Practising Domains 1 and 2: security and risk management, and asset security · CISSP-160 Lesson 5

This lesson starts four practice lessons that work through the eight domains in pairs. Each one begins with a short map of what the domains cover and which ideas appear most often, then works through original practice items in the CISSP style, with the reasoning behind each answer. The items are not taken from any exam; they are written to exercise the same judgement. Try each one before reading the steps.

Domains 1 and 2 together carry about 26 % of the 2024 outline and about 25.6 % of the 2027 outline. Domain 1 is the broadest in the outline and the home of the manager's mindset: governance, risk, law, ethics, policy, business continuity and people. Domain 2 is narrower and more precise: how information and assets are identified, classified, owned, handled, retained and destroyed. Hannah is strong in both. Tomás's diagnostic showed Domain 1 as his highest priority, so he works through this lesson twice.

Domain 1 at a glance

Area	Ideas that appear often	Course that taught it
Governance	Senior management accountability, security strategy aligned to business, roles (board, CISO, owners, custodians), due care and due diligence	CISSP-110 lessons 2 to 3
Risk management	Asset valuation, threats, vulnerabilities, likelihood and impact, quantitative and qualitative analysis, treatment (avoid, mitigate, transfer, accept), risk appetite, residual risk	CISSP-110 lessons 4 to 6
Policy framework	Policies, standards, procedures, guidelines and baselines, and who approves each	CISSP-110 lesson 3
Law and compliance	Privacy law, breach notification, intellectual property, import and export controls, contracts, investigations	CISSP-110 lessons 7 to 8
Business continuity	Business impact analysis, maximum tolerable downtime, recovery time and point objectives, continuity strategy	CISSP-110 lesson 10
People and supply chain	Hiring, agreements, separation of duties, awareness, third-party risk	CISSP-110 lessons 9 and 11
Ethics	The ISC2 Code of Ethics and organizational ethics	Lesson 9 of this course

Three ideas cut across the whole of Domain 1 and decide many items. First, senior management is accountable and owns risk. Second, due care means doing what a reasonable person would do to protect assets, while due diligence means the ongoing investigation and verification that shows due care is actually happening. Third, the policy hierarchy runs from broad, management-approved policy to specific procedures, and higher documents govern lower ones.

Domain 2 at a glance

Area	Ideas that appear often	Course that taught it
Identification and classification	Classification schemes, labelling and marking, who classifies (owner), criteria (value, sensitivity, law)	CISSP-111 lessons 2 to 3
Roles	Owner, custodian, steward, controller and processor, user	CISSP-111 lesson 4
Handling and protection	Data states (at rest, in transit, in use), encryption, data loss prevention, scoping and tailoring baselines	CISSP-111 lessons 6 to 8
Life cycle and retention	Collection limitation, retention schedules, legal holds, archiving	CISSP-111 lesson 5
Destruction	Clearing, purging and destroying media; remanence; cryptographic erasure	CISSP-111 lesson 9
Privacy	Data minimization, purpose limitation, de-identification, pseudonymization and anonymization	CISSP-111 lessons 10 to 11

Domain 2 items reward precise vocabulary. Clearing, purging and destroying are not interchangeable; a controller and a processor have different legal duties; a steward is not the same as a custodian. Hannah keeps a one-page glossary of these pairs and reviews it before every practice session.

A diagram with the data owner at the top, connected to the data custodian and the data steward below. The owner classifies, approves access and accepts risk; the custodian implements protection such as backups and encryption; the steward manages quality and business meaning; users use data under policy. — Data roles that Domain 2 items test again and again.

Practice items: Domain 1

Worked problem

Item 1: who signs the policy

Ridgeline is writing its first information security policy. Who should approve it? (A) The CISO. (B) The internal audit team. (C) Senior management. (D) The IT operations manager.

Show solution

Stem: who should approve a top-level policy.
Recall: policies are high-level statements of management intent and must carry senior management authority.
The CISO usually drafts and owns the policy programme but does not give it its authority. Audit evaluates; operations implements.

Answer: C. Senior management approves the policy, which gives it authority across the organization.

Worked problem

Item 2: due care or due diligence

After installing new access controls, Ridgeline's security team reviews logs each month to confirm the controls work as intended. What does the monthly review BEST demonstrate? (A) Due care. (B) Due diligence. (C) Risk transfer. (D) Separation of duties.

Show solution

Distinguish the pair: due care is taking reasonable protective action; due diligence is the ongoing verification and investigation that shows the action is effective.
Installing controls is due care. Checking that they work is due diligence.

Answer: B. Ongoing review and verification is due diligence.

Worked problem

Item 3: treating a risk

A risk assessment shows that a legacy reporting tool exposes customer data, and replacing it would cost more than the expected losses for several years. The business owner wants to keep it while a replacement is planned. What is the MOST appropriate action? (A) Shut the tool down immediately. (B) Document a formal risk acceptance by the owner, with compensating controls and a review date. (C) Buy cyber insurance and take no other action. (D) Hide the tool from the next audit.

Show solution

Stem: MOST appropriate action for a risk the owner wants to keep.
Eliminate D (unethical) and A (out of proportion and outside the owner's decision).
C transfers part of the financial impact but leaves the exposure untreated and undocumented.
B records the owner's decision, adds compensating controls and sets a review date.

Answer: B. A documented acceptance with compensating controls and a review date is the responsible treatment.

Worked problem

Item 4: the business impact analysis

Ridgeline is starting a business continuity programme. What should be done FIRST after obtaining senior management support? (A) Select a hot site. (B) Write the recovery procedures. (C) Conduct a business impact analysis. (D) Run a full interruption test.

Show solution

Stem: FIRST step after management support.
Recall the order: project initiation and support, then the business impact analysis (BIA) to identify critical functions, their maximum tolerable downtime and recovery objectives, then strategy, then plans, then testing.
A and B depend on BIA results; D comes much later and is risky.

Answer: C. The BIA identifies what matters and how quickly it must recover, which drives every later decision.

Worked problem

Item 5: a supplier with weak controls

A critical software supplier refuses to share its security assessment reports. What should Ridgeline's security manager do FIRST? (A) Terminate the contract. (B) Assess the risk this creates and inform the business owner of the relationship. (C) Run an unauthorized scan of the supplier's systems. (D) Accept the risk on the business's behalf.

Show solution

Stem: FIRST action when a supplier will not provide assurance.
C is unlawful. D is outside the security manager's authority. A may be an eventual outcome but is premature.
B evaluates the risk and puts the decision with the owner, who may negotiate contract terms, seek alternative assurance or replace the supplier.

Answer: B. Assess and report the risk to the owner, who decides how to respond.

Worked problem

Item 6: an AI tool and confidential data

Staff at Ridgeline have started pasting customer support tickets into a public generative AI service to draft replies. What should the security manager do FIRST? (A) Block all AI websites at the proxy. (B) Work with leadership to set an acceptable use policy for AI tools based on a risk assessment. (C) Discipline the staff involved. (D) Build an in-house AI model.

Show solution

Stem: FIRST response to an emerging use of AI with customer data.
A is extreme and may push use underground; C is punitive before any rule exists; D is a large project, not a first step.
B establishes governance: assess the risk, set policy with leadership, then choose technical controls and approved tools.

Answer: B. Governance first: a risk-based acceptable use policy approved by leadership, then controls and training.

Practice items: Domain 2

Worked problem

Item 7: who classifies

A new dataset of merchant bank details is created. Who is responsible for deciding its classification? (A) The database administrator. (B) The data owner. (C) The CISO. (D) The users who enter the data.

Show solution

Recall the roles: the owner, usually a senior business manager, decides classification and access; the custodian implements protection.
The CISO sets the classification scheme but does not classify each dataset.

Answer: B. The data owner classifies the data.

Worked problem

Item 8: disposing of solid-state drives

Ridgeline is retiring laptops with self-encrypting solid-state drives that held confidential data. The laptops will be donated to a school. Which approach BEST ensures the data cannot be recovered while allowing reuse? (A) Delete the files and empty the recycle bin. (B) Degauss the drives. (C) Perform a cryptographic erase or a verified purge using the drive's sanitize function. (D) Format the drives with a quick format.

Show solution

Stem: BEST approach that allows reuse.
A and D leave data recoverable. B does not work on solid-state drives, which store data in flash memory, not magnetically, and would not leave a reusable device in any case.
C uses the drive's built-in sanitize or cryptographic erase, which purges the data and keeps the device usable; verification confirms it worked.

Answer: C. Cryptographic erase or a verified sanitize purge suits self-encrypting SSDs that will be reused.

Worked problem

Item 9: retention and legal hold

Ridgeline's retention schedule says support emails are deleted after two years. Legal counsel has placed a hold on emails related to a dispute, some of which are now three years old. What should happen to those emails? (A) Delete them, because the schedule requires it. (B) Preserve them until counsel lifts the hold. (C) Move them to personal storage of the employees involved. (D) Delete them and keep a summary.

Show solution

Recall: a legal hold overrides normal retention and destruction for the data it covers.
A and D would destroy evidence and could expose Ridgeline to sanctions. C breaks custody and control.

Answer: B. Data under legal hold must be preserved until the hold is formally released.

Worked problem

Item 10: applying a baseline

Ridgeline adopts a published security baseline. Some controls in it do not apply to its environment, and others need adjusting. What is this process called? (A) Scoping and tailoring. (B) Hardening. (C) Accreditation. (D) Due diligence.

Show solution

Recall CISSP-111: scoping removes controls that do not apply; tailoring adjusts the remaining controls to fit the organization.
Hardening is configuring systems securely; accreditation is a formal authorization decision.

Answer: A. Scoping and tailoring adapt a baseline to the organization.

One more legal point is worth reviewing before the exam. The CISSP is an international exam, so its legal items test principles rather than any one country's statutes: notice and consent, purpose limitation, cross-border transfer, breach notification and the duties of controllers and processors. Canadian candidates should still be comfortable recognizing PIPEDA, Quebec's Law 25 and the role of the Office of the Privacy Commissioner, because scenarios often use them as examples, and should remember that the federal bill to replace PIPEDA's private-sector rules, tabled in June 2026, was not yet law when this course was written.

A quick risk calculation check

Quantitative risk items appear in Domain 1 most often, though lesson 10 covers calculations across all domains. The program below checks one item Tomás got wrong: whether a proposed control is worth its cost.

# Is a control worth its annual cost? (quantitative risk analysis)
asset_value = 400_000      # value of the customer database, dollars
exposure_factor = 0.30     # share of value lost in one breach
aro_before = 0.5           # expected breaches per year without the control
aro_after = 0.1            # expected breaches per year with the control
control_cost = 35_000      # annual cost of the control

sle = asset_value * exposure_factor
ale_before = sle * aro_before
ale_after = sle * aro_after
value_of_control = ale_before - ale_after - control_cost
print(f"SLE = {sle:,.0f}")
print(f"ALE before = {ale_before:,.0f}, ALE after = {ale_after:,.0f}")
print(f"Value of control = {ale_before:,.0f} - {ale_after:,.0f} - {control_cost:,.0f} = {value_of_control:,.0f}")
print("Worth it" if value_of_control > 0 else "Not worth it on cost alone")

Output

SLE = 120,000
ALE before = 60,000, ALE after = 12,000
Value of control = 60,000 - 12,000 - 35,000 = 13,000
Worth it

The control reduces expected annual loss by 48,000 a year and costs 35,000, so it adds 13,000 of value each year. Tomás had compared the control's cost with the single loss expectancy instead of with the reduction in annual loss, which is a common slip. Lesson 10 returns to the formula.

Patterns to remember

If the item asks...	The answer is usually...
Who is ultimately accountable for security	Senior management or the board
Who classifies data or approves access	The data owner
Who carries out backups, encryption and day-to-day protection	The data custodian
What comes first in continuity planning (after support)	The business impact analysis
What to do with a risk the business will not fund	Document it and obtain a formal decision from the owner
What overrides a retention schedule	A legal hold
How to sanitize SSDs for reuse	Cryptographic erase or verified sanitize, not degaussing

Common mistakes

MistakeTreating the CISO as the person who approves top-level policy.
InsteadSenior management approves policy; the CISO drafts and manages it.
MistakeConfusing due care with due diligence.
InsteadDue care is doing the right thing; due diligence is verifying it continues to be done.
MistakeChoosing degaussing for solid-state drives.
InsteadDegaussing works on magnetic media; use cryptographic erase or sanitize for SSDs.
MistakeFollowing a retention schedule when a legal hold applies.
InsteadA legal hold overrides normal deletion until it is released.
MistakeComparing a control's cost with the single loss expectancy.
InsteadCompare it with the reduction in annual loss expectancy.

Summary and key terms

Domains 1 and 2 together carry about a quarter of the exam.
Domain 1 items turn on accountability, due care and due diligence, risk treatment, the policy hierarchy, continuity planning and law.
Domain 2 items turn on precise roles (owner, custodian, steward, controller, processor), classification, handling, retention and destruction.
Senior management approves policy and owns risk; data owners classify and approve access; custodians protect.
The business impact analysis comes first in continuity planning, after management support.
Legal holds override retention schedules, and SSDs need cryptographic erase or sanitize rather than degaussing.

Due care: Taking the protective actions a reasonable, prudent organization would take.
Due diligence: The ongoing investigation and verification that due care is being exercised.
Business impact analysis (BIA): An assessment of critical business functions, their dependencies and how quickly they must be recovered.
Data custodian: The person or team that implements and operates protection for data on behalf of the owner.
Scoping and tailoring: Removing baseline controls that do not apply and adjusting the rest to fit the organization.
Cryptographic erase: Sanitizing media by destroying the encryption key so that the encrypted data cannot be recovered.

Practice problems

Work each problem on paper first, then reveal the answer to check.

Who approves an organization's top-level security policy?
Show answer
Senior management.
Installing a control is due care. What is checking that it still works?
Show answer
Due diligence.
What is done first in business continuity planning after management support?
Show answer
The business impact analysis.
Who decides the classification of a dataset?
Show answer
The data owner.
Why is degaussing wrong for solid-state drives?
Show answer
SSDs store data in flash memory, not magnetically, so degaussing does not reliably remove it.
A control costs 20,000 a year and reduces ALE from 60,000 to 30,000. What value does it add each year?
Show answer
60,000 - 30,000 - 20,000 = 10,000.