CISSP Domain 2: Asset Security explained

Domain 2 at a glance

The subdomains in plain words

1. 2.1 Identify and classify: government and commercial classification schemes, kinds of sensitive data, and classifying the assets that hold it.
2. 2.2 Handling requirements: labelling, storing, transporting and limiting the collection of sensitive data.
3. 2.3 Secure provisioning: asset ownership, inventory, media management and provisioning in the cloud.
4. 2.4 The data lifecycle: data roles (owner, controller, processor, custodian, user, subject), location, remanence and destruction.
5. 2.5 Retention and end of life: how long to keep records, and what changes when products reach end of life or end of support.
6. 2.6 Data security controls: data states, baselines, scoping and tailoring, and protection methods such as DLP and DRM.

What the exam tends to test

• The owner decides. The data owner, a senior person accountable for the data, sets its classification and protection requirements. Custodians carry out the daily work.
• Classification first. You cannot choose sensible controls until you know what the data is worth and who would be hurt by its loss.
• Protection follows the data. Backups, test copies and cloud replicas need the same protection as the original.
• Destruction matches sensitivity. The more sensitive the data, the more final the disposal method.
• Collect less. Not collecting data is the cheapest protection there is.

Common traps

• Confusing owner and custodian. If the question asks who decides, it is the owner; who implements, the custodian.
• Assuming deletion removes data. Erasing and clearing can leave remanence; the question will often want purging or destruction.
• Degaussing solid-state drives. Degaussing does not work on SSDs.
• Mixing up end of life and end of support. End of life usually stops sales; end of support stops patches, and that is when the risk climbs.
• Treating public data as needing no controls. It still needs integrity protection.
• Scoping versus tailoring. Scoping removes controls that do not apply; tailoring adjusts the ones that do to fit your organisation.

How to study it

1. Draw the data lifecycle once and hang every topic on it: create, store, use, share, archive, destroy.
2. Make a small table of data roles with one example each from your own workplace. In an Indian bank, for instance, the head of retail lending might own customer loan data while the IT operations team is its custodian.
3. Learn the destruction methods as a ladder from weakest to strongest, and which media each one suits.
4. Pair this domain with Domain 1 (risk and privacy law) and Domain 7 (media management in operations).
5. From 15 April 2027 the outline names cloud data protection methods such as CASB and CNAPP under 2.6; see what changes in 2027.

Worked example: thinking it through

Our own illustration, not an exam item.

The situation. A project team in Hyderabad copies a full production customer table into a test environment so that user testing can start on Monday. The test environment has looser access controls. As the security manager, what is your best response?

• Let it run, since the test environment is internal.
• Delete the copy immediately and report the team.
• Ask the data owner to confirm handling rules, and replace the copy with masked or synthetic data that meets them.
• Add encryption to the test database and move on.

The reasoning. Copies carry the classification of the original, so "it is internal" does not lower the protection required. Deleting the copy and reporting the team solves today's problem but not the process gap, and it ignores the owner. Encryption helps with one threat but leaves testers with access to real personal data they do not need. Going back to the owner's rules and minimising the data, by masking or using synthetic records, protects the data and lets the testing continue. That pairing of ownership and minimisation is the heart of this domain.

Next steps

Compare this domain's weight with the rest on the domains overview, then work through our own practice questions on data roles and handling.