Security foundations, governance and Chinese context
This domain covers the vocabulary and models that every later domain assumes: what security protects, how it is decomposed, and the formal rules that describe access control. NISP Level 1 questions here are usually definitional, so precision matters more than depth.
Core vocabulary and the CIA triad
Confidentiality, integrity and availability are the three classic goals; authenticity, non-repudiation and accountability are added as supporting properties. A threat is a potential cause of harm, a vulnerability is a weakness a threat can exploit, and risk combines threat, vulnerability and impact. Controls are preventive, detective or corrective, and can be administrative, technical or physical.
Formal security models
- Bell-LaPadula - confidentiality. No read up (simple security property), no write down (*-property), plus the discretionary property.
- Biba - integrity. No read down, no write up: the mirror image of Bell-LaPadula.
- Clark-Wilson - integrity via well-formed transactions and separation of duties; users act on data only through approved transformation procedures.
- Brewer-Nash (Chinese Wall) - prevents conflicts of interest by dynamically restricting access once a user touches a competing dataset.
- Harrison-Ruzzo-Ullman - an access matrix whose rights can be granted and revoked; used to reason about safety.
Worked example
An analyst cleared at Secret tries to open a Top Secret report. Bell-LaPadula's simple security property forbids reading up, so the request is denied even though the analyst is trusted. Under the basic Bell-LaPadula rules stated here, writing up is not forbidden by the no-write-down property, although other permissions or a stronger model variant can still restrict the operation. Bell-LaPadula protects confidentiality, not integrity; Biba would give the opposite answers.
Traps
- Mixing the direction of the rules; remember that Bell-LaPadula protects secrets and Biba protects correctness.
- Treating a model as a product feature rather than a policy abstraction.
- Confusing a vulnerability (the weakness) with the risk (the possible loss).
- Forgetting that least privilege, need-to-know and separation of duties are principles, not formal models.
Governance sets direction, not controls
Corporate IT governance is the framework of structures, roles, and processes through which the board and senior leadership direct IT and ensure IT risk is managed within agreed limits. It is distinct from IT management: governance decides what level of risk is acceptable and who is accountable, while management decides how to achieve it. Candidates should know COBIT (governance and management objectives, goals cascade), ISO 31000 (risk principles, framework, process), and the Three Lines Model (operational management; risk and compliance oversight; independent internal audit). Also know the escalation path linking the board, audit committee, CRO, CISO, and business risk owners, and the document hierarchy: policy (board-approved intent) to standard (specific mandatory requirements) to procedure (step-by-step instructions).
Three terms are tested repeatedly. Risk appetite is the amount and type of risk the enterprise is willing to pursue. Risk tolerance is the acceptable variation around that appetite. Risk capacity is the maximum risk the enterprise could bear before failure. A fourth, risk culture, is reflected in behavior and incentives, not in documents.
Traps
Questions blur governance with management, so "the CISO sets the enterprise risk appetite" is wrong: the board or its risk committee approves appetite, while the CISO proposes and implements. Another trap treats internal audit as a control owner; the third line must stay independent. Watch also for "tone at the top" items where the answer is leadership behavior and culture, not a new tool.
Rule of thumb
Ask: who is accountable versus who executes? The board approves appetite and policy; the risk owner accepts residual risk; internal audit gives independent assurance.
Worked example. A board states the enterprise will absorb at most $2 million of annual loss from IT outages. IT engineers recovery targets to that limit and each business unit's risk owner documents acceptance of residual outage risk inside the stated appetite: governance above, execution below.
Chinese legal context and evidence
For these Chinese catalog credentials, distinguish national legal duties, technical standards, contracts and the organization's own policy. The Cybersecurity Law addresses network-security responsibilities and graded protection; the Data Security Law concerns data-security governance; the Personal Information Protection Law addresses personal-information processing. These instruments overlap without becoming interchangeable. The current official Cybersecurity Law text places the relevant network-log retention requirement in Article 23, including at least six months under its stated conditions. Do not extend one requirement to every data type or infer a complete compliance result from it.
Identify the actual system, responsible role, data categories and activity before selecting applicable requirements. A privacy or cross-border question may require facts that a short security scenario does not supply. A technical standard number is not a substitute for reading its scope and applicable version. Grade, assessment frequency, reporting deadline, processing permission and cross-border route should be checked against the current official sources and actual circumstances; no universal hospital grade or automatic overseas-transfer permission is invented here. Keep the requirement, responsible owner, supporting evidence and review trigger linked in a compliance record. Passing a technical check does not itself establish every legal duty has been met.