BCS CISMP cheat sheet

The CIA triad defines three core properties: confidentiality (access limited to authorised parties), integrity (accuracy and completeness of data), and availability (timely, reliable access by authorised users).

Additional properties often cited alongside CIA are authenticity, accountability, non-repudiation, and reliability; ISO/IEC 27000 defines information security as preservation of confidentiality, integrity, and availability.

Governance assigns accountability: the board or equivalent body owns risk appetite and sets direction; senior management implements; a CISO or security manager typically operates the programme without owning residual risk.

The three lines model separates functions: first line owns and manages risk operationally, second line provides oversight and compliance, third line (internal audit) gives independent assurance to the governing body.

Segregation of duties prevents one person from controlling all stages of a critical transaction; the compensating control where segregation is impractical is independent review or dual authorisation.

Least privilege means each identity receives only the access needed for its function; need-to-know restricts access to specific information beyond role requirements.

Defence in depth layers preventive, detective, and corrective controls so that failure of one layer does not expose the asset; no single control is assumed sufficient.

Security awareness, training, and education differ in depth: awareness changes behaviour and attention, training teaches skills for a role, education builds broader conceptual knowledge.

Policy hierarchy typically runs from governing policy (management intent) to standards (mandatory specifics), procedures (step-by-step), and guidelines (recommended practice).

Risk is the effect of uncertainty on objectives; information risk combines the likelihood of a threat exploiting a vulnerability with the resulting business impact.

Qualitative risk = likelihood x impact assessed on descriptive scales; quantitative risk uses monetary values such as single loss expectancy (SLE) = asset value x exposure factor.

Annualised loss expectancy (ALE) = SLE x annualised rate of occurrence (ARO); a control is cost-justified when its annual cost is below the ALE reduction it delivers.

Risk treatment options are mitigate (reduce), transfer (e.g. insurance, contract), avoid (stop the activity), and accept (retain, with documented sign-off by the risk owner).

Inherent risk is assessed before controls; residual risk remains after controls; risk appetite is the amount of risk an organisation is willing to seek or retain, and risk tolerance is the acceptable variation around it.

A risk register records asset, threat, vulnerability, existing controls, likelihood, impact, risk score, owner, treatment plan, and review date; it is a living document reviewed at defined intervals.

Threat modelling identifies threats against an asset or system before deployment; common approaches include STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege).

Risk assessment comprises risk identification, risk analysis, and risk evaluation (ISO/IEC 27005 and ISO 31000); outputs feed treatment decisions and acceptance by the risk owner.

Bow-tie analysis separates causes (threats) from consequences (impacts) through a top event, showing preventive barriers on the left and mitigating barriers on the right.

Incident management lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned (a common six-phase model).

An event is an observable occurrence; an incident is an event that actually or potentially breaches security policy or threatens operations; escalation criteria and severity levels must be predefined.

Containment strategies include short-term isolation (e.g. network disconnection) and longer-term measures; evidence preservation follows forensic order of volatility, capturing volatile data (memory, connections) before disk and backups.

Business impact analysis (BIA) identifies critical business processes, their dependencies, and the impact of disruption over time; outputs include recovery time objective (RTO) and recovery point objective (RPO).

RTO is the maximum acceptable time to restore a process; RPO is the maximum acceptable data loss measured in time; maximum tolerable downtime (MTD) is the absolute limit before unacceptable harm.

Recovery strategies range from hot sites (near-instant, high cost) through warm sites (partial, hours to days) and cold sites (shell, days to weeks) to reciprocal arrangements and cloud failover.

A business continuity plan addresses keeping critical operations running during disruption; a disaster recovery plan focuses on restoring IT systems and data; both require testing and maintenance.

Plan testing types in increasing rigour: plan review/desk check, tabletop exercise, simulation, parallel test, and full interruption test (highest risk, rarely used for critical systems).

Crisis communication covers internal notification, stakeholder and regulator reporting (breach notification deadlines are jurisdiction-specific), and media handling; single points of contact should be pre-agreed.