CISSP CORE CONCEPTS -Domain-1 | The Ultimate CISSP Course

Explain CISSP ethics, including organizational and professional ethics, and the ISC2 code of ethics canons; cover responsible and public vulnerability disclosure, policy alignment, and reporting breaches.

Explore the CIA triad—confidentiality, availability, integrity—along with authentication and non-repudiation, and learn how encryption, access control, and audit trails secure data and align security with business risk.

Align security with business by conducting risk analysis within regulatory and contractual requirements, balancing risk tolerance and appetite, and choosing centralized or decentralized governance for multinational organizations.

Explore organizational processes such as acquisitions, mergers, and divestitures, and learn risk-based security governance that integrates cyber security controls after assessing posture and third-party risk, with legal input.

Define roles and responsibilities, apply separation of duties, and secure independence in assurance functions; ensure the CSO reports to the highest authority within a governance framework and federated structure.

Explore security control frameworks such as ISO 27001/27002, NIST CSF, COBIT, SABSA, PCI-DSS, and FedRAMP, and learn how to align them with business objectives and governance.

Clarifies the difference between due care and due diligence, with due care as prudent front-end actions and due diligence as back-end risk research and vendor assessments.

Identify and align legal, regulatory, business, and contractual requirements for cyber security, navigate regulators, and address privacy, data localisation, import-export rules, and compliance with HIPAA, GLBA, ECPA, and FISMA.

Explore tangible and intangible property—copyrights, patents, trademarks, and trade secrets—and how licensing, EULA, and open source shape security governance.

Explore import/export controls under the Wassenaar agreement, focusing on ITAR and EAR, how cryptographic modules may be restricted, licensing requirements, and that cloud or temporary transfers do not exempt compliance.

Explore transborder data flow, data sovereignty, and data localization, including GDPR, corporate binding rules, and how national security and privacy shape cross-border data transfer.

Explore privacy basics, OECD privacy principles, and how GDPR and CCPA regulate data collection, processing, rights, breach reporting, cross-border transfers, and consumer control.

Explore contractual, legal, regulatory, and industry standards requirements, including PCI DSS and HIPAA. Learn that impact assessment, training, and technical controls are needed, and that risk transfer cannot eliminate accountability.

Learn the governance perspective on investigations, differentiating administrative, civil (tort), and criminal types, including burden of proof, e-discovery, and early legal counsel.

Explore how governance translates planning into action by crafting policies, standards, procedures, and guidelines, with enforcement, approvals, and alignment to regulatory requirements.

Explore how business continuity planning centers on business impact analysis to identify critical processes and dependencies, set MTD, RTO, and RPO, and choose recovery strategies.

Embed personal security across HR processes, from candidate screening and background verification to onboarding, training, and termination, by integrating security expectations, awareness, and IAM.

Master core risk management concepts, including threat, vulnerability, risk appetite, acceptable levels, layered security, and residual vs inherent risk, using qualitative and quantitative analysis.

Explore risk management concepts from a CISSP perspective, including cyber insurance limitations, risk transfer, risk acceptance scenarios, and selecting safeguards, countermeasures, and compensating controls.