Certified Information Systems Security Professional (CISSP) Security and Risk Management Syllabus

Under GDPR, define data controller vs. data processor.

The data controller determines the purposes and means of processing personal data; the data processor processes data on behalf of, and under instructions from, the controller.

What U.S. law protects the privacy of healthcare information (PHI)?

HIPAA — the Health Insurance Portability and Accountability Act.

What are the key GDPR data subject rights (name at least three)?

Right to be informed, right of access, right to rectification, right to erasure ('right to be forgotten'), right to restrict processing, right to data portability, and right to object.

What law governs financial institutions' protection of customer financial information in the U.S.?

The Gramm-Leach-Bliley Act (GLBA).

What is PCI DSS and who enforces it?

The Payment Card Industry Data Security Standard — a contractual/industry standard (not a law) for protecting cardholder data, enforced by the payment card brands and acquiring banks.

Define the chain of custody for evidence.

A documented, unbroken record of who collected, handled, controlled, transferred, and stored evidence, with times and purposes — proving the evidence was not altered and is admissible.

What are the five rules/characteristics of admissible evidence?

Evidence must be Relevant, Reliable (authentic/competent), Permissible (legally obtained), Complete, and the chain of custody preserved. Often summarized as relevant, sufficient/material, and competent.

Compare the types of evidence: real, documentary, testimonial, and demonstrative.

Real = physical/tangible objects; Documentary = written/recorded data (must meet best evidence rule); Testimonial = witness statements; Demonstrative = aids like models/charts used to illustrate.

What is the 'best evidence rule'?

It requires that the original document/evidence be presented in court rather than a copy, unless the original is unavailable for legitimate reasons.

Distinguish among investigation types: administrative, criminal, civil, and regulatory.

Administrative = internal/operational issues (lowest proof); Criminal = violations of criminal law ('beyond reasonable doubt'); Civil = disputes between parties ('preponderance'); Regulatory = compliance with government regulations.

What is the difference between enticement and entrapment?

Enticement is legally luring an already-willing offender (e.g., a honeypot) into committing a crime they intended; entrapment is illegally inducing someone to commit a crime they would not otherwise have committed.

State the four canons of the ISC2 Code of Professional Ethics in order.

1) Protect society, the common good, necessary public trust and confidence, and the infrastructure. 2) Act honorably, honestly, justly, responsibly, and legally. 3) Provide diligent and competent service to principals. 4) Advance and protect the profession.

Why does the order of the ISC2 Code of Ethics canons matter?

The canons are listed in priority order; when canons conflict, earlier (higher) canons take precedence over later ones.

Differentiate security awareness, training, and education.

Awareness = changing behavior/recognition (the 'what'); Training = building specific skills for a role (the 'how'); Education = broad, in-depth understanding and decision-making (the 'why'), often leading to certification/degree.

What is the purpose of a security awareness program?

To reinforce that security is everyone's responsibility, change user behavior, reduce human-factor risk (e.g., phishing/social engineering), and keep security top of mind through ongoing reinforcement.

What is the principle of separation of duties and what does it prevent?

It divides a critical task among multiple people so no single individual can complete it alone, preventing fraud and abuse by requiring collusion.

What personnel control mandates that employees take time off, and why?

Mandatory vacation — it helps detect fraud or irregularities by having another person perform the absent employee's duties, exposing hidden malicious activity.

What is job rotation and what security benefit does it provide?

Rotating employees through different roles; it reduces fraud risk through cross-checking, provides backup coverage, and helps detect irregularities.

What personnel security agreement restricts an employee from disclosing sensitive information?

A Non-Disclosure Agreement (NDA).

What controls should be triggered during employee termination (offboarding)?

Disable/revoke all access and accounts, recover assets/badges/keys, conduct an exit interview, remind of NDA obligations, and escort the employee out — ideally coordinated and prompt to prevent retaliation.

State the formula for Single Loss Expectancy (SLE).

SLE = Asset Value (AV) × Exposure Factor (EF), where EF is the percentage of asset loss from a single event.

State the formula for Annualized Loss Expectancy (ALE).

ALE = SLE × ARO (Annualized Rate of Occurrence). Equivalently ALE = AV × EF × ARO.

How do you calculate the value justifying a safeguard (cost-benefit of a control)?

Value of control = ALE before control − ALE after control − annual cost of the control. A positive result means the safeguard is cost-justified.

Compare quantitative vs. qualitative risk analysis.

Quantitative assigns objective numeric/monetary values (SLE, ALE, ARO) and is data-intensive; qualitative uses subjective ratings (high/medium/low, scenarios, expert judgment) and is faster but less precise. Most assessments are hybrid.

What are the four primary risk treatment/response options?

Risk Mitigation (reduce), Risk Transference (e.g., insurance/outsourcing), Risk Avoidance (eliminate the activity), and Risk Acceptance. (Risk rejection/ignoring is not acceptable.)

Define residual risk and the formula relating it to total risk.

Residual risk is the risk remaining after controls are applied. Conceptually: Residual Risk = Total Risk − Controls Gap, i.e., the risk left over once safeguards reduce the threats × vulnerabilities × asset value.

What is the difference between total risk and the controls gap?

Total risk = threats × vulnerabilities × asset value (risk with no controls); the controls gap is the amount of risk reduced by implementing safeguards. Total risk minus controls gap = residual risk.

What is risk appetite (risk tolerance)?

The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by senior management to guide risk decisions.

List the three control categories by type (the nature of the control).

Administrative/Managerial (policies, procedures, training), Technical/Logical (firewalls, encryption, access controls), and Physical (fences, locks, guards, CCTV).

Name the six (or seven) control functions and their purpose.

Preventive (stop incidents), Detective (identify incidents), Corrective (fix after an incident), Deterrent (discourage), Recovery (restore), Compensating (alternative when primary isn't feasible), and Directive (mandate/guide behavior).

Give an example distinguishing a deterrent control from a preventive control.

A warning sign or visible camera is a deterrent (discourages action); a locked door or firewall is preventive (physically/technically stops the action).

What is a compensating control?

An alternative control put in place when the primary/intended control is not feasible or cost-effective, providing a comparable level of protection (e.g., increased monitoring when MFA can't be deployed).

Name four common threat modeling methodologies and what each focuses on.

STRIDE (threat categories, Microsoft), PASTA (risk/attacker-centric, 7 stages), DREAD (risk rating/scoring), and Trike/VAST (risk management and scalable enterprise modeling).

What does STRIDE stand for and what security property does each threat violate?

Spoofing (authentication), Tampering (integrity), Repudiation (non-repudiation), Information disclosure (confidentiality), Denial of service (availability), Elevation of privilege (authorization).

What does the DREAD threat-rating model evaluate?

Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability — used to rate/prioritize the severity of threats.

What is supply chain risk management (SCRM) concerned with in security?

Managing risks introduced by third parties, vendors, suppliers, and hardware/software providers — including ensuring minimum security requirements via contracts (SLA, SLR), assessments, and addressing risks like counterfeit components or compromised code.

Define the third-party agreement terms SLA, MOU/MOA, and BPA.

SLA = Service Level Agreement (measurable performance/uptime commitments); MOU/MOA = Memorandum of Understanding/Agreement (less formal intent to cooperate); BPA = Business Partner Agreement (terms of a partnership).

What is a Business Impact Analysis (BIA) and what is its primary purpose?

A BIA identifies critical business functions and the impact of their disruption over time, prioritizing recovery and quantifying potential losses — it is the foundation of BCP/DRP.

Define RTO, RPO, MTD, and WRT.

RTO = Recovery Time Objective (max acceptable downtime to restore a function); RPO = Recovery Point Objective (max acceptable data loss measured in time); MTD = Maximum Tolerable Downtime; WRT = Work Recovery Time (time to verify/restore data after systems are up). RTO + WRT ≤ MTD.

What is the relationship between RTO and MTD?

RTO must be less than or equal to the MTD. The RTO plus the Work Recovery Time (WRT) must not exceed the Maximum Tolerable Downtime.

What does MTBF and MTTR measure?

MTBF = Mean Time Between Failures (average operational time before a device fails, reliability); MTTR = Mean Time To Repair (average time to restore a failed component).

What is the first/most important step in business continuity planning according to ISC2?

Obtaining senior management's support, commitment, and funding (project scope and planning) — without executive buy-in the BCP cannot succeed.

List the main phases of the BCP process per CISSP.

1) Project scope and planning, 2) Business Impact Analysis (BIA), 3) Continuity planning (recovery strategy and provisions/processes), and 4) Approval and implementation (plus testing, training, and maintenance).

Differentiate Business Continuity Planning (BCP) from Disaster Recovery Planning (DRP).

BCP is strategic and broad — keeping the whole business operating during/after a disruption; DRP is tactical and focused — restoring IT systems/operations at the affected site after a disaster. DRP is a subset of BCP.

What is the difference between a quantitative and qualitative impact assessment within a BIA?

Quantitative impact estimates measurable financial loss (revenue, fines, recovery costs); qualitative impact estimates non-monetary effects (reputation, customer confidence, morale, legal/strategic harm).

Define the maximum tolerable downtime (MTD) and give example ranges by criticality.

MTD is the longest a function can be unavailable before unacceptable harm. Examples: Critical ≈ minutes–hours; Urgent ≈ 24 hours; Important ≈ 72 hours; Normal ≈ 7 days; Nonessential ≈ 30 days.

Compare the major disaster recovery site types: hot, warm, cold, and what about mobile/cloud.

Hot site = fully equipped, near-instant failover (most expensive); Warm site = hardware/connectivity but data must be loaded (hours–days); Cold site = empty space with power/HVAC, no equipment (cheapest, slowest); Mobile/cloud = portable or provider-hosted alternatives.

What are reciprocal agreements as a recovery strategy and their key drawback?

A mutual aid agreement where two organizations agree to host each other's operations during a disaster; cheap but problematic due to capacity, confidentiality, compatibility, and enforceability concerns.

List the BCP/DRP test types from least to most disruptive.

1) Read-through/checklist review, 2) Structured walk-through/tabletop, 3) Simulation, 4) Parallel test (recovery site runs alongside production), 5) Full-interruption test (primary shut down — most disruptive/risky).

What is the difference between a parallel test and a full-interruption test?

In a parallel test the recovery site is brought up and operates alongside the still-running primary (no production disruption); in a full-interruption test the primary is shut down and operations fully shift to recovery — the most realistic but highest risk.

Why must BCP/DRP plans be regularly tested and maintained?

To validate that the plan works, identify gaps/outdated assumptions, train personnel, meet RTO/RPO objectives, and keep the plan current with organizational, technological, and personnel changes.

What governance role does senior management hold regarding the BCP, and who typically owns/maintains it?

Senior management is ultimately responsible and accountable (sign-off, funding, support); a BCP coordinator/team develops and maintains it day-to-day. Management approval is required to make the plan official.