ISC2 Code of Ethics canons (PAPA)
1.1“PAPA”
- 1
- 2
- 3
- 4
The canons are in priority order: when two conflict, the earlier one wins.
Memory aids
Mnemonics for the lists you need to recall
From the illustrated mnemonics worksheet you shared, checked against the Official Study Guide and the standards they describe. Where the worksheet differs, a note says so. Read the phrase, try to recall each step, then reveal it.
PCI DSS — six goals
1.3, 2.6“Brian's Puppies Make Incredible Racing Machines”
- 1
- 2
- 3
- 4
- 5
- 6
The six goals group the 12 PCI DSS requirements.
ISO/IEC 27002 clauses (2005 edition)
1.3 · old edition“Rats Swim Over Apples Holding Pears And Carefully Inspect Big Carrots”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
This is the old 2005 structure, and the phrase has 11 words for 12 clauses. The current edition (2022) groups 93 controls into four themes — see the ISO/IEC 27002:2022 summary in Domain 1.
GDPR — lawful processing, rights and obligations
1.4“Lions In Action Really Excel Daily, Often Achieving Brilliant Tasks”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
A study shortcut, not the legal structure. Article 5 of the GDPR names seven principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.
Business continuity planning steps
1.7, 7.13“Panda Bears Devour Plump Termites”
- 1
- 2
- 3
- 4
- 5
The Official Study Guide describes four phases: project scope and planning, business impact analysis, continuity planning, and approval and implementation. The order is the same idea.
Business impact analysis steps
1.7“Imagine Rabbits Leaping In Rain”
- 1
- 2
- 3
- 4
- 5
Annualized loss expectancy
1.9“ALE = SLE × ARO”
- 1
- 2
- 3
- 4
NIST SP 800-30 risk assessment process
1.9“Penguins Can Run Marathons”
- 1
- 2
- 3
- 4
NIST Risk Management Framework (SP 800-37)
1.9“Persian Cats Seldom Implode After Attacking Mice”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
Records retention steps
2.4“Elephants Climb Daily Pursuing Treasure And Reaching Dreams”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
Clark-Wilson integrity goals
3.2“Unapproved persons / Authorized stay within bounds / Well-formed tasks ensure”
- 1
- 2
- 3
A haiku rather than an acronym: one line per goal.
Common Criteria evaluation assurance levels (EAL 1–7)
3.3“Fluffy Socks Soothe Moms Mildly Sore Feet”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
The phrase's third word doesn't match: the lead letters should run F, S, M, M, S, S, F.
Cloud computing — five essential characteristics (NIST SP 800-145)
3.5“Big Mountains Offer Really Rare Experiences”
- 1
- 2
- 3
- 4
- 5
CPTED — three strategies
3.8- 1
- 2
- 3
The worksheet shows this as a picture only, without a phrase.
Fire extinguisher classes
3.9“Ash, Boil, Circuit, Dent, Kitchen”
- 1
- 2
- 3
- 4
- 5
These are the US classes, which the Official Study Guide uses.
OSI model layers (1 to 7)
4.1“Please Do Not Throw Sausage Pizza Away”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
Data encapsulation — PDU names
4.1“Don't Stop Pouring Free Beer”
- 1
- 2
- 3
- 4
- 5
DHCP lease process (DORA)
4.1“DORA”
- 1
- 2
- 3
- 4
Digital forensics process
7.1“Colorful Elephants Always Run Away”
- 1
- 2
- 3
- 4
- 5
NIST SP 800-86 names four phases: collection, examination, analysis, reporting. The review step is the worksheet's addition.
Incident response life cycle (NIST SP 800-61)
7.6“Puppies Dance Artfully & Chase Every Rabbit Lustily”
- 1
- 2
- 3
- 4
- 5
- 6
The Official Study Guide uses seven steps: detection, response, mitigation, reporting, recovery, remediation, lessons learned. NIST SP 800-61 Revision 3 (2025) now maps incident response to the CSF 2.0 functions.
Waterfall SDLC phases
8.1“Playful Australian Dogs Dig Tirelessly in Meadows”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
Sources name the phases slightly differently; what matters is that each phase finishes before the next begins.