Chapter 1 of 5 · ISC2 CC
Security Principles
The CIA triad, AAA, non-repudiation, privacy, risk management, governance, security controls and the ISC2 Code of Ethics.
- 4topics
- 12 minfast track
- 3diagrams and exhibits
- 24%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Cybersecurity ConceptsThe CIA triad, authentication, authorization and accounting, non-repudiation and privacy for the ISC2 CC exam, with examples from…Diagram3 min
- 2Risk Management ConceptsThe risk management lifecycle and processes for the ISC2 CC exam: assets, threats, vulnerabilities, likelihood and impact, risk…Diagram3 min
- 3Governance and Security ControlsLaws and regulations, frameworks, policies, standards and procedures, and technical, administrative and physical security…Diagram3 min
- 4Professional and Ethical ConductThe ISC2 Code of Ethics canons, professional codes of conduct, due care and due diligence, and ethical questions raised by AI…3 min
About this chapter
What this chapter covers
Security Principles is the largest CC domain, worth 24 percent of the exam. It gives you the vocabulary the rest of the exam builds on: what security protects, how risk is managed, how organizations govern security, which kinds of controls exist and how a security professional is expected to behave.
It covers cybersecurity concepts (confidentiality, integrity, availability, authentication, authorization and accounting, non-repudiation and privacy), risk management (the lifecycle and its processes), governance (laws, frameworks, policies, standards and procedures), security controls (technical, administrative and physical) and professional and ethical conduct (codes of conduct, due care and due diligence, the ISC2 Code of Ethics). As in every CC domain, the 2026 outline also asks you to apply these ideas to AI systems.
How the topics fit together
CC questions are entry level. They ask what a concept means and when it applies, not how to configure a product. Most questions describe a short situation and ask which concept, control or response fits.
Learn the exact meaning of each term. Many wrong answers are real security terms that simply describe something else.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.