ISSEP study plan

Diagram the end-to-end system security engineering process (requirements, architecture, design, implementation, verification, transition) and label where security gates occur

Derive a security requirements baseline from a sample system description using misuse cases and security functional requirements categories

Apply a requirements traceability matrix to connect stakeholder needs to security controls

Identify at least three common failure modes in requirements elicitation (ambiguous, incomplete, conflicting) and write a mitigation for each

Build a security planning outline that aligns security architecture activities with acquisition phases and milestones

Perform a qualitative risk assessment on a sample architecture using likelihood, impact, and risk tolerance criteria

Map identified risks to candidate security controls and document residual risk acceptance criteria

Compare at least two risk frameworks (e.g., NIST RMF and ISO 31000) and note where they diverge in operational context

Draft procurement security requirements for a hardware/software acquisition, including supply chain and evaluation criteria

Evaluate vendor responses against weighted security criteria and document a source-selection rationale

Define verification and acceptance testing activities that map to contractual security requirements

Outline a configuration management and change control process for delivered security components

Design a continuous monitoring plan with metrics, thresholds, and escalation paths for a deployed system

Analyze a sample incident scenario and produce a containment, eradication, and recovery sequence

Integrate vulnerability management outputs into the risk register and prioritize remediation using exploitability and asset criticality

Document operational security procedures for backup, patch, and access review cycles

Translate a set of security requirements into an architecture view (logical, deployment, and data flow) with trust boundaries marked

Select and justify security design patterns (e.g., least privilege, defense in depth, fail-safe defaults) for specific components

Conduct a design review against a threat model and record findings with severity and recommended changes

Verify that each architecture decision traces back to a requirement or accepted risk

Create a security engineering plan that sequences activities across a program lifecycle and assigns roles

Develop a test and evaluation master plan outline that includes developmental, operational, and security testing

Estimate resource needs (staff, tools, schedule) for the plan and identify dependencies and constraints

Review a sample statement of work and flag security gaps with recommended language

Operate a tabletop exercise on a sample system failure and document decisions, communications, and gaps

Evaluate security operations metrics (mean time to detect, patch latency, control coverage) and propose improvements

Update the risk register and monitoring plan based on exercise findings

Draft a management briefing that summarizes residual risk and recommended investments

Synthesize the prior deliverables into a single integrated case study narrative across all six domains

Complete a timed 60-question practice set and categorize every miss by domain and root cause

Re-derive the three most-missed concepts from first principles and write a concise explanation for each

Produce a personal exam-day strategy covering time allocation, question triage, and review checkpoints