CISSP Experience Requirements and Endorsement (2026)
Video
An organization is developing its information security program and wants to ensure alignment with business objectives. Which role is PRIMARILY responsible for defining the acceptable level of risk for the organization?
Cissp Security Risk Management
Question · Easy
No read up, no write down: a ballad of Bell-LaPadula
Short
A practical 2026 guide to CISSP experience requirements, one-year waivers, Associate of ISC2, endorsement evidence, and when to sit for the exam.
Blog
CIA Triad
Security Principles
Flashcard
Which security governance principle ensures that organizational security policies are derived from and support the overall business strategy?
Study that ranks which systems and processes are most critical so recovery efforts can be prioritized.
Security and risk management
Guess the Term
Chapter 1: CISSP Orientation, CAT, and Official Source Control
1.1 Credential Scope, CISSP Mindset, and Search Language
Study guide
Cheat sheet
A company has implemented a security policy requiring all employees to complete annual security awareness training. Six months later, a phishing attack succeeds because multiple employees clicked malicious links. What governance control is MOST lacking?
Question · Medium
Read the clue and guess the term in 6 tries.
Game
CISSP Study Plan: 3-Month Schedule + Hours (2026)
Defense in Depth
Which framework provides a comprehensive set of controls specifically designed for organizations handling credit card data?
How long to study for CISSP? 150-400+ hours depending on experience. Free 3-month study plan with corrected 2024 domain weights, weekly targets, and practice questions.
Document that describes how an organization will sustain its mission and key processes during and after a disruption, not only how it will restore technology systems.
An organization wants to adopt a risk management framework that is widely recognized internationally and provides a structured approach to establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Which standard should they adopt?
New hire access: Expectation vs Reality
Least Privilege
During a board meeting, the CISO presents the organization's security posture and requests approval for a new security initiative. The board challenges whether the security team has been performing its responsibilities properly. Which concept describes the board's expectation that the security team has been taking reasonable steps to protect the organization?
Federal agency founded in 1901, part of the Department of Commerce, whose laboratories work on measurement science.
1.2 Exam Outline Effective Date and Eight-Domain Map
A multinational corporation is establishing a security governance structure. Which of the following BEST describes the relationship between security policies, standards, guidelines, and procedures?
Swap tiles to line up three of the same term.
Term Match
AAA (Authentication, Authorization, Accounting)
An organization undergoes a third-party audit and discovers that while they have comprehensive security policies, many employees are unaware of them. The auditor notes a lack of security awareness training. In terms of governance, the organization has failed at which aspect?
Records that can single out a specific human, either directly or because they can be linked to that person.
Asset security
A security analyst determines that a specific server has an asset value of $100,000, the exposure factor for a particular threat is 40%, and the annualized rate of occurrence is 0.5. What is the Annualized Loss Expectancy (ALE)?
RTO vs RPO
Separation of Duties
Which risk assessment methodology uses numeric values such as asset value, exposure factor, and annualized rate of occurrence to calculate potential losses?
Sanitization method that makes data recovery infeasible even with state-of-the-art laboratory techniques while keeping the media potentially reusable.
1.3 CAT Format, 100-150 Items, and Forward-Only Rules
After completing a risk assessment, an organization decides to purchase cyber insurance to cover potential data breach costs. Which risk treatment strategy is being applied?
Flip two cards at a time to find matching terms.
Term Pairs
Need to Know
A company decides to discontinue an online service that has been repeatedly targeted by attackers rather than invest in additional security controls. Which risk treatment strategy is this?
Symmetric block cipher that uses 128-bit blocks and a choice of 128-, 192- or 256-bit keys.
Security architecture
During a qualitative risk assessment, the team uses a matrix that plots likelihood against impact to prioritize risks. A risk is rated as "High Likelihood" and "High Impact." How should this risk be categorized?
Security by Design
An organization has implemented a new firewall to reduce the likelihood of external attacks on its web application. After implementation, the residual risk is still above the acceptable level. What should the organization do NEXT?
Arrangement that includes certificate authorities that create certificates and registration authorities that confirm the identity of entities requesting them.
1.4 Passing Grade, Results, Feedback, and Retake Policy
A risk assessment team is using the Delphi technique to evaluate threats. What is the PRIMARY advantage of this approach?
Find five hidden terms in a grid of letters.
Term Search
Loading more…
