Baitaphish
Security intelligence
SearchLatest briefing
CISSP final review

Compare the decision, not the slogan.

Use these matrices to recover the governing requirement, viable alternatives, tradeoffs, failure modes, and evidence before selecting an answer.
8 matricesPrintableObjective-linked

title: "CISSP Decision Cheat Sheet" summary: "A compact management-oriented framework for risk, assets, architecture, networking, identity, testing, operations, and software security decisions."

CISSP decision sequence

  1. Read the role, authority, scope, and “first/best/most” qualifier.
  2. Protect life safety and comply with mandatory legal or contractual duties.
  3. Identify the business, asset, data, risk, and process owner.
  4. Prefer policy, assessment, authorization, and evidence before unauthorized implementation.
  5. Choose the action that addresses the complete risk with appropriate governance.
  6. Preserve evidence, reversibility, communication, continuity, and follow-up.
  7. Reject technically attractive answers that are premature or outside the role.

The current live ISC2 page states 100–150 items, while its linked April 2024 outline PDF states 125–150. Keep that discrepancy visible. Baitaphish practice is fixed-length and non-adaptive; raw percentages do not reproduce ISC2 CAT selection or scaled scoring.

Use each matrix from the need or condition column. Explain the owner and evidence for every choice. If the answer contains only a technology and no governance, lifecycle, or validation, it is probably incomplete.

Risk response

Management owns risk; security supports a defensible decision.

Risk response: Management owns risk; security supports a defensible decision.
ResponseUseCaution
AvoidStop the risk-producing activityMay sacrifice business value
MitigateReduce likelihood or impact with controlsResidual risk remains
Transfer/shareShift financial/operational portionAccountability and reputation may remain
AcceptAuthorized owner accepts documented residual riskCannot waive law or contract
Objectives: 1.3, 1.4, 1.9

Control classification

A control can have multiple classifications depending on purpose and implementation.

Control classification: A control can have multiple classifications depending on purpose and implementation.
AxisExamplesQuestion
AdministrativePolicy, training, reviewWho governs and performs it?
TechnicalAccess, encryption, monitoringWhat system enforces it?
PhysicalBarrier, guard, sensorWhat physical condition changes?
FunctionPrevent, deter, detect, correct, recover, compensateWhen does it act relative to the event?
Objectives: 1.2, 1.6, 3.3

Cryptographic decision

Match mechanism and key lifecycle to the security property.

Cryptographic decision: Match mechanism and key lifecycle to the security property.
NeedMechanismRemember
ConfidentialityEncryptionKey access and lifecycle determine protection
Integrity/authenticityMAC or digital signatureMAC does not provide nonrepudiation
Password verificationSalted adaptive password hashNot reversible encryption
Trust at scaleCertificates/PKIValidation, revocation, roots, and private keys matter
Objectives: 3.6, 3.7

Network protection

Combine architecture, component, channel, identity, and monitoring decisions.

Network protection: Combine architecture, component, channel, identity, and monitoring decisions.
NeedPatternFailure to consider
Limit lateral movementSegmentation plus identity and monitoringImplicit trust inside segment
Remote accessStrong authentication, managed endpoint, encrypted channelSplit tunnel and endpoint risk
Third partyDedicated constrained connectionLifecycle and supplier compromise
High availabilityDiverse paths and componentsShared physical/provider dependency
Objectives: 4.1, 4.2, 4.3

IAM decision

Identity proofing, authentication, authorization, and lifecycle solve different problems.

IAM decision: Identity proofing, authentication, authorization, and lifecycle solve different problems.
DecisionPurposeEvidence
ProofingEstablish claimed identityVerified source and process
AuthenticationVerify current claimantFactors and session record
AuthorizationDetermine permitted actionPolicy and access decision
LifecycleKeep access aligned to status and needProvision/review/revoke records
Objectives: 5.1, 5.2, 5.3, 5.4, 5.5, 5.6

Assessment method

Use the least disruptive method that produces sufficient assurance.

Assessment method: Use the least disruptive method that produces sufficient assurance.
MethodStrengthConstraint
Review/interviewGovernance and process evidenceMay not prove technical operation
Vulnerability assessmentBroad exposure discoveryRequires validation and prioritization
Penetration testDemonstrates exploit pathsAuthorized scope and safety required
AuditIndependent criteria-based assuranceSampling and point-in-time limitations
Objectives: 6.1, 6.2, 6.3, 6.4, 6.5

Incident and recovery priority

Authority, safety, evidence, containment, business continuity, and recovery must be coordinated.

Incident and recovery priority: Authority, safety, evidence, containment, business continuity, and recovery must be coordinated.
StagePrimary concernManagement question
PrepareRoles, plans, access, evidence, exercisesWho can declare and decide?
RespondSafety, triage, evidence, containment, communicationWhat action is authorized and reversible?
RecoverTrusted restoration and business prioritiesHow is integrity validated?
ImproveRoot cause, remediation, lessons, riskWho owns corrective action?
Objectives: 7.1, 7.6, 7.10, 7.11, 7.12, 7.13, 7.15

Software and supplier assurance

Assurance spans requirements, environment, code, dependencies, release, operation, and exit.

Software and supplier assurance: Assurance spans requirements, environment, code, dependencies, release, operation, and exit.
LayerControlEvidence
Requirements/designAbuse cases, architecture, threat modelApproved security criteria
Build ecosystemProtected repo/pipeline, secrets, dependenciesSigned/versioned artifact and logs
VerificationReview and layered testsFindings, coverage, remediation
Supplier/acquisitionContract, assessment, provenance, monitoring, exitAccepted residual risk and obligations
Objectives: 1.11, 8.1, 8.2, 8.3, 8.4, 8.5