CISSP Domains
CISSP is a management exam written for someone who thinks like a risk owner rather than an engineer. The weightings decide where study time goes, and the models table covers the recognition questions.
CISSP Domains · firsttry.app/cheatsheets/cissp-domains · original reference written from published exam objectives. Not affiliated with any certification body.
The eight domains
| Domain | Weight | Core of it |
|---|---|---|
| 1. Security and Risk Management | 16% | Governance, compliance, risk, ethics, continuity |
| 2. Asset Security | 10% | Classification, ownership, handling, retention |
| 3. Security Architecture and Engineering | 13% | Models, cryptography, physical security |
| 4. Communication and Network Security | 13% | Network architecture and secure transmission |
| 5. Identity and Access Management | 13% | Identification, authentication, authorisation, federation |
| 6. Security Assessment and Testing | 12% | Audits, testing strategies, logging |
| 7. Security Operations | 13% | Investigation, incident management, recovery |
| 8. Software Development Security | 10% | Secure SDLC, controls in development |
Security models
| Model | Protects | Rule |
|---|---|---|
| Bell-LaPadula | Confidentiality | No read up, no write down |
| Biba | Integrity | No read down, no write up |
| Clark-Wilson | Integrity | Well-formed transactions and separation of duties |
| Brewer-Nash | Conflict of interest | Access changes based on what you have already seen |
| Graham-Denning | Object and subject management | Eight primitive rights |
| Take-Grant | Rights propagation | Four rules for how rights move |
Terms the exam expects
| Term | Meaning |
|---|---|
| Due care | Doing what a reasonable person would do |
| Due diligence | Investigating before acting. Diligence precedes care |
| Prudent person rule | The standard both are measured against |
| Defence in depth | Layered controls so no single failure is fatal |
| Least privilege | Only the access needed for the task |
| Need to know | Access limited to information required for the task |
| Separation of duties | No single person completes a sensitive process |
| Job rotation | Detects fraud that persists in one seat |
| Mandatory vacation | Same purpose, by forcing absence |
| Safety of people first | The tiebreaker answer whenever life is at risk |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.