Forward or Backwards

Topics › Computers › Information Security

CISSP Domain 1: Security and Risk Management

Published · 57 min

Watch on YouTube

A full tour of Domain 1 of the CISSP exam - Security and Risk Management - the largest of the eight domains, worth 16% of the exam under ISC2's exam outline effective 15 April 2024.

This video works through all twelve of Domain 1's sub-domains in order: the ISC2 Code of Ethics and its four canons, ranked in precedence; the CIA triad plus authenticity and non-repudiation, tested against a worked ransomware scenario; security governance, business alignment and M&A due diligence; the major control frameworks (ISO/IEC 27001:2022, NIST CSF 2.0, NIST SP 800-53, COBIT, SABSA, PCI DSS v4.0.1); the legal and regulatory landscape; privacy law across the EU's GDPR, California's CCPA/CPRA, China's PIPL and South Africa's POPIA, worked through a four-jurisdiction scenario; the four kinds of investigation and their evidentiary standards; the policy-standard-procedure-guideline hierarchy; business continuity fundamentals (BIA, MTD, RTO, RPO) with a worked outage timeline; external dependencies and continuity, illustrated by the October 2025 AWS US-EAST-1 outage; personnel security from hiring to termination; identifying threats and vulnerabilities; quantitative risk analysis with a full worked SLE/ARO/ALE calculation, alongside qualitative risk matrices; the four risk responses and control types and categories; risk maturity models and the NIST RMF against ISO 31000:2018; threat modelling with STRIDE, PASTA and attack trees; the 2020 SolarWinds supply-chain compromise; and security awareness and training.

It closes with a recap tying all twelve sub-domains together and showing how they feed the other seven CISSP domains, then fifteen exam-style questions, each with four options, a pause to think, and an explained answer.

Every figure is on screen with its source and date.

Educational documentary. Not financial or investment advice.

In these topics

Chapters

  1. Welcome, and What This Domain Covers
  2. Professional Ethics: The ISC2 Code of Ethics
  3. Security Concepts: CIA, Plus Authenticity & Non-Repudiation
  4. Security Governance and Alignment to Business Strategy
  5. Control Frameworks
  6. Legal and Regulatory Landscape
  7. Privacy Law in Practice
  8. Investigations
  9. Policies, Standards, Procedures and Guidelines
  10. Business Continuity Planning Fundamentals
  11. External Dependencies and Continuity
  12. Personnel Security
  13. Risk Management: Identifying Threats and Vulnerabilities
  14. Quantitative and Qualitative Risk Analysis
  15. Risk Response, Controls and Continuous Monitoring
  16. Risk Maturity and Risk Frameworks
  17. Threat Modelling
  18. Supply Chain Risk Management
  19. Security Awareness, Education and Training
  20. Domain Recap, and How It Links to the Other Seven
  21. Review: Exam-Style Questions, Part One
  22. Review: Exam-Style Questions, Part Two
  23. Review: Exam-Style Questions, Part Three

More from Forward or Backwards on YouTube

Sources and credits

Photo credits (Wikimedia Commons)

Primary sources

  • ISC2, 'CISSP Certification Exam Outline', effective 15 April 2024 (isc2.org) - Domain 1 weight raised to 16%; the twelve sub-domain structure. Re-checked by web search 11 October 2026 (Refonte Learning's 2026 guide corroborates: the outline and weighting remain current).
  • ISC2, 'Code of Ethics' (isc2.org/ethics) - preamble and the four canons, in order of precedence. Exact wording cross-checked 11 October 2026 against dummies.com and fractionalciso.com's published reproductions, which agree verbatim.
  • ISO/IEC 27001:2022, 'Information security management systems - Requirements', published 25 October 2022, replacing the 2013 edition.
  • NIST, 'Cybersecurity Framework 2.0', published 26 February 2024 - six functions (Govern, Identify, Protect, Detect, Respond, Recover).
  • NIST Special Publication 800-53 Revision 5, 'Security and Privacy Controls for Information Systems and Organizations', originally published September 2020 - named only as a control catalogue, no revision figure narrated.
  • PCI Security Standards Council, PCI DSS v4.0.1, published 11 June 2024. Re-checked by web search 11 October 2026 (brightdefense.com, rsisecurity.com): all requirements, including the 51 future-dated best practices carried over from v4.0, became mandatory on 31 March 2025.
  • Regulation (EU) 2016/679 (General Data Protection Regulation), enforceable from 25 May 2018.
  • California Civil Code section 1798.100 et seq., as amended by the California Privacy Rights Act (CPRA). Re-checked by web search 11 October 2026 (cookieyes.com, calchamber.com): CPRA's substantive provisions became operative 1 January 2023.
  • Personal Information Protection Law of the People's Republic of China, effective 1 November 2021. Re-checked by web search 11 October 2026 (wiley.law, twobirds.com, wilmerhale.com).
  • Protection of Personal Information Act 4 of 2013 (South Africa, POPIA). Re-checked by web search 11 October 2026 (iapp.org, bowmanslaw.com, michalsons.com): full enforcement, including penalties, from 1 July 2021.
  • AWS post-event summary for the Northern Virginia (US-EAST-1) region outage, corroborated by InfoQ (November 2025) and contemporaneous technical write-ups found by web search 11 October 2026 - a DynamoDB DNS automation fault from 19 to 20 October 2025, roughly 15 hours, affecting more than 140 AWS services.
  • NIST Special Publication 800-37 Revision 2, 'Risk Management Framework for Information Systems and Organizations', published 20 December 2018.
  • ISO 31000:2018, 'Risk management - Guidelines', revised 15 February 2018.
  • CISA, Emergency Directive 21-01, 'Mitigate SolarWinds Orion Code Compromise', issued 13 December 2020 - the estimated 18,000 affected customers figure is the directive's own language.

Not regulated financial advice.