I85PREP
⌘ K
TR-C study materials
TR-C study resources

TR-C: TR-C Domain 2: Planning and Design

TR-C · Work through your exam, one topic at a time.

All guide sections

TR-C Domain 2: Planning and Design

TR-C Domain 2, Planning and Design, tests how you turn business and compliance requirements into a scoped, risk-based design. Questions often ask you to choose design inputs, define boundaries, classify data, select controls, and show traceability from requirement to control to test. The exam favors designs that are testable, proportionate, and explicit about assumptions and dependencies.

Core rules

  • Start with scope and data flows. Identify where data is created, processed, stored, transmitted, and deleted, including third parties.
  • Classify data before choosing controls. Confidentiality, integrity, availability, retention, and privacy obligations drive control strength.
  • Map each requirement to a control objective, a control activity, an owner, and a test method. A control that cannot be tested cannot be reliably evidenced.
  • Apply defense in depth and least privilege. Avoid single controls that carry the whole design, such as relying only on a firewall or only on user training.
  • Record design assumptions, compensating controls, and residual risk acceptance. Design decisions should survive an audit and a staff change.

Worked example

A customer portal will store identity documents. Requirements are confidentiality, auditability, and 99.9% availability. The design classifies the documents as confidential; uses SSO with MFA, TLS in transit, encryption at rest, and centralized logging; sets a one-year retention rule; adds redundant storage; and requires vendor due diligence for the document-checking API. Each requirement is entered in a traceability matrix with an owner and a test, such as sampling access logs or restoring a backup. A legacy integration that cannot support MFA receives a documented compensating control and a time-bound remediation plan.

Traps

Do not design before scoping, or you will over-build and miss data flows. Do not treat a framework mapping as a design; ISO/IEC 27001 Annex A or NIST CSF references still need local control activities. Do not propose untestable controls. Do not ignore third-party and retention requirements, and do not hide compensating controls in narrative rather than explicit risk acceptance.