CISSO study plan

Map every governance artifact a security program needs (charter, policies, standards, baselines, procedures) and label which tier each sample document belongs to

Define risk terminology precisely (asset, threat, vulnerability, likelihood, impact, inherent vs residual risk) and write one-paragraph definitions in your own words

Walk through a qualitative risk assessment end to end on a small fictional system, assigning likelihood and impact scores and justifying each

Distinguish risk avoidance, mitigation, transference, and acceptance, and match each to two concrete examples

Compare common control frameworks conceptually (governance vs control-catalog vs process-improvement families) without quoting any proprietary text

Build a risk appetite and tolerance statement for a fictional organization and explain how each drives escalation thresholds

Trace how security strategy flows from business objectives into measurable security metrics

Practice explaining third-party/supply-chain risk due diligence steps in sequence

Diagram a defense-in-depth architecture for a hybrid environment and justify each layer's purpose

Explain cryptographic primitives (symmetric, asymmetric, hashing, key exchange) and select appropriate algorithms for data at rest, in transit, and in use

Describe identity and access management concepts: authentication factors, federation, least privilege, separation of duties, privileged access management

Compare network segmentation approaches (VLANs, subnets, microsegmentation, zero trust) and state when each is warranted

Explain secure SDLC gates and where threat modeling, code review, and security testing fit

Differentiate vulnerability scanning, penetration testing, and configuration compliance, and describe outputs of each

Describe logging, monitoring, and SIEM use cases, including what makes a log source valuable

Summarize change management and configuration baseline enforcement for operational security

Order the incident response lifecycle phases and list the decisions made in each

Classify incidents by severity and define escalation triggers and notification paths

Draft containment, eradication, and recovery options for a ransomware scenario and state trade-offs of each

Explain tabletop exercise design: objectives, scenario injects, participants, and after-action outputs

Distinguish RTO, RPO, MTD, and MTTR and apply them to a tiered application portfolio

Compare backup strategies (full, incremental, differential, snapshot, immutable) and match each to recovery objectives

Sequence disaster recovery plan activation, including declaration authority and communications

Apply forensic fundamentals: order of volatility, chain of custody, evidence integrity, and when to isolate versus power off a host

Map the accreditation lifecycle (categorize, select controls, implement, assess, authorize, monitor) and identify who signs the authorization decision

Distinguish laws, regulations, standards, and contractual obligations and give an example of each relevant to security programs

Explain data classification, retention, and privacy obligations including breach notification triggers

Describe audit evidence types and how to respond to findings with corrective action plans

Integrate all four domains by solving a full-length practice scenario set and tagging each miss to a domain and a root cause

Re-drill every weak objective identified in earlier weeks using your own notes only

Rehearse explaining cross-domain linkages aloud, such as how a risk decision drives an architecture control that produces audit evidence

Build a final one-page recall sheet of formulas, thresholds, and lifecycle sequences