ISC2 CISSP study board

Visual study board for ISC2 CISSP: every exam objective on a hand-drawn mind map, 2,120 flashcards and 2,004 practice questions. Free preview, $49.99 one-time.

Exam version: Follows the ISC2 CISSP exam outline effective 15 April 2024.

What you get

• 83 hand-drawn sheets: every exam objective on its own sheet, in reading order
• 2,120 flashcards written from the cards on the map, that come back just before you'd forget
• 2,004 original practice questions, each graded with the answer explained
• A Treemap of every card the flashcards and practice questions cover, painted by the score you have earned on it, so you can see what is left
• Bookmarks and sticky notes, saved to your account
• One payment of $49.99: no subscription, no expiry date

Who it is for

People studying for ISC2 CISSP on their own who learn best by seeing how topics connect, and who want one place to read the map, recall it with flashcards, prove it on practice questions and see their progress on a Treemap.

Who it is not for

It is not a hands-on lab, not a full video course and not a replacement for practising on real equipment or software.

Free preview: what is on the board

• Start here
  • How to use this map
    • Big idea: walk it, then test yourself
    • A study session that sticks
    • Getting around
    • Reading a card
    • What the marks mean
  • The exam at a glance
    • Big idea: study the 2024 outline
    • Where the marks are
    • Exam facts
• Security and Risk Management (16%)
  • 1.1 Professional ethics
    • Big idea: a code of trust, not a law
    • Who can file the ethics complaint?
    • ISC2 Code of Professional Ethics
    • Other codes of ethics
    • Check yourself: ethics
  • 1.2 Security concepts
    • Big idea: name the pillar that broke
    • Which pillar was violated?
    • The CIA Triad
    • The five elements of AAA services
    • Beyond the triad
    • Protection mechanisms
    • Check yourself: security concepts
  • 1.3 Security governance
    • Big idea: the board owns the risk
    • Due diligence or due care?
    • Aligning security with the business
    • Organizational processes
    • Security roles
    • Security control frameworks
    • Due diligence
    • Due care
    • Check yourself: governance
  • 1.4.1-3 Cybercrime, IP and export
  • 1.4.4-6 Privacy and compliance
  • 1.5 Investigation types
  • 1.6 Security policy documents
  • 1.7 Business Continuity Requirements
  • 1.8 Personnel Security
  • 1.9.1-3 Risk Analysis and Response
  • 1.9.4-9 Controls and Risk Frameworks
  • 1.10 Threat Modeling
  • 1.11 Supply Chain Risk Management
  • 1.12 Security Awareness and Training
• Asset Security (10%)
  • 2.1 Identify and classify assets
  • 2.2 Handling requirements
  • 2.3 Provision assets securely
  • 2.4.1-4 Data roles, collection, upkeep
  • 2.4.5-7 Retention, remanence, destruction
  • 2.5 Asset retention (EOL, EOS)
  • 2.6.1-3 States, baselines, standards
  • 2.6.4 Data protection methods
• Security Architecture and Engineering (13%)
  • 3.1.1-6 Secure design principles
  • 3.1.7-11 Zero trust, privacy, SASE
  • 3.2 Security Models
  • 3.3 Controls From System Requirements
  • 3.4 Security Capabilities of IS
  • 3.5.1-7 Clients to cloud
  • 3.5.8-15 IoT to virtualization
  • 3.6.1-2 Crypto life cycle and methods
  • 3.6.3-5 PKI, keys and signatures
  • 3.7 Cryptanalytic attacks
  • 3.8 Site and facility design
  • 3.9.1-5 Secure rooms and work areas
  • 3.9.6-7 HVAC, utilities and environment
  • 3.9.8-9 Fire and power
  • 3.10 Information system lifecycle
• Communication and Network Security (13%)
  • 4.1.1-5 Models and protocols
  • 4.1.6-12 Architecture and segmentation
  • 4.1.13-18 Wireless, cloud and SDN
  • 4.2.1-2 Infrastructure and media
  • 4.2.3-4 NAC and endpoint security
  • 4.3.1-2 Voice and remote access
  • 4.3.3-4 WAN links and third parties
• Identity and Access Management (13%)
  • 5.1 Physical and logical access
  • 5.2.1-2 Authentication and AAA
  • 5.2.3-8 Proofing, sessions and SSO
  • 5.3 Federation with third parties
  • 5.4.1-6 Access control models
  • 5.4.7 Policy enforcement
  • 5.5 Identity and access lifecycle
  • 5.6 Authentication systems
• Security Assessment and Testing (12%)
  • 6.1 Assessment and Audit Strategy
  • 6.2.1-4 Scans, Pen Tests and Logs
  • 6.2.5-10 Software and Control Testing
  • 6.3 Collect Security Process Data
  • 6.4 Analyze Results and Report
  • 6.5 Security Audits
• Security Operations (13%)
  • 7.1 Investigations
  • 7.2 Logging and monitoring
  • 7.3 Configuration management
  • 7.4 Foundational security operations
  • 7.5 Resource protection
  • 7.6 Incident management
  • 7.7 Detection and preventive measures
  • 7.8 Patch and vulnerability management
  • 7.9 Change management
  • 7.10.1 Backup storage strategies
  • 7.10.2-3 Recovery sites
  • 7.10.4 Resilience and high availability
  • 7.11 Disaster recovery processes
  • 7.12 Testing the DR plan
  • 7.13 Business continuity planning
  • 7.14 Physical security operations
  • 7.15 Personnel safety and security
• Software Development Security (10%)
  • 8.1 Security in the SDLC
  • 8.2 Development ecosystem controls
  • 8.3 Software security effectiveness
  • 8.4 Acquired software
  • 8.5.1 Source-code weaknesses
  • 8.5.2-4 Secure coding and APIs

Sample flashcard

Under the ISC2 Code of Ethics, who may file a complaint about a breach of Canon I or Canon II?

Any member of the public, since those canons protect society and require honorable, legal conduct. The complainant must still have been injured by the behavior.

Sample practice question

Priya, a CISSP working as a contract penetration tester, finds evidence during an engagement that her client is quietly selling customer location data in breach of its own published privacy notice. Her contract says nothing about reporting such findings. Which canon of the ISC2 Code of Professional Ethics should carry the most weight in deciding what she does next?

• A. The duty to strengthen and defend the security profession
• B. The duty to serve her client with care and skill
• C. The duty to safeguard the public and its trust
• D. The duty to behave with honor and within the law

Answer: C. The canons are applied in order of precedence, and protecting society and public trust comes first, so the harm to the public outweighs her duty to the client. Acting honorably and legally is the second canon and matters here, but it ranks below the first. Service to principals is the third canon and cannot justify concealing harm to the public. Advancing the profession is the fourth and lowest-ranked canon.

Questions

Do I download the ISC2 CISSP board?

No. Boards open on the website in your browser, on a computer or a phone, once you sign in. Your flashcard progress, bookmarks and test results are saved to your account.

How long do I keep access?

It is a one-time purchase with no subscription and no expiry date.

Can I try it before I buy?

Yes. Every board has a free preview: the introduction, the first three sheets of the first domain and ten sample questions, with no account needed.

What if the exam changes?

This board follows one exam version (CISSP). Check that it matches the exam you are booking before you buy.

What is the refund policy?

You can ask for a refund within 7 days of buying, with no reason needed. Details are in the Refund Policy.

ISC2 CISSP · All study boards · About

Terms · Privacy · Refunds · Contact

BoardITGuy is not affiliated with or endorsed by ISC2, ISACA, Cisco, CompTIA or Amazon Web Services. Product names are trademarks of their owners and are used only to say which exam a board is for.