What Is CISSP?

CISSP (Certified Information Systems Security Professional) is (ISC)²’s globally recognized gold-standard information security certification.

Exam details:

CAT format: 100–150 questions (adaptive)
3 hours
Passing: 700/1000
Experience requirement: 5+ years in 2+ of the 8 CISSP domains

8 Domains:

Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)
Security Assessment and Testing
Security Operations
Software Development Security

The CIA Triad

The three foundational information security objectives:

Confidentiality: Only authorized parties can access information.

Controls: Encryption, access control, data classification

Integrity: Information is not modified without authorization.

Controls: Hashing, digital signatures, checksums

Availability: Authorized users can access resources when needed.

Controls: Redundancy, backups, failover

Plus AAA: Authentication (verify identity), Authorization (verify permission), Accounting (track activity). These complement CIA. “Who (authentication) can do what (authorization), and what did they do (accounting)?”

Risk Management

Risk = Threat × Vulnerability × Asset Value

Core Terminology

Threat: Potential cause of harm to an asset (hackers, natural disasters)

Vulnerability: Weakness that can be exploited by a threat (unpatched software)

Exposure: Susceptibility to harm from a threat

Control: Security measure that reduces risk

Risk Response Strategies

Strategy	Description
Avoid	Discontinue the risky activity
Transfer	Insurance, outsourcing
Mitigate	Reduce risk with controls
Accept	Accept the residual risk

Security Governance

Policy: High-level statement of security goals, principles, and responsibilities.

Standards: Specific mandatory requirements supporting policy.

Procedures: Step-by-step implementation instructions.

Guidelines: Recommended best practices (not mandatory).

Key Regulations

GDPR: EU data protection regulation
HIPAA: US healthcare information protection
PCI DSS: Payment card industry security standard
SOX: Financial reporting integrity (Sarbanes-Oxley)

Key Concept Cards

CIA Triad ★★★★★ : Confidentiality (encryption/access control), Integrity (hashing/signatures), Availability (redundancy/backups). The foundation of all security decisions.

Risk = Threat × Vulnerability × Asset Value ★★★★★ : If any factor is zero, risk is zero. Controls reduce vulnerability or asset exposure.

Policy → Standard → Procedure → Guideline ★★★★☆ : Policy (Why) → Standard (What) → Procedure (How) → Guideline (Best Practice).

Practice Quiz

Q1. Encryption primarily protects which CIA element?

Confidentiality. Encrypted data cannot be read without the key. When combined with digital signatures, encryption can also protect integrity.

Q2. A company migrates its IT infrastructure to a cloud provider. Which risk response strategy is this?

Transfer. The technical responsibility is shifted to a third-party cloud provider. However, the organization retains legal and regulatory accountability — risk transfer doesn’t eliminate all risk.

Ch1. CISSP Exam Overview and Security Risk Management