Professional ethics

Security concepts and governance principles

Privacy and regulatory requirements

Information security legal and regulatory issues in a holistic context

Requirements for investigation types

Develop, document and implement security policy, standards, procedures and guidelines

Business Continuity requirements

Personnel security policies and procedures

Risk management concepts

Threat modeling concepts and methodologies

Supply Chain Risk Management concepts

Establish and maintain a security awareness, education and training program

Data and asset classification

Information and asset handling requirements

Asset ownership and management

Manage data lifecycle

Appropriate asset retention

Data security controls and compliance requirements

Engineering processes using secure design principles

Fundamental concepts of security models

Select controls based on systems security requirements

Security capabilities of information systems

Vulnerabilities of security architectures, designs and solution elements

Cryptographic solutions

Methods of cryptanalytic attacks

Apply security principles to site and facility design

Design site and facility security controls

Secure design principles in network architectures

Secure network components

Implement secure communication channels according to design

Control physical and logical access to assets

Identification and authentication of people, devices and services

Federated identity with a third-party service

Authorization mechanisms

The identity and access provisioning lifecycle

Implement authentication systems

Assessment, test and audit strategies

Security control testing

Collect security process data

Analyze test output and generate report

Security audits

Understand and comply with investigations

Conduct logging and monitoring activities

Configuration Management

Foundational security operations concepts

Resource protection

Incident management

Detective and preventative measures

Patch and vulnerability management

Change management processes

Recovery strategies

Disaster Recovery Plans and processes

Business Continuity planning and exercises

Physical security

Address personal safety and security concerns

Security in the Software Development Life Cycle

Security controls in software development ecosystems

Assess the effectiveness of software security

Security impact of acquired software

Secure coding guidelines and standards