CISSP Certification Training (ISC²)
0% Completed
M1 — Domain 1: Security and Risk Management
Confidentiality, integrity and availability as competing demands
Reading
Security governance: policies, standards, procedures and guidelines
Reading
Regulatory, contractual and legal issues, including DPDP for India
Reading
Risk: identification, analysis, treatment, transfer and acceptance
Reading
Professional ethics and why ISC² scores it separately
Reading
Business continuity principles and the risk register
Reading
M2 — Domain 2: Asset Security
Data ownership, stewardship, custodianship and controllership
Reading
Classification schemes and the handling rules they trigger
Reading
Data lifecycle: creation through to destruction and disposition
Reading
Scoping and tailoring a control set to the actual environment
Reading
Retention, crypto-shredding and defensible deletion
Reading
Asset inventory as a control rather than a spreadsheet
Reading
M3 — Domain 3: Security Architecture and Engineering
Security models: Bell-LaPadula, Biba, Clark-Wilson and their intent
Reading
Vulnerabilities of the OS, firmware and hardware security features
Reading
Cryptography in depth: symmetric, asymmetric, hashing and PKI
Reading
Site and facility design: the physical security layer
Reading
Vulnerability assessment of a designed architecture
Reading
Selected and engineered controls versus default ones
Reading
M4 — Domain 4: Communication and Network Security
OSI and TCP/IP models as an incident debugging tool
Reading
Secure protocols, and which of the familiar ones are not
Reading
Network attacks: on-path, DNS, ARP, DoS and their mitigations
Reading
Segmentation, zero trust and micro-segmentation as design choices
Reading
Secure communications across cloud, on-premise and remote access
Reading
Mobile and IoT connectivity and their weaker edges
Reading
M5 — Domain 5: Identity and Access Management
Identification, authentication and authorization as distinct steps
Reading
Authentication factors, federation and single sign-on patterns
Reading
Authorization models: RBAC, ABAC, rule-based and MAC
Reading
Privileged access management and just-in-time elevation
Reading
Identity lifecycle: joiner, mover, leaver and orphaned accounts
Reading
Access review, attestation and the evidence an auditor wants
Reading
M6 — Domain 6: Security Assessment and Testing
Internal, external and third-party assessment types
Reading
Vulnerability scanning versus penetration testing and scope
Reading
Audit process, findings classification and remediation tracking
Reading
Security control testing: penetration, synthetic and log review
Reading
Validating that a control works rather than exists
Reading
Reporting findings so that they are acted on
Reading
M7 — Domain 7: Security Operations
Investigations: evidence, chain of custody and interview discipline
Reading
Incident response lifecycle and resource management
Reading
Logging, monitoring and the detection that survives scrutiny
Reading
Patch, vulnerability and change management in a live estate
Reading
Resource availability: resilience, redundancy and failover
Reading
Database and application security in operation
Reading
M8 — Domain 8: Security in the Software Development Lifecycle
Security in requirements, design, code, test and deployment
Reading
Maturity models and what they actually measure
Reading
Secure coding practices and the failure classes that recur
Reading
Database application security, ORM and injection defence
Reading
Third-party libraries, software supply chain and SBOMs
Reading
Assessment methods: code review, SAST, DAST and threat modelling
Reading
📞
Enroll Now
Start Your Journey
Fill in your details and our team will get back to you within 24 hours