CISSP Engine

Domain 1 · 13.6% of exam

Security Governance and Risk Management

Lead with ethics. Govern by risk.

Studied

0/12

Questions seen

0/60

Accuracy

—

Practice all 60

Memory aids & drills

Shortcuts for the lists and processes in this domain. Try to recall each step before revealing it.

Due diligence or due care?

1/16 · 0 right

Decide whether each activity is due diligence (finding out and planning) or due care (doing and maintaining).

Running a risk assessment before moving payroll to a cloud provider.

The infographic places “developing policies” under due care. The Official Study Guide treats establishing a plan or policy as due diligence and putting it into practice as due care, so this drill follows the Study Guide.

ISO/IEC 27002:2022 — information security controls

The 2022 edition reorganized 114 controls in 14 clauses into 93 controls in four themes. ISO/IEC 27001:2022 Annex A lists the same 93 controls.

Organizational37

Clause 5 (5.1–5.37)

Policies for information security · Roles and responsibilities · Threat intelligence · Inventory of assets · Supplier relationships · Use of cloud services · Incident management · ICT readiness for business continuity · Legal and contractual requirements

People8

Clause 6 (6.1–6.8)

Screening · Terms of employment · Awareness, education and training · Disciplinary process · Responsibilities after termination · Confidentiality agreements · Remote working · Reporting security events

Physical14

Clause 7 (7.1–7.14)

Physical perimeters and entry · Physical security monitoring · Protection against environmental threats · Clear desk and clear screen · Equipment siting and maintenance · Storage media · Supporting utilities and cabling · Secure disposal or re-use

Technological34

Clause 8 (8.1–8.34)

Endpoint devices · Privileged access · Secure authentication · Malware protection · Technical vulnerabilities · Backup and redundancy · Logging and monitoring · Cryptography · Secure development life cycle · Change management

93 controls in total

New in 2022 (11)

  • Threat intelligence (5.7)
  • Information security for use of cloud services (5.23)
  • ICT readiness for business continuity (5.30)
  • Physical security monitoring (7.4)
  • Configuration management (8.9)
  • Information deletion (8.10)
  • Data masking (8.11)
  • Data leakage prevention (8.12)
  • Monitoring activities (8.16)
  • Web filtering (8.23)
  • Secure coding (8.28)

Control attributes

Control type
Preventive, detective, corrective
Information security properties
Confidentiality, integrity, availability
Cybersecurity concepts
Identify, protect, detect, respond, recover
Operational capabilities
e.g. governance, asset management, identity and access management
Security domains
Governance and ecosystem, protection, defence, resilience
  • ISO/IEC 27001 sets the requirements for an ISMS and is the standard organizations certify against.
  • ISO/IEC 27002 is guidance on choosing and implementing controls. You can't be certified to it.
  • Memory aid for the counts: 37 + 8 + 14 + 34 = 93.

The uploaded infographic's sub-groups don't match the standard's clause numbering, so this summary follows the standard's own structure.

ISC2 Code of Ethics canons (PAPA)

1.1

“PAPA”

  1. 1
  2. 2
  3. 3
  4. 4

The canons are in priority order: when two conflict, the earlier one wins.

PCI DSS — six goals

1.3, 2.6

“Brian's Puppies Make Incredible Racing Machines”

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6

The six goals group the 12 PCI DSS requirements.

ISO/IEC 27002 clauses (2005 edition)

1.3 · old edition

“Rats Swim Over Apples Holding Pears And Carefully Inspect Big Carrots”

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12

This is the old 2005 structure, and the phrase has 11 words for 12 clauses. The current edition (2022) groups 93 controls into four themes — see the ISO/IEC 27002:2022 summary in Domain 1.

GDPR — lawful processing, rights and obligations

1.4

“Lions In Action Really Excel Daily, Often Achieving Brilliant Tasks”

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10

A study shortcut, not the legal structure. Article 5 of the GDPR names seven principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.

Business continuity planning steps

1.7, 7.13

“Panda Bears Devour Plump Termites”

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5

The Official Study Guide describes four phases: project scope and planning, business impact analysis, continuity planning, and approval and implementation. The order is the same idea.

Business impact analysis steps

1.7

“Imagine Rabbits Leaping In Rain”

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5

Annualized loss expectancy

1.9

“ALE = SLE × ARO”

  1. 1
  2. 2
  3. 3
  4. 4

NIST SP 800-30 risk assessment process

1.9

“Penguins Can Run Marathons”

  1. 1
  2. 2
  3. 3
  4. 4

NIST Risk Management Framework (SP 800-37)

1.9

“Persian Cats Seldom Implode After Attacking Mice”

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
All memory aids →

Key Terminology & Definitions

The official ISC2 terms for this domain. Switch sources to add Official Study Guide terms tagged to Domain 1, or drill them as flashcards.

35 terms

Acceptable riskISC2 · D1
A suitable level of risk commensurate with the potential benefits of the organization's operations as determined by senior management.
Audit/auditingISC2 · D1
The tools, processes, and activities used to perform compliance reviews.
AvailabilityISC2 · D1
Ensuring timely and reliable access to and use of information by authorized users.
Business continuity (BC)ISC2 · D1
Actions, processes, and tools for ensuring an organization can continue critical operations during a contingency.
Business continuity and disaster recovery (BCDR)ISC2 · D1
A term used to jointly describe business continuity and disaster recovery efforts.
Business impact analysis (BIA)ISC2 · D1
A list of the organization's assets, annotated to reflect the criticality of each asset to the organization.
ComplianceISC2 · D1
Adherence to a mandate; both the actions demonstrating adherence and the tools, processes, and documentation that are used in adherence.
ConfidentialityISC2 · D1
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
Data custodianISC2 · D1
The person/role within the organization who usually manages the data on a day-to-day basis on behalf of the data owner/controller.
Data owner/ controllerISC2 · D1
An entity that collects or creates PII.
Data subjectISC2 · D1
The individual human related to a set of personal data.
Disaster recovery (DR)ISC2 · D1
Those tasks and activities required to bring an organization back from contingency operations and reinstate regular operations.
Due careISC2 · D1
A legal concept pertaining to the duty owed by a provider to a customer.
Due diligenceISC2 · D1
Actions taken by a vendor to demonstrate/ provide due care.
GovernanceISC2 · D1
The process of how an organization is managed; usually includes all aspects of how decisions are made for that organization, such as policies, roles, and procedures the organization uses to make those decisions.
Governance committeeISC2 · D1
A formal body of personnel who determine how decisions will be made within the organization and the entity that can approve changes and exceptions to current relevant governance.
GuidelinesISC2 · D1
Suggested practices and expectations of activity to best accomplish tasks and attain goals.
IntegrityISC2 · D1
Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.
Intellectual propertyISC2 · D1
Intangible assets (notably includes software and data).
Maximum allowable downtime (MAD)ISC2 · D1
The measure of how long an organization can survive an interruption of critical functions. [also known as maximum tolerable downtime (MTD)]
Personally identifiable information (PII)ISC2 · D1
Any data about a human being that could be used to identify that person.
PolicyISC2 · D1
Documents published and promulgated by senior management dictating and describing the organization's strategic goals.
PrivacyISC2 · D1
The right of a human individual to control the distribution of information about him- or herself.
ProceduresISC2 · D1
Explicit, repeatable activities to accomplish a specific task. Procedures can address one-time or infrequent actions or common, regular occurrences.
Recovery point objective (RPO)ISC2 · D1
A measure of how much data the organization can lose before the organization is no longer viable.
Recovery time objective (RTO)ISC2 · D1
The target time set for recovering from any interruption.
Residual riskISC2 · D1
The risk remaining after security controls have been put in place as a means of risk mitigation.
RiskISC2 · D1
The possibility of damage or harm and the likelihood that damage or harm will be realized.
Risk acceptanceISC2 · D1
Determining that the potential benefits of a business function outweigh the possible risk impact/likelihood and performing that business function with no other action.
Risk avoidanceISC2 · D1
Determining that the impact and/or likelihood of a specific risk is too great to be offset by the potential benefits and not performing a certain business function because of that determination.
Risk mitigationISC2 · D1
Putting security controls in place to attenuate the possible impact and/or likelihood of a specific risk.
Risk transferenceISC2 · D1
Paying an external party to accept the financial impact of a given risk.
Security control frameworkISC2 · D1
A notional construct outlining the organization's approach to security, including a list of specific security processes, procedures, and solutions used by the organization.
Security governanceISC2 · D1
The entirety of the policies, roles, and processes the organization uses to make security decisions in an organization.
StandardsISC2 · D1
Specific mandates explicitly stating expectations of performance or conformance.
Next domain2. Asset Security