Core Principles and Frameworks
Principles that recur
Candidates should be able to explain least privilege, separation of duties, defense in depth, fail-safe defaults, need to know, and least functionality. These are design principles, not products, and questions test whether you can apply them to a scenario rather than recite them.
Frameworks in outline
You should recognize the purpose of major framework families without memorizing clause numbers. Control catalogs organize safeguards into families (access, audit, incident response, and so on). Risk-management frameworks describe a cycle: identify, assess, treat, monitor. Governance frameworks describe how oversight, roles, and reporting are structured. The exam rarely asks for a specific publication number; it asks which framework type fits a described need.
Traps to watch
- Choosing the most specific framework when the question asks for a broad governance structure, or vice versa.
- Confusing defense in depth (independent layers) with redundancy (duplicate copies of the same layer).
- Assuming separation of duties requires two people; it can also be enforced by system-enforced role splits.
- Overlooking that fail-safe defaults means denying by default when a decision cannot be made.
Rule of thumb
Match the framework to the question being asked: "What should we do?" → control catalog. "How risky is this?" → risk framework. "Who decides and who reports?" → governance framework.
Worked example
A team wants one administrator to both approve and deploy production changes. Applying separation of duties, you split approval from deployment, so no single person can push an unapproved change. Defense in depth adds a second layer - automated tests and audit logging - so a lapse in one control does not become a breach.