CISSP Domains
CISSP is a management exam written for someone who thinks like a risk owner rather than an engineer. The weightings decide where study time goes, and the models table covers the recognition questions.
CISSP Domains · firsttry.app/cheatsheets/cissp-domains · original reference written from published exam objectives. Not affiliated with any certification body.
The eight domains
| Domain | Weight | Core of it |
|---|---|---|
| 1. Security and Risk Management | 16% | Governance, compliance, risk, ethics, continuity |
| 2. Asset Security | 10% | Classification, ownership, handling, retention |
| 3. Security Architecture and Engineering | 13% | Models, cryptography, physical security |
| 4. Communication and Network Security | 13% | Network architecture and secure transmission |
| 5. Identity and Access Management | 13% | Identification, authentication, authorization, federation |
| 6. Security Assessment and Testing | 12% | Audits, testing strategies, logging |
| 7. Security Operations | 13% | Investigation, incident management, recovery |
| 8. Software Development Security | 10% | Secure SDLC, controls in development |
Security models
| Model | Protects | Rule |
|---|---|---|
| Bell-LaPadula | Confidentiality | No read up, no write down |
| Biba | Integrity | No read down, no write up |
| Clark-Wilson | Integrity | Well-formed transactions and separation of duties |
| Brewer-Nash | Conflict of interest | Access changes based on what you have already seen |
| Graham-Denning | Object and subject management | Eight primitive rights |
| Take-Grant | Rights propagation | Four rules for how rights move |
Terms the exam expects
| Term | Meaning |
|---|---|
| Due care | Doing what a reasonable person would do |
| Due diligence | Investigating before acting. Diligence precedes care |
| Prudent person rule | The standard both are measured against |
| Defense in depth | Layered controls so no single failure is fatal |
| Least privilege | Only the access needed for the task |
| Need to know | Access limited to information required for the task |
| Separation of duties | No single person completes a sensitive process |
| Job rotation | Detects fraud that persists in one seat |
| Mandatory vacation | Same purpose, by forcing absence |
| Safety of people first | The tiebreaker answer whenever life is at risk |
Exams covered
Try it here
Two verified practice questions on this material. Answer one, and see the official page behind the answer.
Security Assessment and Testing
How many phases does the Penetration Testing Execution Standard define?
4-1Security Operations
What is the minimum amount of entropy a session identifier should contain to resist brute-force guessing attacks?
Five free questions on every practice exam. No account, no card.