ISC Engineer study plan
ISC Engineer · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Concepts and Fundamentals & Network Security Architecture and Design
Define and contrast confidentiality, integrity, and availability using three original workplace examples
Map the OSI model layers to the security controls that operate at each layer
Diagram a reference network with DMZ, segmentation, and least-privilege trust boundaries
Explain defense in depth and identify where single points of failure weaken it
Your checkpoint
A one-page annotated network diagram with trust boundaries plus a written mapping of OSI layers to controls
Network Security Architecture and Design & Security Engineering and Implementation
Compare firewall, IDS/IPS, and proxy placement options and justify each choice
Design a segmented architecture that enforces least privilege between zones
Select hardening baselines for servers and network devices and list the specific settings to change
Identify where encryption and authentication belong in the architecture you designed
Your checkpoint
A design document proposing a segmented architecture with a control-placement table and hardening checklist
Security Engineering and Implementation & Access Control and Identity Management
Implement a hardening checklist against a test host and record each change made
Configure role-based access using least privilege and separation of duties on a sample system
Compare authentication factors and select an appropriate multi-factor approach for a given scenario
Evaluate federation and single sign-on tradeoffs against directory-based authentication
Your checkpoint
A hardening and access-control lab report showing before/after configuration and a justified MFA recommendation
Cryptography and Key Management & Access Control and Identity Management
Distinguish symmetric, asymmetric, and hashing primitives and match each to a use case
Explain key lifecycle stages from generation through destruction and the controls at each stage
Design a key management scheme for data at rest and in transit
Assess certificate and PKI trust chain weaknesses in a described scenario
Your checkpoint
A cryptography decision matrix mapping use cases to algorithms, key lengths, and lifecycle controls, plus a PKI risk write-up
Security Assessment, Testing, and Monitoring & Security Concepts and Fundamentals
Differentiate vulnerability scanning, penetration testing, and configuration review by purpose and output
Draft a scoped assessment plan with rules of engagement and success criteria
Interpret sample scan findings and rank them by risk with justification
Define logging, monitoring, and alerting requirements that would detect the weaknesses you found
Your checkpoint
A scoped assessment plan with rules of engagement and a prioritized findings register from sample scan data
Security Assessment, Testing, and Monitoring & Incident Response and Business Continuity
Build a detection-to-response flow that links monitoring alerts to incident triage steps
Classify a sample incident by severity and outline containment, eradication, and recovery actions
Compare recovery objectives and select RTO/RPO values for stated business functions
Evaluate backup strategies against the recovery objectives you selected
Your checkpoint
An incident response runbook for one scenario plus a business impact table with justified RTO/RPO values
Incident Response and Business Continuity & Security Governance, Risk, and Compliance
Draft continuity and disaster recovery procedures that meet the recovery objectives from week 6
Perform a qualitative risk assessment using likelihood and impact scoring on a sample asset inventory
Select risk treatment options and justify each against a stated risk appetite
Map a control set to a governance framework and identify coverage gaps
Your checkpoint
A risk register with treatment decisions plus a control-to-framework gap analysis
Security Governance, Risk, and Compliance & Security Concepts and Fundamentals & Network Security Architecture and Design & Security Engineering and Implementation & Cryptography and Key Management & Security Assessment, Testing, and Monitoring & Incident Response and Business Continuity
Summarize policy, compliance, and audit obligations and their effect on engineering decisions
Reconcile the artifacts from weeks 1-7 into a single coherent security program narrative
Complete two timed practice sets and log every missed concept by domain
Re-study the three weakest domains using the logged misses as a study list
Your checkpoint
A consolidated program summary linking all eight domains plus a scored practice log with a prioritized review list
Milestones
Week 2: Can explain and defend the segmented architecture and control placement without notes
Week 4: Can match any given use case to a cryptographic primitive and key lifecycle control and justify the choice
Week 6: Can walk from a monitoring alert through triage, containment, and recovery objectives in under 10 minutes of explanation
Week 8: Practice scores show no domain below 70 percent and the consolidated summary covers all eight domains