2 cissp ® Official Study Guide Eighth Edition

Domain 1: Security and Risk Management
■
1.1 Understand and apply concepts of confidentiality, 
integrity and availability
■
1.2 Evaluate and apply security governance principles
■
1.2.1 Alignment of security function to business strategy, 
goals, mission, and objectives
■
1.2.2 Organizational processes
■
1.2.3 Organizational roles and responsibilities
■
1.2.4 Security control frameworks
■
1.2.5 Due care/due diligence
■
1.6 Develop, document, and implement security policy, 
standards, procedures, and guidelines
■
1.10 Understand and apply threat modeling concepts and 
methodologies
■
1.10.1 Threat modeling methodologies
■
1.10.2 Threat modeling concepts
■
1.11 Apply risk-based management concepts to the
supply chain
■
1.11.1 Risks associated with hardware, software,
and services
■
1.11.2 Third-party assessment and monitoring
■
1.11.3 Minimum security requirements
■
1.11.4 Service-level requirements
Chapter 
1

---

The Security and Risk Management domain of the Common 
Body of Knowledge (CBK) for the CISSP certification exam 
deals with many of the foundational elements of security solu-
tions. These include elements essential to the design, implementation, and administration of 
security mechanisms. Additional elements of this domain are discussed in various chapters: 
Chapter 2, “Personal Security and Risk Management Concepts”; Chapter 3, “Business 
Continuity Planning”; Chapter 4, “Laws, Regulations, and Compliance”; and Chapter 19, 
“Investigations and Ethics.” Please be sure to review all of these chapters to have a com-
plete perspective on the topics of this domain.
Understand and Apply Concepts of 
Confidentiality, Integrity, and Availability
Security management concepts and principles are inherent elements in a security policy and 
solution deployment. They define the basic parameters needed for a secure environment. 
They also define the goals and objectives that both policy designers and system implement-
ers must achieve to create a secure solution. It is important for real-world security profes-
sionals, as well as CISSP exam students, to understand these items thoroughly. This chapter 
includes a range of topics related to the governance of security for global enterprises as well 
as smaller businesses.
Security must start somewhere. Often that somewhere is the list of most important secu-
rity principles. In such a list, confidentiality, integrity, and availability (CIA) are usually 
present because these are typically viewed as the primary goals and objectives of a security 
infrastructure. They are so commonly seen as security essentials that they are referenced by 
the term 
CIA Triad
(see Figure 1.1).
F I G u r e 1.1
The CIA Triad
Confidentiality
Integrity
Availability

---

Understand and Apply Concepts of Confidentiality, Integrity, and Availability 
3
Security controls are typically evaluated on how well they address these three core 
information security tenets. Overall, a complete security solution should adequately address 
each of these tenets. Vulnerabilities and risks are also evaluated based on the threat they 
pose against one or more of the CIA Triad principles. Thus, it is a good idea to be familiar 
with these principles and use them as guidelines for judging all things related to security.
These three principles are considered the most important within the realm of security. 
However important each specific principle is to a specific organization depends on the orga-
nization’s security goals and requirements and on the extent to which the organization’s 
security might be threatened.