Information Security Fundamentals
What this domain tests
Domain 1 covers the vocabulary and mental models the rest of the exam depends on: what information security protects, how threats become risk, and how controls change that risk. Expect definition questions, classification of controls, and short scenarios asking you to identify a threat, vulnerability, or risk treatment.
Core definitions
- Data vs information: data are raw facts; information is data with meaning. Information security protects information, but controls often apply to data, systems, people, and premises.
- CIA triad: confidentiality means only authorized people or processes can access information; integrity means information is accurate, complete, and protected from unauthorized change; availability means authorized users can access it when needed.
- Threat: a potential cause of an unwanted incident, such as a person, malware, fire, or flood. A vulnerability is a weakness a threat can exploit, such as unpatched software, a poor procedure, or an unlocked door.
- Risk: commonly expressed as likelihood multiplied by impact on an asset. Risk is not the same as a threat or a vulnerability.
- Assets include information, hardware, software, services, people, and reputation.
Risk management in practice
Risk management identifies assets, threats, and vulnerabilities; estimates likelihood and impact; evaluates the result against agreed criteria; and treats the risk. Treatment options are reduce (add controls), transfer (insurance or contract), avoid (stop the activity), and accept (formally tolerate the residual risk). Management owns risk acceptance; security staff advise.
Control families
Controls are often classified as preventive (stop an incident), detective (discover it), and corrective/repressive (limit damage or restore service). They can also be organizational, physical, or technical.
Worked example
A consultant's laptop containing client data is left in a car and stolen. Asset: laptop and client data. Threat: theft. Vulnerabilities: unencrypted disk, no cable lock, data stored locally. Likelihood: medium; impact: high because of confidentiality loss and possible regulatory notification. Risk: high. Preventive controls: full-disk encryption, cable lock, secure storage procedure. Detective: asset register and periodic audit. Corrective/repressive: remote wipe and restore from backup. Encryption reduces confidentiality impact but does not restore availability; backup restores availability but does not undo disclosure. The residual risk is documented and accepted or further treated.
Traps that cost marks
Do not label a threat as a vulnerability: the stolen laptop is not the weakness; the missing encryption is. Do not say a control eliminates risk; it reduces risk to a residual level. Accept is a formal management decision, not ignore. Availability is not integrity: a correct but inaccessible record fails availability.
ISO/IEC 27001: ISMS Requirements and Controls
What this domain tests
Domain 2 tests the requirements of ISO/IEC 27001, the certifiable management-system standard for an information security management system (ISMS). Questions focus on the clause structure, risk assessment and treatment, the Statement of Applicability, Annex A, and continual improvement, not on memorizing every control.
The ISMS and clause structure
ISO/IEC 27001 requires an organization to establish, implement, maintain, and continually improve an ISMS. The main requirements are organized in clauses 4–10: context of the organization (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9), and improvement (10). Clause 6 contains risk assessment and risk treatment; clause 9 covers monitoring, internal audit, and management review.
PDCA and the control set
The 2013 edition describes the ISMS through Plan–Do–Check–Act: plan the ISMS and risk treatment, implement it, check performance, and act on nonconformities. The 2022 revision keeps the same process logic in the harmonized clause structure. Annex A is a reference set of controls, not a mandatory checklist. The 2013 edition lists 114 controls in 14 domains; the 2022 edition restructures them into 93 controls in four themes: organizational, people, physical, and technological. ISO/IEC 27002 provides implementation guidance and is not certifiable.
Risk treatment and the SoA
The organization must define a risk-assessment method, produce consistent results, identify risks, analyze them, and evaluate them against criteria. Risk treatment selects controls and produces a Statement of Applicability (SoA): it lists each Annex A control, whether it is applicable, and the justification, including why an excluded control is not needed. Risk owners approve residual risk.
Worked example
A SaaS company finds that a departing contractor still has admin access to production. Asset: customer data and service. Threat: misuse of credentials. Vulnerability: no joiner–mover–leaver process and no periodic access review. Likelihood: high; impact: high. Treatment: reduce by adding an access-review control and a leaver checklist, mapped to the Annex A access-control and human-resources controls. These are marked applicable in the SoA with the risk reference. The risk owner accepts the residual risk after the review. If the company claimed the control was not applicable, the SoA would need a documented justification; 'we forgot' is not acceptable.
Traps that cost marks
ISO/IEC 27001 does not require every Annex A control; it requires justified inclusion or exclusion in the SoA. Certification covers the ISMS, not a promise that no incident will occur. Do not confuse ISO/IEC 27001 (requirements) with ISO/IEC 27002 (guidance). Management review is not the same as internal audit. Continual improvement is a requirement, not an optional extra.