CISSP Domain 3: Security Architecture and Engineering explained

Domain 3 at a glance

The subdomains in plain words

1. 3.1 Secure design principles: defence in depth, secure defaults, failing securely, simplicity, least privilege and zero trust.
2. 3.2 Security models: Bell-LaPadula, Biba, Clark-Wilson and friends, plus the trusted computing base and reference monitor.
3. 3.3 Choosing controls from requirements: evaluation criteria and the authorisation to operate.
4. 3.4 System security capabilities: memory protection, secure and measured boot, virtualisation, TPMs and HSMs.
5. 3.5 Vulnerabilities in architectures: client, server, industrial control, distributed, IoT, cloud and modern application designs.
6. 3.6 Cryptographic solutions: symmetric and asymmetric algorithms, hashing, signatures and public key infrastructure.
7. 3.7 Cryptanalytic and related attacks: how attackers defeat cryptography and credentials.
8. 3.8 Secure site and facility design: site selection, crime prevention through environmental design and the order of physical controls.
9. 3.9 Site and facility controls: server rooms, media storage, power, environment and fire.
10. 3.10 The information system lifecycle: stages from need to disposal, verification and validation.

What the exam tends to test

• Design over bolt-on. The best time to add security is early, in requirements and design.
• Purpose of a mechanism. Which key encrypts and which signs; what a hash proves and what it does not; what a model protects (confidentiality or integrity).
• Fit for the environment. Industrial control systems put availability first; distributed systems are judged by how they connect.
• People first in physical security. Life safety beats asset protection, every time.
• Accountability for risk. A senior authorising official accepts residual risk; technical staff assess it.

Common traps

• Mixing up model properties. Bell-LaPadula is about confidentiality; Biba and Clark-Wilson are about integrity. Read whether the rule governs reading or writing.
• Thinking measured boot blocks anything. Secure boot prevents untrusted code; measured boot only records what loaded.
• Treating evaluation levels as absolute security. They measure how rigorously a product was evaluated.
• Getting key use backwards. You sign with your private key and others verify with your public key.
• Fail-safe versus fail-secure. Doors on escape routes fail safe to protect people; data systems fail secure to protect information.

How to study it

1. Split the domain into four blocks and study them separately: design and models, system capabilities, cryptography, physical security.
2. For cryptography, learn what each primitive is for before learning key sizes. A one-page grid of "goal, mechanism, key used" covers a lot of questions.
3. For models, draw the arrows (read up, write down and so on) rather than memorising sentences.
4. Link physical security to Domain 7, which runs those controls day to day, and network design to Domain 4.
5. From 15 April 2027 the outline names Zero Trust and SASE under 3.1, quantum computing under 3.5, post-quantum cryptography under 3.6 and AI threats under 3.7. See what changes in 2027.

Worked example: thinking it through

Our own illustration, not an exam item.

The situation. Your company sends a monthly compliance report to a regulator. The regulator wants to be sure each report really came from you and was not altered on the way. Which approach meets that need?

• Encrypt the report with the regulator's public key.
• Hash the report and send the hash in the same email.
• Sign the report with your organisation's private key, so the regulator can verify it with your public key.
• Send the report over TLS.

The reasoning. Encrypting with the regulator's public key keeps the report confidential, but anyone could have done that, so it proves nothing about the sender. A hash sent alongside the file can be replaced by whoever alters the file. TLS protects the report in transit, but not once it is saved and forwarded. A digital signature gives integrity and proof of origin together, and it stays with the document. The pattern to learn is "goal first, then mechanism": name the property the scenario needs before you choose the tool.

Next steps

See how Domain 3 compares on the domains overview, then test the cryptography and model questions in our own practice questions.