Most engineers think…
Domain 1 is the "easy theory domain" you can skim because it has no technical depth.
It is the single heaviest domain (16%, the largest of eight) and ISC2 writes it at manager altitude: questions reward the business-aligned, risk-treatment answer over the technically "correct" one. Skim it and you misread the framing of every other domain.
Welcome to the cornerstone of the CISSP. Domain 1: Security and Risk Management carries 16% of the exam, the heaviest of the eight domains, and ISC2 writes it from a manager's chair, not an engineer's keyboard. This deep-dive walks four pillars: the CIA triad with governance and the ISC2 Code of Ethics; risk management with quantitative and qualitative analysis; compliance and privacy law including India's DPDP Act 2023 and GDPR; and continuity, threats, and security awareness. We close with the AI angle: how generative AI reshapes risk treatment, data-governance, and supply-chain risk. Master this and the other seven domains become applications of principles you already own, the way real security leaders are paid to think on the job.
Domain 1 at a glance
Flip each card for the one-line essence of each area before you dive in.
Five pillars = CIA + authenticity + non-repudiation; owners classify, custodians implement.
ALE = SLE × ARO turns risk into rupees that justify avoid, transfer, mitigate, or accept.
Regulatory = law; contractual (PCI-DSS) = signed standard; due diligence checks, due care acts.
RTO + WRT must stay within MTD; RPO is data loss, STRIDE finds threats, DREAD ranks them.
CIA, governance & ethics
Think of a bank vault: the cash inside, the locked door, and the manager who decides who gets a key. Security starts with the same three ideas, now expanded to five pillars in the 2024 ISC2 outline. Confidentiality keeps secrets from the wrong eyes, integrity stops silent tampering, and availability keeps the door open for authorised users. The 2024 refresh adds two more: authenticity (the message and sender are genuinely who they claim) and non-repudiation (the actor cannot later deny the action). Digital signatures deliver both authenticity and non-repudiation at once.
Security governance is the steering wheel, not the engine. It flows down from the organisation's mission, goals and objectives, so security decisions serve the business rather than fight it. Governance also enforces the ISC2 Code of Ethics four canons, listed in strict precedence so conflicts resolve top-down: (1) protect society and infrastructure, (2) act honourably and legally, (3) serve principals diligently, (4) advance and protect the profession.
Governance is then written down as a hierarchy. The policy is the high-level mandatory intent signed by management. Standards make it specific and mandatory (use AES-256). Procedures give the step-by-step how-to. Baselines set the minimum acceptable configuration. Guidelines are the only optional, recommended layer.
Roles separate accountability from labour. The mission/senior owner holds ultimate accountability and accepts residual risk. The data owner classifies the data and sets handling rules. The data custodian (often IT) just implements those controls daily — backups, patching, access lists.
If a document is mandatory and detailed it is a standard or procedure; if it is optional and merely advisory, it is a guideline. The word "should" usually signals a guideline; "must/shall" signals policy or standard.
Ananya at HDFC faces this
An auditor asks who is accountable if mis-classified customer KYC data leaks, and the IT team points to itself.
The team confused custodian with owner. IT runs the controls, but it never owned the classification decision for KYC records.
Name the business data owner who classifies the data; IT remains custodian. The senior owner formally accepts any residual risk.
During CISSP study, Karthik lists the five pillars of information security from the 2024 ISC2 outline. Which option correctly names the two pillars added to the classic CIA triad?
Pause & Predict
In one line, what is the single most important idea in "CIA, governance & ethics"? Type your guess.
Risk management
Think of risk management like a Mumbai monsoon plan — you cannot stop the rain, so you decide which drains to clear, which roads to avoid, and which losses to simply budget for. CISSP treats risk management as a continuous lifecycle, not a one-time audit. The loop runs: identify assets and threats, assess risk, treat it, then monitor and repeat.
Frameworks give that loop structure. NIST SP 800-37 RMF drives federal system authorization and added a "Prepare" step in Revision 2. ISO 27005 is the assessment companion you pick when chasing ISO 27001 certification. FAIR is the model you choose when the board wants risk stated in rupees, not "High/Medium/Low".
That distinction is the qualitative-versus-quantitative split. Qualitative analysis ranks risks subjectively using scales and techniques like the Delphi method (anonymous expert consensus). Quantitative analysis attaches real money. The core math chains three values: SLE = Asset Value × Exposure Factor, then ALE = SLE × ARO. So a Rs 100,00,000 database with a 30% exposure factor gives an SLE of Rs 30,00,000; if the breach hits twice a year (ARO = 2), the ALE is Rs 60,00,000 — your annual loss budget.
On the 2024 outline, cyber insurance is the canonical example of risk transfer, and buying a control is mitigation. Never call insurance "avoidance".
ALE then drives the four treatments. Avoid drops the risky activity entirely. Transfer shifts financial impact to a third party (insurance, outsourcing). Mitigate applies controls to lower likelihood or impact. Accept formally signs off on a risk the business can tolerate. Whatever leftover remains after controls is residual risk — and the data owner, not the security team, accepts it.
Priya at HDFC faces this
Leadership asks whether to spend Rs 40,00,000 on a WAF when the team only has "High risk" on a heat map.
A purely qualitative rating gives no rupee figure to justify the spend against expected loss.
Run a quantitative pass: compute ALE before and after the WAF; if the ALE drop exceeds Rs 40,00,000 yearly, mitigation is cost-justified.
A Bengaluru fintech values a payments server at Rs 50,00,000. A ransomware event would destroy 40% of its value, and threat intel estimates it strikes 0.5 times per year. What is the ALE the CFO should budget?
▶ The risk management lifecycle
Press Play to step through it, then Break it to see how it fails.
Compliance & privacy law
Think of compliance law as the traffic rules for personal data: break them and you pay a fine, but follow them and everyone moves safely. CISSP Domain 1 expects you to separate three obligation types. Regulatory requirements come from governments and carry legal force — GDPR, India's DPDP Act, HIPAA. Contractual requirements come from agreements you signed — PCI-DSS is industry-contractual, not a law. Due care means doing what a reasonable person would do to protect data; due diligence means the ongoing investigation that proves you keep checking. Due diligence is the homework; due care is acting on it.
Know each framework's scope. GDPR protects EU residents' personal data globally, granting rights like access, erasure, and portability, with fines up to 4% of global turnover. HIPAA guards US PHI and forces business-associate contracts down the supply chain. India's DPDP Act 2023, operationalised by the DPDP Rules 2025, calls you a Data Fiduciary, the user a Data Principal, and demands free, specific, informed consent. Substantive provisions phase in by May 2027; Significant Data Fiduciaries face annual DPIAs and a mandatory DPO.
Privacy by Design means data minimisation and default protection are engineered in, not patched on. Always limit collection to PII you genuinely need.
Exam writers love making PCI-DSS look like a law. It is a contractual standard enforced by card brands — non-compliance triggers fines and lost merchant rights, not arrest.
Priya at HDFC faces this
A new lending app stores every customer's full Aadhaar and salary slip "in case we need it later," with no deletion schedule.
The team ignored DPDP purpose limitation and data minimisation, collecting PII beyond the stated lending purpose.
Apply Privacy by Design: collect only fields the loan needs, set retention/erasure timelines, and document consent as the lawful basis.
Karthik, a security lead at a Bengaluru fintech, is told the company must comply with PCI-DSS because it stores cardholder data. A junior engineer argues they can ignore it since 'it isn't an Indian law.' What is the most accurate response Karthik should give?
Pause & Predict
Without scrolling up: name the biggest difference in "Qualitative vs Quantitative risk". Type your guess.
Continuity, threats & awareness
Think of business continuity like a hospital's backup generator: when the mains fail, surgery cannot pause for hours. Business Continuity Planning (BCP) is the high-level strategy that keeps critical functions alive during disruption, while Disaster Recovery Planning (DRP) is the technical subset that restores IT systems. The heart of both is the Business Impact Analysis (BIA). The BIA ranks each process by impact and sets four exam-critical metrics. MTD (Maximum Tolerable Downtime) is the longest a function can stay dead before the business is severely harmed. RTO (Recovery Time Objective) is your target to get the system technically back up. WRT (Work Recovery Time) is the extra time to clear backlogs and validate data before going live. The golden rule: RTO + WRT must be less than or equal to MTD. Separately, RPO (Recovery Point Objective) measures acceptable data loss in time — a 15-minute RPO means backups every 15 minutes.
RPO points backward (how much data you can lose); RTO points forward (how long to recover). If a question says "no more than one hour of transactions lost," that is RPO, not RTO.
Threats must be found before they are mitigated. Threat modeling does this proactively. STRIDE (Microsoft, 1999) enumerates six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Attack trees map an attacker's goal at the root and branch downward into the steps and conditions needed to reach it. Remember STRIDE finds threats; DREAD only ranks already-found threats. The 2024 outline also stresses supply-chain and third-party risk (SCRM): your security is only as strong as your weakest vendor. Use SLAs, right-to-audit clauses, fourth-party (sub-supplier) review, and minimum security requirements in contracts. Finally, security awareness, training and education must be ongoing, role-based, and measurable — phishing simulations, security champions, and gamification beat one-time annual videos.
Sneha at HDFC faces this
The board set a 4-hour MTD for the loan-processing app, but her DR runbook shows RTO 3 hours plus WRT 2 hours.
RTO (3h) + WRT (2h) = 5h exceeds the 4h MTD, so the recovery design fails the BIA requirement.
Shorten RTO or WRT — add warm-site replication or pre-staged data — until RTO + WRT is at or under 4 hours.
A Pune fintech's BIA sets the payments gateway MTD at 6 hours. The DR team reports RTO of 4 hours and WRT of 3 hours. As the security lead reviewing this design, what is the correct conclusion?
Domain 1 in the AI era (2026)
CISSP Domain 1 is about managing risk to acceptable levels — and in 2025/2026 the fastest-growing risk on most enterprise registers is AI itself. As a security and risk leader you no longer just buy AI; you must govern it across its lifecycle. Three frameworks now anchor that work, and a Domain-1 professional should know how they stack.
- NIST AI RMF — voluntary US framework with four functions: Govern, Map, Measure, Manage. Its Generative AI Profile (NIST AI 600-1) adds 12 GenAI-specific risks (hallucination, data leakage, systemic bias). NIST published a crosswalk mapping RMF subcategories to ISO clauses.
- ISO/IEC 42001:2023 — the certifiable AI Management System (AIMS) standard, the AI cousin of ISO 27001. ISO/IEC 42006:2025 (the audit/certification-body qualification standard) makes third-party certification real.
- EU AI Act — risk-tiered law with hard dates: prohibited practices and AI-literacy duties since 2 Feb 2025; general-purpose AI (GPAI) obligations since 2 Aug 2025; most high-risk and GPAI enforcement (with fines) from 2 Aug 2026. It has extraterritorial reach, so Indian firms selling into the EU are in scope.
The India angle matters most here. India's DPDP Rules 2025 were notified on 13 Nov 2025, with full applicability by 13 May 2027 — directly shaping how AI systems may process personal data (consent, purpose limitation, breach reporting). Days earlier, on 5 Nov 2025, MeitY released the India AI Governance Guidelines — a light-touch, principles-based framework (not yet binding law), overseen by an AI Governance Group chaired by the Principal Scientific Adviser.
For the risk register, treat each AI system as an asset with its own owner, classification, and AI-specific third-party/supply-chain risk: poisoned training data, opaque model provenance, and vendor model swaps you can't see.
Strengths tip: If you're strong at GRC and asset classification, AI governance is a natural extension — reuse your existing register, RACI, and third-party-risk muscle rather than building a parallel program.
The AI-era angle, in four cards
What 2026 adds to this domain — flip to see why each matters.
Voluntary Govern-Map-Measure-Manage framework; its GenAI Profile (AI 600-1) adds 12 GenAI risks. So what: a ready structure to organize AI risk before regulators force it.
Certifiable AI Management System standard; 42006:2025 qualifies its auditors. So what: lets you prove AI governance to clients and regulators with a third-party badge.
Bans Feb 2025, GPAI Aug 2025, high-risk + fines Aug 2026; extraterritorial. So what: hard deadlines that reach Indian firms selling into the EU.
DPDP Rules notified 13 Nov 2025 (full by May 2027); MeitY AI Governance Guidelines 5 Nov 2025, light-touch. So what: India's twin AI/privacy baseline for the register.
Pause & Predict
Name one thing AI changes about Domain 1 — and one fundamental it does NOT change. Type your guess.
🎯 Prove it — your Domain 1 practice exam
You have read the theory. Now do the reps. This is the free, timed Techclick assessment built for exactly this domain, with full reasoning on every question — plus the full-length mock for when you are close to your exam date.
Part of the 8-part series · start from the CISSP overview → · all assessments live on exam.techclick.in (sign in with your Techclick account).
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from ISC2 docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: A junior analyst says, "We found a vulnerability, so we should patch it immediately." Using Domain 1 risk thinking, explain in your own words why a CISSP would NOT automatically say yes, and what they would weigh first. Then compare to the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Non-repudiation
- Assurance that an actor cannot later deny having sent a message or performed an action, usually proven by digital signatures.
- Baseline
- The minimum mandatory security configuration a system must meet before it is allowed into production.
- Data custodian
- The party (usually IT) that implements and maintains controls on data per the owner's classification, without owning the data itself.
- ALE (Annualized Loss Expectancy)
- Expected yearly loss from a risk, calculated as SLE multiplied by ARO.
- Residual risk
- The risk left over after controls are applied; the data/asset owner must formally accept it.
- Exposure Factor (EF)
- The percentage of an asset's value lost in a single incident, used to compute SLE.
- Due care vs due diligence
- Due care is taking reasonable protective action; due diligence is the ongoing investigation that confirms those actions stay effective.
- Data Fiduciary / Data Principal
- Under India's DPDP Act, the Data Fiduciary decides how personal data is processed; the Data Principal is the individual the data belongs to.
- Privacy by Design
- Engineering privacy and data minimisation into a system from the start, with protective settings on by default.
- BIA (Business Impact Analysis)
- The study that identifies critical functions, the cost of their downtime, and the priority and metrics for recovering them.
- MTD (Maximum Tolerable Downtime)
- The longest a business function can be unavailable before the organization suffers severe or unrecoverable harm; equals RTO + WRT.
- STRIDE
- A threat-modeling framework listing six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
- AIMS (AI Management System)
- The governance system defined by ISO/IEC 42001:2023 for managing AI risk across its lifecycle — the AI counterpart to ISO 27001's ISMS, and certifiable by qualified bodies under ISO/IEC 42006:2025.
- GPAI (General-Purpose AI)
- Under the EU AI Act, a model that can perform a wide range of tasks (e.g., large language models). GPAI obligations began 2 Aug 2025, with Commission enforcement and fines from 2 Aug 2026.
- Data Fiduciary
- India's DPDP term for the entity that decides the purpose and means of processing personal data (akin to GDPR's 'controller'). Under the DPDP Rules 2025, AI systems handling personal data trigger fiduciary duties like consent and breach reporting.
📚 Sources
- ISC2 — CISSP Certification Exam Outline (April 2024, Domain 1 = 16%). isc2.org
- ISC2 — Code of Professional Ethics (Canons). isc2.org
- NIST — SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations. csrc.nist.gov
- NIST — SP 800-30 Rev. 1, Guide for Conducting Risk Assessments. csrc.nist.gov
- NIST — SP 800-34 Rev. 1, Contingency Planning Guide (BIA, RTO/RPO). csrc.nist.gov
- Ministry of Electronics & IT, Government of India — The Digital Personal Data Protection Act, 2023 and DPDP Rules 2025. meity.gov.in
- ISO/IEC — 27005:2022 Information security risk management; 31000:2018 Risk management guidelines. iso.org
- European Union — General Data Protection Regulation (GDPR), Regulation (EU) 2016/679. eur-lex.europa.eu
What's next?
Domain 1 done. Keep the momentum — next is Domain 2: Asset Security.