Certified Information Systems Auditor (CISA) Protection of Information Assets Syllabus

Protection of Information Assets syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Protection of Information Assets in Certified Information Systems Auditor (CISA), not a summary of it.

1. 1

   Information Security Governance and Frameworks

   5 topics

   • Security policies, standards, and procedures
   • Security program management and roles
     • CISO responsibilities and reporting
   • Security awareness and training programs
   • Security frameworks and standards
     • NIST CSF, ISO/IEC 27001/27002
   • Data classification and asset ownership
2. 2

   Logical Access Controls

   4 topics

   • Identification, authentication, and authorization
     • Multi-factor authentication mechanisms
     • Single sign-on and federation
   • Access control models
     • DAC, MAC, RBAC, and ABAC
     • Least privilege and need-to-know
   • Identity and access management lifecycle
     • Provisioning, recertification, and deprovisioning
   • Privileged access management
3. 3

   Network and Endpoint Security

   5 topics

   • Network architecture and segmentation
     • Firewalls, DMZ, and zero trust concepts
   • Intrusion detection and prevention systems
   • Secure protocols and remote access
     • VPNs, TLS, and secure email
   • Endpoint protection and mobile device security
   • Wireless and cloud network security
4. 4

   Cryptography and Data Protection

   4 topics

   • Symmetric and asymmetric encryption
   • Public key infrastructure (PKI)
     • Digital certificates and certificate authorities
     • Digital signatures and hashing
   • Key management lifecycle
   • Data loss prevention and data masking
5. 5

   Physical and Environmental Controls

   4 topics

   • Physical access controls and perimeter security
   • Environmental controls
     • Fire suppression, HVAC, and power protection
   • Data center and facility security
   • Equipment disposal and media sanitization
6. 6

   Security Operations and Incident Response

   5 topics

   • Security monitoring and SIEM operations
   • Vulnerability management and penetration testing
   • Security incident response lifecycle
     • Preparation, detection, containment, eradication, recovery
   • Digital forensics and evidence handling
     • Chain of custody and evidence preservation
   • Threat intelligence and emerging attack vectors

Protection of Information Assets flashcards for Certified Information Systems Auditor (CISA)

19 of 52 cards from the Protection of Information Assets deck — real questions with worked answers.

1. What is the difference between a security policy, a standard, and a procedure?

   A policy is a high-level management statement of intent/direction (mandatory, broad). A standard specifies mandatory, uniform requirements (e.g., specific technologies or settings) that support the policy. A procedure is a detailed, step-by-step instruction on how to implement the standard/policy. (Guidelines are optional/recommended.)

2. In security governance, what is the primary role of senior/executive management versus the security function?

   Senior management provides direction, sets the tone at the top, approves the security strategy and policy, and is ultimately accountable. The security function (e.g., CISO) develops, implements, and monitors the program. Data owners classify and authorize access; custodians protect data per the owner's direction.

3. Who is the data owner and what are their key responsibilities?

   The data owner is typically a senior business manager accountable for a data asset. Responsibilities: classifying the data, defining access rules and acceptable use, authorizing access, and ensuring appropriate controls. The owner delegates day-to-day protection to a custodian but retains accountability.

4. What is the difference between a data owner and a data custodian?

   The data owner (a business manager) is accountable for classifying data and authorizing access. The data custodian (often IT/operations) is responsible for the technical day-to-day protection, backup, storage, and maintenance of the data according to the owner's instructions.

5. What is the main objective of a security awareness and training program, and how do awareness, training, and education differ?

   Objective: change behavior and build a security culture so staff recognize and respond to threats. Awareness = focuses attention/reinforces (the 'what'); Training = builds specific skills for a role (the 'how'); Education = integrates concepts into a broader body of knowledge for professionals (the 'why').

6. Name three widely used information security frameworks/standards a CISA candidate should know and their focus.

   ISO/IEC 27001 (ISMS certification standard) with 27002 (controls); NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover); COBIT (IT governance/management). Others: NIST SP 800-53 (control catalog), PCI DSS (cardholder data).

7. What are the five core functions of the NIST Cybersecurity Framework?

   Identify, Protect, Detect, Respond, and Recover. (NIST CSF 2.0 adds a sixth function, Govern.)

8. What are the typical levels in a commercial data classification scheme, ordered from least to most sensitive?

   Public, Internal/Private (Sensitive), Confidential, and Restricted/Highly Confidential. Classification drives the handling, labeling, encryption, and access controls applied to the data.

9. What is the difference between identification, authentication, and authorization?

   Identification = claiming an identity (e.g., username). Authentication = proving that claim (e.g., password/token/biometric). Authorization = granting access rights/permissions to resources after the identity is authenticated. (Accountability/auditing tracks the actions.)

10. What are the three authentication factors, with an example of each?

    Something you know (password/PIN), something you have (smart card/token/OTP device), and something you are (biometric — fingerprint/iris). Multi-factor authentication requires factors from two or more different categories.

11. In biometrics, what are FAR, FRR, and the CER (EER), and which indicates accuracy?

    FAR (False Acceptance Rate / Type II error) = impostor wrongly accepted. FRR (False Rejection Rate / Type I error) = legitimate user wrongly rejected. CER/EER (Crossover/Equal Error Rate) = the point where FAR equals FRR; a lower CER indicates a more accurate biometric system.

12. Compare the DAC, MAC, RBAC, and ABAC access control models.

    DAC: owner decides access at their discretion (e.g., file ACLs). MAC: system enforces access via labels/clearances (rigid, used in high-security/military). RBAC: access based on job role. ABAC: access based on evaluated attributes (user, resource, environment) and policies — most granular/dynamic.

13. What two security principles do the Bell-LaPadula and Biba models protect, and what are their rules?

    Bell-LaPadula protects confidentiality: 'no read up, no write down' (simple security + *-property). Biba protects integrity: 'no read down, no write up' (simple integrity + *-integrity). BLP = secrecy; Biba = integrity.

14. What are the principle of least privilege and separation of duties, and why do they matter?

    Least privilege: users get only the minimum access needed to do their job, limiting damage from compromise/misuse. Separation of duties: split critical tasks among multiple people so no single individual can complete a sensitive transaction alone, reducing fraud and error.

15. What are the stages of the identity and access management (IAM) lifecycle?

    Provisioning (account creation/onboarding), maintenance (role changes, periodic access reviews/recertification, modifications), and de-provisioning (timely revocation on transfer or termination). Goal: ensure access matches current need throughout the user's tenure.

16. What is 'privilege creep' (access aggregation) and what control detects it?

    Privilege creep is the accumulation of unnecessary access rights as an employee changes roles over time without old rights being removed. It is detected and corrected through periodic user access reviews/recertification by data owners and enforced by least privilege.

17. What is Privileged Access Management (PAM) and what techniques does it use?

    PAM secures and monitors accounts with elevated rights (admin/root). Techniques: credential vaulting, password rotation, just-in-time access, session recording/monitoring, and enforcing least privilege. Goal: prevent abuse of powerful accounts, a top attacker target.

18. What is the difference between SSO and federated identity, and what protocols enable them?

    SSO lets a user authenticate once to access multiple systems within one organization/domain. Federation extends trust across different organizations/domains so one identity provider's authentication is accepted elsewhere. Enabling protocols/standards: SAML, OAuth 2.0, OpenID Connect, Kerberos (intra-domain SSO).

19. What is network segmentation and why is a DMZ used?

    Segmentation divides a network into isolated zones to contain breaches and limit lateral movement, applying controls between zones. A DMZ (demilitarized zone) is a buffer subnet between the internet and the internal network that hosts public-facing servers, so external users never directly reach the internal LAN.

See more Protection of Information Assets flashcards →

Planning Protection of Information Assets for Certified Information Systems Auditor (CISA)

Protection of Information Assets (Certified Information Systems Auditor (CISA)) FAQ