GISP study guide
GISP · Work through your exam, one topic at a time.
The GIAC Information Security Professional (GISP) is a practitioner-level certification from GIAC, an ISO/IEC 17024 personnel certification body accredited through ANAB. GIAC positions GISP as a pragmatic alternative to the CISSP, signaling broad security domain fluency validated by a respected provider. The GISP study guide has 8 sections and about 3,690 words.
01Security and Risk Management: Governance, Quantified Risk, and Business Continuity
Domain 1 is the governance layer of the GISP blueprint. Questions probe whether you can connect business objectives to controls, express risk in terms a budget owner can act on, document who accepted which residual risk, and keep continuity planning aligned to real recovery limits.
440 words, about 2 min02Asset Security: Classification, Ownership, Lifecycle, and Secure Disposal
Domain 2 tests how information is classified, who is accountable for it, how handling rules follow it through its lifecycle, and how it is destroyed when no longer needed. Privacy obligations and data remanence questions appear frequently because they expose the difference between deleting a reference and erasing the data.
460 words, about 2 min03Security Architecture and Engineering: Models, Cryptography, and Trusted Components
Domain 3 checks whether you can select a security model that matches the requirement, reason about where trust is anchored in a system, and apply cryptography correctly. Expect questions on formal models, the trusted computing base, virtualization and cloud boundaries, key management, and physical and environmental controls.
476 words, about 2 min04Communication and Network Security: Segmentation, Filtering, and Secure Protocols
Domain 4 moves from architecture to data in motion. The exam tests whether you can place a control at the right layer, design deny-by-default filtering between zones, choose protocols that still make sense in 2024 and beyond, and recognize where encryption stops protecting you.
487 words, about 2 min05Identity and Access Management: Federation, Models, and Lifecycle Control
Domain 5 tests the full identity path: proving who someone is, deciding what they may do, recording what they did, and removing access when the relationship ends. Expect questions on authentication factors, federation protocols, access control models, privileged access, and joiner-mover-leaver hygiene.
446 words, about 2 min06Security Assessment and Testing: Scoping, Evidence, and Interpreting Results
Domain 6 asks how you prove a control works. The exam distinguishes assessment types, tests whether you can read scanner and scoring output critically, and checks that you can design tests with valid scope, sampling, and authorization.
439 words, about 2 min07Security Operations: Incident Response, Evidence Handling, and Recovery
Domain 7 covers running security day to day: detecting and responding to incidents, preserving evidence defensibly, keeping backups restorable, controlling change, and protecting facilities. Questions often hinge on sequencing: what happens first, and what action destroys something you cannot get back.
459 words, about 2 min08Software Development Security: Secure Design, Threat Modeling, and Pipeline Gates
Domain 8 tests whether security is built into how software is specified, designed, built, tested, and acquired. Questions focus on design principles, threat modeling, the classes of defect that keep appearing in real applications, and controls that belong in a CI/CD pipeline rather than in a late review.
483 words, about 2 min