CISSP Cheat Sheet

Exam at a glance

Pass without the experience? You become an Associate of ISC2 and have up to six years to earn it.

The eight domains and weightings

Domain 1 carries the most weight — and its themes (risk, governance, ethics) run through every other domain.

Domain 1 — Security and Risk Management (16%)

• CIA triad + authenticity and non-repudiation — the core goals: keep data confidential, accurate, and available, plus prove who did what and stop them denying it.
• Governance — the hierarchy that steers security: policies are mandatory, standards set specific requirements, procedures give the steps, and guidelines are discretionary — all aligned to business objectives.
• Risk management process — identify risks, assess them, respond, and keep monitoring over time.
• Quantitative risk math — AV × EF = SLE (the cost of one loss) and SLE × ARO = ALE (the expected yearly cost), used to justify spending on controls.
• Risk responses — mitigate (reduce it), transfer (insure or outsource it), accept (live with it), or avoid (stop the activity).
• (ISC)² Code of Ethics canons — the order is the tie-breaker — (1) protect society and the common good, (2) act honorably, honestly, justly, responsibly, and legally, (3) provide diligent and competent service to principals, (4) advance and protect the profession.
• Legal and continuity fundamentals — GDPR, HIPAA, and intellectual property; due care (doing the right thing) vs due diligence (verifying it); and BCP/DRP basics.

Domain 2 — Asset Security (10%)

• Data classification — rank data by sensitivity and criticality, then label and handle it to match.
• Data roles — the owner is accountable for the data, the custodian maintains and protects it, the controller decides why and how it's processed, the processor handles it on the controller's behalf, and the steward ensures its quality and proper use.
• Data states — protect data at rest (stored), in transit (moving), and in use (being processed).
• Data lifecycle — create → store → use → share → archive → destroy; secure destruction includes wiping, degaussing, shredding, and cryptographic erase.
• Data sovereignty / residency — laws dictating where data may physically live and whose jurisdiction governs it.

Domain 3 — Security Architecture and Engineering (13%)

• Secure design principles — least privilege, defense in depth, fail-secure, separation of duties, zero trust, and privacy by design.
• Security models — Bell-LaPadula protects confidentiality (no read up, no write down), Biba protects integrity (no write up, no read down), and Clark-Wilson enforces well-formed transactions.
• Cryptography — symmetric vs asymmetric encryption, hashing, digital signatures, PKI, and the key-management lifecycle; watch for attacks like birthday and side-channel.
• Physical security — CPTED (designing the space itself to deter crime), access-control vestibules (mantraps), fire suppression, and power protection (UPS, generators).
• Vulnerable system types — cloud, IoT, ICS/SCADA, and embedded systems each carry their own weaknesses.

Domain 4 — Communication and Network Security (13%)

• OSI and TCP/IP models — know the layers and which security control belongs at each.
• Secure protocols — TLS (transport encryption), IPsec (AH vs ESP; transport vs tunnel mode), SSH (secure remote access), and DNSSEC (authenticated DNS).
• Segmentation — VLANs, firewalls, DMZs, micro-segmentation, and network access control to separate and contain traffic.
• Wireless security — WPA3 encryption, EAP authentication methods, and rogue access-point detection.
• Network attacks — DDoS, on-path (man-in-the-middle), and DNS poisoning, along with their mitigations.

Domain 5 — Identity and Access Management (13%)

• IAAA sequence — Identification (claim an identity) → Authentication (prove it) → Authorization (what you may do) → Accountability (logging what you did).
• Authentication factors — something you know / have / are, plus somewhere you are and something you do; true MFA combines factors from different categories.
• Access control models — DAC (the owner decides), MAC (the system enforces labels and clearances), RBAC (access by role), ABAC (access by attributes), and rule-based.
• Federation and SSO — ways to share identity across systems and organizations: SAML, OAuth 2.0, OpenID Connect, and Kerberos.
• Identity lifecycle — provision on join, review regularly (access recertification), and deprovision on exit; privileged access gets extra control.

Domain 6 — Security Assessment and Testing (12%)

• Assessment vs audit vs test — an assessment reviews controls broadly, an audit is a formal (often independent) check against a standard, and a test exercises one specific control; know who performs each.
• Testing techniques — vulnerability scanning, penetration testing (black/grey/white box), SAST (static code analysis) vs DAST (running-app analysis), and fuzzing.
• Other techniques — log reviews, synthetic transactions, code review, and misuse-case testing.
• Metrics and reporting — show control effectiveness to management with KPIs (performance) and KRIs (risk).
• Account management reviews — periodically confirm accounts and their access are still appropriate.

Domain 7 — Security Operations (13%)

• Investigations and forensics — preserve chain of custody, follow order of volatility (collect the most perishable evidence first), and match evidence handling to the investigation type (criminal, civil, regulatory, administrative).
• Logging and monitoring — SIEM correlation, egress monitoring (watching data leave), and UEBA (flagging abnormal user/entity behavior).
• Incident management — detect → respond → mitigate → report → recover → remediate → lessons learned.
• Resilience — backups (3-2-1), RAID, and redundancy; the objectives RTO, RPO, MTD, MTTR; BCP (keep the business running) vs DRP (recover IT); and recovery sites (hot/warm/cold).
• Change and patch management — control configuration changes and keep systems patched to reduce risk.

Domain 8 — Software Development Security (10%)

• SDLC with security built in — weave security into every phase of the software development lifecycle ("shift left" — catching flaws earlier is far cheaper).
• Development models — Waterfall (sequential), Agile (iterative), and DevSecOps (security automated into the delivery pipeline).
• Maturity models — CMMI and SAMM rate how mature a development or security process is.
• Common flaws — injection, broken authentication, and insecure design; see the OWASP Top 10.
• Supply-chain and pipeline security — secure coding, code repositories, CI/CD security, and managing third-party and open-source risk.

The numbers worth memorizing

• Risk math: AV × EF = SLE · SLE × ARO = ALE
• Recovery objectives: RTO (how fast you must recover), RPO (how much data loss is tolerable), MTD (maximum tolerable downtime)
• Backups: 3-2-1 — three copies, two media, one off-site
• Ethics canons order: society → act honorably → service to principals → the profession

Study tips

• Answer as a CISO, not an engineer. If one option is "fix the firewall rule" and another is "update the risk register and inform management," the exam usually wants the governance answer.
• The CAT format adapts — it gets harder as you do well and won't let you go back. Commit to each answer and keep moving.
• Breadth over depth. CISSP is a mile wide; you need working command of all eight domains rather than deep mastery of one.
• Watch qualifiers: BEST, FIRST, MOST, MOST likely. The exam is testing prioritization.

---

Go deeper: if CISSP is a step up from where you are, the Security+ cheat sheet covers the foundational tier, and our security lane — OWASP Top 10, Encryption and HTTPS — fills in the technical background. Exam outline verified against ISC2 on 19 August 2026; confirm the current outline before you book.