C-ACYFSW study guide
C-ACYFSW · Work through your exam, one topic at a time.
C-ACYFSW is an independent certification-style exam focused on applied cybersecurity resilience and secure operations. It is aimed at practitioners who sit between hands-on engineering and program-level decision making: security analysts moving toward architecture roles, IT and cloud administrators who own hardening and recovery duties, risk and compliance staff who need technical fluency, and team leads accountable for keeping services running under attack. The C-ACYFSW study guide has 9 sections and about 2,582 words.
01Cyber Resilience Strategy and Governance
Cyber resilience strategy and governance is about how leadership sets direction, allocates authority, and keeps security functioning through disruption. Candidates should be fluent in the distinction between governance (decision rights, accountability, policy, risk appetite) and management (execution of controls).
317 words, about 2 min02Risk Management and Threat Assessment
This domain tests whether you can move from raw threat data to defensible risk decisions. Understand the risk equation: risk as a function of likelihood and impact , with inherent risk before controls and residual risk after.
319 words, about 2 min03Security Architecture and Engineering
Architecture questions reward understanding of design principles and where controls sit. Master defense in depth , least privilege , separation of duties , fail-safe versus fail-open , secure defaults , and trust boundaries .
312 words, about 2 min04Identity, Access, and Data Protection
Identity is the modern control plane. Understand the identity lifecycle: proofing, provisioning, authentication, authorization, review, and deprovisioning, plus joiner-mover-leaver risk.
280 words, about 1 min05Network and Endpoint Security Operations
Operations questions test whether you can keep defenses running and detect what slips through. Know network zoning and segmentation, DMZ design, east-west traffic controls, and where inspection happens.
266 words, about 1 min06Incident Response and Recovery
Incident response is a lifecycle, not an event. Know the phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.
276 words, about 1 min07Third-Party and Supply Chain Risk
Supply chain risk asks how you extend trust deliberately. Understand third-party lifecycle: due diligence, contracting with security requirements, onboarding, ongoing monitoring, and offboarding with data return or destruction.
266 words, about 1 min08Compliance, Audit, and Awareness
Compliance questions test whether you can distinguish obligation, control, and evidence. Know the major regimes by purpose: GDPR for personal data and privacy rights, HIPAA for health information, PCI DSS for card data, SOX for financial reporting controls, and sector regulators.
283 words, about 1 min09Emerging Technology and Workforce Security
This domain covers new technology risk and the human layer. For emerging tech, reason about AI/ML risk : data poisoning, model theft, prompt injection, hallucination, and output trust; plus governance concepts like model inventory, human oversight, and evaluation.
263 words, about 1 min