NISP Level 1 - Security Awareness study plan

Define the CIA triad and give one realistic workplace example of a confidentiality, integrity, and availability failure each

Distinguish between threat, vulnerability, risk, and control, and classify five short scenarios into those four categories

Explain the difference between an insider threat and an external attacker, and describe two behavioral red flags for each

List at least six everyday security-aware behaviors expected of a non-technical employee and state why each matters

Recite the organization's security escalation path from memory, naming the role you report to first

Match common social-engineering tactics (pretexting, urgency, authority, quid pro quo, tailgating) to real message examples

Identify at least eight red flags in a suspicious email by inspecting sender address, link target, greeting, tone, and attachment type

Explain the difference between phishing, spear phishing, vishing, and smishing, and describe the delivery channel of each

Draft the correct response steps for a suspected phishing email, from non-clicking through reporting and deletion

Describe how multi-factor authentication reduces the impact of a stolen credential in a phishing attack

Apply passphrase construction rules to build three strong, memorable passphrases and explain why length beats complexity

Identify at least five unsafe password habits and state the concrete risk each creates

Explain how password managers, MFA, and single sign-on interact, and list two risks of reusing passwords across sites

Describe account takeover warning signs and the steps to recover a compromised account

Analyze a business email compromise scenario and explain why verifying payment changes by phone protects the organization

Distinguish malware types (virus, worm, trojan, spyware, adware, keylogger, rootkit) by propagation method and behavior

Explain how ransomware encrypts files and extortion works, and list four preventive habits that reduce infection risk

Identify unsafe browsing and download behaviors, including fake update prompts, cracked software, and malicious browser extensions

Apply mobile device hardening: screen lock, app permissions review, OS updates, and safe public Wi-Fi use

State the immediate do-and-do-not steps when malware or a ransomware note is suspected

Classify data you handle daily into public, internal, confidential, and restricted tiers with one example each

Apply the principle of least privilege and data minimization to three everyday work tasks

Explain key privacy obligations around personal data collection, retention, and sharing, and describe what a privacy notice must communicate

Identify physical security controls for badges, visitor management, clean desk, and secure disposal of documents and media

Describe environmental and physical risks such as tailgating, shoulder surfing, unattended devices, and printer leftovers, and the countermeasure for each

Define what constitutes a security incident versus a near miss, and classify five scenarios correctly

State the reporting chain, time expectations, and information to include in an initial incident report

Explain the difference between backup, replication, and archiving, and why replication is not a backup

Describe the 3-2-1 backup rule and the difference between RTO and RPO in plain language

Outline how business continuity and disaster recovery plans differ and what role an ordinary employee plays in each

Explain why an acceptable use policy exists and list five behaviors it typically permits and five it typically prohibits

Distinguish among law, regulation, standard, and internal policy, with one example of each

Describe core obligations of common data protection and privacy frameworks in general terms without citing specific article numbers you are unsure of

Explain the employee's duty to report suspected policy violations and the protection typically offered to good-faith reporters

Identify consequences of non-compliance for the individual and the organization

Review all ten domain summaries and produce a one-page condensed cheat sheet per domain

Complete at least 120 self-written or openly available practice questions and log every miss with its cause

Re-teach your three weakest domains aloud in five minutes each without notes

Simulate a full incident from detection to report to containment and identify where your response slipped

Confirm your personal action list from earlier weeks is fully closed out