SecurityCISSP

CISSP Security Domains and Framework Explained for CISSP

The CISSP is designed for experienced security practitioners who think at a management and architecture level, not just a technical implementation level. Every CISSP question asks what a security manager or architect would do, not what a technician would do. The exam covers eight domains spanning security governance, asset management, cryptography, network security, identity and access management, security assessment, security operations, and software development security. The distinguishing skill is reasoning: given a risk, a policy constraint, and an organizational goal, what is the most appropriate response?

9 min
3 sections · 7 exam key points

The eight CISSP domains

Domain 1, Security and Risk Management, is the largest domain and covers security governance, compliance, legal issues, professional ethics, and risk management. Risk is expressed as the product of likelihood and impact. Risk responses include accept (tolerate the risk), transfer (insurance or outsourcing), mitigate (reduce likelihood or impact with controls), and avoid (eliminate the activity that creates the risk). Security policies, standards, baselines, guidelines, and procedures form the governance hierarchy.

Domain 2, Asset Security, covers the protection of information assets throughout their lifecycle: classification, ownership, handling, retention, and disposal. Data owners are responsible for classification. Data custodians are responsible for day-to-day protection and handling. Data remnance (data that persists after deletion) requires secure disposal procedures: overwriting, degaussing, or physical destruction depending on the media type and sensitivity.

Domain 3, Security Architecture and Engineering, covers security models (Bell-LaPadula for confidentiality, Biba for integrity), secure design principles, cryptography, and physical security. The principle of least privilege, defense in depth, fail-safe defaults, and separation of duties are the foundational design principles. Domain 4, Communication and Network Security, covers network protocols, firewalls, VPNs, wireless security, and network attacks. Domain 5, Identity and Access Management (IAM), covers authentication methods, access control models (MAC, DAC, RBAC, ABAC), and federation.

Risk management, governance, and the CISSP mindset

The CISSP exam tests management thinking first. When presented with a security problem, the first step is always to understand the risk, not to immediately apply a technical control. The exam repeatedly rewards answers that align security decisions with business objectives, organizational risk tolerance, and cost-benefit analysis. A perfect technical solution that costs more than the asset it protects is not the right CISSP answer.

Domains 6 through 8 cover Security Assessment and Testing (audits, penetration testing, vulnerability assessment), Security Operations (incident response, investigations, recovery), and Software Development Security (SDLC integration, secure coding, code review). Security operations covers the chain of custody for forensic evidence, which requires maintaining an unbroken, documented record of evidence handling from collection through legal proceedings.

Quantitative risk analysis expresses risk in monetary terms. Annual Loss Expectancy (ALE) = Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO). SLE = Asset Value x Exposure Factor. These formulas appear in CISSP questions about comparing the cost of a control against the risk it reduces. If a control costs more than the ALE it reduces, it is not cost-justified.

How to choose the correct answer

Think like a manager: when asked what to do first, identify and assess risk before implementing controls. Understand the problem before solving it.

Risk responses: Accept (live with it), Transfer (insurance/outsource), Mitigate (controls), Avoid (eliminate the activity). Select based on risk level and cost.

ALE = SLE x ARO. SLE = Asset Value x Exposure Factor. Control is justified if its annual cost is less than ALE it reduces.

Data owner: classifies data, accountable for protection. Data custodian: implements controls, day-to-day handling.

Bell-LaPadula: no read up, no write down (confidentiality). Biba: no write up, no read down (integrity).

Chain of custody: unbroken documentation for evidence admissibility. A gap can make evidence inadmissible.

CISSP answer pattern: business objectives and risk management first, technical controls second.

Key exam facts — CISSP

  • Eight CISSP domains: Security/Risk Mgmt, Asset Security, Security Architecture, Network Security, IAM, Assessment/Testing, Security Operations, Software Dev Security.
  • Risk management: Identify, Assess, Respond (Accept/Transfer/Mitigate/Avoid), Monitor.
  • ALE = SLE x ARO. SLE = Asset Value x Exposure Factor. Quantify risk in dollars to justify controls.
  • Data owner: responsible for classification. Data custodian: responsible for implementation and protection.
  • Bell-LaPadula (confidentiality): no read up/no write down. Biba (integrity): no write up/no read down.
  • SDLC security: integrate security at every phase, not added at the end. Security requirements in design phase.
  • Chain of custody: documented evidence handling from collection to court. Any gap = potentially inadmissible.

Common exam traps

The CISSP exam primarily tests technical security knowledge.

CISSP is designed for senior security practitioners thinking at the governance and management level. While technical knowledge is needed, the exam prioritizes management decision-making: aligning security with business objectives, communicating risk to leadership, justifying controls through cost-benefit analysis, and choosing policy responses over technical fixes. Candidates who think only technically often fail despite deep technical expertise.

Mitigating every identified risk is always the correct CISSP answer.

Risk mitigation (reducing risk with controls) is one of four risk responses. Accepting a risk is appropriate when mitigation costs more than the potential loss. Transferring risk (through insurance) is appropriate for low-probability, high-impact events. Avoiding risk (eliminating the activity) is appropriate when the activity's value does not justify the risk. The CISSP answer depends on the specific risk, asset value, and organizational context.

The Bell-LaPadula model ensures both confidentiality and integrity.

Bell-LaPadula was designed specifically for confidentiality. Its rules (no read up: subjects cannot read data above their clearance; no write down: subjects cannot write data below their clearance) prevent classified information from reaching unauthorized parties. The Biba model addresses integrity with opposite rules. Most real systems need both and implement controls from multiple models.

Practice this topic

Test yourself on CISSP Security Domains

JT Exams routes you to questions in your exact weak areas — automatically, after every session.

No credit card · Cancel anytime

Related certification topics