CISSP Domains

CISSP Domains

1. Domain 1: Access Control

   • Concepts/methodologies/techniques
   • Effectiveness
   • Attacks

2. Domain 2: Telecommunications and Network Security

   • Network architecture and design
   • Communication channels
   • Network components
   • Network attacks

3. Domain 3: Information Security Governance and Risk Management

   • Security governance and policy
   • Information classification/ownership
   • Contractual agreements and procurement processes
   • Risk management concepts
   • Personnel security
   • Security education, training and awareness
   • Certification and accreditation

4. Domain 4: Software Development Security

   • Systems development life cycle (SDLC)
   • Application environment and security controls
   • Effectiveness of application security

5. Domain 5: Cryptography

   • Encryption concepts
   • Digital signatures
   • Cryptanalytic attacks
   • Public Key Infrastructure (PKI)
   • Information hiding alternatives

6. Domain 6: Security Architecture and Design

   • Fundamental concepts of security models
   • Capabilities of information systems (e.g. memory protection, virtualization)
   • Countermeasure principles
   • Vulnerabilities and threats (e.g. cloud computing, aggregation, data flow control)

7. Domain 7: Operations Security

   • Resource protection
   • Incident response
   • Attack prevention and response
   • Patch and vulnerability management

8. Domain 8: Business Continuity and Disaster Recovery Planning

   • Business impact analysis
   • Recovery strategy
   • Disaster recovery process
   • Provide training

9. Domain 9: Legal, Regulations, Investigations and Compliance

   • Legal issues
   • Investigations
   • Forensic procedures
   • Compliance requirements/procedures

10. Domain 10: Physical (Environmental) Security

    • Site/facility design considerations
    • Perimeter security
    • Internal security
    • Facilities security