The CISSP Field Guide.

The test is adaptive. It gets harder when you answer correctly, and it can stop at any point after question 100 once it's confident you passed or failed. You can't skip a question or go back to one.

What changed in 2026

AI vocabulary you need for the 2026 lens

For context only (not confirmed exam scope): NIST AI RMF (Govern, Map, Measure, Manage), ISO/IEC 42001 (AI management system), and the EU AI Act.

Think like the exam

Core principles

The triad is extended by authenticity (it's genuine), non-repudiation (you can't deny you did it, usually proven with a digital signature), and privacy.

Governance and the policy stack

Risk management

Risk is a threat exploiting a vulnerability, weighted by likelihood and impact. An asset is anything of value. An exposure is a moment when an asset is open to loss.

Worked example: a $200,000 asset with an EF of 25% gives an SLE of $50,000. With an ARO of 0.2 (once every 5 years), the ALE is $10,000. A control that costs more than that each year doesn't pay for itself.

Residual risk is what's left after controls. Total risk is the risk before controls. Management decides whether the residual risk falls within risk appetite.

Control types

By category, controls are administrative (managerial), technical (logical), or physical.

Frameworks to recognize

• NIST CSF 2.0 (2024): Govern, Identify, Protect, Detect, Respond, Recover. Govern is the new function.
• NIST RMF (SP 800-37): Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor.
• ISO/IEC 27001 is the certifiable management system (ISMS). 27002 is the control guidance.
• COBIT covers IT governance. ITIL covers IT service management. SABSA is business-driven security architecture. Zachman is an enterprise architecture matrix.

Threat modeling

Other methods: PASTA (a seven-stage, risk-centric process) and DREAD (scores threats by damage, reproducibility, exploitability, affected users, and discoverability).

Law, IP and privacy

• GDPR: notify the supervisory authority within 72 hours of a breach. The controller decides why and how data is processed. The processor handles it for them.
• HIPAA covers health data. SOX covers financial reporting. GLBA covers financial institutions. PCI DSS is a contractual industry standard, not a law.
• Kinds of law: criminal (prison, beyond reasonable doubt), civil (damages, preponderance of evidence), and administrative/regulatory.

Business continuity

• BIA (business impact analysis) comes first. It finds critical processes and sets MTD, RTO and RPO.
• BCP keeps the business running (strategic, organization-wide). DRP restores IT after a disaster (tactical, a subset of the BCP).
• Senior management must approve and sponsor the BCP.

People and the supply chain

• Personnel controls: separation of duties, job rotation, mandatory vacation (catches fraud), NDAs, background checks, formal offboarding.
• Awareness changes behavior for everyone. Training builds job skills. Education builds deep, long-term understanding.
• Supply chain: assess vendors, set SLAs, keep a right to audit, and ask for an SBOM.

ISC2 Code of Ethics: the canons, in priority order

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.

When two canons conflict, the higher one wins.

Data roles

Classification

Classify according to the damage that disclosure would cause. Classification drives handling, labeling, storage and destruction rules.

Data lifecycle and states

Create → Store → Use → Share → Archive → Destroy

Removing data for good (NIST SP 800-88)

Data remanence is the data left behind after deletion. Crypto-erase (destroying the encryption key) works well in the cloud and on SSDs.

Protecting data in practice

• Scoping means picking the baseline controls that apply. Tailoring means adjusting them to fit your mission.
• DLP stops data leaving. DRM controls use after it's shared. A CASB gives visibility and control over cloud apps.
• De-identification methods: masking (hide parts), tokenization (swap the data for a token stored in a vault), pseudonymization (reversible with a key), and anonymization (irreversible).
• Retention: keep data only as long as law and business need require. Keeping it longer adds liability.

Secure design principles

Least privilege · Defense in depth · Secure defaults · Fail securely · Separation of duties · Keep it simple · Zero trust ("never trust, always verify") · Trust but verify · Privacy by design · Shared responsibility

Security models

Evaluating products: Common Criteria (ISO/IEC 15408)

A Protection Profile states what the customer needs. A Security Target states what the vendor claims. The TOE (target of evaluation) is the product being tested. Assurance runs from EAL1 (functionally tested) to EAL7 (formally verified design and tested). EAL4 (methodically designed, tested, and reviewed) is the common commercial target.

System weak points

• TOCTOU (time of check to time of use) is a race condition between checking a resource and using it.
• Covert channels are hidden communication paths. A storage channel writes to a shared resource. A timing channel modulates resource use over time.
• Aggregation combines low-sensitivity facts into something sensitive. Inference deduces hidden facts from what's visible.
• Emanations are electromagnetic leakage. TEMPEST shielding counters them.
• Maintenance hooks and backdoors: remove them before production.

Hardware roots of trust: a TPM (chip on the board that stores keys and supports secure and measured boot), an HSM (dedicated device for managing keys), and a TEE (isolated execution area on the processor). Protection rings: ring 0 is the kernel, ring 3 is user applications.

Cloud and virtualization

You always own your data and its accountability. Type 1 hypervisors run on bare metal. Type 2 run on a host OS. VM escape (breaking out of a guest into the host) is the major virtualization risk. Also know ICS/SCADA (availability and safety come first), IoT, embedded systems, containers, and serverless.

Cryptography

• Hashing is one-way and fixed-length. Use SHA-2 or SHA-3. MD5 and SHA-1 are broken. Salting defeats rainbow tables.
• Modes: ECB leaks patterns (avoid it). CBC chains blocks. CTR turns a block cipher into a stream. GCM adds authentication (AEAD).
• PKI: the CA issues X.509 certificates, the RA verifies identity, and revocation is checked through a CRL or OCSP (OCSP stapling).
• Attacks: brute force, birthday (hash collisions), known- and chosen-plaintext, side-channel (timing, power), and meet-in-the-middle (why 2DES adds almost nothing).
• Post-quantum: NIST published FIPS 203 (ML-KEM), 204 (ML-DSA) and 205 (SLH-DSA) in 2024. Quantum computing mainly threatens RSA and ECC. "Harvest now, decrypt later" is the reason to migrate early.

Physical security

• Sprinklers: wet pipe (always full of water), dry pipe (for freezing areas), pre-action (best choice for data centers, because it needs two triggers), and deluge (all heads open at once).
• Fence height: 3–4 ft deters casual trespassers. 6–7 ft is hard to climb. 8 ft with barbed wire deters determined intruders.
• Power problems: fault (a short loss), blackout (a long loss), sag (short low voltage), brownout (long low voltage), spike (short high voltage), surge (long high voltage).
• CPTED (crime prevention through environmental design): natural surveillance, natural access control, territorial reinforcement.

OSI model: layers, attacks and controls

The TCP/IP model has four layers: Application (OSI 5–7), Transport (4), Internet (3), and Network Access (1–2). The TCP handshake is SYN → SYN-ACK → ACK.

Ports to know

Secure channels

• IPsec: AH provides integrity and authentication but no encryption. ESP adds confidentiality. Transport mode protects the payload only (host to host). Tunnel mode wraps the whole packet (gateway to gateway VPN). IKE negotiates the security associations (SAs).
• TLS 1.3 is the current standard. SSL and early TLS versions are deprecated.
• Wireless: WEP is broken. WPA2 uses AES-CCMP. WPA3 uses SAE, which resists offline dictionary attacks. Enterprise Wi-Fi uses 802.1X/EAP, and EAP-TLS (certificates on both sides) is the strongest.
• 802.1X roles: supplicant (the device), authenticator (the switch or access point), and authentication server (RADIUS).

Network architecture

• Segmentation: a screened subnet (DMZ) for public-facing servers, VLANs, and micro-segmentation for workload-to-workload traffic.
• Zero trust (NIST SP 800-207): no implicit trust based on location. A policy decision point (PDP) decides, and a policy enforcement point (PEP) enforces, on every request.
• SASE combines networking and security services in the cloud. SDN separates the control plane from the data plane. NAC checks a device's posture before it can join.
• Converged protocols: iSCSI and FCoE (storage over IP and Ethernet), VoIP, and MPLS.

The access chain

Identification (claim an identity) → Authentication (prove it) → Authorization (what you may do) → Accountability (logs tie actions to you).

Multi-factor means factors of different types. A password plus a PIN is still just one factor.

Biometric accuracy

Access control models

Federation and SSO

Identity lifecycle

• Provision → Review → Revoke. Remove access promptly at termination, ideally before or at the moment the person is told.
• Privilege creep is access that piles up as people change roles. Regular access reviews fix it.
• PAM (privileged access management) adds just-in-time (JIT) elevation, password vaulting, and session recording.
• Passwords under NIST SP 800-63B: length beats complexity, check passwords against breach lists, and don't force periodic changes without a reason. FIDO2 / passkeys resist phishing.

Assessment types

Pen test phases: Planning → Discovery → Attack → Reporting. Knowledge levels: full knowledge (white box / known environment), partial (gray box), and zero knowledge (black box / unknown environment).

Testing software

Audits and SOC reports

Type I checks whether controls are designed correctly at one point in time. Type II checks whether they operated effectively over a period (usually 6–12 months), and it's the one you want from a vendor. Audits can be internal, external, or third-party (an independent firm).

Measuring and reporting

• KPIs look back at performance. KRIs look ahead to rising risk.
• SCAP standardizes the formats: CVE (vulnerability IDs), CVSS (severity scores), CCE (configurations), CPE (platforms).
• Log review, account-management reviews, and backup verification (test the restore, not just the backup).
• Write reports for the audience. Executives get risk in business terms. Technical teams get the details to fix.

Incident response

NIST SP 800-61 condenses this to Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity. Rev. 3 (2025) maps incident response to the CSF 2.0 functions.

Investigations and evidence

• Investigation types: administrative (internal), criminal, civil, and regulatory. Each has its own standard of proof.
• Chain of custody records who handled evidence, when, and why. Without it, evidence may not be accepted in court.
• Admissible evidence must be relevant, material and competent (legally obtained).
• Evidence types: real (physical), documentary, and testimonial. The best evidence rule prefers originals. The parol evidence rule says a written contract is the whole agreement. Hearsay is generally inadmissible.
• Order of volatility (collect first to last): CPU registers and cache → RAM → swap and page files → disk → remote logs → archives and backups.
• Work on a forensic copy (bit-for-bit image, verified with a hash), never on the original.

Monitoring and ongoing operations

• SIEM collects and correlates logs. SOAR automates the response. UEBA learns normal behavior and flags anomalies. Threat hunting assumes a breach and searches for it.
• Change management: request → review → approve → test → implement → document. Emergency changes still get documented afterward.
• Patch management: test before deploying, roll out in stages, and verify.
• Operational controls: need to know, least privilege, separation of duties, job rotation, two-person control.

Backups, resilience and recovery sites

DR tests, from least to most disruptive: checklist (read-through) → tabletop (structured walk-through) → simulation → parallel → full interruption.

Development approaches

Security belongs in requirements, from the very first phase. Fixing a flaw costs more the later you find it.

Maturity models

Also know OWASP SAMM (prescriptive: what you should do) and BSIMM (descriptive: what other organizations actually do).

Common flaws and their fixes

Validate input on the server side, since anything the client checks can be bypassed.

Databases

• ACID: Atomicity, Consistency, Isolation, Durability.
• Polyinstantiation keeps different versions of a record at different classification levels to block inference.
• Views limit what users see. Watch for aggregation and inference attacks.

Code you don't write yourself

• SCA (software composition analysis) finds vulnerable open-source components. An SBOM lists every ingredient.
• Code signing proves who wrote the code and that it hasn't been altered. Protect code repositories and pipeline secrets.
• For third-party software and APIs: assess the vendor, put security requirements in the contract, and test what you receive.

Tap a card to flip it. Use the arrow keys to move and the space bar to flip.