Chapter 2 of 8 · ISC2 CISSP
Asset Security
Classifying information and assets, handling, provisioning, data roles, the data lifecycle, retention and data security controls.
- 3topics
- 10 minfast track
- 1diagrams and exhibits
- 10%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Classification and HandlingIdentifying and classifying information and assets, government and commercial classification levels, marking and labeling, and…3 min
- 2Data Lifecycle, Provisioning and RetentionSecure asset provisioning and inventory, data roles, the data lifecycle, data remanence and sanitization, and retention through…Diagram4 min
- 3Data Security Controls and ComplianceProtecting data at rest, in transit and in use, scoping and tailoring baselines, selecting standards, and using DRM, DLP and CASB…3 min
About this chapter
What this chapter covers
Asset Security is worth 10 percent of the CISSP exam. It is about knowing what information and assets the organization has, how valuable and sensitive they are, who is responsible for them, and how to protect them from creation to destruction.
It covers identifying and classifying information and assets, handling requirements (marking, labeling, storage, destruction), provisioning assets securely (inventory, ownership), managing the data lifecycle (data roles, collection, location, maintenance, retention, remanence, destruction), asset retention (end of life and end of support) and data security controls and compliance (data states, scoping and tailoring, standards, and protection methods such as DRM, DLP and CASB).
How the topics fit together
The questions often ask who decides (the owner), what happens to copies (they keep the source classification) and how to dispose of data on specific media (the method must fit the media).
Classification drives everything else. If an option protects data without first knowing its classification or owner, look for a better answer.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.