Certified Information Systems Security Professional – CISSP

Module 1: Security and Risk Management

• Information security governance
• Security principles
• Confidentiality, Integrity, and Availability
• Governance and compliance
• Legal and regulatory requirements
• Professional ethics
• Security policies and procedures
• Risk management
• Risk assessment and analysis
• Risk treatment
• Risk monitoring
• Threat modeling
• Supply chain risk management
• Security awareness and training
• Business continuity considerations
• Security strategy and objectives

Module 2: Asset Security

• Information and asset classification
• Asset ownership
• Asset lifecycle
• Data classification
• Data retention
• Data handling requirements
• Data security controls
• Privacy considerations
• Data storage
• Data destruction
• Media management
• Asset management responsibilities

Module 3: Security Architecture and Engineering

• Security architecture principles
• Secure design principles
• Security models
• Enterprise security architecture
• Security engineering
• Cryptography
• Encryption
• Key management
• Physical security
• Site and facility security
• Environmental controls
• Secure hardware and firmware
• Trusted computing
• Vulnerability management
• Cloud security architecture
• Resilient and fault-tolerant systems

Module 4: Communication and Network Security

• Network architecture
• Secure network design
• OSI and TCP/IP models
• Network protocols
• Network security controls
• Secure communication channels
• Segmentation
• Network access controls
• Firewalls
• VPN technologies
• Wireless security
• Remote access
• Network monitoring
• Network attacks
• Transmission security
• Software-defined networking
• Cloud and hybrid network security

Module 5: Identity and Access Management (IAM)

• Identity management
• Authentication
• Authorization
• Accountability
• Access control models
• Role-Based Access Control
• Rule-Based Access Control
• Mandatory Access Control
• Discretionary Access Control
• Attribute-Based Access Control
• Single Sign-On
• Federation
• Privileged access management
• Identity governance
• Access provisioning and deprovisioning
• Multi-factor authentication
• Access review and monitoring

Module 6: Security Assessment and Testing

• Security assessment principles
• Security control assessment
• Audit strategies
• Testing methodologies
• Vulnerability assessments
• Penetration testing
• Security testing tools
• Code review
• Security assessments
• Test planning
• Test execution
• Results analysis
• Reporting
• Remediation
• Continuous security improvement

Module 7: Security Operations

• Security operations management
• Incident response
• Incident detection and analysis
• Investigation
• Digital forensics
• Evidence collection
• Evidence handling
• Security monitoring
• Logging
• Security Information and Event Management
• Vulnerability management
• Patch management
• Configuration management
• Change management
• Disaster recovery
• Business continuity
• Recovery strategies
• Security operations metrics
• Threat intelligence

Module 8: Software Development Security

• Secure software development
• Secure development lifecycle
• Software security principles
• Security requirements
• Secure coding
• Software architecture
• Application security
• DevSecOps
• Source code security
• Code review
• Software testing
• Vulnerability management
• Third-party software
• Software supply chain security
• Application deployment security
• Secure maintenance

• Cybersecurity Professionals
• Information Security Professionals
• Security Managers
• Security Consultants
• Security Architects
• Security Engineers
• Security Analysts
• Security Auditors
• IT Directors and Managers
• Chief Information Security Officers (CISOs)
• Chief Security Officers (CSOs)
• Network Security Professionals
• Risk Management Professionals
• GRC Professionals
• Incident Response Professionals
• Security Operations Professionals
• Professionals responsible for enterprise security strategy and governance

• Apply comprehensive information security principles.
• Develop and align security strategies with business objectives.
• Identify, assess, and manage cybersecurity risks.
• Apply security governance, compliance, and regulatory principles.
• Classify and protect organizational information assets.
• Design secure and resilient enterprise architectures.
• Apply cryptographic principles and secure communication techniques.
• Design secure network architectures.
• Implement appropriate identity and access management controls.
• Apply authentication and authorization principles.
• Evaluate security controls through assessments and testing.
• Understand vulnerability assessments and penetration testing.
• Develop effective incident response and security operations processes.
• Apply digital forensics and evidence-handling principles.
• Design business continuity and disaster recovery strategies.
• Integrate security into the software development lifecycle.
• Apply DevSecOps and secure software development practices.
• Make risk-based decisions across complex enterprise environments.
• Prepare for the ISC2 CISSP certification examination.

• Strong understanding of cybersecurity and information security concepts.
• Practical experience with security technologies and processes.
• Familiarity with networking and operating systems.
• Understanding of risk management and security governance.
• Experience with security operations, architecture, or engineering is beneficial.
• Knowledge of enterprise IT environments is recommended.

Certification: Certified Information Systems Security Professional (CISSP)
Certification Body: ISC2
Exam Duration: Up to 3 hours
Number of Items: 100–150
Question Types: Multiple-choice and advanced item types
Passing Score: 700 out of 1,000
Exam Languages: English, Chinese, German, Japanese, and Spanish
Experience Requirement: 5 years in 2 or more CISSP domains, subject to applicable waiver rules