GISP study plan

Define each core risk-management term (asset, threat, vulnerability, risk, likelihood, impact, residual risk) in your own words and map how they chain together in a single worked example.

Compare qualitative and quantitative risk analysis, then calculate a single-yearized loss expectancy and an annualized loss expectancy for one scenario using the SLE x ARO formula.

Distinguish the major risk-treatment options (mitigate, transfer, avoid, accept) and justify which one fits three different business constraints.

Outline the components of a security governance program: policies, standards, procedures, guidelines, and how each differs in enforceability.

Build a business continuity and disaster recovery vocabulary sheet covering RTO, RPO, MTD, MTBF, and MTTR, and apply each to a hypothetical outage.

Classify data by sensitivity and map each classification to handling, retention, and destruction requirements.

Describe the data lifecycle from creation through decommissioning and identify the security control expected at each stage.

Explain the roles and responsibilities for data ownership: owner, custodian, steward, and user, with one example duty each.

Select appropriate cryptographic controls for data at rest, in transit, and in use, and state the tradeoffs of symmetric versus asymmetric approaches.

Compare the security properties of the major security models (Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash) and match each to a realistic use case.

Identify the security implications of common architecture weaknesses: single points of failure, unsegmented networks, and shared tenancy.

Evaluate physical security controls for a data center and rank them by deterrence, detection, and delay function.

Diagram the OSI and TCP/IP models side by side and name the attacks that target each layer.

Explain how network segmentation, VLANs, and DMZs reduce blast radius in a compromised environment.

Compare the security posture of common network devices (firewalls, proxies, IDS/IPS, load balancers) and where each belongs in a defense-in-depth design.

Describe how TLS establishes trust and identify the failure modes of certificate validation.

Compare authentication factors and select a multi-factor scheme for two different user populations with different risk profiles.

Explain the identity lifecycle (provisioning, entitlement review, deprovisioning) and the control that prevents orphaned accounts.

Contrast access control models (DAC, MAC, RBAC, ABAC) and justify one for a regulated environment.

Describe how federation and single sign-on shift trust and where the new failure points appear.

Distinguish vulnerability assessment, penetration testing, and red teaming by objective, scope, and output.

Design a test plan that combines automated scanning, manual validation, and remediation tracking with defined severity thresholds.

Explain the purpose and structure of a security operations center and the escalation path for a detected incident.

Sequence the phases of incident response and identify the evidence-handling steps that preserve admissibility.

Compare detective and preventive monitoring controls and specify what each logs, alerts on, and misses.

Explain how change management and configuration baselines reduce operational risk, and identify the control that catches drift.

Describe how secure coding practices (input validation, output encoding, error handling) map to common vulnerability classes.

Identify where security gates belong in a software development lifecycle and what each gate should verify.

Synthesize all eight domains into a single one-page concept map showing how governance, architecture, operations, and development controls reinforce each other.

Complete a timed full-length practice set and categorize every missed question by domain and root cause.

Re-derive the formulas and frameworks you are least confident in from memory, then verify against your notes.

Write a personal exam-day strategy covering time allocation, question triage, and flag-and-return rules.