The CISSP exam uses Computerized Adaptive Testing (CAT) for all English exams. CISSP exams in all other languages are administered as linear, fixed-form exams.
About CISSP
The Certified Information Systems Security Professional (CISSP) is the most globally recognized certification in the information security market. CISSP validates an information security professional’s deep technical and managerial knowledge and experience to effectively design, engineer, and manage the overall security posture of an organization. The broad spectrum of topics included in the CISSP Common Body of Knowledge (CBK) ensure its relevancy across all disciplines in the field of information security. Successful candidates are competent in the following 8 domains:
• Security and Risk Management
• Asset Security
• Security Architecture and Engineering
• Communication and Network Security
• Identity and Access Management (IAM)
• Security Assessment and Testing
• Security Operations
• Software Development Security
Experience Requirements
Candidates must have a minimum of 5 years cumulative paid full-time work experience in 2 or more of the 8 domains of the CISSP CBK. Earning a 4-year college degree or regional equivalent or an additional credential from the (ISC)² approved list will satisfy 1 year of the required experience. Education credit will only satisfy 1 year of experience. A candidate that doesn’t have the required experience to become a CISSP may become an Associate of (ISC)² by successfully passing the CISSP examination. The Associate of (ISC)² will then have 6 years to earn the 5 years required experience.
Accreditation
CISSP was the first credential in the field of information security to meet the stringent requirements of ANSI/ ISO/IEC Standard 17024.
Job Task Analysis (JTA)
(ISC)² has an obligation to its membership to maintain the relevancy of the CISSP. Conducted at regular intervals, the Job Task Analysis (JTA) is a methodical and critical process of determining the tasks that are performed by security professionals who are engaged in the profession defined by the CISSP. The results of the JTA are used to update the examination. This process ensures that candidates are tested on the topic areas relevant to the roles and responsibilities of today’s practicing information security professionals.
Course Curriculum
| Domain 1: Security and Risk Management | |||
| 1.1 Understand and apply concepts of confidentiality, integrity and availability Details | 00:45:00 | ||
| 1.2 Evaluate and apply security governance principles Details | 00:45:00 | ||
| 1.3 Determine compliance requirements Details | 00:45:00 | ||
| 1.4 Understand legal and regulatory issues that pertain to information security in a global context Details | 00:45:00 | ||
| 1.5 Understand, adhere to, and promote professional ethics Details | 00:45:00 | ||
| 1.6 Develop, document, and implement security policy, standards, procedures, and guidelines Details | 00:45:00 | ||
| 1.7 Identify, analyze, and prioritize Business Continuity (BC) requirements Details | 00:45:00 | ||
| 1.8 Contribute to and enforce personnel security policies and procedures Details | 00:45:00 | ||
| 1.9 Understand and apply risk management concepts Details | 00:45:00 | ||
| 1.10 Understand and apply threat modeling concepts and methodologies Details | 00:45:00 | ||
| 1.11 Apply risk-based management concepts to the supply chain Details | 00:45:00 | ||
| 1.12 Establish and maintain a security awareness, education, and training program Details | 00:00:00 | ||
| Domain 2: Asset Security | |||
| 2.1 Identify and classify information and assets Details | 00:00:00 | ||
| 2.2 Determine and maintain information and asset ownership Details | 00:00:00 | ||
| 2.3 Protect privacy Details | 00:00:00 | ||
| 2.4 Ensure appropriate asset retention Details | 00:00:00 | ||
| 2.5 Determine data security controls Details | 00:00:00 | ||
| 2.6 Establish information and asset handling requirements Details | 00:00:00 | ||
| Domain 3: Security Architecture and Engineering | |||
| 3.1 Implement and manage engineering processes using secure design principles Details | 00:00:00 | ||
| 3.2 Understand the fundamental concepts of security models Details | 00:00:00 | ||
| 3.3 Select controls based upon systems security requirements Details | 00:00:00 | ||
| 3.4 Understand security capabilities of information systems (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption) Details | 00:00:00 | ||
| 3.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements Details | 00:00:00 | ||
| 3.6 Assess and mitigate vulnerabilities in web-based systems Details | 00:00:00 | ||
| 3.7 Assess and mitigate vulnerabilities in mobile systems Details | 00:00:00 | ||
| 3.8 Assess and mitigate vulnerabilities in embedded devices Details | 00:00:00 | ||
| 3.9 Apply cryptography Details | 00:00:00 | ||
| 3.10 Apply security principles to site and facility design Details | 00:00:00 | ||
| 3.11 Implement site and facility security controls Details | 00:00:00 | ||
| Domain 4: Communication and Network Security | |||
| 4.1 Implement secure design principles in network architectures Details | 00:00:00 | ||
| 4.2 Secure network components Details | 00:00:00 | ||
| 4.3 Implement secure communication channels according to design Details | 00:00:00 | ||
| Domain 5: Identity and Access Management (IAM) | |||
| 5.1 Control physical and logical access to assets Details | 00:00:00 | ||
| 5.2 Manage identification and authentication of people, devices, and services Details | 00:00:00 | ||
| 5.3 Integrate identity as a third-party service Details | 00:00:00 | ||
| 5.4 Implement and manage authorization mechanisms Details | 00:00:00 | ||
| 5.5 Manage the identity and access provisioning lifecycle Details | 00:00:00 | ||
| Domain 6: Security Assessment and Testing | |||
| 6.1 Design and validate assessment, test, and audit strategies Details | 00:00:00 | ||
| 6.2 Conduct security control testing Details | 00:00:00 | ||
| 6.3 Collect security process data (e.g., technical and administrative) Details | 00:00:00 | ||
| 6.4 Analyze test output and generate report Details | 00:00:00 | ||
| 6.5 Conduct or facilitate security audits Details | 00:00:00 | ||
| Domain 7: Security Operations | |||
| 7.1 Understand and support investigations Details | 00:00:00 | ||
| 7.2 Understand requirements for investigation types Details | 00:00:00 | ||
| 7.3 Conduct logging and monitoring activities Details | 00:00:00 | ||
| 7.4 Securely provisioning resources Details | 00:00:00 | ||
| 7.5 Understand and apply foundational security operations concepts Details | 00:00:00 | ||
| 7.6 Apply resource protection techniques Details | 00:00:00 | ||
| 7.7 Conduct incident management Details | 00:00:00 | ||
| 7.8 Operate and maintain detective and preventative measures Details | 00:00:00 | ||
| 7.9 Implement and support patch and vulnerability management Details | 00:00:00 | ||
| 7.10 Understand and participate in change management processes Details | 00:00:00 | ||
| 7.11 Implement recovery strategies Details | 00:00:00 | ||
| 7.12 Implement Disaster Recovery (DR) processes Details | 00:00:00 | ||
| 7.13 Test Disaster Recovery Plans (DRP) Details | 00:00:00 | ||
| 7.14 Participate in Business Continuity (BC) planning and exercises Details | 00:00:00 | ||
| 7.15 Implement and manage physical security Details | 00:00:00 | ||
| 7.16 Address personnel safety and security concerns Details | 00:00:00 | ||
| Domain 8: Software Development Security | |||
| 8.1 Understand and integrate security in the Software Development Life Cycle (SDLC) Details | 00:00:00 | ||
| 8.2 Identify and apply security controls in development environments Details | 00:00:00 | ||
| 8.3 Assess the effectiveness of software security Details | 00:00:00 | ||
| 8.4 Assess security impact of acquired software Details | 00:00:00 | ||
| 8.5 Define and apply secure coding guidelines and standards Details | 00:00:00 | ||
Course Reviews
No Reviews found for this course.
