CISSP Certified Information Systems Security Professional

CISSP Certified Information Systems Security Professional

Module 1. Security and Risk Management

Aligning security and risk to organisational objectives

• Evaluate and apply security governance principles
• Implement policies, standards and procedures
• Applying compliance

Applying risk management concepts

• Assessing threats and vulnerabilities
• Performing risk analysis and control
• Defining qualitative and quantitative analysis

Preserving the business

• Adhering to Business Continuity Management Code of Practise and Specifications
• Performing a business impact analysis

Investigating legal measures and techniques

• Reviewing intellectual property, liability and law, and compliance
• Differentiating traditional computer crime
• Establishing information and asset handling requirements

Module 2. Asset Security

Examining security models and frameworks

• The Information Security Triad and multi-level models
• Investigating industry standards: ISO 27001/27002
• Evaluating security model fundamental concepts

Exploring system and component security concepts

• Certification and accreditation criteria and models
• Reviewing mobile system/cloud/IoT vulnerabilities

Protecting information by applying cryptography

• Detailing symmetric and asymmetric encryption systems
• Ensuring message integrity through hashing
• Uncovering threats to cryptographic systems

Safeguarding physical resources

• Designing environments to resist hostile acts and threats
• Designing environments to resist hostile acts and threats

Module 3. Communication & Network Security

Defining a secure network architecture

• TCP/IP and other protocol models
• Protecting from network attacks
• Reviewing secure network components and communication channels

Examining secure networks and components

• Identifying wired and wireless technologies
• Implementing firewalls, secure communications, proxies, and tunnels

Module 4. Identity & Access Management

Controlling access to protect assets

• Defining administrative, technical and physical controls
• Implementing centralised and decentralised approaches
• Investigating biometric and multi-factor authentication
• Identifying common threats
• Managing the identity and access provisioning lifecycle

Module 6. Security Assessment & Testing

Designing and conducting security assessment strategies

• Leveraging the role of testing and auditing to analyse the effectiveness of security controls
• Differentiating detection and protection systems

Conducting logging and monitoring activities

• Distinguishing between the roles of internal and external audits
• Conduct or facilitate security audits

Module 7. Security Operations

Maintaining operational resilience

• Managing security services effectively
• Leveraging and supporting investigations and incident response
• Differentiating detection and protection systems
• Securely provisioning resources

Developing a recovery strategy

• Designing a disaster recovery plan
• Implementing test and maintenance processes
• Provisioning of resources

Module 8. Software Security Development

Securing the software development life cycle

• Applying software development methods and security controls
• Addressing database security concepts and issues
• Define and apply secure coding guidelines and standards
• Reviewing software security effectiveness and security impact

CISSP Certified Information Systems Security Professional

Module 1. Security and Risk Management

Aligning security and risk to organisational objectives

• Evaluate and apply security governance principles
• Implement policies, standards and procedures
• Applying compliance

Applying risk management concepts

• Assessing threats and vulnerabilities
• Performing risk analysis and control
• Defining qualitative and quantitative analysis

Preserving the business

• Adhering to Business Continuity Management Code of Practise and Specifications
• Performing a business impact analysis

Investigating legal measures and techniques

• Reviewing intellectual property, liability and law, and compliance
• Differentiating traditional computer crime
• Establishing information and asset handling requirements

Module 2. Asset Security

Examining security models and frameworks

• The Information Security Triad and multi-level models
• Investigating industry standards: ISO 27001/27002
• Evaluating security model fundamental concepts

Exploring system and component security concepts

• Certification and accreditation criteria and models
• Reviewing mobile system/cloud/IoT vulnerabilities

Protecting information by applying cryptography

• Detailing symmetric and asymmetric encryption systems
• Ensuring message integrity through hashing
• Uncovering threats to cryptographic systems

Safeguarding physical resources

• Designing environments to resist hostile acts and threats
• Designing environments to resist hostile acts and threats

Module 3. Communication & Network Security

Defining a secure network architecture

• TCP/IP and other protocol models
• Protecting from network attacks
• Reviewing secure network components and communication channels

Examining secure networks and components

• Identifying wired and wireless technologies
• Implementing firewalls, secure communications, proxies, and tunnels

Module 4. Identity & Access Management

Controlling access to protect assets

• Defining administrative, technical and physical controls
• Implementing centralised and decentralised approaches
• Investigating biometric and multi-factor authentication
• Identifying common threats
• Managing the identity and access provisioning lifecycle

Module 6. Security Assessment & Testing

Designing and conducting security assessment strategies

• Leveraging the role of testing and auditing to analyse the effectiveness of security controls
• Differentiating detection and protection systems

Conducting logging and monitoring activities

• Distinguishing between the roles of internal and external audits
• Conduct or facilitate security audits

Module 7. Security Operations

Maintaining operational resilience

• Managing security services effectively
• Leveraging and supporting investigations and incident response
• Differentiating detection and protection systems
• Securely provisioning resources

Developing a recovery strategy

• Designing a disaster recovery plan
• Implementing test and maintenance processes
• Provisioning of resources

Module 8. Software Security Development

Securing the software development life cycle

• Applying software development methods and security controls
• Addressing database security concepts and issues
• Define and apply secure coding guidelines and standards
• Reviewing software security effectiveness and security impact

• Examination: Certified Information Systems Security Professional
• Awarding body: ISC2
• Delivery method: Computerised Adaptive Testing
• Duration: Three hours
• Number of questions: Between 100 and 150
• Question format: Multiple-choice and advanced item types
• Passing score: 700 out of 1,000
• Delivery: ISC2-authorised Pearson VUE testing centre
• Examination voucher: Not included

Certification Requirements

To become CISSP certified, you must have at least five years of cumulative professional experience in two or more of the eight CISSP domains.

A relevant degree or an additional credential from ISC2’s approved list may satisfy up to one year of the experience requirement. Only one year can be waived.

You must also:

• Pass the CISSP examination.
• Complete the ISC2 endorsement process.
• Agree to follow the ISC2 Code of Ethics.
• Pay the applicable annual maintenance fee.
• Meet ISC2’s continuing professional education requirements.

If you pass the examination without the required experience, you can become an Associate of ISC2 while working towards full certification. You will then have six years to obtain the required five years of experience.

• Examination: Certified Information Systems Security Professional
• Awarding body: ISC2
• Delivery method: Computerised Adaptive Testing
• Duration: Three hours
• Number of questions: Between 100 and 150
• Question format: Multiple-choice and advanced item types
• Passing score: 700 out of 1,000
• Delivery: ISC2-authorised Pearson VUE testing centre
• Examination voucher: Not included

Certification Requirements

To become CISSP certified, you must have at least five years of cumulative professional experience in two or more of the eight CISSP domains.

A relevant degree or an additional credential from ISC2’s approved list may satisfy up to one year of the experience requirement. Only one year can be waived.

You must also:

• Pass the CISSP examination.
• Complete the ISC2 endorsement process.
• Agree to follow the ISC2 Code of Ethics.
• Pay the applicable annual maintenance fee.
• Meet ISC2’s continuing professional education requirements.

If you pass the examination without the required experience, you can become an Associate of ISC2 while working towards full certification. You will then have six years to obtain the required five years of experience.

• Five days of instructor-led training and examination preparation delivered by an experienced CISSP trainer.
• Course notes and presentation slides.
• Exam Pass Guarantee – if you do not pass the examination after attending the course, you can retake the same training with NILC at no additional cost. You will only need to pay the examination fee charged by ISC2.

Please note: The official CISSP examination voucher is not included in the course price. You must register and pay for the examination separately.

• Five days of instructor-led training and examination preparation delivered by an experienced CISSP trainer.
• Course notes and presentation slides.
• Exam Pass Guarantee – if you do not pass the examination after attending the course, you can retake the same training with NILC at no additional cost. You will only need to pay the examination fee charged by ISC2.

Please note: The official CISSP examination voucher is not included in the course price. You must register and pay for the examination separately.

There are no formal prerequisites for attending this course or sitting the CISSP examination.

However, CISSP is intended for experienced cybersecurity practitioners, managers and executives. You should have a broad understanding of information security and practical experience in one or more cybersecurity disciplines.

Passing the examination does not automatically make you CISSP certified. You must also meet ISC2’s professional experience, endorsement and membership requirements.

There are no formal prerequisites for attending this course or sitting the CISSP examination.

However, CISSP is intended for experienced cybersecurity practitioners, managers and executives. You should have a broad understanding of information security and practical experience in one or more cybersecurity disciplines.

Passing the examination does not automatically make you CISSP certified. You must also meet ISC2’s professional experience, endorsement and membership requirements.