ITIS SOLUTIONS

CISSP Domains
The CISSP domains are drawn from various information security topics within the (ISC) CBK. The CISSP CBK consists of the following ten domains:
1. Access Control a collection of mechanisms that work together to create security architecture to protect the assets of the information system.
Concepts/methodologies/techniques
Effectiveness
Attacks
2. Telecommunications and Network Security discusses network structures, transmission methods, transport formats and security measures used to provide availability, integrity and confidentiality.
Network architecture and design
Communication channels
Network components
Network attacks
3. Information Security Governance and Risk Management the identification of an organizations information assets and the development, documentation and implementation of policies, standards, procedures and guidelines.
Security governance and policy
Information classification/ownership
Contractual agreements and procurement processes
Risk management concepts
Personnel security
Security education, training and awareness
Certification and accreditation
4. Software Development Security refers to the controls that are included within systems and applications software and the steps used in their development.
Systems development life cycle (SDLC)
Application environment and security controls
Effectiveness of application security
5. Cryptography the principles, means and methods of disguising information to ensure its integrity, confidentiality andauthenticity.
Encryption concepts
Digital signatures
Cryptanalytic attacks
Public Key Infrastructure (PKI)
Information hiding alternatives
6. Security Architecture and Design contains the concepts, principles, structures and standards used to design, implement, monitor, and secure, operating systems, equipment, networks, applications, and those controls used to enforce various levels of confidentiality, integrity and availability.
Fundamental concepts of security models
Capabilities of information systems (e.g. memory protection, virtualization)
Countermeasure principles
Vulnerabilities and threats (e.g. cloud computing, aggregation, data flow control)

7. Operations Security used to identify the controls over hardware, media and the operators with access privileges to any of these resources.
Resource protection
Incident response
Attack prevention and response
Patch and vulnerability management
8. Business Continuity and Disaster Recovery Planning addresses the preservation of the business in the face of major disruptions to normal business operations.
Business impact analysis
Recovery strategy
Disaster recovery process
Provide training
9. Legal, Regulations, Investigations and Compliance addresses computer crime laws and regulations; the investigative measures and techniques which can be used to determine if a crime has been committed and methods to gatherevidence.
Legal issues
Investigations
Forensic procedures
Compliance requirements/procedures
. Physical (Environmental) Security addresses the threats, vulnerabilities and countermeasures that can be utilized tophysically protect an enterprises resources and sensitive information.
Site/facility design considerations
Perimeter security
Internal security
Facilities security
The CISSP candidate must have at least 5 years of experience in two or more of the above domains. Download the Exam Outline for more information.