Complete Cybersecurity Certification - ISC2

Explains the CIA triad, confidentiality, integrity, and availability, and its role in information assurance for protecting data from breaches. Shows authentication, encryption, hashing, and redundancy in real-world systems.

Explore authentication fundamentals, including single-factor and multifactor methods (something you know, something you have, something you are), and discuss password risks, phishing, MFA benefits, and biometric and token-based options.

Explore how multifactor authentication strengthens security by requiring two or more verification factors, including knowledge, possession, and biometrics, with real-world examples like online banking and corporate access.

Explore data privacy basics, PII concepts, online tracking challenges, and the GDPR framework that protects individual rights and governs EU data processing.

Learn how non-repudiation prevents denial of a message, proves delivery and sender identity, and shows how digital signatures and encryption guard integrity and trust in digital transactions.

Explore the risk management process, from risk identification and analysis to mitigation, monitoring, and reporting, to protect data, manage threats, and support organizational goals.

Identify risks early in the risk management process by crafting risk statements, performing basic and detailed identification, and using brainstorming, interviews, and documentation with cross-checks to finalize the risk statement.

Learn the risk analysis phase, assess harm and likelihood to protect assets through asset valuation, and define key terms like asset, threat, vulnerability, exposure, risk, safeguard, attack, and breach.

Explore risk assessment within the risk management process, comparing quantitative and qualitative methods, identifying assets and threats, estimating losses, and understanding how upper management uses results to mitigate operational impact.

Identify four risk responses after risk assessment: mitigate, transfer, accept, or reject. Apply practical examples like multifactor authentication, anti-malware, cybersecurity insurance, and outsourcing to manage risk.

Practice risk monitoring as the final, ongoing step in risk management, ensuring controls stay effective and responses occur promptly under the guidance of a dedicated risk team.

Explore security controls across physical, technical, and administrative layers in a defense-in-depth model to protect confidentiality, integrity, and availability of critical assets.

Explore the functions of security controls, including directive, deterrent, preventive, detective, corrective, and recovery controls, with examples like access control, encryption, monitoring, and backups.

Define the code of conduct and code of ethics as guiding standards of integrity, accountability, and respect; learn how breaches trigger complaints to the ISC2 ethics committee and certification revocation.

Explore the ISC2 code of ethics, its four mandatory canons, and guidelines that govern honesty, integrity, and professionalism to ensure trust, reliability, and adherence as an information security professional.

Explore the ISC2 code of ethics and its four canons, ranked by priority, to protect society, the Commonwealth, and infrastructure, act honorably, provide competent service, and advance the profession.

Explore how governance elements—laws and regulations, standards, policies, and procedures—interrelate to protect data and guide cybersecurity compliance, with examples like GDPR and ISO 27,001.

Understand governance standards that guide information security practices, from ISO and NIST frameworks to industry communication standards like IETF and IEEE, ensuring secure, compliant operations.

Explore governance through organizational policies that define standards and practices, guide decision making, and ensure compliance. Learn how high level policies drive specific procedures, audits, and training across departments.

Procedures define step-by-step instructions for completing tasks, including required information, decision criteria, and success measures. In cybersecurity, follow a documented phishing response procedure to identify, report, and secure affected accounts.

Navigate regulations and laws shaping data privacy, including HIPAA and GDPR. Understand penalties for noncompliance and why organizations should comply with the strictest regulations to avoid penalties.

Define incident terminologies such as breach, event, exploit, incident, intrusion, threat, vulnerability, and zero day, and explain their roles in incident response as first responders to cyber incidents.

Learn how incident response quickly identifies and stops breaches, minimizes damage, and restores operations by prioritizing issues based on impact and urgency to protect life, health, and safety.

Implement an incident response plan to guide detection, containment, eradication, recovery, and post-incident review. Assign clear roles to the response team to minimize downtime, protect data, and strengthen regulatory compliance.

Explore how a cross-functional incident response team leads incident management, trains members through regular exercises, and executes incident response plan to determine damage, recover systems, secure data, and prevent recurrence.

Explore the incident response plan components using the NIST four-step approach—preparation, detection and analysis, containment, and eradication and recovery—plus post-incident activity and policy-backed training.

Understand business continuity to keep essential services running during disasters, and learn the red book concept, an offsite hard-copy plan updated with electronic records.

Develop and implement a business continuity plan to keep most important products and services running during cyber incidents, using backup systems and alternate networks to reduce revenue and reputation losses.

Explore the key components of a business continuity plan, including stakeholder contacts, service level agreements, business impact analysis, risk assessment, critical-function prioritization, resource allocation, clear communications, and tabletop exercises.

Learn to apply a systematic, data-driven business impact analysis to evaluate disruptive events and assess external and internal risks—supply chain problems, cyber attacks, and disasters—on critical functions and interdependencies.

Explore how business continuity activates during disruptions, coordinating stakeholders, alternate work sites, data backups, and remote access to maintain critical functions and secure operations.

Explore the disaster recovery plan that resumes operations after disruptions, detailing risk analysis, business impact analysis, and recovery point objectives (rpo) and recovery time objectives (rto) to restore information systems.

master disaster recovery plan components by detailing risk assessment, business impact analysis, clear rto and rpo goals, encrypted backups, access controls, recovery strategies, and ongoing testing and maintenance.

Identify the importance of a disaster recovery plan for data protection, uptime, and regulatory compliance. See how backups, data flow, and multiple system dependencies enable quick recovery and uninterrupted services.

Learn about disaster recovery sites (hot, warm, and cold) and how real-time synchronization, backups, and secondary data storage enable rapid restoration after outages.

Understand security controls and access control concepts that protect data confidentiality, integrity, and availability. Distinguish administrative, physical, and logical controls with examples like passwords, MFA, guards, badges, and access audits.

Protect an organization's assets, including information, systems, devices, facilities, and personnel, by implementing access controls that safeguard data and IT services like file and web servers.

Examine access control elements—subjects, objects, and rules—and how they govern permissions, with models like discretionary access control, mandatory access control, and role based access control.

Learn how access controls manage resource access by identifying, authenticating, authorizing users, and monitoring attempts, with primary types—preventive, detective, corrective—and secondary types—deterrent, recovery, directive, compensation.

Explore defense in depth by stacking administrative, technical, and physical controls to protect assets; learn how multi-factor authentication, layered firewalls, and access policies deter unauthorized access.

Learn monitoring techniques and how log analysis, IDS and SIEM tools detect intrusions and failures in real time, report alarms, and preserve audit trails as evidence.

Explore physical monitoring controls, including cameras, motion sensors, logs, alarms, and security guards, to oversee movement, deter crime, capture evidence, and comply with log retention and anomaly detection requirements.

Explore logical monitoring controls through logging, monitoring, and auditing to prevent incidents, track activity, and support accountability, reconstruction, and disaster recovery with security, system, and change logs.