2 cissp ® Official Study Guide Eighth Edition

48
Chapter 1 
■
Security Governance Through Principles and Policies
19.
Which commercial business/private sector data classification is used to control information 
about individuals within an organization?
A.
Confidential
B.
Private
C.
Sensitive
D.
Proprietary
20.
Data classifications are used to focus security controls over all but which of the following?
A.
Storage
B.
Processing
C.
Layering
D.
Transfer

---

Chapter 
2
Personnel Security 
and Risk Management 
Concepts
The CISSP exaM ToPICS CoveRed In 
ThIS ChaPTeR InClude:
✓
Domain 1: Security and Risk Management
■
1.8 Contribute to and enforce personnel security policies
and procedures
■
1.8.1 Candidate screening and hiring
■
1.8.2 Employment agreements and policies
■
1.8.3 Onboarding and termination processes
■
1.8.4 Vendor, consultant, and contractor agreements
and controls
■
1.8.5 Compliance policy requirements
■
1.8.6 Privacy policy requirements
■
1.9 Understand and apply risk management concepts
■
1.9.1 Identify threats and vulnerabilities
■
1.9.2 Risk assessment/analysis
■
1.9.3 Risk response
■
1.9.4 Countermeasure selection and implementation
■
1.9.5 Applicable types of controls (e.g., preventive,
detective, corrective)
■
1.9.6 Security Control Assessment (SCA)
■
1.9.7 Monitoring and measurement
■
1.9.8 Asset valuation
■
1.9.9 Reporting
■
1.9.10 Continuous improvement
■
1.9.11 Risk frameworks

---

■
1.12 Establish and maintain a security awareness, education, 
and training program
■
1.12.1 Methods and techniques to present awareness
and training
■
1.12.2 Periodic content reviews
■
1.12.3 Program effectiveness evaluation
✓