Study Hub / ISC2 CISSP (CISSP) / Domain 2.0
CISSP Domain 2.0: Asset Security — Explained
Domain 2.0 is about the stuff being protected: how data gets classified, who owns it, how long it lives, and how protections follow it through every state. Small domain, pure concept — the CISSP's most free-preview-friendly material.
Classification and ownership
- Data classification — labeling by sensitivity: typical tiers are Public, Internal, Confidential/Sensitive, Restricted. Classification drives everything downstream: handling, encryption, retention, destruction.
- Data owner — the business executive accountable for a dataset: sets classification, approves access. Ownership is accountability, not administration.
- Data custodian/steward — implements the owner's decisions: backups, provisioning, day-to-day protection. Usually IT.
- Classify early — classification ideally happens at creation; retroactively classifying a data lake is archaeology.
The data lifecycle: cradle to grave
- Create → store → use → share → archive → destroy — protections must follow data through every phase. A classic failure pattern: strong protection in "store," none in "share."
- Retention — keep data as long as business or law requires, no longer. Old data is pure liability: breach exposure with zero business value. Retention schedules are legal documents, not IT preferences.
- Destruction — matched to classification: cryptographic erasure (destroy the keys), degaussing (magnetic media), physical destruction (highest sensitivity). "Delete" is not destruction.
- Data remanence — the residue left after deletion: the reason destruction methods exist. Slack space, unallocated blocks, and SSD wear-leveling all hide recoverable fragments.
Protecting data in every state
- Data at rest — on disks and tapes: full-disk/volume encryption, database encryption, encrypted backups. Protects against theft of the media.
- Data in transit — on the wire: TLS, IPsec VPNs. Protects against interception.
- Data in use — in memory during processing: the hardest state to protect; memory encryption and trusted execution environments are the emerging answers.
- Scoping and tailoring — not every control applies everywhere: scoping removes irrelevant baseline controls; tailoring adjusts the rest to the system. Document both — auditors ask.
- Privacy by design — minimize collection, define purpose, limit retention, build in consent. Regulations (GDPR especially) turned these from ideals into requirements.
The must-memorize table: data states and protections
Match the state to the control.
| State | Where it lives | Protection |
|---|---|---|
| At rest | Disks, tapes, backups | Full-disk / volume / database encryption |
| In transit | Networks, the internet | TLS, IPsec VPN |
| In use | RAM, CPU during processing | Memory encryption, trusted execution |
| Archived | Long-term storage | Encryption + retention schedule + integrity checks |
| Destroyed | Nowhere (should be) | Crypto-erasure, degaussing, physical destruction |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A company discovers a ten-year-old customer database nobody uses, stored unencrypted on a forgotten server. What is the core asset-security failure?
- A. A. The data was never classified, so no retention or protection lifecycle applied
- B. B. The server hardware is too old
- C. C. The database lacks an index
- D. D. The company needs a bigger firewall
Show answer & reasoning
A. Unclassified data gets no lifecycle: no retention schedule (so it was never destroyed), no protection requirements (so it sat unencrypted). Classification at creation would have assigned both. The hardware age (B) and firewall (D) miss the point — this is a governance-of-data failure.
2. An SSD containing restricted data is being retired. The team destroys the encryption keys, rendering all data on the drive unrecoverable. What is this called?
- A. A. Degaussing
- B. B. Overwriting
- C. C. Cryptographic erasure
- D. D. Formatting
Show answer & reasoning
C. Destroying the keys so ciphertext can never be decrypted is cryptographic erasure — fast, verifiable, and ideal for SSDs where overwriting can't reliably reach every cell (wear-leveling hides blocks). Degaussing (A) doesn't work on flash media; formatting (D) is not destruction.
3. A backup tape is stolen from a courier van. The backups were encrypted with AES-256. Which data state was protected, and what is the exposure?
- A. A. Data in transit was protected; exposure is minimal if key management was sound
- B. B. Data at rest was protected; the thieves can read everything
- C. C. No state was protected
- D. D. Data in use was protected; the tapes are unreadable
Show answer & reasoning
A. A backup tape in a van is data in transit (moving between locations), and the encryption protected exactly that state. With sound key management, the thieves hold unreadable ciphertext. This is why backup encryption exists — media gets lost; encryption makes loss survivable.
4. A privacy review finds the app collects location data "just in case" with no defined purpose or deletion schedule. Which principle is violated?
- A. A. Defense in depth
- B. B. Data minimization and purpose limitation
- C. C. Separation of duties
- D. D. Fail securely
Show answer & reasoning
B. Collecting data without purpose and keeping it indefinitely violates minimization (collect only what you need) and purpose limitation (use it only for the stated purpose). "Just in case" data is breach liability with no business value — and under GDPR, it's unlawful.
This was one domain. The simulator drills all 8.
This free preview covered Asset Security (Domain 2.0, 10%). Not covered here: Communication & Network Security (Domain 4.0, 13%); Security Assessment & Testing (Domain 6.0, 12%); Security Operations (Domain 7.0, 13%). The three most operational domains — network security, assessment, and security operations — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CISSP Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy