The CISSP exam is organised into eight domains derived from the (ISC)² Common Body of Knowledge (CBK). This page is a map, not a textbook: the explanations live in the topic folders (basics/, defensive/, offensive/) and are shared with other certifications. Domain weights change between exam versions, so check the current official exam outline.
Domain 1 — Security and Risk Management
The foundation for every other domain: how security is governed, managed, and applied. Scope covered by the original course:
- Professional ethics, core security concepts and the CIA Triad
- Security governance principles, privacy and legal and regulatory requirements
- Investigation types
- Security policies, standards, procedures, and guidelines
- Business continuity requirements, personnel security, risk management concepts
- Threat modeling, supply chain risk management, and security awareness training
| Topic | Pages |
|---|---|
| Ethics and law | Law and Ethics, Intellectual Property |
| Security concepts | CIA Triad, Security Concepts, Security Controls |
| Privacy and regulation | GDPR, OECD Privacy Principles, EU Cyber Resilience Act |
| Frameworks | Security Frameworks and Standards |
| Policies | Security Policy |
| Investigations | Investigation |
| Business continuity | Business Continuity |
| Risk management | Risk Management, Risk Identification, Risk Assessment, Risk Response, Risk Monitoring |
| Threat modeling | Threat Modeling |
| Supply chain | Security Requirements |
Domain 2 — Asset Security
How organisations identify, classify, manage, and protect assets across their lifecycle: identification and classification, handling requirements, secure provisioning, data lifecycle, retention, and determining security controls and compliance requirements.
| Topic | Pages |
|---|---|
| Classification | Asset Classification |
| Lifecycle | Data Lifecycle, Data Collection, Data Maintenance |
| Ownership | Data Roles |
Domain 3 — Security Architecture and Engineering
| Topic | Pages |
|---|---|
| Design principles | Security Architecture Principles, Threat Modeling |
| Cryptography | Cryptography Fundamentals, Cryptographic Solutions, Public Key Infrastructure, Cryptography Attacks |
| System security | System Hardening, Operating System Security, Cloud Security |
Domain 4 — Communication and Network Security
| Topic | Pages |
|---|---|
| Fundamentals | Networking Fundamentals |
| Secure design | Network Segmentation, Firewalls and IDS/IPS |
| Secure channels | VPNs and Tunneling, Wireless Network Security, Email Security, SSH |
| Attacks | Network Attacks, Wireless Attacks |
Domain 5 — Identity and Access Management (IAM)
| Topic | Pages |
|---|---|
| IAM concepts and models | Identity and Access Management |
| Network access control | Security Technologies (802.1x, RADIUS, NAC) |
| Key management | SSH Key Management |
Domain 6 — Security Assessment and Testing
| Topic | Pages |
|---|---|
| Vulnerability assessment | Vulnerability and Patch Management, Vulnerability Scanning with CVE and Exploit Databases |
| Testing and reconnaissance | Information Security Attacks — Methodologies and Frameworks, nmap |
| Log review | SIEM and Log Management |
Domain 7 — Security Operations
| Topic | Pages |
|---|---|
| Monitoring and detection | Security Operations Center, SIEM and Log Management, Wireshark, tcpdump |
| Incident management | Incident Response Process, Digital Forensics, Investigation |
| Change and configuration | Change Management, System Hardening |
| Resilience | Backup and Disaster Recovery, Business Continuity |
| Protection | Endpoint Security |
Domain 8 — Software Development Security
| Topic | Pages |
|---|---|
| Secure SDLC | Secure Software Development |
| Application risks | OWASP Top 10, Application Attacks, Application Security Roadmap |
Gaps to fill
Personnel security and security-awareness programmes (Domain 1), physical and environmental security (Domain 3), and a dedicated security-audit page (Domain 6).