Business processes, Technical implications, Documentation, Version control

PKI, Encryption, Tools, Obfuscation, Hashing, Salting, Digital signatures, Key stretching, Blockchain, Open public ledger, Certificates

Threat actors (Nation-state, Unskilled, Hacktivist, Insider, Organized crime, Shadow IT), Attributes, Motivations

Message-based, Image-based, File-based, Voice call, Removable device, Vulnerable software, Unsecure networks, Open service ports, Default credentials, Supply chain, Human vectors

Application, OS-based, Web-based, Hardware, Virtualization, Cloud-specific, Supply chain, Cryptographic, Misconfiguration, Mobile device, Zero-day

Malware attacks, Physical attacks, Network attacks, Application attacks, Cryptographic attacks, Password attacks, Indicators

Segmentation, Access control, Application allow list, Isolation, Patching, Encryption, Monitoring, Least privilege, Configuration enforcement, Decommissioning, Hardening techniques

Architecture and infrastructure concepts, Considerations (Availability, Resilience, Cost, Responsiveness, Scalability, etc.)

Infrastructure considerations, Secure communication/access, Selection of effective controls

Data types, Data classifications, General data considerations, Methods to secure data

High availability, Site considerations, Platform diversity, Multi-cloud systems, Continuity of operations, Capacity planning, Testing, Backups, Power

Secure baselines, Hardening targets, Wireless devices, Mobile solutions, Wireless security settings, Application security, Sandboxing, Monitoring

Acquisition/procurement process, Assignment/accounting, Monitoring/asset tracking, Disposal/decommissioning

Identification methods, Analysis, Vulnerability response and remediation, Validation of remediation, Reporting

Monitoring computing resources, Activities, Tools

Firewall, IDS/IPS, Web filter, Operating system security, Implementation of secure protocols, DNS filtering, Email security, File integrity monitoring, DLP, NAC, EDR/XDR, User behavior analytics

Provisioning/de-provisioning, Permission assignments, Identity proofing, Federation, SSO, Interoperability, Attestation, Access controls, Multifactor authentication, Password concepts, Privileged access management tools

Use cases of automation and scripting, Benefits, Other considerations

Process, Training, Testing, Root cause analysis, Threat hunting, Digital forensics

Log data, Data sources

Guidelines, Policies, Standards, Procedures, External considerations, Monitoring and revision, Types of governance structures, Roles and responsibilities

Risk identification, Risk assessment, Risk analysis, Risk register, Risk tolerance, Risk appetite, Risk management strategies, Risk reporting, Business impact analysis

Vendor assessment, Vendor selection, Agreement types, Vendor monitoring, Questionnaires, Rules of engagement

Compliance reporting, Consequences of non-compliance, Compliance monitoring, Privacy

Attestation, Internal, External, Penetration testing

Phishing, Anomalous behavior recognition, User guidance and training, Reporting and monitoring, Development, Execution