Technology and Security · Topic 7 of 7
Security Concepts, Frameworks, Standards and Awareness Training
CRISC security principles: CIA, least privilege, defense in depth, zero trust, ISO/IEC 27001 and NIST CSF 2.0, and awareness that changes behaviour.
- 5 min
- CIA: confidentiality, integrity, availability.
- Least privilege, segregation of duties and defense in depth apply everywhere.
- Zero trust verifies every request; NIST SP 800-207 describes it.
What it is
Information security protects information and systems against threats to their confidentiality, integrity and availability. Its core concepts, such as least privilege and defense in depth, appear across every framework.
Security and risk awareness and training make people part of the control environment. The job practice asks the practitioner to promote a risk-aware culture by contributing to awareness and training, because many incidents start with a human action.
How it works
Core concepts
| Concept | Meaning |
|---|---|
| Confidentiality | Only authorized people can see information |
| Integrity | Information is accurate and changed only in authorized ways |
| Availability | Information and systems are usable when needed |
| Authentication, authorization, accountability | Prove identity, grant only permitted actions, record who did what |
| Non-repudiation | A party cannot credibly deny an action, often through digital signatures and logs |
| Least privilege and need to know | Minimum access required for the job |
| Segregation of duties | Sensitive tasks split between people |
| Defense in depth | Several layers of control so one failure does not lead to a breach |
| Zero trust | No implicit trust based on network location; every request is verified |
Zero trust is described in NIST SP 800-207. It focuses on protecting resources rather than network perimeters, with continuous verification of user, device and context.
Common control families a risk practitioner should recognize
| Area | Key ideas |
|---|---|
| Identity and access management | Authentication factors (something you know, have, are); MFA; privileged access management; periodic access recertification by the owner |
| Cryptography | Symmetric encryption uses one shared key and is fast; asymmetric uses a public/private key pair for key exchange and digital signatures; hashing gives integrity, not secrecy; PKI issues and revokes certificates; key management protects keys through their life cycle |
| Network security | Segmentation limits how far an attacker can move; firewalls filter traffic; IDS detects and IPS blocks suspicious traffic |
| Monitoring | Logs collected into a SIEM are correlated to detect incidents; logs must be protected and retained |
| Endpoint and cloud | Endpoint detection and response, patching and hardening; in the cloud, the shared responsibility model decides which controls the customer owns |
A CRISC question rarely asks how a control works in detail. It asks whether the control addresses the risk, who owns it and how its effectiveness is monitored.
Frameworks and standards
| Framework or standard | Purpose |
|---|---|
| ISO/IEC 27001:2022 | Requirements for an information security management system (ISMS); certifiable |
| ISO/IEC 27002:2022 | Guidance for the 93 Annex A controls |
| NIST Cybersecurity Framework 2.0 | Outcomes in six functions: Govern, Identify, Protect, Detect, Respond, Recover |
| NIST SP 800-53 Rev 5 | Detailed security and privacy control catalogue |
| CIS Critical Security Controls | Prioritized technical safeguards |
| COBIT 2019 | Governance and management of enterprise IT, including security |
NIST CSF 2.0, released in February 2024, added the Govern function to emphasize strategy, roles, policy and supply chain risk. ISO/IEC 27001 requires the organization to perform information security risk assessment and treatment, and to produce a statement of applicability listing which controls apply and why.
The practitioner evaluates whether business practices actually align with the frameworks and standards the organization claims to follow, and reports gaps as risks.
Awareness, training and education
| Level | Audience | Goal | Example |
|---|---|---|---|
| Awareness | Everyone | Recognize risks and know what to do | Phishing reminders, posters, short videos |
| Training | Specific roles | Build skills for a job | Secure coding for developers, data handling for HR |
| Education | Specialists | Deep understanding | Professional certification |
An effective program is based on the organization's risks, is tailored to roles, starts at onboarding and repeats regularly, uses realistic examples, and is supported visibly by senior management. Content should be updated when threats change, such as new phishing techniques or AI-generated voice fraud.
Measuring effectiveness
Completion rates show that people attended, not that behaviour changed. Better measures include phishing simulation click and report rates over time, the number of incidents caused by human error, security policy violations, and how quickly staff report suspicious events. A rising report rate is a good sign of a healthy culture.
Building a risk-aware culture
Awareness is one part of culture. Others include leaders following the rules, easy ways to report concerns, no-blame treatment of honest mistakes, and recognition for good risk behaviour. The practitioner contributes content on risk scenarios and lessons from real incidents, and helps measure results.
A worked example
A company runs annual security training with 99% completion, yet phishing incidents keep rising. The practitioner reviews the data: the training is a generic video, and finance staff, who are targeted with invoice fraud, get the same content as everyone else.
The program is redesigned with short quarterly modules, role-based training for finance on payment fraud and call-back verification, and monthly phishing simulations. Six months later, the simulation click rate has halved and the report rate has tripled, while two real fraud attempts were reported and stopped.
How the exam asks about this
- "What is the BEST indicator that security awareness training is effective?" A measurable change in behaviour, such as fewer phishing clicks and more reports.
- "Which principle limits damage if one control fails?" Defense in depth.
- "What did NIST CSF 2.0 add to the previous version's functions?" The Govern function.
What to remember for the exam
- CIA: confidentiality, integrity, availability.
- Least privilege, segregation of duties and defense in depth apply everywhere.
- Zero trust verifies every request; NIST SP 800-207 describes it.
- NIST CSF 2.0 has six functions, with Govern added in 2024; ISO/IEC 27001:2022 is the certifiable ISMS standard.
- Measure awareness by behaviour change, not completion rates.
Training completion is a weak metric. When asked for the BEST evidence of an effective awareness program, choose behaviour-based measures such as phishing report rates or fewer human-caused incidents.
Common mistakes
Same training for everyone. Role-based content addresses the risks each group actually faces.
Confusing ISO/IEC 27001 and 27002. 27001 sets certifiable ISMS requirements; 27002 gives control guidance.
Blaming individuals for clicking. Blame discourages reporting, which is the behaviour that limits damage.
Check yourself
What does zero trust mean?
No user or device is trusted by default because of its network location; every access request is verified using identity, device and context.
Which function did NIST CSF 2.0 add, and why?
Govern, to emphasize cybersecurity strategy, roles, policy and supply chain risk management.
Why is a rising phishing report rate a good sign?
It shows staff recognize suspicious messages and act, which helps detect and contain attacks early.
Topic 7 of 7 in Technology and Security
Test yourself on Technology and Security
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.