CISSP cheat sheet · Domain 1 · 16% of exam
Security and Risk Management
The largest domain. It is about governance: aligning security with business goals, managing risk with numbers and judgement, staying legal and ethical, and keeping the business running.
Rule cards
| Accountability | Senior management / the board is ultimately responsible. The CISO runs the programme. Accountability can never be outsourced or transferred — only tasks can. |
|---|---|
| Document hierarchy | Policy (high-level, mandatory) → Standard (specific, mandatory) → Baseline (minimum configuration) → Procedure (step by step) → Guideline (optional advice). |
| Risk math | SLE = AV × EF (impact of one event) · ALE = SLE × ARO (yearly risk) · Safeguard value = ALE before − ALE after − annual cost of safeguard · EF is only an input %. |
| Risk responses | Mitigate (controls) · Transfer/share (insurance, outsourcing — accountability stays) · Avoid (stop the activity) · Accept (documented and signed by the risk owner) · Reject/ignore = never acceptable. |
| Risk levels | Inherent (before controls) · Residual (after controls) · Appetite (how much risk we want) > Tolerance (acceptable deviation) > Capacity (maximum we can survive). |
| Priority truths | Primary goal of BCP / IR = human life · BCP success factor = senior management support · New CISO / new ISMS → understand the business and assess risk first · Prove compliance → independent auditor · New vendor → assess first (e.g., SOC 2 Type II). |
| Control types | Directive · Deterrent (warning banner, visible CCTV) · Preventive (SoD, locks, MFA) · Detective (IDS, logs, job rotation, mandatory vacation) · Corrective · Recovery · Compensating (alternative when the primary control is not possible). |
| Control categories | Administrative (policies, training) · Technical / logical (firewalls, encryption) · Physical (fences, guards). |
| Ethics (order matters) | 1. Protect society, the common good and the infrastructure → 2. Act honourably, honestly, justly, responsibly and legally → 3. Provide diligent and competent service to principals → 4. Advance and protect the profession. Watch for word-swaps in options. |
| Laws & regulations | GDPR: breach to the regulator within 72 h, fines up to €20M or 4% of turnover, controller is accountable · HIPAA: health privacy · HITECH: health breach notification · SOX: financial reporting integrity · GLBA: banks/financial privacy · PCI DSS: card data (industry standard, not law) · Wassenaar: crypto export. |
| Intellectual property | Patent = invention (public, ~20 years) · Copyright = creative expression (life + 70 years) · Trademark = brand/logo (renewable while used) · Trade secret = kept secret (NDAs, no registration). |
| Legal systems | Common law = precedent · Civil law = written codes · Customary = traditions · Religious = scriptures · Regulatory/administrative = agencies. |
| Investigation standards | Criminal = beyond reasonable doubt · Civil = preponderance of evidence (>50%) · Administrative = internal policy · Regulatory = regulator’s rules. |
| Frameworks | ISO 27001 (certifiable ISMS) / 27002 (controls) · NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover · NIST RMF (800-37) · NIST 800-53 (control catalogue) · COBIT (IT governance) · SABSA/TOGAF (architecture). |
| NIST RMF (800-37) | Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor. |
| BCP (NIST 800-34) | Policy → BIA → Preventive controls → Recovery strategies → Plan → Test / train / exercise → Maintain. RTO + WRT ≤ MTD. |
| Personnel security | Background checks · NDAs · separation of duties · job rotation · mandatory vacation · least privilege · onboarding/offboarding · hostile termination → disable access as they are told. |
| Awareness | Awareness (everyone, what) → Training (job skills, how) → Education (deep understanding, why). Measure effectiveness (e.g., phishing simulation trends). |
Hard words made simple
| Term | Simple meaning | Example / analogy | Exam hook |
|---|---|---|---|
| Due diligence | Researching / finding out before you decide | Checking a vendor’s SOC 2 before signing (pehle pata karo) | research, investigate, assess → diligence |
| Due care | Acting like a responsible, prudent person | Actually fixing a known hazard (sahi kaam karo) | lawsuit / negligence → failed due care |
| Prudent person rule | What a sensible, careful professional would do | Locking the server room | Courts judge negligence with this test |
| Risk appetite | How much risk the organisation is willing to take | A startup takes more risk than a bank | Set by the board / senior management |
| Residual risk | Risk left after controls | Door locked, but a window remains | Management formally accepts it |
| Exposure factor (EF) | % of the asset lost in one incident | A fire destroys 40% of the server room | Only an input; impact = SLE |
| KPI vs KRI | KPI = how well controls perform now · KRI = early warning of future risk | KPI: % patched in 30 days · KRI: rising phishing clicks | Current performance → KPI; future warning → KRI |
| Substantiate | To prove | Prove you comply with ISO 27001 | → independent auditor |
| Amenability | Willingness to comply | “Ensure amenability” = ensure compliance | Decode unusual words from context |
| Charter | To formally appoint or authorise | Charter an independent assessor | — |
| Delphi technique | Anonymous expert opinions repeated until they agree | Experts vote secretly on a risk level | Qualitative method |
| STRIDE / DREAD / PASTA | STRIDE categorises threats · DREAD rates them · PASTA is a 7-stage risk-centric model | Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation | Categorise → STRIDE; rate → DREAD; business risk → PASTA |
| Supply chain risk (SCRM) | Risk from vendors, parts and software you buy | A router tampered with before delivery | Trusted vendors + integrity checks + SBOM |
| Right to audit | Contract clause letting you inspect the vendor | Checking your cloud vendor’s controls | Verifies vendor compliance |
| Enticement vs entrapment | Luring someone already intending to attack (legal) vs pushing an innocent person into a crime (illegal) | Honeypot = enticement | Honeypot → enticement |