Certified Information Systems Security Professional

Understand, adhere to, and promote professional ethics (ISC² Code of Ethics).

Understand and apply security concepts (confidentiality, integrity, availability, authenticity, non-repudiation).

Evaluate and apply security governance principles (alignment with organizational goals, legal/regulatory compliance).

Manage the information security function (security policies, standards, procedures, guidelines).

Develop, document, and implement a security policy based on risk assessment findings.

Implement threat intelligence in risk management and business continuity planning.

Identify and classify information and assets according to data classification policies.

Establish information and asset handling requirements throughout the data lifecycle.

Manage data lifecycle (collection, location, maintenance, retention, remanence, destruction).

Ensure appropriate retention and destruction of assets based on compliance requirements.

Research, implement, and manage engineering processes using secure design principles.

Understand the fundamental concepts of security models (BLP, Biba, Clark-Wilson, Brewer-Nash).

Select controls based on system security requirements and evaluate security capabilities.

Assess and mitigate vulnerabilities in security architectures, designs, and solution elements.

Apply cryptography concepts (symmetric, asymmetric, hashing, PKI, digital signatures, blockchain).

Assess and implement secure design principles for network architectures (OSI/TCP-IP model).

Secure network components (firewalls, IDS/IPS, proxies, load balancers, wireless, VPN).

Implement secure communication channels according to design (voice, multimedia, remote access).

Control physical and logical access to assets using authentication and authorization mechanisms.

Manage identification and authentication of people, devices, and services (MFA, biometrics, SSO, SAML, OAuth).

Federated identity with a third-party service (on-premise, cloud, hybrid).

Implement and manage authorization mechanisms (RBAC, ABAC, MAC, DAC, rule-based).

Manage the identity and access provisioning lifecycle (account reviews, privileged access).

Design and validate assessment, test, and audit strategies.

Conduct security control testing (vulnerability assessments, penetration testing, log reviews).

Collect security process data (technical, administrative, management controls).

Analyze test output and generate reports for stakeholders.

Understand and support investigations and forensic analysis requirements.

Conduct logging and monitoring activities (IDS/IPS, SIEM, egress monitoring, threat intelligence).

Perform configuration management and apply patch management processes.

Implement and support incident management and disaster recovery plans.

Implement and manage detective and preventive measures (whitelisting, sandboxing, honeypots).

Understand and integrate security in the Software Development Life Cycle (SDLC).

Identify and apply security controls in software development ecosystems (APIs, CI/CD, third-party libraries).

Assess the effectiveness of software security (code review, security testing, fuzzing, SAST/DAST).

Assess security impact of acquired software (COTS, open source, third-party, managed services).