CISSP Domain 1: Security and Risk Management explained

Domain 1 at a glance

The subdomains in plain words

1. 1.1 Professional ethics: the ISC2 Code of Ethics, its canons in order, and how to act when duties conflict.
2. 1.2 Core security concepts: confidentiality, integrity and availability, plus authenticity and nonrepudiation.
3. 1.3 Governance principles: aligning security with the business, roles, frameworks, due diligence and due care.
4. 1.4 Law, regulation and compliance: kinds of law, computer crime, intellectual property, export controls and privacy rules such as India's DPDP Act or the GDPR.
5. 1.5 Investigations: types of investigation and the standard of proof each needs.
6. 1.6 Policy documents: policies, standards, baselines, procedures and guidelines, and who approves what.
7. 1.7 Business continuity requirements: scoping the plan and running the business impact analysis.
8. 1.8 Personnel security: hiring, onboarding, transfers, termination and third-party staff.
9. 1.9 Risk management: vocabulary, assessment, responses, control selection and reporting.
10. 1.10 Threat modelling: finding and ranking threats during design.
11. 1.11 Supply chain risk: what can go wrong with suppliers and how to assess them.
12. 1.12 Awareness, training and education: building a programme and measuring whether it changes behaviour.

What the exam tends to test

This domain is where the manager's lens is most visible. Expect scenarios in which several answers are technically sound and only one fits the role you are given.

• Who owns the decision. Senior management owns risk and approves policy; security professionals advise and implement.
• Process before product. Governance, policy and a risk assessment come before buying a control.
• Life safety first. In continuity and personnel scenarios, people outrank assets.
• Ethics in order. When canons conflict, the higher one wins, and the transparent, escalated answer beats the convenient one.
• Proportion. A control should not cost more than the risk it reduces.

Common traps

• Picking the most technical answer. In Domain 1 the right answer is usually a governance step, not a tool.
• Mixing up due diligence and due care. Due diligence is knowing and planning; due care is doing what a reasonable person would.
• Treating "ignore the risk" as acceptance. Accepting risk is a documented management decision; ignoring it is never right.
• Confusing RTO, RPO and the maximum tolerable downtime. The recovery time must sit inside the maximum tolerable downtime; RPO is about data loss.
• Reading a guideline as mandatory. Of the policy documents, only guidelines are optional.

How to study it

1. Start here, not at the end. Domain 1 sets the vocabulary every other domain uses.
2. Learn the frameworks by purpose, not by clause number.
3. Do the risk formulas by hand until single and annual loss expectancy feel routine.
4. For each topic, ask "who decides, and what do they need from me?" Our think like a manager guide trains that question.
5. Mix in Domain 7, which runs the continuity and investigation work this domain plans.

Worked example: thinking it through

Our own illustration, not an exam item.

The situation. You lead security at a fintech in Pune. The product head wants to launch a lending app in two weeks. You learn that customer data will sit with a cloud vendor nobody has assessed. What should you do first?

• Block the launch until the vendor is fully audited.
• Encrypt the data and let the launch go ahead.
• Assess the vendor risk quickly and present it, with options, to the business owner for a decision.
• Accept the risk yourself, since the deadline is fixed.

The reasoning. Blocking the launch oversteps your role: security advises, the business decides. Encryption may well be part of the answer, but choosing a control before you understand the risk skips a step. Accepting the risk yourself is wrong for the same reason as blocking: it is not your risk to own. The third option makes the risk visible to the person accountable for it, with choices and costs, which is exactly how Domain 1 expects a security leader to act.

Next steps

Check the weights against the other domains on the domains overview, see what the 2027 outline renames, then test this domain with our own practice questions.