CSIS study guide
CSIS · Work through your exam, one topic at a time.
The Certified Information Security Specialist (CSIS) is a vendor-neutral, multiple-choice credential aimed at practitioners who need breadth across the security discipline rather than depth in a single product. It suits security analysts, administrators, auditors and IT generalists moving into a dedicated security role, as well as managers who must evaluate technical decisions without making them. The CSIS study guide has 8 sections and about 3,288 words.
01Security Fundamentals and Governance
Security exists to protect the confidentiality, integrity and availability (CIA) of information, plus supporting properties such as authenticity, non-repudiation and accountability. Candidates must be able to map a control or incident to the property it protects: encryption protects confidentiality, hashing and change control protect integrity, redundancy and backups protect availability.
346 words, about 2 min02Access Control and Identity Management
Access control answers four questions in sequence: identification (who claims to be there), authentication (prove it), authorization (what may they do) and accountability (what did they do, via logging). Keep that order straight - many questions hinge on it.
342 words, about 2 min03Cryptography and Key Management
Separate the goals before choosing a tool. Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) solves key distribution and enables signatures but is slow.
375 words, about 2 min04Network and Perimeter Security
Be fluent in the layers you will be asked to place a control at: physical/data link (802.1X, MAC filtering, VLANs), network (IPsec, routing, ACLs), transport (TLS, port filtering), application (WAF, proxies, DNS filtering). Perimeter design is now about segmentation rather than a single edge: DMZs for internet-facing services, internal zones by sensitivity, micro-segmentation and zero trust for east-west traffic.
354 words, about 2 min05Security Architecture and Engineering
Architecture questions test whether you can place security requirements into a design before code exists. Know the classic design principles: least privilege, separation of duties, economy of mechanism, fail-safe defaults, complete mediation, open design, least common mechanism, psychological acceptability, and trust boundaries.
384 words, about 2 min06Risk Management, Compliance and Legal Issues
Risk language is precise and heavily tested. Risk is the combination of the probability of an event and its consequence; assets have vulnerabilities, threats exploit them, and controls modify likelihood or impact.
741 words, about 4 min07Security Operations and Incident Response
Operations is continuous: centralise logs in a SIEM, define baselines from hardened configurations, monitor for deviation, and manage change and patching with documented approvals and rollback plans. Vulnerability management is a cycle - discover, prioritise by risk and exploitability, remediate or mitigate, verify - not a scan report.
366 words, about 2 min08Application and Data Security
Application security starts in the SDLC: security requirements, design threat modelling, secure coding standards, code review, SAST, SCA for third-party components, DAST against running builds, and a gated release. Shift-left reduces cost, but you still need runtime testing and monitoring; SAST reads source, DAST probes a live app, and SCA maps dependencies to known vulnerabilities.
380 words, about 2 min