CSPI study guide
CSPI · Work through your exam, one topic at a time.
CSPI is a professional certification in security practice, and this page is an independent study companion for candidates preparing for it. The credential is aimed at practitioners who need to combine day-to-day security work with the risk, governance and engineering judgement that surrounds it: analysts moving into broader responsibilities, engineers who increasingly own control decisions, and managers who must defend those decisions to auditors, clients and executives. Because the designation is written as an unexpanded acronym in most candidate enquiries, the first practical step is confirming the exact title and issuing organisation before you register, then reading that body's published content outline. The provisional structure used here splits the material into four areas: security principles and risk management; governance, compliance and professional ethics; security architecture, engineering and controls; and security operations with incident response. The CSPI study guide has 4 sections and about 1,329 words.
01Security Principles and Risk Management
An asset has value; a threat is anything (actor or event) that could harm it; a vulnerability is a weakness a threat can exploit. Risk is the combination of likelihood and impact when a threat exploits a vulnerability - it is never the same as any single one of those terms.
342 words, about 2 min02Governance, Compliance, and Professional Ethics
A policy is management's mandatory statement of intent - high-level, rarely technical, and slow to change. Standards are mandatory specifics (AES-256, 12-character minimum).
338 words, about 2 min03Security Architecture, Engineering, and Controls
Bell-LaPadula protects confidentiality: no read up, no write down. Biba protects integrity: no read down, no write up.
320 words, about 2 min04Security Operations and Incident Response
Prepare → detect and analyze → contain → eradicate → recover → lessons learned. Containment is short-term stabilization (isolate host, block port, disable account) and comes before eradication (remove malware, patch, rebuild).
329 words, about 2 min