Security and Risk Management
Core concepts
This domain is the governance backbone of the exam. Know the difference between a policy (management intent), standard (mandatory requirement), procedure (step-by-step), and guideline (recommendation). Understand risk terminology: asset, threat, vulnerability, likelihood, impact, and risk = f(likelihood, impact). Be able to contrast quantitative analysis (AV, EF, SLE = AV × EF, ARO, ALE = SLE × ARO) with qualitative analysis (scales, Delphi, scenario ranking). Know risk treatment options: mitigate, transfer, avoid, accept, and that residual risk must be formally accepted by management.
Legal, regulatory, and ethics
Understand BCP vs DRP (BCP is broader; DRP is recovery of IT). Know the (ISC)² Code of Ethics canon order - protect society, act honorably, provide diligent service, advance the profession. Recognize privacy principles (data minimization, purpose limitation) and the concept of due care vs due diligence.
Traps
Questions love to test who owns risk - senior management accepts risk, not the security team. Another trap: confusing a policy with a standard, or treating guidelines as enforceable. Watch for BIA questions where the answer is about determining MTD/RTO, not choosing a backup site. Also, a "risk assessment" answer is often wrong when the question asks what to do first - governance/scope usually precedes it.
Rule of thumb
If a question asks who is accountable, the answer is almost always senior management; if it asks what must exist before a control is deployed, the answer is usually a policy or approved risk decision.