CC - Certified in Cybersecurity °ê»Ú»{¥iÃҮѽҵ{

Domain 1: Security Principles (24%)

1.1 Understand cybersecurity concepts

1. Confidentiality
2. Integrity
3. Availability
4. Authentication, Authorization, Accounting (AAA)
5. Non-repudiation
6. Privacy

1.2 Understand risk management concepts

1. Risk management lifecycle
2. Risk management processes

1.3 Understand governance concepts

1. Regulations and laws
2. Frameworks and guidelines
3. Policies, standards (e.g., International Organization for Standardization (ISO), Center for Internet Security), procedures

1.4 Understand cybersecurity controls

1. Technical controls
2. Administrative controls
3. Physical controls

1.5 Maintain professional and ethical conduct

1. Professional code of conduct
2. Due care and due diligence
3. ISC2 Code of Ethics

Domain 2: Security Governance (17.3%)

2.1 Plan Governance, Risk, and Compliance (GRC)

1. Purpose
2. Importance
3. Frameworks and tools

2.2 Understand redundancy

1. Business Continuity (BC)
2. Disaster Recovery (DR)

2.3 Understand security awareness

1. Organizational culture (e.g., importance of security, security leadership)
2. Concepts (e.g., social engineering, password protection, phishing)

2.4 Measure cybersecurity effectiveness

1. Key metrics, Key Risk Indicators (KRI)
2. Dashboards, score cards, reports

Domain 3: Identity and Access Management (IAM) Concepts (20%)

3.1 Understand identity life cycle management

1. Roles definition
2. Provision
3. Review
4. Deprovision
5. Frameworks and tools

3.2 Understand logical access controls

1. Principle of Least Privilege (PoLP)
2. Separation of Duties (SoD)
3. Access control models

Domain 4: Networking and Cloud Security Concepts (21.3%)

4.1 Understand network security

1. Concepts (e.g., Open Systems Interconnection (OSI) model, Transmission Control Protocol/Internet Protocol (TCP/IP) model, Internet Protocol version 4 (IPv4), Internet Protocol version 6 (IPv6), Virtual Private Network (VPN))
2. Firewalls (e.g., ports, applications)
3. Wireless (e.g., Wi-Fi, Bluetooth)
4. Embedded systems (e.g., Industrial Control System (ICS)), Internet Of Things (IoT)

4.2 Understand network security architecture

1. Comprehending network segmentation (e.g., Firewall zones, Virtual Local Area Network (VLAN), micro-segmentation)
2. Defense in Depth
3. Zero Trust (ZT)

4.3 Understand cloud security

1. Characteristics (e.g., Broad network access, rapid elasticity, measured service, on-demand self-service, resource pooling)
2. Service models
3. Deployment models
4. Shared security model (e.g., roles and responsibilities)

Domain 5: Security Operations and Incident Response (17.3%)

5.1 Understand data security

1. Data handling (e.g., classification, labeling, masking, and sanitization)
2. Encryption (e.g., symmetric, asymmetric, hashing, quantum resistant cryptography)

5.2 Understand security operations

1. Logging and monitoring security events
2. Security event triage (e.g., incident use cases, prioritization, correlation)
3. Threat actors (e.g., types, motivations)
4. Cyber threat intelligence
5. Threat frameworks

5.3 Understand Incident Response (IR)

1. Data handling policy implementing Incident Response Plan (IRP)
2. Incident Response (IR) exercises (e.g., testing, tabletop)

5.4 Understand asset protection

1. Asset lifecycle management (e.g., End Of Life (EOL) software and devices)
2. Configuration and change management

5.5 Understand security testing

1. Security readiness testing (e.g., blue teaming, purple teaming, red teaming)
2. Application testing (e.g., vulnerability scanning, static analysis, dynamic analysis, threat modeling)
3. Physical penetration testing (e.g., phishing, tailgating, impersonation)

The course content above may change at any time without notice in order to better reflect the content of the examination.