CISSP Glossary: Key Exam Terms Defined by Domain

This glossary defines the core terms on the CISSP exam the way ISC2 tests them — the distinctions, models, and formulas the Common Body of Knowledge (CBK) expects you to recognize. Terms are grouped by the eight CISSP domains. For how the domains are weighted and structured, see our breakdown of the eight CISSP domains and the CAT exam format guide.

Domain 1 — Security and Risk Management

CIA Triad

Confidentiality, Integrity, and Availability — the three goals every security control ultimately supports. On the exam, map any control or scenario back to the pillar it protects.

Confidentiality

Preventing unauthorized disclosure of information. Encryption, access controls, and need-to-know all serve confidentiality.

Integrity

Ensuring information is not altered by unauthorized parties and remains accurate. Hashing and digital signatures are integrity controls, not confidentiality controls.

Availability

Ensuring authorized users can access systems and data when needed. Redundancy, fault tolerance, and DDoS protection serve availability.

Risk

The likelihood that a threat exploits a vulnerability, causing impact to an asset. Risk exists only when a threat, a vulnerability, and a valued asset all coincide.

Threat vs Vulnerability

A threat is a potential danger (the actor or event); a vulnerability is the weakness it could exploit. The exam frequently asks you to tell these two apart.

SLE, ARO, ALE

Single Loss Expectancy = Asset Value x Exposure Factor. Annualized Loss Expectancy = SLE x Annualized Rate of Occurrence (ARO). These formulas drive quantitative risk analysis — memorize them.

Quantitative vs Qualitative Risk Analysis

Quantitative assigns dollar values (SLE, ALE); qualitative uses ratings like high/medium/low. Most real programs blend both.

Risk Treatment

The four responses to risk: mitigate (reduce), transfer (e.g., insurance), avoid, or accept. Whatever remains after controls is residual risk.

Residual Risk

The risk left over after controls are applied. Senior management (the data or system owner) formally accepts residual risk — not the security team.

Due Care vs Due Diligence

Due diligence is investigating and knowing what should be done (planning, research); due care is doing it — taking prudent action. The classic ISC2 ‘prudent person’ distinction.

Policy, Standard, Procedure, Guideline, Baseline

The governance hierarchy: policy (high-level intent, mandatory), standard (mandatory specifics), procedure (step-by-step, mandatory), baseline (minimum level), guideline (recommended, discretionary).

Defense in Depth

Layering multiple, overlapping controls so no single failure exposes the asset. Also called layered security.

Domain 2 — Asset Security

Data Classification

Labeling data by sensitivity/value (e.g., public to confidential; or unclassified to top secret) so protection matches impact. The data owner assigns classification.

Data Owner vs Data Custodian

The owner is a senior/business role accountable for the data who sets classification; the custodian (often IT) implements and maintains the controls day to day. Know who is accountable vs who operates.

Data States

Data at rest (stored), in transit (moving across a network), and in use (in memory/processing). Each state needs different controls, and the exam tests the distinction.

Data Remanence

Residual data left on media after deletion. Countermeasures include clearing, purging, degaussing, cryptographic erasure (crypto-shredding), and physical destruction.

Scoping and Tailoring

Scoping selects which baseline controls apply; tailoring adjusts them to the organization. Both refine a control baseline to fit real risk.

Domain 3 — Security Architecture and Engineering

Bell-LaPadula Model

A confidentiality model: ‘no read up’ (simple security property) and ‘no write down’ (star property). It stops information from leaking to lower clearance levels.

Biba Model

An integrity model and effectively the inverse of Bell-LaPadula: ‘no read down’ and ‘no write up.’ It protects data from being corrupted by lower-integrity sources.

Clark-Wilson Model

An integrity model enforcing well-formed transactions and separation of duties through a subject-program-object relationship — users act on data only through controlled programs.

Brewer-Nash (Chinese Wall)

A model that prevents conflicts of interest by changing a user’s access dynamically based on what they have already accessed.

Reference Monitor

The abstract component that mediates all access between subjects and objects. It must be tamperproof, always invoked, and small enough to be verifiable; the security kernel implements it.

Trusted Computing Base (TCB)

The total combination of hardware, software, and firmware responsible for enforcing the security policy. Keeping the TCB small and verifiable is the goal.

Symmetric Encryption

One shared secret key encrypts and decrypts (e.g., AES). Fast, but key distribution is the challenge, and it needs n(n-1)/2 keys for a group.

Asymmetric Encryption

A public/private key pair (e.g., RSA, ECC). Slower than symmetric, but it solves key distribution and enables digital signatures. Encrypt with the recipient’s public key for confidentiality.

Hashing

A one-way function producing a fixed-length digest to verify integrity (e.g., SHA-256). Hashing is not encryption and is not reversible.

Digital Signature

A hash of a message encrypted with the sender’s private key. It provides integrity, authentication, and non-repudiation — but not confidentiality by itself.

Public Key Infrastructure (PKI)

The framework of certificate authorities, registration authorities, and X.509 certificates that binds identities to public keys and enables trust at scale.

Non-repudiation

Assurance that a party cannot deny an action they took. Digital signatures provide it; shared accounts destroy it.

Domain 4 — Communication and Network Security

OSI Model

The seven-layer reference model (Physical, Data Link, Network, Transport, Session, Presentation, Application). The exam expects you to know which protocols and devices operate at each layer.

TCP Three-Way Handshake

The SYN, SYN-ACK, ACK sequence that establishes a reliable TCP connection. Contrast with connectionless UDP.

IPsec

A network-layer protocol suite for VPNs. AH provides integrity/authentication; ESP adds confidentiality. Transport mode protects the payload; tunnel mode protects the whole packet.

Firewall Types

Packet-filtering (stateless, layer 3/4), stateful inspection (tracks connections), proxy/application (layer 7), and next-generation (adds IPS, app awareness). Know what each inspects.

Zero Trust

An architecture that never trusts by default and verifies every request regardless of network location — ‘never trust, always verify.’

Network Segmentation

Dividing a network into isolated zones (e.g., VLANs, subnets) to contain breaches and enforce least privilege at the network level.

Domain 5 — Identity and Access Management (IAM)

AAA

Identification, Authentication, Authorization, and Accountability — the sequence that controls and records access. Accountability depends on unique identities and logging.

Authentication Factors

Something you know (password), something you have (token), and something you are (biometric). Multi-factor authentication (MFA) combines two or more different factor types.

DAC vs MAC

Discretionary Access Control lets the data owner grant access at their discretion; Mandatory Access Control enforces access by system-assigned labels/clearances and is the most rigid. A frequent exam contrast.

RBAC vs ABAC

Role-Based Access Control grants permissions by job role; Attribute-Based Access Control decides using attributes (user, resource, environment). RBAC scales with roles; ABAC is more granular.

Least Privilege

Users and processes get only the access needed to do their job — nothing more. Pairs with need-to-know.

Separation of Duties

Splitting a sensitive task across multiple people so no single person can commit and conceal fraud. Collusion is required to defeat it.

Single Sign-On (SSO)

One authentication grants access to multiple systems. Convenient and reduces password fatigue, but a compromised credential now unlocks more — the trade-off the exam wants you to see.

Federation / SAML

Federated identity lets one organization trust another’s authentication. SAML is the XML standard commonly used to exchange authentication and authorization assertions between them.

Kerberos

A ticket-based authentication protocol using a Key Distribution Center (KDC) and time-stamped tickets. It provides SSO and relies on synchronized clocks.

Domain 6 — Security Assessment and Testing

Vulnerability Assessment vs Penetration Test

A vulnerability assessment identifies and lists weaknesses; a penetration test actively exploits them to prove impact. Scope and authorization matter more for pentests.

Black, White, and Gray Box Testing

Black box = no prior knowledge; white box = full knowledge of internals; gray box = partial knowledge. Describes how much the tester knows going in.

SOC 1 / SOC 2 / SOC 3

Service Organization Control reports: SOC 1 covers financial-reporting controls; SOC 2 covers security/availability/confidentiality (etc.); SOC 3 is a public summary. Type I is point-in-time; Type II covers a period of operation.

Security Audit

A formal, evidence-based review of controls against a standard. Independence matters — third-party audits carry more weight than self-assessments.

Domain 7 — Security Operations

RTO vs RPO

Recovery Time Objective is how quickly a system must be restored; Recovery Point Objective is how much data loss (measured in time) is acceptable. RPO drives backup frequency; RTO drives recovery capability.

MTD / MAD

Maximum Tolerable Downtime (a.k.a. Maximum Allowable Downtime) is the longest an outage can last before the business is unacceptably harmed. RTO plus work recovery time must stay within MTD.

BCP vs DRP

A Business Continuity Plan keeps the whole business running during disruption; a Disaster Recovery Plan is the IT-focused subset that restores systems and data. DRP lives inside BCP.

Business Impact Analysis (BIA)

The analysis that identifies critical functions and the impact of their loss, producing RTO, RPO, and MTD values. It comes early and drives the whole continuity effort.

Incident Response Lifecycle

ISC2’s phases: detection, response, mitigation, reporting, recovery, remediation, and lessons learned. Containment (mitigation) comes before eradication and recovery.

Backup Types

Full backs up everything. Incremental backs up changes since the last backup (fast backup, slower restore, resets the archive bit). Differential backs up changes since the last full backup (slower backup, faster restore, does not reset the archive bit).

RAID

Redundant Array of Independent Disks for availability/performance: RAID 0 stripes (no redundancy), RAID 1 mirrors, RAID 5 stripes with distributed parity (survives one disk loss).

Data Loss Prevention (DLP)

Controls that detect and block sensitive data from leaving the organization, whether at rest, in transit, or in use.

SIEM

Security Information and Event Management — centralizes log collection, correlation, and alerting to support monitoring and incident detection.

Chain of Custody

The documented, unbroken record of who handled evidence, when, and how. Breaking it can make forensic evidence inadmissible.

Domain 8 — Software Development Security

SDLC

The Software Development Life Cycle. Security should be built into every phase (requirements through disposal), not bolted on at the end — the exam favors early, integrated security.

DevSecOps

Integrating security into agile/DevOps pipelines so it is continuous and automated. Often summarized as ‘shift left’ — test security earlier.

SAST vs DAST

Static Application Security Testing analyzes source code without running it (white-box); Dynamic Application Security Testing tests the running application from the outside (black-box). They find different classes of flaws.

OWASP Top 10

A widely referenced list of the most critical web application security risks, such as injection and broken access control. Good grounding for secure-coding questions.

Input Validation

Checking untrusted input against expected format before processing, to prevent injection and buffer attacks. Server-side validation is authoritative; client-side alone is not a control.

Software Escrow

A third party holds source code so the customer can recover it if the vendor fails or defaults. An availability/continuity control for purchased software.