Information Security and Cybersecurity Controls
Domain 6 tests whether you can evaluate security controls as controls (designed, implemented and operating) rather than as a list of technologies.
Foundations
- Confidentiality, integrity and availability, with accountability as the practical fourth element.
- Defence in depth, least privilege, segregation of duties, and zero trust's operating logic: verify explicitly, assume breach, limit blast radius.
- Identity lifecycle: request and approval, provisioning, periodic access review, timely removal on termination. Late deprovisioning is among the most common and most reportable findings.
- Privileged access: vaulting, session recording, just-in-time elevation, separate administrative accounts, no shared IDs.
Technical control areas
- Authentication: MFA for remote and privileged access; password complexity alone is weak; conditional access and SSO change the risk profile.
- Encryption in transit and at rest plus key management: HSM storage, rotation, separation of duties. Encryption without key control is false comfort.
- Vulnerability management: asset inventory, authenticated scanning, risk-based prioritisation (severity, exploitability, exposure), defined patch SLAs, remediation verification. Penetration testing validates; scanning enumerates.
- Logging and monitoring: centralised collection, defined use cases, retention, SOC escalation paths, tested alerting.
- Incident response lifecycle (NIST SP 800-61): preparation; detection and analysis; containment, eradication and recovery; post-incident activity with lessons applied.
Worked example
An access review shows 500 privileged accounts; 40 belong to leavers, and 25 of those were still enabled more than 30 days after termination. The control is not the quarterly review, it is the termination trigger. The auditor tests the HR-to-directory feed, samples terminations across the period, and reports the failure rate against the population rather than citing 40 as the total exposure.
Traps
- Treating a policy document as an operating control.
- Accepting a scan report with no remediation evidence.
- Reviewing access recertification without checking approver independence.
- Concluding on security from a penetration test with a narrow external scope.