{"id":26549,"date":"2026-10-06T09:38:18","date_gmt":"2026-10-06T09:38:18","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=26549"},"modified":"2026-10-06T09:38:18","modified_gmt":"2026-10-06T09:38:18","slug":"isc2-cissp-core-terms-and-frameworks-that-matter","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/isc2-cissp-core-terms-and-frameworks-that-matter\/","title":{"rendered":"ISC2 CISSP: Core Terms and Frameworks That Matter"},"content":{"rendered":"

CISSP terminology can feel overwhelming because it combines governance, law, architecture, cryptography, networking, identity, testing, operations, continuity, and software development. The most efficient way to learn terms is to organize them by the decision they support. The current CISSP<\/a> outline rewards conceptual precision, but it rarely rewards memorizing an acronym with no understanding of why it exists.<\/p>\n

The terms and frameworks below are grouped by how a security professional uses them: to govern, classify, design, control access, assess, respond, recover, and build securely.<\/p>\n

Governance terms: policy, standard, procedure, guideline<\/h3>\n

A policy expresses management direction. Standards create mandatory specific requirements. Procedures describe steps for performing work. Guidelines provide recommended practices. These terms matter because scenario questions can ask which document should be changed when the organization wants to establish a new requirement versus explain how staff execute it.<\/p>\n

Governance also includes charters, committees, roles, responsibility, due care, and due diligence.<\/p>\n

Risk terms: threat, vulnerability, likelihood, impact, residual risk<\/h3>\n

A threat can exploit a vulnerability and create impact. Controls reduce likelihood or impact, leaving residual risk. Risk can then be mitigated, transferred, avoided, or accepted by the appropriate owner. Inherent risk describes exposure before selected controls; residual risk is what remains afterward.<\/p>\n

Do not reduce this entire process to a vulnerability severity score. CISSP asks whether risk matters to the business.<\/p>\n

Asset terms: owner, custodian, classification, retention<\/h3>\n

The data owner defines classification and protection expectations, while custodians operate systems or controls on the owner’s behalf. Classification determines handling, access, encryption, retention, and destruction. Data can exist at rest, in transit, and in use, with different controls for each state.<\/p>\n

The Asset Security<\/a> domain becomes easier when these lifecycle terms are learned together.<\/p>\n

Architecture models: Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash<\/h3>\n

Bell-LaPadula emphasizes confidentiality, Biba emphasizes integrity, Clark-Wilson uses well-formed transactions and separation of duties for integrity, and Brewer-Nash addresses conflict-of-interest access. The exam value is understanding the security property each model protects, not reciting historical details.<\/p>\n

Other architecture concepts such as trusted computing, reference monitors, security kernels, fail-secure design, zero trust, defense in depth, and least privilege connect models to practical controls.<\/p>\n

Frameworks: NIST, ISO, COBIT, SABSA and others<\/h3>\n

Security frameworks provide different ways to organize controls, risk, governance, architecture, or compliance. NIST frameworks are common in risk and cybersecurity programs; ISO\/IEC 27001 centers on an information-security management system; COBIT emphasizes governance and management of enterprise IT; SABSA provides risk-driven security architecture.<\/p>\n

CISSP candidates do not need to pretend the frameworks are interchangeable. The scenario determines whether the need is governance, architecture, control catalog, risk process, or certification.<\/p>\n

Identity terms: IAAA, federation, SSO, MFA, PAM<\/h3>\n

Identification claims an identity; authentication verifies it; authorization determines allowed actions; accounting records activity. Federation lets identity cross organizational\/service boundaries, SSO reduces repeated authentication, MFA combines factor categories, and privileged-access management adds stronger controls around powerful identities.<\/p>\n

A CISSP IAM<\/a> framework should always include provisioning, review, transfer, and deprovisioning\u2014not only login.<\/p>\n

Assessment terms: scan, penetration test, audit, red team<\/h3>\n

Vulnerability assessment identifies weaknesses; penetration testing attempts exploitation under defined rules; audits compare controls\/process with criteria; red-team exercises emulate adversary objectives more broadly; code review and configuration review examine other layers. Continuous monitoring adds ongoing evidence between point-in-time assessments.<\/p>\n

The assessment\/testing<\/a> method chosen should match the assurance question and acceptable operational risk.<\/p>\n

Continuity terms: BIA, RTO, RPO, MTD, DR<\/h3>\n

A business impact analysis identifies critical functions and dependencies. RTO describes how quickly a service should be restored; RPO describes acceptable data-loss duration; maximum tolerable downtime\/disruption defines the outer business limit. Disaster recovery restores technology, while business continuity keeps critical business functions operating.<\/p>\n

These terms should be connected to business requirements before specific recovery technology is selected.<\/p>\n

Software terms: SDLC, threat modeling, SAST, DAST, SCA<\/h3>\n

The secure SDLC integrates security into requirements, design, development, testing, release, and maintenance. Threat modeling identifies design-level threats. SAST analyzes code\/static artifacts; DAST tests running applications; software composition analysis evaluates third-party dependencies. These techniques complement one another and support different lifecycle stages.<\/p>\n

Supply-chain security, code signing, dependency governance, CI\/CD controls, and change management connect Domain 8 to the rest of CISSP.<\/p>\n

Use terms to reason, not merely to recall<\/h3>\n

Create contrast pairs: confidentiality versus integrity; authentication versus authorization; risk acceptance versus mitigation; RTO versus RPO; policy versus procedure; vulnerability scan versus penetration test; DR versus business continuity; SAST versus DAST. Most difficult questions exploit confusion between closely related terms.<\/p>\n

Control categories are another useful framework. Administrative or managerial controls govern people and process; technical or logical controls use technology; physical controls protect facilities and equipment. Preventive, detective, corrective, deterrent, compensating, recovery, and directive describe what a control does. The same control can belong to more than one classification depending on context.<\/p>\n

Defense in depth means using complementary layers so one control failure does not create complete compromise. It is not an excuse to stack redundant products with no risk rationale. Effective layers should address different attack paths or failure modes and remain operationally manageable.<\/p>\n

Least privilege and need-to-know are related but distinct. Least privilege limits permissions to those required for a function; need-to-know limits access to information required for a task. Separation of duties divides sensitive processes among multiple roles, while job rotation and mandatory vacation can expose fraud or dependency risk.<\/p>\n

Zero trust is a security architecture principle centered on explicit verification, least privilege, assumption of breach, identity\/device\/context signals, and segmentation. It does not mean that every network is hostile in exactly the same way or that one vendor product creates a zero-trust architecture automatically.<\/p>\n

Due care and due diligence are paired governance ideas. Due care is taking reasonable protective action; due diligence is the ongoing investigation and verification that controls remain appropriate and effective. A company can publish a policy and still fail due diligence if it never checks compliance or changing threats.<\/p>\n

SLE, ARO, and ALE are classic risk terms. Single Loss Expectancy estimates loss from one event; Annualized Rate of Occurrence estimates frequency; Annualized Loss Expectancy combines them conceptually. The calculations are less important than understanding how quantitative analysis supports cost-benefit decisions.<\/p>\n

RTO and RPO should be kept separate from backup frequency. RPO concerns acceptable data-loss period, while RTO concerns restoration time. Backup frequency influences achievable RPO, but actual recovery testing, dependencies, staffing, and infrastructure influence whether RTO can be met.<\/p>\n

Hot, warm, and cold sites describe different continuity readiness and cost trade-offs. Hot sites can resume more quickly with greater cost, cold sites require more setup, and warm sites sit between them. Cloud recovery patterns can implement similar trade-offs without using those exact physical-site labels.<\/p>\n

DAC, MAC, RBAC, and ABAC are access-control models. Discretionary access control gives owners significant control; mandatory access control follows centrally enforced labels\/rules; role-based control groups permissions by role; attribute-based control evaluates attributes and policies. The best model depends on governance and scale.<\/p>\n

AAA can mean authentication, authorization, and accounting. In CISSP reasoning, authentication verifies identity, authorization decides allowed action, and accounting records activity. Identification usually precedes authentication, which is why some study materials use IAAA when identification is made explicit.<\/p>\n

Federation terms such as identity provider, service provider, assertions, SAML, OAuth, and OpenID Connect can appear around modern IAM. At CISSP depth, understand the purpose and trust flow rather than every protocol field. OAuth is authorization-focused, OIDC adds identity, and SAML commonly carries federated authentication assertions.<\/p>\n

STRIDE is a threat-modeling mnemonic for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Other methods can organize threats differently. The important skill is using a repeatable method early enough that architecture can change before vulnerabilities become expensive production defects.<\/p>\n

CVSS is a technical vulnerability-severity framework, not a complete business-risk score. Asset value, exposure, compensating controls, active exploitation, legal impact, and business consequence can move a remediation priority away from the raw CVSS ranking.<\/p>\n

RACI is a responsibility framework that can appear in security governance or projects. Responsible performs work, Accountable owns the outcome, Consulted provides input, and Informed receives updates. Security programs often fail when everyone is \u201cinvolved\u201d but nobody is clearly accountable.<\/p>\n

SIEM, SOAR, EDR, XDR, IDS, IPS, and DLP are product categories with different primary jobs: log\/event analysis, orchestration, endpoint detection\/response, cross-domain detection, network detection\/prevention, and data-loss control. CISSP does not require one vendor; it requires understanding where each control fits.<\/p>\n

SAST, DAST, IAST, RASP, and SCA belong to application security at different stages or perspectives. Static tools analyze code\/artifacts, dynamic tools test running software, interactive approaches combine runtime context, RASP protects from inside an application at runtime, and SCA focuses on dependencies\/components.<\/p>\n

OWASP, NIST SSDF, maturity models, and secure-development standards provide different kinds of software-security guidance. A CISSP should recognize whether the organization needs a threat list, secure-development practice framework, or capability-maturity improvement model rather than selecting a framework by popularity alone.<\/p>\n

MTTD, MTTR, RTO, and other metrics need context. Mean time to detect and respond can reveal operational performance, but a low average can hide severe outliers. Metrics should support decisions and improvement, not exist only because they are easy to count.<\/p>\n

Finally, frameworks should be mapped to organizational purpose. NIST CSF can organize cybersecurity outcomes, NIST RMF structures risk authorization in certain contexts, ISO\/IEC 27001 supports an ISMS, COBIT emphasizes governance, and SABSA emphasizes business-driven security architecture. The acronym matters less than the problem it is designed to structure.<\/p>\n

A CISSP preparation<\/a> strategy should therefore use frameworks and terminology as a mental navigation system. Within the ISC2 certification<\/a> path, the goal is to recognize which concept governs a security decision and apply it at the correct organizational level.<\/p>\n","protected":false},"excerpt":{"rendered":"

CISSP terminology can feel overwhelming because it combines governance, law, architecture, cryptography, networking, identity, testing, operations, continuity, and software development. The most efficient way to learn terms is to organize them by the decision they support. The current CISSP outline rewards conceptual precision, but it rarely rewards memorizing an acronym with no understanding of why […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/26549"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=26549"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/26549\/revisions"}],"predecessor-version":[{"id":26550,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/26549\/revisions\/26550"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=26549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=26549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=26549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}