Duration:

5 days

Course Synopsis:

This course is the most comprehensive review of information security concepts and industry best practices, and covers the eight domains of the official CISSP CBK (Common Body of Knowledge). You'll acquire information security expertise to effectively oversee security programs in any organization or government entity. You will learn how to determine who or what may have altered data or system information, potentially affecting the integrity of those asset and match an entity, such as a person or a computer system, with the actions that entity takes against valuable assets, allowing organizations to have a better understanding of the state of their security posture. Policies, concepts, principles, structures, and standards used to establish criteria for the protection of information assets are also covered in this course.

Course Objectives:

In-depth coverage of the eight domains required to pass the CISSP exam:

Security and Risk Management
Asset Security
Security Engineering
Communications and Network Security
Identity and Access Management
Security Assessment and Testing
Security Operations
Software Development Security

Course Prerequisites:

Candidates must have a minimum of five years cumulative paid work experience in two or more of the eight domains of the CISSP CBK. Earning a four years college degree or regional equivalent or an additional credential from the (ISC)² approved list will satisfy one year of the required experience. Education credit will only satisfy one year of experience.

Who Should Attend:

The CISSP is ideal for experienced security practitioners, managers and executives interested in proving their knowledge across a wide array of security practices and principles, including those in the following positions:

Chief Information Security Officer
Chief Information Officer
Director of Security
IT Director/Manager
Security Systems Engineer
Security Analyst
Security Manager
Security Auditor
Security Architect
Security Consultant
Network Architect

1. Security and Risk Management (e.g., Security, Risk, Compliance, Law, Regulations, Business Continuity)

Understand and Apply Concepts of Confidentiality, Integrity, and Availability
Apply Security Governance Principles
Compliance
Understand Legal and Regulatory Issues that Pertain to Information Security in a Global Context
Develop and Implement Documented Security Policy, Standards, Procedures, and Guidelines
Understand Business Continuity Requirements
Contribute to Personnel Security Policies
Understand and Apply Risk Management Concepts
Understand and Apply Threat Modeling
Integrate Security Risk Considerations into Acquisitions Strategy and Practice
Establish and Manage Security Education, Training, and Awareness

2. Asset Security (Protecting Security of Assets)

Classify Information and Supporting Assets
Determine and Maintain Ownership
Protect Privacy
Ensure Appropriate Retention
Determine Data Security Controls
Establish Handling Requirements
3. Security Engineering (Engineering and Management of Security)
Implement and Manage an Engineering Life Cycle Using Security Design Principles
Understand Fundamental Concepts of Security Models
Select Controls and Countermeasures Based Upon Information Systems Security Standards
Understand the Security Capabilities of Information Systems
Assess and Mitigate the Vulnerabilities of Security Architectures, Designs, and Solution Elements
Assess and Mitigate Vulnerabilities in Web-based Systems
Assess and Mitigate Vulnerabilities in Mobile Systems
Assess and Mitigate Vulnerabilities in Embedded Devices and Cyber-Physical Systems
Apply Cryptography
Apply Secure Principles to Site and Facility Design
Design and Implement Facility Security
4. Communications and Network Security (Designing and Protecting Network Security)
Apply Secure Design Principles to Network Architecture
Securing Network Components
Design and Establish Secure Communication Channels
Prevent or Mitigate Network Attacks
5. Identity and Access Management (Controlling Access and Managing Identity)
Control Physical and Logical Access to Assets
Manage Identification and Authentication of People and Devices
Integrate Identity as a Service (IDaaS)
Integrate Third-Party Identity Services
Implement and Manage Authorization Mechanisms
Prevent or Mitigate Access Control Attacks
Manage the Identity and Access Provisioning Life Cycle
6. Security Assessment and Testing (Designing, Performing, and Analyzing Security Testing)
Design and Validate Assessment and Test Strategies
Conduct Security Control Testing
Collect Security Process Data
Conduct or Facilitate Internal and Third-Party Audits
7. Security Operations (e.g., Foundational Concepts, Investigations, Incident Management, Disaster Recovery)
Understand and Support Investigations
Understand Requirements for Investigation Types
Conduct Logging and Monitoring Activities
Secure the Provisioning of Resources through Configuration Management
Understand and Apply Foundational Security Operations Concepts
Employ Resource Protection Techniques
Conduct Incident Response
Operate and Maintain Preventative Measures
Implement and Support Patch and Vulnerability Management
Participate in and Understand Change Management Processes
Implement Recovery Strategies
Implement Disaster Recovery Processes
Test Disaster Recovery Plan
Participate in Business Continuity Planning
Implement and Manage Physical Security
Participate in Personnel Safety
8. Software Development Security (Understanding, Applying, and Enforcing Software Security)
Understand and Apply Security in the Software Development Life Cycle
Enforce Security Controls in the Development Environment
Assess the Effectiveness of Software Security
Assess Software Acquisition Security

Length of exam

4 hours

Number of questions

125 to 175

Question format

Multiple-choice and advanced innovative questions

Passing grade

700 out of 1000 points

Exam availability

English

Testing center

(ISC)2 Authorized PPC and PVTC Select Pearson VUE Testing Centers

Examination Information

Programme scope, delivery arrangements and suitability are confirmed during enquiry.