3
CISSP Certification Exam Outline
CISSP Examination Information
CISSP Examination Weights
Length of exam
Number of questions
Question format
Passing grade
Exam availability
Testing center
6 hours
250
Multiple choice and advanced innovative questions
700 out of 1000 points
English, French, German, Brazilian Portuguese, Spanish,
Japanese, Simplified Chinese, Korean, Visually impaired
Pearson VUE Testing Center
Domains
Weight
1. Security and Risk Management
16%
2. Asset Security
10%
3. Security Engineering
12%
4. Communications and Network Security
12%
5. Identity and Access Management
13%
6. Security Assessment and Testing
11%
7. Security Operations
16%
8. Software Development Security
10%
Total:
100%
4
CISSP Certification Exam Outline
Domain 1:
Security and Risk Management
1.1
Understand and apply concepts of confidentiality, integrity and availability
1.2
Apply security governance principles through:
1.3
Compliance
»
Legislative and regulatory compliance
»
Privacy requirements compliance
1.4
Understand legal and regulatory issues that pertain to information security in a global
context
1.5
Understand professional ethics
»
Exercise (ISC)² Code of Professional Ethics
»
Support organization’s code of ethics
1.6
Develop and implement documented security policy, standards, procedures, and
guidelines
1.7
Understand business continuity requirements
»
Develop and document project scope and plan
»
Conduct business impact analysis
»
Alignment of security function to strategy, goals,
mission, and objectives (e.g., business case,
budget and resources)
»
Organizational processes (e.g., acquisitions,
divestitures, governance committees)
»
Security roles and responsibilities
»
Control frameworks
»
Due care
»
Due diligence
»
Computer crimes
»
Licensing and intellectual property (e.g.,
copyright, trademark, digital-rights management)
»
Import/export controls
»
Trans-border data flow
»
Privacy
»
Data breaches
5
CISSP Certification Exam Outline
1.8
Contribute to personnel security policies
1.9
Understand and apply risk management concepts
1.10
Understand and apply threat modeling
1.11
Integrate security risk considerations into acquisition strategy and practice
1.12
Establish and manage information security education, training, and awar
eness
»
Appropriate levels of awareness, training, and education required within organization
»
Periodic reviews for content relevancy
»
Employment candidate screening (e.g., reference
checks, education verification)
»
Employment agreements and policies
»
Employment termination processes
»
Vendor, consultant, and contractor controls
»
Compliance
»
Privacy
»
Identify threats and vulnerabilities
»
Risk assessment/analysis (qualitative, quantitative,
hybrid)
»
Risk assignment/acceptance (e.g., system
authorization)
»
Countermeasure selection
»
Implementation
»
Types of controls (preventive, detective,
corrective, etc.)
»
Control assessment
»
Monitoring and measurement
»
Asset valuation
»
Reporting
»
Continuous improvement
»
Risk frameworks
»
Identifying threats (e.g., adversaries, contractors,
employees, trusted partners)
»
Determining and diagramming potential attacks
(e.g., social engineering, spoofing)
»
Performing reduction analysis
»
Technologies and processes to remediate threats
(e.g., software architecture and operations)
»
Hardware, software, and services
»
Third-party assessment and monitoring (e.g., on-
site assessment, document exchange and review,
process/policy review)
»
Minimum security requirements
»
Service-level requirements
6
CISSP Certification Exam Outline
Domain 2:
Asset Security
2.1
Classify information and supporting assets (e.g., sensitivity, criticality)
2.2
Determine and maintain ownership (e.g., data owners, system owners, business/mission
owners)
2.3
Protect privacy
2.4
Ensure appropriate retention (e.g., media, hardware, personnel)
2.5
Determine data security controls (e.g., data at rest, data in transit)
2.6
Establish handling requirements (markings, labels, storage, destruction of sensitive
information)
»
Data owners
»
Data processers
»
Data remanence
»
Collection limitation
»
Baselines
»
Scoping and tailoring
»
Standards selection
»
Cryptography
7
CISSP Certification Exam Outline
Domain 3:
Security Engineering
3.1
Implement and manage engineering processes using secure design principles
3.2
Understand the fundamental concepts of security models (e.g., Confidentiality
,
Integrity, and Multi-level Models)
3.3
Select controls and countermeasures based upon systems security evaluation models
3.4
Understand security capabilities of information systems (e.g., memory pr
otection,
virtualization, trusted platform module, interfaces, fault tolerance)
3.5
Assess and mitigate the vulnerabilities of security architectures, designs, and solution
elements
3.6
Assess and mitigate vulnerabilities in web-based systems (e.g., XML, OW
ASP)
3.7
Assess and mitigate vulnerabilities in mobile systems
3.8
Assess and mitigate vulnerabilities in embedded devices and cyber
-physical systems (e.g.,
network-enabled devices, Internet of things (loT))
3.9
Apply cryptography
»
Client-based (e.g., applets, local caches)
»
Server-based (e.g., data flow control)
»
Database security (e.g., inference, aggregation,
data mining, data analytics, warehousing)
»
Large-scale parallel data systems
»
Distributed systems (e.g., cloud computing, grid
computing, peer to peer)
»
Cryptographic systems
»
Industrial control systems (e.g., SCADA)
»
Cryptographic life cycle (e.g., cryptographic
limitations, algorithm/protocol governance)
»
Cryptographic types (e.g., symmetric, asymmetric,
elliptic curves)
»
Public Key Infrastructure (PKI)
»
Key management practices
»
Digital signatures
»
Digital rights management
»
Non-repudiation
»
Integrity (hashing and salting)
»
Methods of cryptanalytic attacks (e.g., brute force,
cipher-text only, known plaintext)
8
CISSP Certification Exam Outline
3.10
Apply secure principles to site and facility design
3.11
Design and implement physical security
»
Wiring closets
»
Server rooms
»
Media storage facilities
»
Evidence storage
»
Restricted and work area security (e.g., operations
centers)
»
Data center security
»
Utilities and HVAC considerations
»
Water issues (e.g., leakage, flooding)
»
Fire prevention, detection and suppression
9
CISSP Certification Exam Outline
Domain 4:
Communications and Network Security
4.1
Apply secure design principles to network architecture (e.g., IP & non-IP protocols,
segmentation)
4.2
Secure network components
4.3
Design and establish secure communication channels
4.4
Prevent or mitigate network attacks
»
OSI and TCP/IP models
»
IP networking
»
Implications of multilayer protocols (e.g., DNP3)
»
Converged protocols (e.g., FCoE, MPLS, VoIP,
iSCSI)
»
Software-defined networks
»
Wireless networks
»
Cryptography used to maintain communication
security
»
Operation of hardware (e.g., modems, switches,
routers, wireless access points, mobile devices)
»
Transmission media (e.g., wired, wireless, fiber)
»
Network access control devices (e.g.,
firewalls, proxies)
»
Endpoint security
»
Content-distribution networks
»
Physical devices
»
Voice
»
Multimedia collaboration (e.g., remote meeting
technology, instant messaging)
»
Remote access (e.g., VPN, screen scraper, virtual
application/desktop, telecommuting)
»
Data communications (e.g., VLAN, TLS/SSL)
»
Virtualized networks (e.g., SDN, virtual SAN, guest
operating systems, port isolation)
10
CISSP Certification Exam Outline
Domain 5:
Identity and Access Management
5.1
Control physical and logical access to assets
»
Information
»
Systems
»
Devices
»
Facilities
5.2
Manage identification and authentication of people and devices
5.3
Integrate identity as a service (e.g., cloud identity)
5.4
Integrate third-party identity services (e.g., on-premise)
5.5
Implement and manage authorization mechanisms
»
Role-Based Access Control (RBAC) methods
»
Rule-based access control methods
»
Mandatory Access Control (MAC)
»
Discretionary Access Control (DAC)
5.6
Prevent or mitigate access control attacks
5.7
Manage the identity and access provisioning lifecycle (e.g., provisioning, review)
»
Identity management implementation (e.g., SSO,
LDAP)
»
Single/multi-factor authentication (e.g., factors,
strength, errors)
»
Accountability
»
Session management (e.g., timeouts,
screensavers)
»
Registration and proofing of identity
»
Federated identity management (e.g., SAML)
»
Credential management systems
11
CISSP Certification Exam Outline
11
6.1
Design and validate assessment and test strategies
6.2
Conduct security control testing
6.3
Collect security process data (e.g., management and operational controls)
6.4
Analyze and report test outputs (e.g., automated, manual)
6.5
Conduct or facilitate internal and third party audits
»
Vulnerability assessment
»
Penetration testing
»
Log reviews
»
Synthetic transactions
»
Code review and testing (e.g., manual, dynamic,
static, fuzz)
»
Misuse case testing
»
Test coverage analysis
»
Interface testing (e.g., API, UI, physical)
»
Account management (e.g., escalation,
revocation)
»
Management review
»
Key performance and risk indicators
»
Backup verification data
»
Training and awareness
»
Disaster recovery and business continuity
Domain 6:
Security Assessment and Testing
