CSPI study plan

Define and contrast the core security principles (confidentiality, integrity, availability, plus authenticity, non-repudiation, least privilege) using your own examples

Map the risk management lifecycle end-to-end: asset identification, threat and vulnerability identification, likelihood and impact assessment, risk treatment, and monitoring

Classify each of the four risk treatment options (avoid, mitigate/transfer, transfer, accept) against five realistic business scenarios

Build a one-page glossary of 25 Domain 1 terms with a definition and a distinguishing example for each

Perform a qualitative and a semi-quantitative risk analysis on the same risk register and explain where the two rankings diverge

Calculate single loss expectancy, annualized loss expectancy, and annualized rate of occurrence for at least three scenarios

Draft a business impact analysis outline that specifies recovery time objectives and recovery point objectives for five business functions

Select appropriate security control types (physical, technical, administrative; preventive, detective, corrective, compensating) for the top five risks

Apply a threat modeling method (for example, STRIDE or attack trees) to a simple web application and record at least eight threats

Distinguish security architecture concepts including defense in depth, segmentation, zero trust, and least functionality, and match each to a control you would deploy

Explain how each of the seven layers (or your chosen reference model) of a layered defense contributes to a specific risk you listed in week 1

Compare symmetric and asymmetric cryptography, hashing, and digital signatures, and identify the correct primitive for four stated use cases

Evaluate network security controls (firewalls, IDS/IPS, segmentation, VPNs) against given network scenarios and justify each placement decision

Differentiate authentication factors and select appropriate multi-factor and identity federation approaches for three described environments

Assess the security implications of physical and environmental controls for a data center, including access control, surveillance, and fire suppression

Interpret common control and assurance frameworks at a conceptual level and explain how a control objective maps to an implemented control

Outline the incident response lifecycle and write, for one scenario, the specific actions and decision authority at each phase

Distinguish event, alert, incident, and breach, and classify ten sample log entries into the correct category with a triage priority

Describe the purpose and contents of logging, monitoring, and continuous improvement activities, including what evidence to preserve for later investigation

Sequence containment, eradication, recovery, and post-incident review actions for a ransomware scenario without violating evidence handling

Relate business continuity and disaster recovery planning to incident response, and identify which plan owns which decision

Interpret key legal and regulatory concepts (data protection, breach notification, privacy, records retention) and apply them to two cross-border scenarios

Explain how the security function supports audit, assurance, and third-party/vendor risk management activities

Produce a short board-level briefing that translates one technical risk into business impact and a funding recommendation

Apply a professional code of ethics to three ambiguous workplace situations and justify the chosen course of action

Define the elements of an effective security policy hierarchy and place ten sample documents at the correct level

Outline how governance structures (roles, accountability, oversight committees) assign risk ownership and decision rights

Explain the concepts of due care and due diligence and identify where each appears in a vendor onboarding process

Synthesize the four domains into a single integrated scenario: from risk identification through control selection, monitoring, and incident response

Complete timed practice sets weighted to the exam blueprint (Domain 1 at 30%, Domain 3 at 25%, Domain 4 at 25%, Domain 2 at 20%) and log every missed item by domain

Re-teach your three weakest concepts from the missed-item log without referring to notes

Refine a one-page exam-day strategy covering question triage, time allocation, and handling of unfamiliar terminology