CISSP Domain Mind Map: The Whole Syllabus on One Page
INSIGHT · 6 min read · September 2026 · Mindsgate
Every CISSP domain, topic and key concept on one interactive map — with exam weights, glossary deep links and domain-filtered flashcards.
The whole CISSP syllabus on one page: eight domains with their current exam weights, the major topics inside each, and the key concepts underneath. Blue-dashed terms open the full definition in the glossary; every domain links straight into domain-filtered flashcards. Based on the current ISC2 CISSP Exam Outline, independently summarized.
CISSP Glossary → CISSP Flashcards → Chapter Score Tracker →
Focus on a domain
All domains D1 Security and Risk Management 16% D2 Asset Security 10% D3 Security Architecture and Engineering 13% D4 Communication and Network Security 13% D5 Identity and Access Management (IAM) 13% D6 Security Assessment and Testing 12% D7 Security Operations 13% D8 Software Development Security 10%
View
Expand all Collapse all Reset view − + CISSP
8 domains · weights from the current exam outline
D1 Security and Risk Management 16% CIA Authenticity Non-repudiation ISC2 Code of Ethics Alignment with business strategy Roles and accountability GRC GDPR PCI DSS PII Criminal vs civil vs administrative law Intellectual property Policy (mandatory, high level) Standard (mandatory, specific) Procedure (step by step) Guideline (recommended) Screening Onboarding / offboarding SoD Job rotation NDAs Threats Vulnerabilities Asset valuation Risk acceptance Risk avoidance Risk mitigation Risk transfer Quantitative risk
SLE = Asset Value × Exposure Factor
ALE = SLE × ARO
Preventive / detective / corrective Administrative / technical / physical Compensating controls STRIDE PASTA VAST DREAD Attack trees Reduction analysis Four methodologies
STRIDE = categorize (6 threat classes)
DREAD = rate (5 scoring questions)
PASTA = 7-stage, risk/asset-centric
VAST = Agile-integrated, scalable
Phishing simulations Role-based training Culture Classification levels Labelling and marking Asset ownership Asset inventory Handling requirements Create → store → use → share → archive → destroy Who is who
Owner — accountable for the data
Controller — decides purpose & means
Custodian — day-to-day care
Processor — handles data for a controller
Subject/user — the person the data is about
Data retention Data remanence Secure destruction (purge, crypto-erase, destroy) EOL EOS Data at rest Data in transit Data in use D3 Security Architecture and Engineering 13% Least privilege DiD Secure defaults Fail secure SoD Zero Trust Privacy by design Shared responsibility Keep it simple Defense-in-depth vocabulary
Related terms: layering · classifications · zones · realms
compartments · silos · segmentations
lattice structure · protection rings
TPM HSM Memory protection Trusted execution Single points of failure Covert channels Emanations SaaS PaaS IaaS Containers Microservices Serverless Virtualization IoT Edge computing AES Fast bulk encryption Key distribution problem MITM Brute force Side channel Birthday attack PFS Encryption at a glance
AES = symmetric = fast bulk encryption
RSA/ECC = asymmetric = keys & signatures
SHA = hashing = integrity
Acquire → implement → operate → retire D4 Communication and Network Security 13% TLS SSL SSH DNSSEC SNMP DHCP DNS IPSec AH — authentication/integrity ESP — encryption/confidentiality IKE — key exchange AH vs ESP
AH = authentication and integrity only
ESP = encryption/confidentiality plus security services
North-south traffic East-west traffic WPA3 CCMP Zigbee Enterprise vs PSK Captive portals Wireless crypto lineage
WEP → TKIP (WPA) → CCMP/AES (WPA2) → SAE (WPA3)
VPN EAP PAP CHAP PVC Voice and collaboration PPP authentication
PAP = plaintext (no protection)
CHAP = challenge/response, password never sent
EAP = extensible framework (40+ methods)
D5 Identity and Access Management (IAM) 13% Physical and logical access Identification Authentication Authorization Accounting AAA MFA Something you know / have / are Session management Identity proofing SSO FIM SAML OAuth OIDC Federation standards
SAML = enterprise federation / browser SSO
OAuth = delegated authorization
OIDC = authentication & identity on OAuth 2.0
SCIM = provisioning / deprovisioning
PAM JIT Break-glass accounts Service accounts SCIM Joiner / mover / leaver Access reviews D6 Security Assessment and Testing 12% Internal assessment External assessment Third-party assessment VA PT Red / Blue / Purple teams Breach and attack simulation VA vs PT
Vulnerability Assessment = identify and evaluate weaknesses
Penetration Test = authorized exploitation to demonstrate impact
Log review Synthetic transactions Security audits SSAE-18 / SOC reports Compliance testing KPI KRI Security metrics Test-result analysis Remediation Exceptions Evidence handling Chain of custody Digital forensics eDiscovery IR CSIRT Incident-response sequence
Detection / Analysis
→ Containment
→ Eradication / Remediation
→ Recovery
→ Lessons Learned
Configuration management Change management Patch and vulnerability management Resource protection Need to know / least privilege Guards and access controls Duress Travel security D8 Software Development Security 10% SDLC SSDLC Security in requirements and design Threat modelling Agile Waterfall DevOps / DevSecOps SW-CMM CI/CD Repositories Code signing Change management SAST DAST IAST SCA RASP Testing at a glance
SAST = analyze code without executing it
DAST = test the running application externally
IAST = instrument the app while it runs
SCA = analyze third-party components
SBOM COTS Open source Libraries and dependencies OWASP Input validation API API authentication and authorization XSRF Auditing and logging of changes Risk analysis of acquired software CSP