Chapter 1 of 8 · ISC2 CISSP
Security and Risk Management
Ethics, security concepts, governance, law and compliance, investigations, policy, continuity, personnel, risk and threats.
- 7topics
- 24 minfast track
- 3diagrams and exhibits
- 16%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Ethics and Security ConceptsThe ISC2 Code of Ethics canons and how to apply them, plus confidentiality, integrity, availability, authenticity and…Diagram4 min
- 2Security Governance PrinciplesAligning security with business strategy, organizational processes, roles and responsibilities, control frameworks, and due care…3 min
- 3Legal, Regulatory and Investigation RequirementsCybercrime and data breaches, intellectual property, import and export controls, transborder data flow, privacy laws and the five…4 min
- 4Policies, Personnel Security and AwarenessPolicies, standards, procedures and guidelines; hiring, onboarding, transfer and termination controls; and building awareness…3 min
- 5Business Continuity RequirementsBusiness continuity requirements for CISSP: scope, the business impact analysis, critical functions, MTD, RTO, RPO and WRT, and…Diagram3 min
- 6Risk Management ConceptsRisk identification, qualitative and quantitative analysis, SLE, ALE and ARO, risk responses, control types, monitoring and…Diagram4 min
- 7Threat Modeling and Supply Chain RiskThreat modeling with STRIDE, PASTA, attack trees and data flow diagrams, and managing supply chain risk from hardware, software…3 min
About this chapter
What this chapter covers
Security and Risk Management is the largest CISSP domain, worth 16 percent of the exam. It sets the managerial mindset the whole exam expects: security exists to support the business, decisions follow risk, and senior management owns that risk.
It covers professional ethics and the ISC2 Code of Ethics, security concepts (confidentiality, integrity, availability, authenticity and nonrepudiation), governance (alignment with the business, roles, frameworks, due care and due diligence), legal and regulatory issues (cybercrime, intellectual property, privacy, transborder data), investigation types, policy documentation, business continuity requirements, personnel security, risk management, threat modeling, supply chain risk and security awareness, education and training.
How the topics fit together
Most questions in this domain have several technically reasonable answers. The best one usually protects people first, follows the law and the organization's policy, involves the right decision maker and addresses the root cause rather than a symptom.
Think like a manager advising the board, not like a technician at a keyboard. When an option jumps straight to a technical fix before the risk is understood or the owner is consulted, it is rarely the best answer.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.