Study Hub / ISC2 CISSP (CISSP) / Domain 1.0
CISSP Domain 1.0: Security and Risk Management — Explained
Domain 1.0 is the CISSP's worldview: security as a business function. The CIA triad, how risk is measured and treated, the models that formalize trust, and the continuity plans that keep the business alive. Think like a manager, not a technician.
Foundations: CIA and beyond
- Confidentiality, integrity, availability — the triad everything serves. The CISSP adds: authenticity (it really came from who it claims), non-repudiation (they can't deny it later), and privacy (individual control over personal data).
- Parkerian hexad — the triad's extension: adds possession/control, authenticity, and utility (encrypted data you can't decrypt has lost utility even though it's "confidential"). The exam mentions it; know the three additions.
- DAD triad — the anti-CIA: Disclosure, Alteration, Destruction. Threats map to triad legs: disclosure hits confidentiality, alteration hits integrity, destruction hits availability.
Security models: formalizing trust
- Bell-LaPadula — confidentiality model: "no read up, no write down." A Secret-cleared subject can't read Top Secret (no read up) and can't write to Unclassified (no write down, which would leak). Government classification systems live here.
- Biba — integrity model: the mirror image — "no read down, no write up." Prevents low-integrity data from contaminating high-integrity processes.
- Clark-Wilson — integrity for business: well-formed transactions, separation of duties, audit trails. The model behind "the accounting system won't let one person both create and approve a payment."
- Least privilege, need-to-know, separation of duties — the principles the models implement. The CISSP frames every access question through these.
Risk, governance, and continuity
- Risk management — identify, assess (likelihood × impact), treat (mitigate/transfer/accept/avoid), monitor continuously. Quantitative analysis uses SLE × ARO = ALE (single loss expectancy × annualized rate of occurrence = annualized loss expectancy).
- Governance — policies flow from the top; the board owns security direction and accepts residual risk. Frameworks (NIST CSF, ISO 27001) give the structure; the organization supplies the decisions.
- BCP vs. DRP — business continuity keeps the business operating (alternate sites, manual procedures); disaster recovery restores the IT. The BIA (business impact analysis) precedes both and sets RTO/RPO.
- Personnel security — background checks, NDAs, onboarding/offboarding, mandatory vacations and job rotation (fraud needs continuous presence; forced absence exposes it).
- Ethics and law — the CISSP code of ethics prioritizes public safety first, then clients, then the profession. Know the major regulations exist (GDPR, HIPAA, SOX) and what each protects — focus on scope, not statutes.
The must-memorize table: security models
Which model answers which question.
| Model | Protects | Rule |
|---|---|---|
| Bell-LaPadula | Confidentiality | No read up, no write down |
| Biba | Integrity | No read down, no write up |
| Clark-Wilson | Integrity (commercial) | Well-formed transactions + separation of duties |
| Take-Grant | Access rights transfer | Rules for passing rights between subjects |
| Brewer-Nash (Chinese Wall) | Conflicts of interest | No access to competing datasets |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A defense contractor's system enforces that analysts cleared to Secret cannot read Top Secret documents. Which model is this?
- A. A. Biba
- B. B. Bell-LaPadula
- C. C. Clark-Wilson
- D. D. Brewer-Nash
Show answer & reasoning
B. Government classification + confidentiality + "no read up" = Bell-LaPadula, the confidentiality model built for exactly this. Biba (A) is the integrity mirror; Clark-Wilson (C) is commercial-transaction integrity; Brewer-Nash (D) handles conflicts of interest (consultants vs. competing clients).
2. A single loss expectancy of $100,000 with an annualized rate of occurrence of 0.5 gives what ALE, and what does it mean?
- A. A. $200,000 — the cost of eliminating the risk
- B. B. $50,000 — the expected yearly loss, used to justify control spending
- C. C. $100,000 — the maximum acceptable loss
- D. D. $50,000 — the insurance premium to buy
Show answer & reasoning
B. ALE = SLE × ARO = $100,000 × 0.5 = $50,000/year. It's the expected annual loss — the number that justifies control budgets: don't spend $200K/year to mitigate a $50K/year risk. It's a decision tool, not a premium quote (D).
3. An accounting system requires one employee to enter a payment and a different employee to approve it. Which concept is this, and which model formalizes it?
- A. A. Least privilege — Bell-LaPadula
- B. B. Separation of duties — Clark-Wilson
- C. C. Need to know — Biba
- D. D. Defense in depth — Take-Grant
Show answer & reasoning
B. Splitting a transaction across two people so neither can complete fraud alone is separation of duties, and Clark-Wilson is the integrity model that formalizes it (well-formed transactions + SoD + auditing). Least privilege (A) limits how much access one person has — related but different.
4. After a flood destroys the primary data center, the company activates its alternate site and continues serving customers while IT rebuilds systems. Which plan governed the customer-facing continuation?
- A. A. The disaster recovery plan (DRP)
- B. B. The business continuity plan (BCP)
- C. C. The incident response plan
- D. D. The risk register
Show answer & reasoning
B. Keeping the business serving customers from the alternate site is business continuity; the DRP covers restoring the technology (rebuilding systems). BCP = business keeps running; DRP = IT gets rebuilt. The scenario describes the former.
This was one domain. The simulator drills all 8.
This free preview covered Security & Risk Management (Domain 1.0, 16%). Not covered here: Communication & Network Security (Domain 4.0, 13%); Security Assessment & Testing (Domain 6.0, 12%); Security Operations (Domain 7.0, 13%). The three most operational domains — network security, assessment, and security operations — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CISSP Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy