Overview
Domain 1 covers the principles and routines that underpin hands-on security work. It starts with ethics, both the ISC2 Code of Ethics and your organization's own code, and with the core concepts: confidentiality, integrity, availability, accountability, non-repudiation, least privilege and segregation of duties. It covers identifying and implementing technical, physical and administrative controls, and documenting controls by function: deterrent, preventive, detective, corrective and compensating. It then covers the operational processes a practitioner supports: the asset management life cycle for hardware, software and data, the change and configuration management life cycle, security awareness and training, and collaboration with physical security.
The domain exists because the SSCP is a practitioner's credential. Every later domain assumes you can classify a control, follow a change process and apply least privilege without being told. Domains 2 to 7 are largely these ideas applied to specific technologies.
How it's tested
SSCP questions are practical and written from the administrator's seat. In this domain they describe a control, a process step or an ethical dilemma and ask you to classify it, choose the BEST next step, or identify which principle applies. Expect short scenarios rather than long management cases.
-
Classify the control
A control is described and you must name its category (technical, physical, administrative) or its function (deterrent, preventive, detective, corrective, compensating).
-
Follow the process
A change, asset or disposal activity is described with a step missing, and you must identify the step or the correct next action.
-
Principle in action
A situation reveals excessive access, a single person controlling a whole process, or an ethical conflict, and you must name the principle or canon that applies.
A help desk technician can both create user accounts and approve their access requests. Asked what principle is violated, least privilege is tempting, because the access seems excessive. But the real problem is that one person controls two steps that should check each other. That is segregation of duties. The fix is to split creation and approval between different people.
Subdomains 8
Official subdomains from the ISC2 outline, in outline order.
1.1 Comply with codes of ethicsThe ISC2 Code of Ethics and organizational codes of conduct.
- What it means
- Certified members must follow the ISC2 Code of Ethics: its preamble and four canons. They must also follow their employer's own code of ethics or conduct.
- What to understand
- The canons are: protect society, the common good, necessary public trust and confidence, and the infrastructure; act honorably, honestly, justly, responsibly and legally; provide diligent and competent service to principals; and advance and protect the profession. When canons conflict, the earlier one generally takes priority.
- How it shows up
- A scenario presents a conflict, such as an employer asking you to hide a vulnerability that endangers the public, and asks which action is MOST consistent with the code.
- Common confusion
- Assuming loyalty to the employer comes first. Duty to principals is the third canon, after protecting society and acting legally and honestly.
1.2 Understand security conceptsCIA, accountability, non-repudiation, least privilege and segregation of duties.
- What it means
- Confidentiality limits disclosure, integrity prevents unauthorized change, and availability keeps systems and data usable. Accountability traces actions to individuals, and non-repudiation prevents someone from credibly denying an action. Least privilege grants only the access needed, and segregation of duties splits critical tasks so no single person controls them end to end.
- What to understand
- Each concept protects against a different failure, and controls usually serve one more than the others. Accountability depends on unique identities and logging, so shared accounts break it. Segregation of duties prevents fraud and errors that least privilege alone would not catch.
- How it shows up
- A situation is described, such as shared admin accounts, one person handling payments end to end, or a tampered record, and you must name the concept most affected.
- Common confusion
- Using least privilege and segregation of duties interchangeably. Least privilege limits how much access one person has, and segregation of duties splits a process across people.
1.3 Identify and implement security controlsTechnical, physical and administrative controls, compliance and periodic review.
- What it means
- Controls come in three categories. Technical controls include firewalls, IDS and ACLs. Physical controls include mantraps, cameras and locks. Administrative controls include policies, standards, procedures and baselines. Implementing them includes checking compliance requirements and reviewing controls periodically.
- What to understand
- Good protection layers controls from different categories. Compliance requirements tell you which controls are mandatory, and periodic audit and review confirm that controls still work as the environment changes.
- How it shows up
- Questions describe a control and ask for its category, or ask what should happen to keep a deployed control effective over time.
- Common confusion
- Classifying a control by where it lives rather than how it works. A badge reader is physical even though it is electronic and networked.
1.4 Document and maintain functional security controlsDeterrent, preventive, detective, corrective and compensating controls.
- What it means
- This describes controls by what they do. Deterrent controls discourage attempts, preventive controls stop events, detective controls identify events, corrective controls fix problems after they occur, and compensating controls provide alternative protection when a primary control is not feasible.
- What to understand
- One control can have a category and a function at the same time. A camera is a physical control that is detective, and deterrent if it is visible. Compensating controls must address the same risk as the control they replace and be documented and approved.
- How it shows up
- A control is described and you must identify its function, or a gap in a control set is described, such as no detection, and you must choose what to add.
- Common confusion
- Mixing up corrective and compensating. Corrective controls fix things after an event, and compensating controls stand in for a missing primary control.
1.5 Support and implement asset management lifecycle (i.e., hardware, software, and data)From planning and acquisition through operation to disposal.
- What it means
- The asset life cycle runs through planning and design, development or acquisition (including DevSecOps and testing), inventory and licensing for open- and closed-source software, implementation and assessment, operation, maintenance and end of life, archival and retention, and disposal and destruction.
- What to understand
- You cannot protect assets you do not know about, so inventory is fundamental. End-of-life assets lose vendor patches and become a growing risk. Disposal must match the media and the data's sensitivity, and retention requirements decide how long data is kept.
- How it shows up
- Questions ask what to do with unsupported systems, how to dispose of media holding sensitive data, or why software licensing matters for security.
- Common confusion
- Treating deletion or formatting as secure disposal. Data often remains recoverable until the media is properly sanitized or destroyed.
1.6 Support and/or implement change management lifecycleChange management, security impact analysis and configuration management.
- What it means
- Change management controls how changes are requested, reviewed, approved, implemented, communicated and audited. Security impact analysis assesses how a proposed change affects security. Configuration management maintains approved baselines and tracks deviations from them.
- What to understand
- Security impact analysis belongs before approval, not after implementation. Configuration baselines let you detect unauthorized changes. Emergency changes still need documentation and retrospective review.
- How it shows up
- A change caused an outage or a security gap, and you must identify which step was skipped, often the security impact analysis or testing.
- Common confusion
- Thinking change management is only about avoiding outages. It is equally about preventing changes that silently weaken security.
1.7 Support and/or implement security awareness and trainingSocial engineering, phishing, tabletop exercises and awareness communications.
- What it means
- Awareness informs all staff about threats such as social engineering and phishing. Training builds role-specific skills. Tabletop exercises rehearse responses, and ongoing communications keep the message current.
- What to understand
- Effectiveness is measured by behavior, such as phishing simulation results and reporting rates, not attendance. Content should be relevant to the audience's roles and refreshed as threats change.
- How it shows up
- Questions ask for the BEST measure of program effectiveness, or the best way to reduce a specific human-driven risk.
- Common confusion
- Using course completion as proof that the program works.
1.8 Collaborate with physical security operationsFacility assessments, badging and visitor management, and personal device restrictions.
- What it means
- Practitioners work with physical security teams on data center and facility assessments, badge and visitor management, and restrictions on personal devices in sensitive areas.
- What to understand
- Physical access can bypass logical controls entirely, so physical and logical security must be coordinated. Visitors should be identified, logged, badged and escorted. Tailgating is one of the most common physical breaches.
- How it shows up
- A scenario describes tailgating, unescorted visitors or phones in a secure area, and you must choose the most effective control.
- Common confusion
- Treating physical security as someone else's job. The exam expects practitioners to collaborate actively with it.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
ISC2 Code of Ethics canons
Protect society and the infrastructure; act honorably, honestly, justly, responsibly and legally; serve principals diligently and competently; advance and protect the profession.
- Remember
- The order matters when canons conflict.
- Tested as
- Ethical dilemma questions.
- Trap
- Putting the employer's interest ahead of public safety or legality.
-
CIA triad
Confidentiality, integrity and availability.
- Remember
- Identify which one a scenario threatens before choosing a control.
- Tested as
- Concept identification.
- Trap
- Treating a denial-of-service attack as a confidentiality problem.
-
Non-repudiation
Assurance that someone cannot credibly deny an action they took.
- Remember
- Usually provided by digital signatures with protected private keys and reliable logs.
- Tested as
- Concept and crypto questions.
- Trap
- Assuming shared credentials still provide it.
-
Least privilege vs. segregation of duties
Least privilege limits each person's access. Segregation of duties splits critical tasks across people.
- Remember
- They address different risks and are used together.
- Tested as
- Principle identification.
- Trap
- Naming least privilege when one person controls a whole process.
-
Control categories
Technical, physical and administrative.
- Remember
- Category describes how a control is implemented.
- Tested as
- Classification questions.
- Trap
- Calling an electronic badge reader technical rather than physical.
-
Control functions
Deterrent, preventive, detective, corrective and compensating.
- Remember
- Function describes what the control does, and one control can have several.
- Tested as
- Classification questions.
- Trap
- Confusing corrective with compensating.
-
Security impact analysis
Assessing how a proposed change affects security before it is approved.
- Remember
- It comes before approval and implementation.
- Tested as
- Change management questions.
- Trap
- Doing it after an incident.
-
Configuration baseline
An approved, documented configuration used as a reference.
- Remember
- Deviations from the baseline signal unauthorized or unmanaged change.
- Tested as
- Configuration management questions.
- Trap
- Not updating baselines after approved changes.
-
End of life (EOL)
The point after which a vendor stops supporting a product.
- Remember
- EOL assets stop receiving security patches, so plan replacement or compensating controls.
- Tested as
- Asset life cycle questions.
- Trap
- Leaving EOL systems in production without added controls.
-
Tailgating
Following an authorized person through a controlled entrance without authenticating.
- Remember
- Mantraps and staff awareness are the main countermeasures.
- Tested as
- Physical security questions.
- Trap
- Relying on badge readers alone.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Deterrent vs. preventive vs. detective vs. corrective vs. compensating
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Deterrent | Discourages someone from attempting an attack | Works on the attacker's decision | Assuming it physically stops anything |
| Preventive | Stops an event from happening | Acts before the event | Relying on it without detection |
| Detective | Identifies an event during or after it happens | Provides visibility, not prevention | Classifying log review as preventive |
| Corrective | Fixes or limits damage after an event | Restores the expected state | Confusing it with compensating |
| Compensating | Alternative protection when a primary control is not feasible | Stands in for another control | Accepting a control that addresses a different risk |
Technical vs. physical vs. administrative controls
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Technical | Implemented in hardware or software, such as firewalls and ACLs | Enforced by systems | Calling any electronic device technical |
| Physical | Protects facilities and hardware, such as locks and mantraps | Controls physical access | Overlooking it for data protection |
| Administrative | Policies, standards, procedures, baselines and training | Directs people and processes | Assuming it is weaker and optional |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Employer first
- What candidates pick
- Follow the manager's instruction to stay silent about a public safety vulnerability.
- Why it looks right
- Serving your principal is part of the code.
- Why it's wrong
- Protecting society and acting honestly and legally come before duty to principals in the ISC2 canons.
Clue to watch for The scenario involves harm to the public or illegal concealment.
-
Wrong principle
- What candidates pick
- Least privilege, for a case where one person both initiates and approves a transaction.
- Why it looks right
- The person seems to have too much access.
- Why it's wrong
- The issue is one person controlling two steps meant to check each other, which is segregation of duties.
Clue to watch for Look for words like 'both create and approve' or 'end to end'.
-
Corrective vs. compensating
- What candidates pick
- Call a manual review that replaces an unavailable automated control corrective.
- Why it looks right
- It fixes a gap.
- Why it's wrong
- A control standing in for a missing primary control is compensating. Corrective controls repair damage after an event.
Clue to watch for The phrase 'cannot implement' or 'instead of' points to compensating.
-
Format and reuse
- What candidates pick
- Reformat drives that held sensitive data before reissuing them.
- Why it looks right
- Formatting appears to erase everything.
- Why it's wrong
- Formatting usually leaves data recoverable. Media must be sanitized or destroyed according to sensitivity.
Clue to watch for The data is sensitive and the media is leaving its current control.
-
Impact analysis afterwards
- What candidates pick
- Review the security impact of a change after it has been deployed and caused a problem.
- Why it looks right
- Problems are clearer after the fact.
- Why it's wrong
- Security impact analysis must happen before approval so harmful changes are caught early.
Clue to watch for The question asks which step was missed or what should happen before approval.
-
Completion as success
- What candidates pick
- Measure the awareness program by the percentage of staff who finished the course.
- Why it looks right
- It is easy to measure and report.
- Why it's wrong
- Completion shows attendance, not behavior. Phishing simulation results and reporting rates show impact.
Clue to watch for The question asks for the BEST measure of effectiveness.
Answer framework
For any Domain 1 scenario, use these steps to find the answer the SSCP expects.
- Identify which security property is at stake, whether confidentiality, integrity, availability, accountability or non-repudiation.
- Classify any control described by both its category, technical, physical or administrative, and its function, such as preventive or detective.
- Check whether the situation violates least privilege, segregation of duties or accountability, and name the precise principle involved.
- For process scenarios, walk through the asset or change life cycle in order and find the step that was skipped or done out of sequence.
- For ethical conflicts, apply the ISC2 canons in their priority order, with protection of society and legality coming before duty to the employer.
Practice question
Want more like this? The SSCP practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the core concepts in 1.2 and the control classification in 1.3 and 1.4, because these appear across the whole exam. Practice classifying controls in both ways, by category and by function, until you can do it quickly for any example. Then learn the ISC2 canons in order and work through a few conflict scenarios.
Next, cover the life cycle processes: asset management in 1.5 and change management in 1.6. For each, write out the stages and ask what goes wrong if a stage is skipped. These are the most common scenario questions in the domain.
Candidates commonly underestimate awareness and training (1.7) and physical security collaboration (1.8), because they feel non-technical. Expect questions on measuring awareness effectiveness and on tailgating and visitors.
Afterwards, move to Domain 2. Access controls apply least privilege, accountability and segregation of duties directly, and practicing them together shows whether the principles carry over into technical decisions.
FAQ
How much of the SSCP exam is Domain 1?
Security Concepts and Practices carries 16% under the outline effective 1 October 2025, tied with Network and Communications Security for the largest share.
Are ethics questions really on the exam?
Yes. Subdomain 1.1 covers the ISC2 Code of Ethics and organizational codes, and questions usually present a conflict to resolve using the canons.
What is the difference between a control category and a control function?
Category describes how a control is implemented: technical, physical or administrative. Function describes what it does: deterrent, preventive, detective, corrective or compensating.
Is Domain 1 mostly theory?
The concepts are foundational, but questions are practical, asking what you would do or which control applies in a specific situation.
Why is change management in a concepts domain?
Because uncontrolled change is one of the most common ways security degrades, and practitioners support the process directly through security impact analysis and configuration baselines.
Does Domain 1 cover AI?
ISC2 states that AI is integrated across all SSCP domains. In Domain 1 that means applying the same principles, change control and accountability to AI-enabled systems and tools.
How does Domain 1 connect to the rest of the exam?
It supplies the principles and control vocabulary that every other domain applies, from access control to network and endpoint security.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 1 knowledge
You have covered ethics, core principles, control types and the asset, change, awareness and physical security processes. Test whether you can classify controls and spot skipped steps under exam conditions.