Certified Information Systems Security Professional (CISSP) Asset Security Syllabus

Asset Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Asset Security in Certified Information Systems Security Professional (CISSP), not a summary of it.

1. 1

   Information and Asset Classification

   3 topics

   • Classification Schemes
     • Government classifications: top secret to unclassified
     • Commercial classifications: confidential, private, public
     • Criteria for assigning classification levels
   • Asset Inventory and Categorization
     • Tangible and intangible assets
     • Hardware, software, and data asset tracking
     • Labeling and marking requirements
   • Data and Asset Ownership Roles
     • Data owner, system owner, and business owner
     • Data custodian and steward
     • Data processor and controller distinctions
2. 2

   Data Lifecycle and Handling

   3 topics

   • Data Lifecycle Phases
     • Create, store, use, share, archive, destroy
     • Data states: at rest, in transit, in use
   • Data Collection and Retention
     • Data minimization principles
     • Retention policies and legal hold
     • Storage location and jurisdiction concerns
   • Secure Data Destruction
     • Clearing, purging, and destruction methods
     • Degaussing, shredding, and cryptographic erasure
     • Remanence and media sanitization standards
3. 3

   Privacy Protection and Data Roles

   3 topics

   • Protecting Privacy
     • Personally identifiable information (PII) and PHI
     • Data subject rights
     • Privacy by design
   • Data Localization and Sovereignty
     • Jurisdictional data residency requirements
     • Cross-border processing constraints
   • Scoping, Tailoring, and Baselines
     • Selecting applicable baseline controls
     • Scoping out non-applicable controls
     • Tailoring to organizational context
4. 4

   Data Protection Methods

   3 topics

   • Data Loss Prevention
     • Network, endpoint, and storage DLP
     • Content discovery and classification engines
   • Protecting Data at Rest and in Transit
     • Encryption of stored data
     • Transport encryption and tunneling
   • Digital Rights Management and Obfuscation
     • DRM controls
     • Tokenization, masking, and anonymization
     • Pseudonymization techniques

Asset Security flashcards for Certified Information Systems Security Professional (CISSP)

22 of 51 cards from the Asset Security deck — real questions with worked answers.

1. In a government/military data classification scheme, list the four levels from highest to lowest sensitivity.

   Top Secret, Secret, Confidential, and Unclassified (with Sensitive but Unclassified often sitting just above Unclassified).

2. What distinguishes the 'Top Secret' classification level in the government scheme?

   It is the highest level; unauthorized disclosure could cause exceptionally grave damage to national security.

3. Name the typical four levels of a commercial/private-sector data classification scheme.

   Confidential (or Proprietary), Private, Sensitive, and Public — from most to least sensitive.

4. What is the primary purpose of classifying data and assets?

   To assign value and sensitivity so that appropriate, cost-effective protection controls can be applied based on potential impact of disclosure.

5. What two criteria most commonly drive the assignment of a classification level to data?

   The data's value to the organization and the potential damage (impact) that would result from its unauthorized disclosure, alteration, or loss.

6. What is the difference between classification and categorization of assets?

   Classification ranks data by sensitivity/value (e.g., Secret vs Public); categorization groups assets by impact level or type (e.g., FIPS 199 low/moderate/high impact based on CIA).

7. Under FIPS 199, what three security objectives are used to categorize an information system, and what impact levels apply?

   Confidentiality, Integrity, and Availability — each rated as Low, Moderate, or High potential impact; the system takes the high-water mark.

8. Why must an organization maintain a complete asset inventory?

   You cannot protect what you do not know you have; inventory enables classification, ownership assignment, control selection, and accountability for hardware, software, and data assets.

9. What is a 'hardware asset' versus an 'information asset' in inventory terms?

   A hardware asset is a tangible device (server, laptop, drive); an information asset is the data or intellectual property itself, which often has value independent of the hardware storing it.

10. Define the role and key responsibility of the Data Owner.

    A senior/management role with ultimate responsibility for the data: assigns its classification, defines acceptable use, and approves access; accountable but does not perform day-to-day handling.

11. Define the role of the Data Custodian.

    An IT/technical role responsible for the day-to-day protection of data: implementing controls, performing backups, applying patches, and maintaining the systems per the owner's directives.

12. Distinguish the Data Owner from the System Owner.

    The Data Owner is accountable for a specific set of data and its classification; the System Owner is accountable for the information system (its operation, security plan, and lifecycle) that processes the data.

13. What is the role of the Data Processor under privacy frameworks like GDPR?

    A natural or legal person/entity that processes personal data on behalf of, and under the instructions of, the data controller.

14. What is a Data Controller under GDPR?

    The entity that determines the purposes and means of processing personal data; it bears primary legal accountability for protecting that data.

15. Who is the 'data subject' in privacy terminology?

    The identifiable living individual to whom the personal data relates.

16. What is the role of a Data Steward?

    A business role responsible for data quality, context, and proper business use — ensuring data fitness for purpose, while custodians handle the technical safeguarding.

17. List the phases of the data lifecycle.

    Create/Collect, Store, Use, Share, Archive, and Destroy (some models also list Acquisition, Maintenance, and Disposal).

18. What is the principle of data minimization in the collection phase?

    Collect only the minimum personal/sensitive data necessary for the stated purpose, and retain it only as long as needed.

19. What is a data retention policy and why is it important?

    A policy specifying how long each data type must be kept and when it must be destroyed; it balances legal/regulatory requirements against minimizing liability and storage cost.

20. What risk does keeping data longer than required (over-retention) create?

    Increased liability, larger attack surface, greater breach exposure, and potential regulatory non-compliance; data not retained cannot be breached.

21. Define data remanence.

    The residual physical representation of data that remains on storage media even after attempts to erase or delete it.

22. List the three NIST SP 800-88 sanitization categories from least to most thorough.

    Clear (logical overwrite, resists keyboard attacks), Purge (renders recovery infeasible even with lab techniques, e.g., crypto erase/degauss), and Destroy (physical destruction).

See more Asset Security flashcards →

Planning Asset Security for Certified Information Systems Security Professional (CISSP)

Asset Security (Certified Information Systems Security Professional (CISSP)) FAQ