ISACA CSX Fundamentals study plan

Define the core cybersecurity objectives (confidentiality, integrity, availability) and give one concrete business example of each

Differentiate threats, vulnerabilities, risks, and controls, and classify ten sample scenarios into those four categories

List the main attacker archetypes (external attacker, insider, hacktivist, organized crime, nation-state) and match each to a typical motivation and capability level

Explain the role of governance, policy, and risk appetite in an organization's security program

Describe the security lifecycle from asset identification through monitoring and improvement

Identify common control categories (preventive, detective, corrective, compensating) and assign the correct category to fifteen controls

Summarize how security strategy aligns with business objectives and regulatory obligations

Explain defense in depth and least privilege using a layered example

Describe authentication, authorization, and accounting and explain how they differ

Compare knowledge, possession, and inherence factors and evaluate multi-factor combinations

Explain identity lifecycle activities: provisioning, review, deprovisioning, and privileged access handling

Identify weaknesses in password-only authentication and describe compensating controls

Explain encryption at rest, in transit, and in use, and select an appropriate approach for three given scenarios

Distinguish symmetric from asymmetric cryptography and describe how both are combined in practice

Explain hashing, digital signatures, and certificates and what property each provides

Identify common cryptographic failures such as weak key management or misconfiguration

Describe network segmentation, firewalls, and DMZs and explain what each protects against

Explain the purpose of IDS/IPS, proxies, and VPNs and where each sits in an architecture

Summarize secure configuration, patching, and hardening practices for endpoints and servers

Explain logging, monitoring, and SIEM concepts and what makes a log source useful

Describe the phases of incident response and the decision points in each

Distinguish business continuity from disaster recovery and state the purpose of RTO and RPO

Explain backup strategies, including the 3-2-1 principle and restoration testing

Outline how forensic evidence should be preserved and why chain of custody matters

Explain risk assessment approaches (qualitative and quantitative) and when each is appropriate

Describe how risk treatment options (mitigate, transfer, avoid, accept) are selected and documented

Identify key legal and regulatory concepts such as data protection obligations, breach notification, and privacy principles

Explain the purpose of security awareness training and how its effectiveness can be measured

Rehearse all domain objectives by answering practice questions and logging every missed concept

Re-teach the five weakest concepts in writing without notes

Review the terminology map, control table, and risk register for gaps and correct them

Build a one-page pre-exam summary of high-frequency concepts