Overview
Security and Risk Management covers how an organization decides what security it needs and who is accountable for that decision. Its 12 sub-objectives run from the ISC2 Code of Professional Ethics and the five pillars (confidentiality, integrity, availability, authenticity, nonrepudiation) through governance, legal and privacy obligations, investigation types, the policy hierarchy, business continuity requirements, personnel security, risk management, threat modeling, supply chain risk and awareness programs.
Candidates must think like an adviser to senior management rather than an administrator. You need to know who owns risk (the business, not the security team), how a business impact analysis feeds recovery objectives, how annualized loss expectancy justifies a control, and which law or framework applies across borders. Every later domain assumes these foundations: asset classification in Domain 2 depends on data owners named here, control selection in Domain 3 depends on risk appetite, and the recovery work in Domain 7 executes the continuity requirements defined in 1.7.
How it's tested
Domain 1 questions are short business scenarios asking for the BEST, FIRST or MOST appropriate action from a manager's point of view. Several options are usually technically valid; the right one respects governance order, assigns decisions to the correct owner and addresses root cause. Expect occasional calculations (SLE, ARO, ALE, safeguard value) and classification items on policy documents or investigation types.
-
Who decides
A risk, exception or residual exposure must be accepted or funded. The answer routes the decision to senior management or the asset owner, never to the security practitioner acting alone.
-
Process before product
A gap is discovered and options mix tools with governance steps. The correct answer usually assesses risk, consults policy or performs a BIA before buying or configuring anything.
-
Calculate and justify
Asset value, exposure factor and frequency are given. You compute SLE and ALE and compare the annual cost of a safeguard with the reduction in ALE it delivers.
A department head asks the security manager to approve storing customer records in an unsanctioned cloud application to meet a deadline. Options include blocking the app, approving it, encrypting the data first, or performing a risk assessment and escalating the decision to the data owner. The manager should not unilaterally block or approve; the data owner accepts risk. Assessing and escalating respects governance and is the BEST answer.
Sub-objectives 12
Official sub-objectives from the ISC2 outline, in outline order.
1.1 Understand, adhere to, and promote professional ethicsThe ISC2 Code of Professional Ethics and organizational codes of ethics.
- What it means
- The ISC2 Code has a preamble and four canons, in priority order: protect society, the common good, necessary public trust and confidence, and the infrastructure; act honorably, honestly, justly, responsibly and legally; provide diligent and competent service to principals; advance and protect the profession.
- What to understand
- Canon order resolves conflicts: a duty to society outranks loyalty to an employer or client. Organizational codes of ethics sit alongside the ISC2 Code and are enforced by the employer, while ISC2 enforces its Code through a formal complaint process against members.
- How it shows up
- A scenario pits an employer's instruction against public safety or honesty, for example being asked to hide a known vulnerability from a regulator, and asks which canon governs.
- Common confusion
- Candidates treat the canons as an unordered list; the exam relies on their order, so protecting society beats serving the principal.
1.2 Understand and apply security conceptsConfidentiality, integrity, availability, authenticity and nonrepudiation.
- What it means
- The outline calls these the five pillars of information security. Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized or undetected modification, availability keeps systems usable, authenticity proves origin, and nonrepudiation stops a party from denying an action.
- What to understand
- Map each control to the pillar it protects: encryption to confidentiality, hashing to integrity, redundancy to availability, and digital signatures to authenticity, integrity and nonrepudiation together. A shared symmetric key gives authenticity between two parties but not nonrepudiation, because either party could have produced the message.
- How it shows up
- A question describes an attack or control, such as a DDoS or a signed contract, and asks which pillar is affected or provided.
- Common confusion
- Treating a message authentication code (MAC) as providing nonrepudiation; only an asymmetric digital signature binds an action to one private-key holder.
1.3 Evaluate, apply, and sustain security governance principlesBusiness alignment, organizational processes, roles, control frameworks, due care and due diligence.
- What it means
- Security governance aligns the security program with business strategy, goals, mission and objectives. It covers acquisitions and divestitures, governance committees, roles such as board, senior management, data owner and custodian, and control frameworks such as ISO, NIST, COBIT, SABSA, PCI and FedRAMP.
- What to understand
- Senior management holds ultimate accountability; the security function advises. During an acquisition you assess the target's security posture before integrating networks, and in a divestiture you revoke shared access and separate data. Due diligence is the investigation before a decision; due care is the ongoing prudent action after it.
- How it shows up
- A merger scenario asks what to do FIRST, or a breach scenario asks whether management showed due care by maintaining controls it had already approved.
- Common confusion
- Assuming the CISO owns organizational risk. The CISO recommends; the board and senior management are accountable.
1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic contextCybercrime, intellectual property, import/export, transborder data flow and privacy law.
- What it means
- This covers cybercrimes and data breach notification, licensing and intellectual property (patents, trademarks, copyrights, trade secrets), import/export controls on technology such as encryption, transborder data flow, and privacy regimes including GDPR, the California Consumer Privacy Act, China's Personal Information Protection Law and South Africa's Protection of Personal Information Act.
- What to understand
- Privacy law follows the data subject, not the server location, so a US company processing EU residents' data falls under GDPR. Trade secrets lose protection if the owner fails to keep them secret, while patents expire and require public disclosure. Encryption products can be subject to export controls such as the Wassenaar Arrangement.
- How it shows up
- A company plans to replicate customer data to a region with weaker privacy law, and the question asks which concern is primary (transborder data flow) or what must happen first (legal review).
- Common confusion
- Believing a contract can override statutory privacy duties; contractual terms add obligations but cannot waive the law.
1.5 Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)Matching evidence standards and goals to the type of investigation.
- What it means
- Administrative investigations handle internal policy violations; criminal investigations pursue violations of law by the state; civil cases resolve disputes between parties; regulatory investigations are run by government agencies against regulated entities; industry-standards investigations check adherence to frameworks such as PCI DSS.
- What to understand
- The burden of proof differs: criminal cases require proof beyond a reasonable doubt, while civil cases use the preponderance of the evidence. An administrative investigation can become criminal, so evidence handling should meet the stricter standard from the start.
- How it shows up
- An internal HR investigation uncovers possible fraud, and the question asks how evidence should now be handled or who must be engaged.
- Common confusion
- Thinking an internal investigation never needs chain of custody; if law enforcement may later be involved, sloppy early handling destroys admissibility.
1.6 Develop, document, and implement security policy, standards, procedures, and guidelinesThe mandatory and advisory layers of security documentation.
- What it means
- A policy states management's intent and is approved by senior management. Standards set mandatory, specific requirements; baselines define minimum configurations; procedures give mandatory step-by-step instructions; guidelines are recommended practice that users may adapt.
- What to understand
- Policies are technology-neutral and change rarely, while standards and procedures change as technology changes. When an auditor finds a control gap, the fix is often in the standard or procedure, but a missing management mandate means the policy itself is absent.
- How it shows up
- A scenario quotes a document, such as one requiring AES-256 for laptops, and asks you to classify it, or asks what must exist before standards can be enforced.
- Common confusion
- Putting product names or settings in a policy; that detail belongs in standards and baselines so the policy survives technology changes.
1.7 Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirementsBusiness impact analysis and external dependencies.
- What it means
- The business impact analysis (BIA) identifies critical business functions, the impact of losing them over time, and the dependencies they rely on. It produces the maximum tolerable downtime (MTD), from which recovery time objectives (RTO) and recovery point objectives (RPO) are set. The 2024 outline adds external dependencies such as cloud providers, utilities and suppliers.
- What to understand
- Senior management must sponsor BC, and the BIA comes before strategy selection. RTO must be shorter than MTD, and RPO measures tolerable data loss in time, which drives backup frequency.
- How it shows up
- A question asks which BC activity happens FIRST after obtaining management support (the BIA), or which metric determines backup frequency (RPO).
- Common confusion
- Swapping RTO and RPO; RTO is time to restore the function, while RPO is how far back in time data may be lost.
1.8 Contribute to and enforce personnel security policies and proceduresScreening, employment agreements, onboarding, transfers, termination and third-party controls.
- What it means
- This covers candidate screening and background checks, employment agreements such as nondisclosure and acceptable use, onboarding, transfers and termination processes, and controls in vendor, consultant and contractor agreements.
- What to understand
- Access should be revoked at or before the moment an involuntary termination is communicated. Transfers must remove old access to prevent privilege creep, and contractors must sign the same security agreements as staff, enforced through contract terms.
- How it shows up
- A hostile termination is scheduled and the question asks when accounts should be disabled, or a transfer scenario reveals accumulated permissions.
- Common confusion
- Waiting until the employee's last day to revoke access after a termination decision has been communicated; the risk window opens at notification.
1.9 Understand and apply risk management conceptsRisk identification, analysis, treatment, control types, monitoring and frameworks.
- What it means
- Risk management identifies threats and vulnerabilities, analyzes risk qualitatively or quantitatively, and treats it by mitigation, transfer (for example cybersecurity insurance), avoidance or acceptance. It includes control types (preventive, detective, corrective, plus deterrent, compensating and recovery), control assessments, continuous monitoring, reporting and risk maturity modeling.
- What to understand
- SLE = asset value x exposure factor; ALE = SLE x ARO. A safeguard is cost-justified when (ALE before - ALE after) - annual cost of the safeguard is positive. Residual risk is what remains after controls and must be formally accepted by management.
- How it shows up
- Expect a calculation or a scenario asking which treatment an insurance purchase represents (transfer) or who signs off residual risk (senior management).
- Common confusion
- Thinking risk transfer moves accountability; insurance moves financial impact, but the organization remains accountable for the loss of data and trust.
1.10 Understand and apply threat modeling concepts and methodologiesStructured identification of threats to a system's design.
- What it means
- Threat modeling systematically identifies how a system could be attacked, ideally during design. Common methodologies include STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege), PASTA (a seven-stage risk-centric process), attack trees, and DREAD-style scoring.
- What to understand
- Threat modeling is most valuable early in the lifecycle, when design changes are cheap. Each STRIDE category maps to a violated property: spoofing to authenticity, tampering to integrity, repudiation to nonrepudiation, information disclosure to confidentiality, denial of service to availability and elevation of privilege to authorization.
- How it shows up
- A design review describes a weakness, such as users denying they submitted transactions, and asks which STRIDE category it represents.
- Common confusion
- Confusing threat modeling with vulnerability scanning; modeling reasons about design-level attack paths before code exists, scanning finds known flaws in running systems.
1.11 Apply supply chain risk management (SCRM) conceptsTampering, counterfeits and implants, and the controls that mitigate them.
- What it means
- SCRM addresses risks introduced by hardware, software and service suppliers, including product tampering, counterfeits and implants. Mitigations named in the outline include third-party assessment and monitoring, minimum security requirements, service-level requirements, silicon root of trust, physically unclonable functions (PUF) and the software bill of materials (SBOM).
- What to understand
- An SBOM lists the components inside software so you can respond quickly when a library vulnerability is announced. A silicon root of trust and PUFs give hardware an unforgeable identity that detects counterfeit or modified components.
- How it shows up
- A newly disclosed open-source library flaw leaves the organization unsure which products contain it, and the answer is requiring SBOMs from suppliers.
- Common confusion
- Assuming a vendor's certification or contract alone controls supply chain risk; ongoing assessment and monitoring are required.
1.12 Establish and maintain a security awareness, education, and training programProgram methods, content refresh and effectiveness measurement.
- What it means
- Awareness changes attention, training builds job skills, and education builds deeper understanding. The outline lists methods such as social engineering exercises, phishing simulations, security champions and gamification, periodic content reviews covering emerging topics like cryptocurrency, AI and blockchain, and program effectiveness evaluation.
- What to understand
- Effectiveness is measured by behavior change, for example falling phishing-click and rising reporting rates, not by course completion. Content must be tailored to role, so developers get secure coding training while executives get targeted whaling awareness.
- How it shows up
- A program reports 100% completion but phishing incidents are not falling, and the question asks what to change: measure behavior and tailor content.
- Common confusion
- Treating completion rates as proof of effectiveness; completion shows attendance, not changed behavior.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
ISC2 canon order
The four canons are ranked: society and infrastructure first, then honorable and legal conduct, then diligent service to principals, then advancing the profession.
- Remember
- When two duties conflict, the higher canon wins, so public safety outranks an employer's instruction.
- Tested as
- Ethics dilemmas are resolved by applying the canons in order rather than by personal judgment.
- Trap
- Choosing loyalty to the employer or client because it feels like professional duty, even when it harms the public.
-
Due care vs. due diligence
Due diligence is the research and assessment done before a decision, such as vetting a cloud provider; due care is the reasonable ongoing action taken after, such as patching and monitoring.
- Remember
- Diligence is knowing; care is doing. Failing at either can establish negligence.
- Tested as
- Breach and liability scenarios ask whether management acted as a prudent person would.
- Trap
- Using the two terms interchangeably instead of placing them at different points in time.
-
SLE, ARO and ALE
Single loss expectancy equals asset value times exposure factor; annualized loss expectancy equals SLE times annualized rate of occurrence.
- Remember
- A $200,000 asset with a 25% exposure factor has a $50,000 SLE; at an ARO of 0.2, the ALE is $10,000 per year.
- Tested as
- Quantitative questions ask for ALE or whether a safeguard is worth its cost.
- Trap
- Entering ARO as a whole number of years (5) instead of a frequency (0.2 for once in five years).
-
Safeguard value
Value = ALE before the control minus ALE after the control minus the annual cost of the control.
- Remember
- A negative result means the control costs more than the risk it removes, so it is not cost-justified.
- Tested as
- Used to decide between controls on economic grounds.
- Trap
- Comparing the control's cost against total ALE instead of against the reduction in ALE.
-
Risk treatment options
Mitigate (reduce likelihood or impact), transfer (insurance or contract), avoid (stop the activity) or accept (document and live with it).
- Remember
- Acceptance is a formal management decision, not ignoring a risk; ignoring risk is called rejection and is never correct.
- Tested as
- Scenarios describe an action and ask which treatment it represents.
- Trap
- Calling insurance mitigation; it is transfer, and accountability stays with the organization.
-
Residual risk and risk appetite
Total risk minus the effect of controls equals residual risk, which must fall within the organization's appetite and tolerance.
- Remember
- Senior management accepts residual risk, usually through a documented sign-off.
- Tested as
- Questions ask who accepts risk or what to do when residual risk exceeds appetite.
- Trap
- Letting the security team accept residual risk on the business's behalf.
-
Policy hierarchy
Policy (management intent) drives standards (mandatory specifics), baselines (minimum configurations) and procedures (mandatory steps); guidelines are advisory.
- Remember
- Only guidelines are optional; policies are approved by senior management.
- Tested as
- Document-classification and audit-gap questions.
- Trap
- Classifying a mandatory configuration value as a guideline because it sounds like advice.
-
BIA outputs: MTD, RTO, RPO
Maximum tolerable downtime is the business limit; RTO is the target to restore a function within that limit; RPO is the acceptable data loss measured in time.
- Remember
- RTO must be less than or equal to MTD, and RPO drives backup frequency.
- Tested as
- Continuity questions ask which metric to use or what comes first.
- Trap
- Setting RTO from IT capability rather than from business impact.
-
STRIDE
Spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, each the violation of a security property.
- Remember
- Repudiation maps to nonrepudiation and is countered by logging and digital signatures.
- Tested as
- Threat modeling questions map a described weakness to a category.
- Trap
- Labeling a user denying an action as spoofing instead of repudiation.
-
Burden of proof
Criminal cases require proof beyond a reasonable doubt; civil cases require a preponderance of the evidence.
- Remember
- Handle evidence to the criminal standard whenever prosecution is possible.
- Tested as
- Investigation-type questions ask which standard applies.
- Trap
- Assuming regulatory or administrative findings require the criminal standard.
-
Intellectual property types
Patents protect inventions for a limited term with public disclosure; copyrights protect expression; trademarks protect brand identifiers; trade secrets protect confidential business information.
- Remember
- Trade secrets have no fixed term but are lost if reasonable secrecy measures lapse.
- Tested as
- Questions ask which protection fits a formula, logo or algorithm.
- Trap
- Choosing patent protection for a recipe the company wants to keep secret indefinitely.
-
Software bill of materials (SBOM)
A machine-readable inventory of the components and versions inside a software product.
- Remember
- Its value is speed: you can find every affected product when a component vulnerability is announced.
- Tested as
- Supply chain scenarios about open-source flaws.
- Trap
- Treating an SBOM as a vulnerability scan; it lists components but does not test them.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Due diligence vs. due care
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Due diligence | Investigation and assessment before acting, such as reviewing a vendor's SOC 2 report before signing | Happens before and informs the decision | Treating a one-time assessment as continuing protection |
| Due care | Prudent, continuing action to protect assets, such as maintaining patches and access reviews | Happens continuously after the decision | Assuming a good initial decision satisfies the ongoing obligation |
Risk treatment: mitigate vs. transfer vs. avoid vs. accept
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Mitigate | Apply controls to reduce likelihood or impact | Risk is reduced but rarely eliminated | Believing mitigation removes the need to accept residual risk |
| Transfer | Shift financial impact through insurance, outsourcing or contract terms | Accountability stays with the organization | Assuming the insurer or provider becomes accountable for the breach |
| Avoid | Stop or never start the risky activity | Removes the risk along with the benefit | Choosing avoidance when the activity is essential to the mission |
| Accept | Formally acknowledge and tolerate the risk | Documented management decision within risk appetite | Confusing acceptance with ignoring or rejecting risk |
Policy vs. standard vs. procedure vs. guideline
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Policy | High-level management intent and mandate | Mandatory, technology-neutral, approved by senior management | Embedding product settings that will soon be outdated |
| Standard | Specific mandatory requirement, such as minimum key length | Mandatory and specific | Calling it a guideline because it reads like a recommendation |
| Procedure | Step-by-step instructions to perform a task | Mandatory and sequential | Mistaking it for a standard because both are detailed |
| Guideline | Recommended practice and advice | The only discretionary layer | Treating it as enforceable in an audit finding |
Criminal vs. civil vs. administrative vs. regulatory investigations
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Criminal | The state prosecutes a violation of law | Beyond a reasonable doubt; penalties include prison | Handling evidence casually because the case started internally |
| Civil | Dispute between parties seeking damages | Preponderance of the evidence | Applying the criminal burden of proof |
| Administrative | Internal inquiry into policy violations | Outcome is disciplinary, run by the organization | Ignoring that it can escalate to criminal |
| Regulatory | Government agency examines compliance with regulations | Agency-led, with fines or sanctions | Confusing it with industry-standard reviews such as PCI DSS assessments |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Fixing it yourself
- What candidates pick
- Immediately reconfiguring or blocking a system when a governance gap is found.
- Why it looks right
- It removes the visible problem and feels decisive.
- Why it's wrong
- Unilateral action bypasses the owner and management, and may break business functions nobody assessed.
Clue to watch for The scenario involves a business owner, an exception, or no active attack in progress.
-
Security accepts the risk
- What candidates pick
- The CISO or security manager signs off on residual risk.
- Why it looks right
- Security understands the risk best.
- Why it's wrong
- Risk acceptance belongs to the asset owner or senior management, who carry accountability.
Clue to watch for The question asks who should approve, accept or sign off.
-
Technology before BIA
- What candidates pick
- Selecting a hot site or replication product as the first continuity step.
- Why it looks right
- It directly improves recovery capability.
- Why it's wrong
- Without a BIA there is no MTD, RTO or RPO, so you cannot size the solution.
Clue to watch for The word FIRST in a continuity planning question after management approval.
-
Law follows the server
- What candidates pick
- Assuming only the law where data is stored applies.
- Why it looks right
- Jurisdiction feels physical.
- Why it's wrong
- Privacy regimes such as GDPR apply based on where data subjects are, so foreign processors remain bound.
Clue to watch for Customers or employees reside in another jurisdiction from the data center.
-
Completion equals effectiveness
- What candidates pick
- Reporting full training completion as proof the awareness program works.
- Why it looks right
- It is easy to measure and looks complete.
- Why it's wrong
- 1.12 asks for program effectiveness evaluation, which means measuring behavior change.
Clue to watch for Incidents persist despite high completion numbers.
-
Employer over society
- What candidates pick
- Following a manager's instruction that conceals a public safety risk.
- Why it looks right
- Diligent service to principals is a canon.
- Why it's wrong
- Protecting society ranks first; the canons are applied in order.
Clue to watch for Harm to the public, infrastructure or trust is at stake.
Answer framework
For any Domain 1 governance or risk scenario, these steps reproduce the manager's reasoning ISC2 rewards.
- Protect human life and safety first; if anyone is at risk, that option wins regardless of cost.
- Identify the business objective, legal obligation and the owner of the asset or risk before thinking about controls.
- Check whether a policy, standard or prior management decision already governs the situation, and follow or escalate through it.
- Prefer assessment steps (risk analysis, BIA, legal review) before purchasing or configuring technology, unless an active attack demands containment.
- Choose the option that addresses root cause rather than a symptom, leaves the decision with the accountable party, and is documented well enough to demonstrate due care to an auditor or regulator later.
Practice question
Want more like this? The CISSP practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with governance and roles (1.3) before anything else, because almost every Domain 1 answer depends on knowing who owns a decision. Then move to risk management (1.9) and drill the SLE, ALE and safeguard value formulas until you can do them on a whiteboard without hesitation. Follow with the policy hierarchy (1.6) and business continuity requirements (1.7), since both feed directly into Domains 6 and 7.
The highest-priority concepts are canon order, due care versus due diligence, risk treatment options, residual risk acceptance and the BIA metrics. Commonly underestimated areas are legal and privacy (1.4), where candidates skim the list of laws but miss the principle that privacy follows the data subject, and supply chain risk (1.11), which the 2024 outline expanded with SBOM, silicon root of trust and physically unclonable functions.
Read every practice explanation, including for questions you got right, and write down which governance principle decided the answer. After this domain, practice mixed sets that combine Domain 1 with Domains 6 and 7, because CAT will interleave them and the manager's mindset must hold across every topic. Finish with timed sets where you flag any answer you chose because it was the most technical option.
FAQ
Why is Domain 1 the most heavily weighted CISSP domain?
ISC2 weights it at 16% because governance, risk and legal reasoning underpin every other domain. The exam is designed for security leaders, so it tests how decisions are made and owned more than how controls are configured.
How much math is in Domain 1?
Expect the quantitative risk formulas: SLE, ARO, ALE and safeguard value. The arithmetic is simple, but candidates lose points by converting frequency incorrectly, such as writing 10 instead of 0.1 for once in ten years.
What does thinking like a manager mean on the CISSP?
It means choosing answers that assess risk, follow policy and route decisions to the accountable owner instead of jumping to a technical fix. The exception is an active threat to life or an attack in progress, where containment and safety come first.
Is BIA tested in Domain 1 or Domain 7?
Both. Domain 1 (1.7) covers identifying and prioritizing continuity requirements through the BIA, while Domain 7 covers implementing recovery strategies, DR processes, plan testing and BC exercises.
Do I need to memorize specific laws?
You need to recognize what major regimes such as GDPR, CCPA, PIPL and POPIA protect and how jurisdiction works, not article numbers. Focus on principles like transborder data flow, breach notification and data subject rights.
What is the difference between a standard and a baseline?
A standard states a mandatory requirement, such as all laptops must use full-disk encryption. A baseline defines the minimum secure configuration for a specific system type, such as a hardened Windows server build, and is usually derived from standards.
How long should I spend on Domain 1?
Our editorial planning estimate is 35 to 45 hours, reflecting its 16% weight within a 250-hour plan. Adjust upward if you come from a purely technical background, since governance reasoning is often the steepest adjustment.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Certified in Risk and Information Systems Control Same subject: Domain 2: Risk Assessment (22%)
- CISM (Certified Information Security Manager) Same subject: Domain 2: Information Security Risk Management (20%)
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 1 knowledge
You have worked through governance roles, risk formulas, the policy hierarchy and continuity requirements. See whether you can apply the manager's mindset to Domain 1 scenarios under time pressure.