CISSP, CISM & AAISM Domain Summaries
High-yield exam checklists for CISSP, CISM & AAISM certifications — distilled by Manoj Sharma, certified coach whose students include 818+ CISSP passers. A quick, focused reference to revise every domain from an exam perspective.
Plan your preparation
Share your goals and our team will help you explore the programme.
Browse Domain Summaries
Select your certification to view the relevant domain study guides.
Showing 8 CISSP domain summaries
Domain 1CISSP Domain 1 Summary | Security & Risk Management — Complete Study Guide by Manoj Sharma, CISSP
The definitive CISSP Domain 1 study guide covering Security and Risk Management — including the ISC2 Code of Ethics, CIA triad, security governance, legal and regulatory compliance, personnel security, risk management frameworks, the ALE formula, threat and vulnerability analysis, and business continuity concepts. Updated for the 2024 ISC2 exam refresh. Written by Manoj Sharma, CISSP — India's leading CISSP instructor with 818+ certified professionals.
Domain 2CISSP Domain 2 Summary | Asset Security — Complete Study Guide by Manoj Sharma, CISSP
The definitive CISSP Domain 2 study guide covering Asset Security — including information and asset classification, data ownership roles (Owner, Custodian, Steward, User), privacy protection, data lifecycle management, asset retention, data states (at rest, in transit, in use), data security controls, sanitization and disposal methods, DLP, DRM, and handling requirements. Updated for the 2024 ISC2 exam refresh (10% exam weight). Written by Manoj Sharma, CISSP — India's leading CISSP instructor with 818+ certified professionals.
Domain 3CISSP Domain 3: Security Architecture and Engineering Guide
Master CISSP Domain 3 covering security architecture, cryptography, secure design principles, and physical security. Accounts for 13% of exam with frameworks like Zero Trust, Bell-LaPadula, and CPTED.
Domain 4CISSP Domain-4 Summary Communication & Network Security
Domain 5CISSP Domain 5 Summary: Mastering Identity & Access Management (IAM)
Concise CISSP Domain 5 Identity & Access Management (IAM) summary covering authentication, authorization, access controls, SSO, MFA, and IAM best practic
Domain 6CISSP Domain 6 Summary – Security Assessment & Testing
CISSP Domain 6 Security Assessment and Testing summary covering audits, vulnerability scanning, penetration testing, metrics, and reporting.
Domain 7CISSP Domain 7 Summary – Security Operations | CyberNous
CISSP Domain 7 Security Operations summary covering incident response, SIEM, logging, monitoring, forensics, disaster recovery, and BCP.
Domain 8CISSP Domain 8 Summary – Software Development Security
CISSP Domain 8 Software Development Security summary covering secure SDLC, code quality, testing, DevSecOps, and secure coding practices.
Why Cybernous Domain Summaries?
Not just another set of notes — these are exam-engineered by a coach who has been there.
Managerial Reasoning Focus
We don't just explain what each domain covers — we teach you how to think when you see domain-specific questions. Domain 1 isn't about memorising risk formulas; it's about prioritising business impact over technical severity.
Exam-Aligned Structure
Each summary maps directly to the ISC² CBK and ISACA CISM Job Practice Areas, so you're studying exactly what will be tested. No filler, no academic padding.
Real-World Scenarios
Every domain includes 2–3 real CISO decision scenarios illustrating how concepts apply in practice. Critical for the CISSP CAT exam, which tests applied knowledge — not rote memorisation.
Quick Revision Format
Designed for last-week exam prep. Each domain summary covers all key concepts in 2–4 pages — short enough to review in 15–20 minutes, comprehensive enough to reinforce deep understanding.
Updated for 2026
Reflects the latest CBK updates including AI/ML security governance, zero trust architecture, and post-quantum cryptography. Always current, never outdated.
Proven 98.3% Success Rate
Written personally by Manoj Sharma (CISSP | CISM | CRISC), who has coached 818+ professionals to CISSP certification.
Ready to pass your CISSP?
Domain summaries are the revision layer. The full programme includes live coaching, practice exams, and the 100-day study plan.
Explore CISSP Success ToolkitCISSP Domain Summaries: 2026 Exam Quick-Reference Guide
The CISSP exam covers 8 domains as defined in the ISC² CBK. Domain 1 (Security and Risk Management) accounts for 16% of exam questions — the highest-weighted domain — while Domains 2 and 8 are each only 10%. Understanding this weighting helps you prioritise your study time effectively. The passing score is 700 out of 1,000 on a scaled basis.
Key Topics
Risk assessment frameworks, BCP/DRP, legal & compliance (GDPR, DPDP Act 2023, SOX), security governance, professional ethics, security policies, risk appetite vs risk tolerance.
Exam Trap
Domain 1 questions test your ability to balance business objectives with security controls. Technical professionals often choose the “most secure” option — but CISSP wants the “most appropriate” option, which might mean accepting calculated risk. Always think like a CISO, not a firewall admin.
Revision Tip
Focus on the four risk treatment strategies — accept, avoid, transfer, mitigate — and when each applies. Know the difference between qualitative and quantitative risk analysis (ALE = SLE × ARO).
Key Topics
Data classification (Top Secret → Unclassified), data lifecycle (create, store, use, share, archive, destroy), privacy protection, data retention policies, data remanence, handling requirements.
Exam Trap
Candidates confuse data classification with asset classification. Classify data based on sensitivity and business impact — not technical value. The data owner (not the custodian) determines the classification level.
Revision Tip
When a question asks “what to do first” with sensitive data, prioritise classification before implementation. Know the roles: data owner, data custodian, data steward, and data processor.
Key Topics
Security models (Bell-LaPadula = confidentiality, Biba = integrity, Clark-Wilson = integrity via well-formed transactions), cryptography, physical security, secure design principles, trusted computing base (TCB).
Exam Trap
Domain 3 is the most technical. Questions involve encryption standards, TCB, and security evaluation criteria. Don't get lost in cryptographic maths — focus on when to use AES vs RSA, not how to calculate key strength. Know: symmetric = fast/bulk data, asymmetric = key exchange/signatures.
Revision Tip
Understand use cases and trade-offs for cryptographic algorithms. Remember: AES (symmetric, 128/192/256-bit), RSA (asymmetric, key exchange), SHA-256 (hashing, integrity). Know the difference between block ciphers and stream ciphers.
Key Topics
OSI model (7 layers), TCP/IP, network attacks (DDoS, MITM, DNS poisoning), VPNs, firewalls (stateful vs stateless), wireless security (WPA3), cloud networking, microsegmentation.
Exam Trap
Domain 4 isn't about configuring firewalls — it's about choosing the right network architecture for a given business scenario. Think zero trust vs perimeter-based security. Exam questions focus on defence in depth, not individual device configs.
Revision Tip
Memorise the OSI layers and their security controls. Understand the CIA triad applied to networks: confidentiality = encryption, integrity = hashing, availability = redundancy. Know which protocols operate at which layer.
Key Topics
Authentication (something you know/have/are), authorisation, accountability, identity federation (SAML, OAuth, OIDC), access control models (DAC, MAC, RBAC, ABAC), SSO, MFA.
Exam Trap
Questions often present scenarios where principles conflict. “A manager requests access to audit logs for their team” — the answer isn't about manager authority, it's about separation of duties. Always check for SoD violations first.
Revision Tip
Master three principles cold: Principle of Least Privilege, Separation of Duties, and Need-to-Know. Know the difference between Type I (false reject), Type II (false accept), and CER (crossover error rate) in biometrics.
Key Topics
Vulnerability assessments, penetration testing, security audits, log management, KPIs/KRIs, SOC reports (Type I vs Type II), code review.
Exam Trap
Vulnerability scan ≠ penetration test ≠ security audit. Each has different scope, intrusiveness, and management approval requirements. A pen test is always authorised — unauthorised testing is an attack. Know the distinctions cold.
Revision Tip
If a question asks “what to do first before deploying a new application,” the answer is often a security assessment or code review — not implementing controls. Know the difference between SOC 1 (financial), SOC 2 (security/availability), and SOC 3 (public).
Key Topics
Incident response, disaster recovery, digital forensics, patch management, change management, security awareness training, BCDR, RPO/RTO/MTD.
Exam Trap
Many candidates underestimate this domain because it seems “operational.” Domain 7 overlaps heavily with CISM Domain 4 — those pursuing both certifications can leverage this overlap. Know the difference between BCP (keep running) and DRP (recover after failure).
Revision Tip
Know the NIST Incident Response Process cold: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned. Also know: RPO = how much data you can lose, RTO = how fast you must recover, MTD = maximum tolerable downtime.
Key Topics
SDLC security, secure coding practices, DevSecOps, application security testing (SAST, DAST, IAST), software assurance, OWASP Top 10, threat modelling.
Exam Trap
Many candidates skip this domain because they're not developers. Don't. Domain 8 focuses on managing secure development — not writing code. Questions test when in the SDLC to apply security controls, not how to write a patch.
Revision Tip
Threat modelling happens during the design phase, not after deployment. This distinction appears frequently on the exam. Know the models: STRIDE (Microsoft), DREAD (risk ranking), PASTA (risk-centric). SAST = white-box (source code), DAST = black-box (running app).
CISM Domain Summaries: 4 Domains Explained
The CISM exam is structured around 4 Job Practice Areas with unequal weightings — Domain 3 (Information Security Programme) carries the most weight at 33%, while Domain 1 (Governance) is 17%. Unlike CISSP (which is technical + managerial), CISM is purely managerial. The passing score is 450 out of 800.
Key Topics
Governance frameworks (COBIT, NIST CSF, ISO 27001), security policies (policy → standard → procedure → guideline hierarchy), organisational structures, security strategy alignment with business goals, charter and steering committee.
Exam Trap
CISSP Domain 1 asks “what risk framework to use?” CISM asks “how do you get executive buy-in for a risk framework?” The mindset is management, not technical. Every answer should prioritise business alignment over technical excellence.
Revision Tip
Focus on board-level reporting, metrics that resonate with executives (risk in financial terms, not CVE scores), and aligning security strategy with business objectives. Know the policy hierarchy cold.
Key Topics
Risk assessment methodologies (qualitative vs quantitative), risk treatment (accept, avoid, transfer, mitigate), risk monitoring, risk communication to stakeholders, risk register, risk appetite.
Exam Trap
CISM tests your ability to communicate risk to non-technical executives — translating technical vulnerabilities into business impact. The exam rewards answers that frame risk in terms of revenue loss, regulatory fines, and reputational damage.
Revision Tip
Practise framing risks in financial terms: “This vulnerability could result in £2M downtime” resonates more than “CVE-2024-1234 is critical.” Maintain a living risk register with risk owners assigned.
Key Topics
Security programme design, resource allocation, third-party risk management (TPRM), security awareness programmes, programme maturity models (CMM), KPIs and KRIs, vendor risk assessments.
Exam Trap
CISSP asks “what control to implement?” CISM asks “how do you get budget for that control?” — a critical management mindset shift. At 33%, this is the highest-weighted CISM domain. Expect the most questions from here.
Revision Tip
This domain is about building and managing a security programme from scratch. Understand programme maturity models (CMM levels 1–5) and how to measure effectiveness through metrics. Know the difference between leading indicators (KRIs) and lagging indicators (KPIs).
Key Topics
Incident response planning, incident classification (severity levels), communication protocols, post-incident review (lessons learned), escalation procedures, BIA (Business Impact Analysis), crisis communication.
Exam Trap
Overlap with CISSP Domain 7, but CISM goes deeper into management aspects: escalation procedures, stakeholder communication, and regulatory notification requirements (e.g., GDPR 72-hour breach notification). At 30%, this is the second highest-weighted CISM domain.
Revision Tip
Know when to escalate to the board, when to involve legal, and when to engage external forensics — these management decisions are the focus. Understand BIA outputs: RPO, RTO, MTD, and how they drive recovery strategy.
AAISM Domain Summaries: 3 Domains Explained
The ISACA AAISM exam is structured around 3 domains — Domain 3 (AI Technologies and Controls) carries the most weight at 38%, while Domains 1 (Governance) and 2 (Risk Management) are each 31%. Unlike CISSP or CISM, AAISM is focused specifically on AI governance, risk and technical controls rather than general information security management.
Key Topics
The evaluate, direct, monitor governance model, accountability (which cannot be delegated) vs responsibility (which can), the provider vs deployer determination, ISO/IEC 42001, NIST AI RMF and the EU AI Act, the three-tier AI acceptable use policy, bias source-matching, AI asset & data inventory, model cards, and AI incident response.
Exam Trap
Domain 1 rewards the option that keeps accountability with the governing body and a human in the final decision — not the most technically sophisticated control. Bias questions match the remedy to the source (systemic, statistical, or human), never to the severity of the outcome.
Revision Tip
Learn the three acceptable-use tiers cold — without prior authorization, with prior authorization, prohibited. The middle tier is what actually prevents shadow AI, and it is one of the most heavily tested ideas in the domain.
Key Topics
The seven NIST trust attributes, NIST AI RMF vs EU AI Act, risk classification and the FRIA, the four risk responses (accept, avoid, mitigate, transfer), six threat modeling methods (STRIDE, PASTA, LINDDUN, Trike, VAST, OCTAVE), the six technical attack categories (data poisoning, model poisoning, model theft, prompt injection, evasion & inversion), nineteen nontechnical threats, and vendor & supply chain risk.
Exam Trap
An option naming a single threat-modeling method as sufficient for AI is always wrong — none of the six adequately covers AI-specific threats. And third-party provision never removes deployer liability, even when the vendor is fully compliant.
Revision Tip
Match the response to the source and the control to the surface — data, model, or supply chain. When an attack sounds unfamiliar, identify the surface it targets before choosing a control.
Key Topics
AI taxonomies (ANI/AGI/ASI, functionality categories), learning paradigms, the seven-phase AI life cycle, TEVV (verification vs validation), model drift’s three verdicts, data governance and lineage, privacy-enhancing technologies, HITL vs AITL human oversight, zero trust for AI, and continuous monitoring.
Exam Trap
Candidates assume this is the hardest domain because it is the most technical — it is actually the most learnable, because it tests categories and definitions rather than judgment calls. The exam consistently rewards returning to the phase where a problem entered rather than patching downstream.
Revision Tip
Learn the seven life-cycle phases in order — plan and design → collect and process → build and adapt → TEVV → deploy → operate and monitor → retire. Every control in the domain has a home in one of them.
The CISSP Code Breaker Book
Cybernous' flagship free resource — a 120-page digital book that teaches the single most important skill for passing CISSP: how to think like a manager, not a technician. Written by Manoj Sharma, who has personally coached 818+ professionals to CISSP certification.
- ✓The 3 core principles of managerial reasoning: People > Technology, Risk > Compliance, Business > Data
- ✓6-step process for eliminating wrong answers — even when you don't know the topic
- ✓How to spot ISC²'s "distractor patterns" designed to trick technical thinkers
- ✓CAT Exam strategy: what it means when questions get harder
- ✓Final Week Revision Checklist + day-of-exam mental prep
The Managerial Mindset Shift
Why technical professionals fail CISSP — and how to fix your thinking.
The Decision Framework
6-step process for eliminating wrong answers. 15 practice scenarios included.
Domain-Specific Thinking Patterns
Domain 1, 3, and 5 exam traps — the three domains that eliminate most candidates.
CAT Exam Strategy
How the adaptive test works and what it means when questions get harder.
Final Week Revision Checklist
Day-by-day study schedule, mental prep, and day-of-exam strategies.
How to Use Domain Summaries for Effective Exam Revision
Domain summaries work best in the final 2–3 weeks before your exam. Here's the optimal revision workflow used by our 818+ successful candidates.
Domain Deep-Dive
- 1Days 1–2: Review Domains 1, 3, 5 (highest weight + most challenging)
- 2Days 3–4: Review Domains 2, 4, 6
- 3Days 5–6: Review Domains 7, 8
- 4Day 7: Take a full 150-question practice exam
Weakness Targeting
- 1Analyse practice exam results — which domains scored below 70%?
- 2Re-read summaries for weak domains only
- 3Focus on why you got questions wrong, not just memorising facts
- 4Do 50 questions daily from weak domains
Quick Review + Mental Prep
- 1Days 1–5: Skim all 8 summaries (15 min each = 2 hours total)
- 2Day 6: Read CISSP Code Breaker Book cover-to-cover
- 3Day 7 (Day Before): No studying — rest, hydrate, visualise success
- 4Exam Day: Review notes briefly, then go
CISSP vs CISM: Which Domains Overlap?
If you're pursuing both certifications, understanding overlap saves study time. If you've passed CISSP, you already know 40–50% of CISM content.
| CISSP Domain | CISM Equivalent | Overlap |
|---|---|---|
| Domain 1: Security & Risk Management | CISM Domain 1 (Governance) + Domain 2 (Risk) | 60% |
| Domain 5: Identity & Access Management | CISM Domain 3 (Programme Development) | 30% |
| Domain 6: Assessment & Testing | CISM Domain 3 (Programme Development) | 40% |
| Domain 7: Security Operations | CISM Domain 4 (Incident Management) | 70% |
Doing CISSP → CISM?
Focus CISM study on governance frameworks (COBIT, NIST CSF) and stakeholder communication. You'll cut prep time to 30–45 days instead of the usual 60–90.
Doing CISM → CISSP?
Expect significantly more technical content: cryptography, network security, and secure architecture. Allocate extra time for Domains 3, 4, and 5.
Frequently Asked Questions
Everything you need to know about CISSP and CISM domain summaries.
The 8 CISSP domains are: (1) Security and Risk Management, (2) Asset Security, (3) Security Architecture and Engineering, (4) Communication and Network Security, (5) Identity and Access Management, (6) Security Assessment and Testing, (7) Security Operations, and (8) Software Development Security. These domains are defined by ISC² in the CISSP Common Body of Knowledge (CBK) and are weighted differently on the exam — Domain 1 accounts for 16% of questions, while Domain 8 is only 10%.
Ready to go beyond summaries?
Join 818+ professionals who passed CISSP with 98.3% first-attempt success. Our structured coaching programme includes everything you need — from domain summaries to live mentorship.
818+
Certified
98.3%
Pass Rate
6,200+
Questions
60+
Live Hours
Last updated · Written by Manoj Sharma