CISSP - Certified Information Systems Security Professional

Published weight 16%. Security governance, compliance and legal/regulatory issues, security policies, risk management, threat modeling, business continuity, and security awareness.

• Security and risk management (governance, compliance, risk, BCP, policies, ethics)

Published weight 10%. Information and asset classification and handling, data lifecycle, data roles, retention, and data security controls.

• Asset security (classification, ownership, data lifecycle, handling, retention)

Published weight 13%. Secure design principles, security models, cryptography and PKI, security capabilities of systems, and physical security.

• Security architecture and engineering (secure design, models, cryptography/PKI, physical security)

Published weight 13%. Secure network architecture and design, secure network components, and secure communication channels.

• Communication and network security (secure network design, components, channels)

Published weight 13%. Identity and access provisioning, authentication and authorization mechanisms, federated identity, and access control models.

• Identity and access management (provisioning, authN/authZ, federation, access control models)

Published weight 12%. Assessment and test strategies, security control testing, collecting security process data, and audits.

• Security assessment and testing (test strategies, control testing, audits, metrics)

Published weight 13%. Logging and monitoring, incident management, detective/preventive measures, disaster recovery, and investigations.

• Security operations (logging/monitoring, incident management, DR, investigations)

Published weight 10%. Security in the SDLC, security controls in development environments, software security effectiveness, and secure coding.

• Software development security (secure SDLC, dev-environment controls, secure coding)