Domain 1: Security and Risk Management
- Professional ethics
- Security concepts
- Security governance principles
- Compliance requirements
- Legal and regulatory issues
- Security policy development
- Business continuity planning
- Personnel security
- Risk management concepts
- Threat modeling
- Supply chain risk management
- Security awareness and training
View Domain 1 NotesDomain 3: Security Architecture and Engineering
- Engineering processes using secure design principles
- Security models fundamental concepts
- Security evaluation models
- Security capabilities of information systems
- Security architectures, designs, and solution elements vulnerabilities
- Web-based systems vulnerabilities
- Mobile systems vulnerabilities
- Embedded devices and IoT vulnerabilities
- Cryptography
- Site and facility design secure principles
- Physical security
View Domain 3 NotesDomain 4: Communication and Network Security
- Secure network architecture design
- Secure network components
- Secure communication channels
- Network attacks
View Domain 4 NotesDomain 5: Identity and Access Management (IAM)
- Physical and logical access to assets
- Identification and authentication of people, devices, and services
- Identity as a Service (IDaaS)
- Third-party identity services
- Authorization mechanisms
- Access control attacks
- Identity and access provisioning lifecycle
View Domain 5 NotesDomain 6: Security Assessment and Testing
- Assessment and testing strategies
- Security controls testing
- Security processes data
- Test outputs
- Security architectures vulnerabilities
View Domain 6 NotesDomain 7: Security Operations
- Investigations support and requirements
- Evidence collection and handling
- Incident management
- Disaster Recovery
- Business Continuity
- Physical security
- Personnel safety
- Security training and awareness
View Domain 7 NotesDomain 8: Software Development Security
- Security in the software development lifecycle
- Development environment security controls
- Secure coding and testing
- Effectiveness of software security
- Security of acquired software
View Domain 8 Notes