NCCSI study guide
NCCSI · Work through your exam, one topic at a time.
The NCCSI is a vendor-neutral cybersecurity certification aimed at practitioners who need to demonstrate breadth across both defensive operations and governance. It suits security analysts, system and network administrators moving into security roles, IT auditors, and early-career consultants who must reason about controls rather than just operate tools. The NCCSI study guide has 8 sections and about 2,215 words.
01Security Principles and Governance
Domain 1, Security Principles and Governance, tests whether you can connect security objectives to enforceable rules and accountable decision-making. Expect questions on the CIA triad, least privilege, separation of duties, defense in depth, policy hierarchy, risk appetite, and governance roles.
290 words, about 1 min02Access Control and Identity Management
Domain 2 tests identity lifecycle control: how subjects are identified, authenticated, authorized, and held accountable. Key topics include AAA, multifactor authentication, RBAC, ABAC, MAC, DAC, single sign-on, federation, privileged access management, and joiner-mover-leaver processes.
270 words, about 1 min03Network Security
Domain 3 tests how you reduce network attack surface and enforce traffic policy. Expect zoning, segmentation, DMZs, firewall rule design, stateful inspection, VPNs, IDS/IPS placement, egress filtering, and zero-trust principles.
289 words, about 1 min04Endpoint and System Security
Domain 4 tests hardening and control of servers, workstations, and mobile endpoints across their lifecycle. Topics include secure baselines, patching, endpoint detection and response, antivirus limitations, application allowlisting, host firewalls, disk encryption, secure boot, logging, and device management.
266 words, about 1 min05Cryptography and Data Protection
Domain 5 tests correct use of cryptography to protect data in transit, at rest, and in use. Expect symmetric and asymmetric encryption, hashing, MACs, digital signatures, PKI, key management, tokenization, masking, and forward secrecy.
282 words, about 1 min06Security Operations and Incident Response
Domain 6 tests detection, triage, and coordinated response. Expect logging and SIEM use, alert triage, severity, playbooks, evidence handling, containment, eradication, recovery, communications, and post-incident review.
266 words, about 1 min07Risk Management and Compliance
Domain 7 tests risk-based decisions and the limits of compliance. Topics include risk assessment, likelihood and impact, inherent versus residual risk, control selection, treatment options, third-party risk, business impact analysis, RTO, RPO, and evidence.
270 words, about 1 min08Cloud and Emerging Technology Security
Domain 8 tests security in cloud service models and newer technology patterns. Expect shared responsibility, IaaS/PaaS/SaaS boundaries, identity as the control plane, misconfiguration, cloud security posture management, CASB, containers, infrastructure as code, secrets management, and emerging AI risks.
282 words, about 1 min