CISSP Domain 2: Asset Security (10%)

Overview

Asset Security covers the full life of information and the assets that hold it. Its six sub-objectives ask you to identify and classify information and assets, set handling requirements, provision assets securely with clear ownership and inventory, manage the data lifecycle from collection to destruction, retain assets appropriately through end of life and end of support, and choose data security controls for data at rest, in transit and in use.

The domain turns Domain 1 governance into concrete decisions about data. The data owner sets classification and accepts risk, custodians implement protection, processors act on a controller's instructions, and data subjects have privacy rights. Candidates must know how classification drives handling, why scoping and tailoring adapt a baseline to a system, and which sanitization method defeats remanence on which media. Domain 3 relies on these choices for cryptography and Domain 7 for media management.

Why it matters on the exam

Domain 2 carries 10% of the exam, but its vocabulary shows up everywhere. A question in Domain 5 about access approvals, or in Domain 7 about media disposal, is often decided by knowing who the data owner is and what classification requires. Candidates struggle because the roles sound similar: owner, controller, custodian, processor, steward. They also overestimate deletion and formatting, which leave recoverable remnants, and forget that solid-state drives behave differently from magnetic disks during sanitization. Weak understanding here costs points in privacy, cloud and incident questions, where the exam expects you to recognize that a processor acting outside the controller's instructions creates liability, or that retaining data longer than required increases breach exposure.

How it's tested

Domain 2 questions are mostly role and lifecycle scenarios: who should classify this data, who approves access, what happens to data when a system reaches end of support, or which sanitization method is appropriate before a drive leaves the building. Look for the asset's classification, its media type and whether it will be reused inside or leave organizational control.

Name the role

A task is described, such as daily backups or deciding classification. You must assign it to the owner, custodian, controller, processor or user.
Choose the sanitization

A device is being reused, returned or discarded. The right answer weighs media type, classification and whether the device stays in the organization.
Fit controls to state

Data is described at rest, in transit or in use, and you select DLP, DRM, CASB or encryption that protects that state.

Reasoning it through

A hospital is returning leased SSDs that stored patient records. Options include formatting, degaussing, overwriting with three passes, or cryptographic erase followed by verification. Degaussing does nothing to flash memory, and overwriting cannot reach SSD over-provisioned cells. Formatting removes only file references. Cryptographic erase of a self-encrypting drive, with verification, is the method that works on this media while allowing the leased device to be returned.

Sub-objectives 6

Official sub-objectives from the ISC2 outline, in outline order.

2.1 Identify and classify information and assetsData classification and asset classification.

What it means: Classification assigns a sensitivity or criticality label, such as confidential, private, sensitive or public in commercial schemes, or top secret, secret and confidential in government schemes. Assets that store or process data inherit a classification at least as high as the data they hold.
What to understand: The data owner decides classification based on value, sensitivity, legal obligations and impact of disclosure. Classification exists to drive proportional protection; without it, organizations either overspend protecting everything or underprotect what matters.
How it shows up: A scenario asks who should determine classification for a new data set, or what the FIRST step is before choosing controls for a repository.
Common confusion: Assuming the security team or IT custodian classifies data; they advise and implement, but the owner decides.

2.2 Establish information and asset handling requirementsLabeling, marking, storage, transmission and access rules per classification.

What it means: Handling requirements translate each classification level into rules for labeling, storage, transmission, sharing, printing and destruction. Marking applies human-readable labels, while labeling can also mean metadata that systems such as DLP read.
What to understand: Handling rules must be clear enough that a user knows what to do without consulting security each time. When data of different levels is combined, the result is handled at the highest level present unless declassified by the owner.
How it shows up: A user emails a document marked confidential to a personal account, and you must identify the handling requirement violated or the control that would have caught it.
Common confusion: Treating unlabeled data as public; good programs assign a default classification so unlabeled data is not exposed.

2.3 Provision information and assets securelyOwnership, asset inventory (tangible and intangible) and asset management.

What it means: Secure provisioning means every asset has a named owner, appears in an inventory, and is configured and tracked from acquisition onward. Inventories include tangible assets such as laptops and intangible ones such as software licenses, data sets and intellectual property.
What to understand: You cannot protect what you do not know you have, so inventory comes before most other controls. Asset management also tracks configuration state and location so lost, unpatched or unauthorized assets are detected.
How it shows up: Shadow IT or an unknown cloud tenant is discovered, and the answer is to bring it into inventory with an assigned owner before applying controls.
Common confusion: Limiting inventory to hardware; intangible assets such as data, licenses and cloud subscriptions also need owners.

2.4 Manage data lifecycleData roles, collection, location, maintenance, retention, remanence and destruction.

What it means: The outline lists the data roles owners, controllers, custodians, processors and users or subjects, then the lifecycle stages of collection, location, maintenance, retention, remanence and destruction. Remanence is residual data that remains after attempts to erase it.
What to understand: Collect only what is needed (data minimization), know where data physically and legally resides, and destroy it when retention ends. NIST SP 800-88 defines clear (logical overwrite), purge (techniques such as degaussing, block erase or cryptographic erase that defeat lab recovery) and destroy (shredding, disintegration, incineration).
How it shows up: A drive is reassigned internally versus sent for disposal; you choose clearing for reuse at the same level and purging or destruction when it leaves control.
Common confusion: Thinking degaussing works on SSDs or optical media; it only affects magnetic media and usually ruins modern hard drives.

2.5 Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)Keeping assets and data only as long as required and planning for vendor end of support.

What it means: Retention policies define how long records and assets are kept for legal, regulatory and business reasons. End of Life means a vendor stops selling a product; End of Support means it stops providing patches and help, which is the security-critical milestone.
What to understand: Keeping data beyond its retention period increases breach exposure and legal discovery cost without adding value. Unsupported systems need replacement plans or compensating controls such as isolation, because new vulnerabilities will never be patched.
How it shows up: A critical application runs on an operating system past end of support, and the best answer is a documented migration plan with isolation as an interim compensating control.
Common confusion: Treating EOL and End of Support as the same date; products often remain supported for years after sales end.

2.6 Determine data security controls and compliance requirementsData states, scoping and tailoring, standards selection and data protection methods.

What it means: Controls depend on data state: at rest (storage encryption), in transit (TLS, IPsec) and in use (access controls, memory protection, confidential computing). Scoping removes baseline controls that do not apply; tailoring adjusts the remaining controls to the organization. Protection methods named include Digital Rights Management (DRM), data loss prevention (DLP) and cloud access security brokers (CASB).
What to understand: Start from a recognized baseline such as NIST SP 800-53, then scope and tailor rather than inventing controls. DRM keeps controlling use after a file leaves your network, DLP detects and blocks sensitive data leaving channels you monitor, and a CASB enforces policy between users and cloud services.
How it shows up: A scenario asks which tool stops a shared design file being printed by an external partner (DRM) versus which detects card numbers in outbound email (DLP).
Common confusion: Confusing scoping with tailoring: scoping decides which controls apply; tailoring modifies how applicable controls are implemented.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Data owner

A senior business role accountable for a data set, who sets its classification, approves access and accepts risk to it.

Remember
Ownership is accountability; the owner rarely touches the systems that store the data.

Tested as
Most who-should questions in this domain end at the owner.

Trap
Picking the custodian or database administrator because they manage the data day to day.
Data custodian

The role, usually IT, that implements the owner's protection decisions through backups, patching, access configuration and storage.

Remember
Custodians implement; they do not decide classification or approve access on their own.

Tested as
Task assignment questions involving backups and configuration.

Trap
Letting the custodian grant access because they hold administrative rights.
Controller vs. processor

Under GDPR-style privacy law, the controller determines the purposes and means of processing personal data; the processor processes it on the controller's behalf.

Remember
A cloud provider processing customer records under contract is typically a processor; the company that collected them is the controller.

Tested as
Privacy and outsourcing scenarios.

Trap
Believing outsourcing processing moves controller responsibility to the provider.
Data remanence

Residual data that remains on media after deletion, formatting or partial overwriting.

Remember
Deleting and formatting remove pointers, not content.

Tested as
Media reuse and disposal questions.

Trap
Treating a quick format as sanitization.
Clear, purge, destroy

NIST SP 800-88 levels: clear protects against simple recovery, purge protects against laboratory recovery, destroy makes the media physically unusable.

Remember
Choose by classification and whether media leaves organizational control.

Tested as
Picking a method for reuse, return or disposal.

Trap
Using clearing before media leaves the organization when purge or destroy is required.
Cryptographic erase

Destroying the encryption key of a self-encrypting drive so the stored ciphertext becomes unrecoverable.

Remember
It is fast and effective on SSDs, but only if all data was encrypted under that key from the start.

Tested as
SSD and cloud sanitization questions where physical destruction is impossible or undesirable.

Trap
Assuming it works on a drive where encryption was enabled after sensitive data was already written in plaintext.
Degaussing

Applying a strong magnetic field to erase magnetic media such as tapes and hard disk platters.

Remember
It has no effect on SSDs, flash or optical discs.

Tested as
Media-type distractors.

Trap
Selecting degaussing for flash media.
Scoping and tailoring

Scoping selects which baseline controls apply to a system; tailoring modifies them to fit mission, environment and risk.

Remember
Both start from an existing baseline rather than a blank page.

Tested as
Control selection and compliance questions.

Trap
Swapping the two definitions.
Data states

At rest (stored), in transit (moving across networks) and in use (being processed in memory).

Remember
Data in use is the hardest to protect because it must be decrypted to be processed in most systems.

Tested as
Matching encryption or other controls to the state described.

Trap
Assuming disk encryption protects data once a system is running and the volume is mounted.
DRM vs. DLP vs. CASB

DRM controls what recipients can do with content anywhere; DLP inspects and blocks sensitive data leaving monitored channels; CASB brokers and enforces policy on cloud service use.

Remember
DRM travels with the file; DLP watches the exits; CASB sits between users and cloud apps.

Tested as
Tool-selection scenarios.

Trap
Choosing DLP when the requirement is to restrict printing or forwarding after the file has been shared.
Data minimization and retention

Collect only data needed for a stated purpose and keep it only as long as legal and business requirements demand.

Remember
Over-retention increases breach impact and e-discovery cost.

Tested as
Privacy and lifecycle questions.

Trap
Keeping everything indefinitely in case it is useful later.
End of Support

The point after which a vendor no longer issues security patches.

Remember
Plan migration before this date; use isolation and monitoring as compensating controls if you cannot.

Tested as
Legacy system scenarios.

Trap
Confusing End of Life (sales stop) with End of Support (patches stop).

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Owner vs. custodian vs. controller vs. processor

Concept	Meaning	Key difference	Common trap
Data owner	Business leader accountable for a data set	Decides classification and approves access	Assigning this to IT
Data custodian	Implements and maintains protection	Performs backups, patching and configuration on the owner's behalf	Letting the custodian approve access
Data controller	Determines why and how personal data is processed	Legal accountability under privacy law	Thinking outsourcing transfers this
Data processor	Processes personal data on the controller's instructions	Acts only within the controller's documented instructions	Treating a processor that sets its own purposes as still only a processor

Clear vs. purge vs. destroy

Concept	Meaning	Key difference	Common trap
Clear	Logical overwrite of user-addressable storage	Defeats simple recovery; suitable for reuse within the organization at the same level	Using it before media leaves organizational control
Purge	Degaussing, block erase or cryptographic erase	Defeats laboratory recovery while possibly leaving the media reusable	Degaussing SSDs, which has no effect
Destroy	Shredding, disintegration, pulverizing or incineration	Media cannot be reused	Destroying leased equipment that must be returned when purge would suffice

Scoping vs. tailoring

Concept	Meaning	Key difference	Common trap
Scoping	Determining which baseline controls apply to a system	Removes controls that are not relevant, such as wireless controls on a system without wireless	Calling any customization scoping
Tailoring	Adjusting applicable controls to the environment	Modifies parameters, adds compensating controls or sets values	Using tailoring to drop controls simply because they are inconvenient

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

The administrator decides

What candidates pick
The database administrator classifies a new data set.

Why it looks right
The administrator knows the data and the system best.

Why it's wrong
Classification is a business decision made by the data owner; administrators are custodians.

Clue to watch for The question asks who should determine, approve or be accountable.
Degauss the SSD

What candidates pick
Degaussing solid-state drives before disposal.

Why it looks right
Degaussing is the textbook purge method.

Why it's wrong
SSDs store data in flash cells, which magnetic fields do not erase.

Clue to watch for The media is described as SSD, flash, USB or optical.
Overwrite is enough for SSDs

What candidates pick
Multiple-pass overwriting of SSDs.

Why it looks right
Overwriting works well on magnetic drives.

Why it's wrong
Wear leveling and over-provisioning leave cells the operating system cannot address, so remnants survive.

Clue to watch for Flash media plus a requirement to defeat laboratory recovery.
DLP for post-share control

What candidates pick
Deploying DLP to stop a partner from printing a shared file.

Why it looks right
DLP is the best-known data protection tool.

Why it's wrong
DLP watches your own egress channels; once the file is outside, only DRM can restrict printing or forwarding.

Clue to watch for The data has already been legitimately shared outside the organization.
Keep everything

What candidates pick
Extending retention indefinitely for analytics value.

Why it looks right
More data seems more useful.

Why it's wrong
Retention beyond legal and business need increases breach impact and conflicts with privacy minimization principles.

Clue to watch for The retention period has passed or the data includes personal information.
Unsupported but working

What candidates pick
Leaving an End of Support system unchanged because it still runs.

Why it looks right
No outage and no cost.

Why it's wrong
Unpatched vulnerabilities accumulate; the owner must accept that risk or fund migration, with isolation as interim mitigation.

Clue to watch for The vendor no longer issues patches.

Answer framework

Use these steps whenever a Domain 2 scenario involves data roles, handling or the end of an asset's life.

Identify the data owner and the classification, because they determine every later handling and control decision in the scenario.
Check the lifecycle stage: collection, storage, use, sharing, retention or disposal, and recall what that stage requires.
Determine the data state (at rest, in transit or in use) and pick controls that protect that specific state, such as storage encryption, TLS or tightly controlled processing environments.
For disposal or reuse, match the method to the media type and to whether the asset will leave organizational control.
Prefer answers that start from an existing baseline, scoped and tailored, and that keep accountability with the owner rather than with IT.

Practice question

A company is moving to a new storage platform and will return its leased all-flash arrays to the vendor. The arrays held confidential financial data and used built-in self-encrypting drives from deployment. Which sanitization approach is MOST appropriate?

Degauss each drive before returning the arrays Perform a cryptographic erase and verify the result Delete all volumes and reformat the arrays Physically shred the drives and pay the lease penalty

Show the answer

Answer B. Because the drives were self-encrypting from deployment, destroying the media encryption keys purges the data and leaves the leased hardware returnable. Verification confirms the erase succeeded. Shredding is the strongest distractor because it is certainly effective, but it is unnecessary and costly when an accepted purge method works. Degaussing does not affect flash, and reformatting leaves remanence.

Want more like this? The CISSP practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with data roles, because they decide more answers than any other concept in this domain. Build a one-page table of owner, custodian, controller, processor, steward and subject, with a sample task for each, and quiz yourself until you assign tasks instantly. Next, study classification and handling (2.1 and 2.2), then the lifecycle (2.4) with special attention to remanence and the clear, purge and destroy levels.

High-priority concepts are owner accountability, sanitization by media type, data states and scoping versus tailoring. Commonly underestimated areas are retention and End of Support (2.5), which candidates skim but which appear as legacy-system risk scenarios, and the data protection tools in 2.6, where DRM, DLP and CASB look interchangeable until a scenario specifies where the data is.

Because this domain is small, it pairs well with Domain 1 in the same week: governance assigns ownership, and asset security puts it to work. Afterwards, practice questions that mix Domain 2 with Domain 7 media management and Domain 3 cryptography, since sanitization and encryption choices often cross those boundaries.

FAQ

Is Asset Security an easy domain?

It is one of the smaller domains at 10%, and the concepts are fewer, but the role definitions are precise. Candidates who treat owner and custodian as interchangeable lose easy points.

Who classifies data on the CISSP exam?

The data owner, a business role accountable for the data. Security professionals advise on classification schemes, and custodians implement the resulting controls.

What is the difference between clearing and purging?

Clearing overwrites data so it cannot be recovered with normal tools and suits reuse inside the organization. Purging defeats laboratory recovery through methods such as degaussing magnetic media or cryptographic erase, and is needed when media leaves your control.

Do I need to know GDPR roles for Domain 2?

Yes at a conceptual level. The outline lists controllers and processors among data roles, and the exam expects you to know that a controller determines purposes and means while a processor acts on the controller's instructions.

How is Domain 2 related to Domain 7?

Domain 2 sets classification, handling and sanitization requirements; Domain 7 applies them operationally through media management and resource protection (7.5). Expect overlapping scenarios.

What does data in use mean and how is it protected?

It is data being processed, typically in memory and usually decrypted. Protections include strict access control, memory protection, process isolation and hardware-based confidential computing that keeps data encrypted inside a protected enclave.

How long should I spend on Asset Security?

Our editorial planning estimate is 20 to 30 hours within a 250-hour plan. Spend most of it on roles, sanitization and data protection tools rather than memorizing classification labels.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

CISSP Domain 2: Asset Security

Overview

How it's tested

Name the role

Choose the sanitization

Fit controls to state

Sub-objectives 6

High-yield concepts

Data owner

Data custodian

Controller vs. processor

Data remanence

Clear, purge, destroy

Cryptographic erase

Degaussing

Scoping and tailoring

Data states

DRM vs. DLP vs. CASB

Data minimization and retention

End of Support

Side by side

Owner vs. custodian vs. controller vs. processor

Clear vs. purge vs. destroy

Scoping vs. tailoring

Exam traps

The administrator decides

Degauss the SSD

Overwrite is enough for SSDs

DLP for post-share control

Keep everything

Unsupported but working

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cybersecurity certifications

Test your Domain 2 knowledge

Keep going