1 and, arguably, of the whole CISSP. A risk is the possibility that a threat will exploit a vulnerability and harm an asset. Risk management means identifying assets, threats and vulnerabilities; assessing the likelihood and impact of harm; choosing how to treat each risk; implementing controls; and monitoring the results. Frameworks such as ISO/IEC 27005, ISO 31000 and the NIST Risk Management Framework describe the process in different ways, but the logic is the same.

Risk assessment can be qualitative, using ratings such as high, medium and low, or quantitative, using monetary values. The CISSP expects you to know the basic quantitative formulas. The asset value (AV) is the value of the asset. The exposure factor (EF) is the percentage of the asset's value lost if a threat occurs. The single loss expectancy (SLE) is the expected loss from one occurrence. The annualized rate of occurrence (ARO) is how many times a year the threat is expected to occur. The annualized loss expectancy (ALE) is the expected loss per year.

Quantitative analysis also helps decide whether a control is worth its cost. The value of a safeguard is the reduction in ALE it produces minus its annual cost.

Once a risk is assessed, there are four ways to treat it. Risk mitigation (or reduction) applies controls to reduce likelihood or impact. Risk transfer (or sharing) moves some of the financial impact to another party, for example through insurance or contracts. Risk avoidance stops the activity that creates the risk. Risk acceptance consciously tolerates the risk, typically when it is within the organization's risk appetite or when treatment costs more than the expected loss. Ignoring a risk without a decision is not acceptance; it is negligence. The risk that remains after treatment is called residual risk, and senior management must formally accept it.

Business continuity and people

Domain 1 also covers business continuity requirements, starting with a business impact analysis (BIA) that identifies critical business functions, the impact of their disruption over time and the maximum tolerable downtime for each. The BIA sets recovery objectives that drive continuity and disaster recovery plans, which are covered further in Domain 7. Personnel security covers the people side of security: screening candidates, employment agreements such as non-disclosure agreements, onboarding and offboarding, separation of duties, job rotation, mandatory vacations and security awareness programs. Supply chain risk management extends these concerns to vendors, service providers and the components in products.

Domain 2 at a glance

Domain 2, Asset Security, is about knowing what information and assets the organization has and protecting them throughout their life. Its topics include identifying and classifying information and assets; establishing information and asset handling requirements; provisioning resources securely; managing the data life cycle; ensuring appropriate asset retention; and determining data security controls and compliance requirements. It is a smaller domain, but its ideas run through all the others: you cannot protect what you do not know you have.

Classification and roles

Classification assigns information to categories based on its sensitivity and value, so that appropriate controls can be applied consistently. Government schemes often use labels such as Top Secret, Secret, Confidential and Unclassified. Private organizations commonly use labels such as Confidential or Restricted, Private, Sensitive or Internal, and Public. The number of levels matters less than consistency: every label must have clear handling rules for storage, transmission, sharing and disposal.

The US government classifies national security information as Confidential, Secret or Top Secret under Executive Order 13526. Sensitive but unclassified information is handled under the Controlled Unclassified Information (CUI) program, which sets handling requirements for categories such as privacy, export control and law enforcement data. Defense contractors handling CUI must meet the requirements of NIST SP 800-171, increasingly verified through the Cybersecurity Maturity Model Certification (CMMC) program.

Domain 2 also defines roles. The data owner, usually a senior business manager, is accountable for a set of data and decides its classification and who may access it. The data custodian, often IT staff, implements and operates the controls the owner specifies, such as backups and access permissions. Data users access the data to do their jobs and must follow the rules. Privacy law adds the data controller, which decides why and how personal data is processed, and the data processor, which processes personal data on the controller's behalf. A cloud provider hosting a customer's database is usually a processor.

The data life cycle and data states

Data moves through a life cycle: creation or collection, storage, use, sharing, archiving and destruction. Controls must cover each stage. Data also exists in three states. Data at rest is stored on disks, tapes or cloud storage and is commonly protected by encryption and access control. Data in transit moves across networks and is protected by protocols such as TLS and VPNs. Data in use is being processed in memory and is the hardest to protect, though techniques such as confidential computing are emerging.

Retention and destruction close the life cycle. Organizations should keep data only as long as legal, regulatory and business needs require, then destroy it securely. Destruction methods range from clearing (overwriting so data cannot be recovered with normal tools) and purging (techniques that resist laboratory recovery, such as cryptographic erasure or degaussing for magnetic media) to physical destruction such as shredding or disintegration. Data remanence, the residual data left on media after deletion, is a recurring exam theme.