ISSAP study plan

Map every GRC artifact named in the ISSAP domain 1 and 2 outlines (policies, standards, baselines, risk registers, control catalogs) to the architecture decision it constrains, and write a one-line rationale for each mapping

Draft a risk-treatment workflow that shows how an architect converts a business impact analysis output into a control selection and a residual-risk acceptance record

Classify at least ten legal and regulatory drivers (privacy, sector-specific, contractual, cross-border data transfer) by whether they impose design constraints, evidence obligations, or both

Build a personal glossary of 40 GRC and compliance terms with a worked example of each used inside a security architecture document

Write a control framework crosswalk that maps one internal control set to two external frameworks and flags where the mappings are one-to-many or non-existent

Produce a compliance-impact assessment template that an architect can complete before design approval, covering data classification, retention, residency, and audit rights

Explain in writing how security architecture review boards, exception processes, and risk appetite statements interact when a design cannot meet a stated standard

Identify the evidence an auditor would request for five common architecture controls and confirm each evidence type is producible by design rather than reconstructed after the fact

Translate a set of business requirements into measurable security requirements using a structured format (requirement, rationale, verification method, acceptance threshold)

Derive infrastructure and system security requirements from threat modeling of a defined architecture, and show which threats drive which requirement

Distinguish functional, non-functional, and assurance requirements and rewrite three vague statements into testable ones

Establish a requirements traceability approach that links business drivers to security requirements to design components to verification tests

Design a segmented reference architecture covering network zones, trust boundaries, and enforcement points, and justify each boundary with a specific threat or requirement

Specify cryptographic controls end to end: data at rest, in transit, in use considerations, key management lifecycle, and crypto-agility provisions

Define resilience and availability requirements including backup, recovery objectives, and failover behavior, and state how each will be validated

Document hardening baselines and configuration management expectations for at least three technology tiers (compute, network, data platform)

Model the full identity lifecycle from provisioning through deprovisioning, naming the authoritative source, approval gate, and audit record at each stage

Compare authentication approaches (phishing-resistant factors, federation, step-up, device-bound credentials) and select one per user population with written justification

Design an authorization model for a multi-tenant system and demonstrate how it enforces least privilege and separation of duties

Specify the accounting and logging pipeline including what events are captured, retention, integrity protection, and how identity events feed detection

Build a verification and validation plan that pairs each architecture claim with an evidence-producing activity (review, test, inspection, demonstration)

Design an architecture review process with entry criteria, reviewer roles, and a scoring rubric that can reject a design

Create abuse-case tests for the authorization model from week 5 and predict the expected result of each

Define acceptance criteria and exit conditions for a design phase so validation is not deferred entirely to operations

Conduct a self-scored architecture review of your week 4 reference design using the week 6 rubric, and record every finding with severity and remediation

Trace three requirements from week 3 all the way to a validation result and document any breaks in the chain

Reconcile the design against the week 1 traceability matrix and identify controls that are designed but unverifiable

Produce a residual-risk statement for the reviewed architecture suitable for a risk acceptance decision

Rehearse scenario-based decision making by writing structured answers to six architecture scenarios, one per domain, each with assumptions, options, trade-offs, and a recommendation

Consolidate all prior deliverables into a single indexed portfolio and identify which artifacts answer which domain's typical question style

Audit your weakest two domains against the portfolio and close at least three specific knowledge gaps with targeted reading and notes

Build a one-page decision framework you can apply to any scenario question, covering requirement elicitation, risk framing, design choice, and validation