| Systems Security Engineering Foundations |
24% |
1.1 Apply systems security engineering fundamentals
- Systems security engineering trust concepts and hierarchies
- Relationships between systems and security engineering processes
- Structural security design principles (e.g., National Institute of Standards and Technology (NIST) engineering framework, International Organization for Standardization (IS0) 27001)
1.2 Execute systems security engineering processes (e.g., hardware, software, data)
- Organizational security authorities (e.g., internal, external)
- System security governance and compliance (e.g., laws, regulations, standards)
- Design concepts (e.g., open, proprietary, modular)
1.3 Integrate with system development methodology
- Security tasks and activities
- Security requirements verification throughout the process
- Assurance methods (e.g., software, hardware, virtual, cloud)
- Models (e.g., System Development Life Cycle (SDLC), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 24641:2023, Model based systems engineering)
1.4 Perform technical management
- Project management processes participation
- Configuration management (CM) processes
- Information management processes
- Measurement processes
- Quality assurance (QA) processes
- Security process automation solution evaluations
1.5 Participate in the technology procurement management
- Security requirements for acquisitions
- Selection process
- Supply chain risk management (SCRM)
- Review security related contractual deliverables (e.g., hardware, software, services, documentation)
1.6 Resource Analysis (e.g., Cost estimation, personnel costs, probabilities and statistics (Monte Carlo))
- Cost estimation
- Personnel costs
- Probabilities and statistics (Monte Carlo method, mean time between failures (MTBF), Maximum Tolerable Downtime (MTD), mean time to failure (MTTF), mean time to repair (MTTR), mean time to recovery (MTTR))
|
| Risk Management |
20% |
2.1 Apply security risk management principles
- Security risk management alignment with enterprise risk management
- Risk management integration throughout the lifecycle
2.2 Manage risk to system
- Establish risk context
- Identify system security risks (e.g., threats, events, vulnerabilities, impact)
- Perform inherent risk analysis
- Perform risk evaluation
- Monitoring and evaluate changes to risk posture (e.g., residual, changed, new)
- Documenting risk posture (e.g., findings, decisions)
2.3 Manage risk to operations
- Establish risk context
- Identify system security risks (e.g., threats, events, vulnerabilities, impact)
- Perform inherent risk analysis
- Perform risk evaluation
- Monitoring and evaluate changes to risk posture (e.g., residual, changed, new)
- Documenting risk posture (e.g., findings, decisions)
|
| Security Planning and Engineering |
22% |
3.1 Analyze organizational and operational environment
- Capture stakeholder requirements
- Identify roles and responsibilities
- Identify relevant constraints and assumptions
- Prepare security validation plan
3.2 Apply system security principles
- Resiliency methods (e.g., redundancy, component diversity/disparity)
- Layered security concepts (e.g., defense-in-depth, Zero Trust, secure-by-default)
- Fail-safe defaults (e.g., fail open, fail secure, fail closed)
- Single points of failure
- Least privilege
- Economy of mechanism
- Separation of interfaces, functions, services, and roles
- Automation (e.g., threat response, SecDevOps, emerging technologies)
- Software assurance
- Data security
3.3 Develop system requirements
- Develop system security context
- Identify functions within the system and security concept of operations
- Document system security requirements baseline
- Analyze system security requirements
3.4 Create system security design
- Develop functional analysis and allocation
- Develop system security design components
- Maintain traceability between specified design and system requirements
- Perform trade-off studies
- Validate design
|
| Systems Security Implementation, Verification, and Validation |
20% |
4.1 Implement and integrate security solutions
- Perform system security implementation and integration
- Support on-going system security activities (e.g., Continuous Integration and Continuous Delivery (CI/CD), DevSecOps)
4.2 Verify successful implementation
- Develop security test plans
- Support system security verification
- Review and update risk analysis
- Document stakeholder acceptance in system implementation
|
| Secure Operations, Change Management and Disposal |
14% |
5.1 Develop secure operations plan
- Identify roles, responsibilities, and requirements for system security personnel conducting operations
- Specify requirements for security related event reporting
5.2 Support secure operations
- Design continuous monitoring functionality (e.g., personnel, processes, technology)
- Support the incident response process
- Develop secure maintenance procedures
5.3 Participate in change management
- Participate in change reviews
- Assess change impact
- Perform verification and validation of changes
- Update risk assessment documentation
5.4 Participate in the disposal process
- Identify disposal security requirements
- Develop secure disposal plan
- Develop decommissioning and disposal procedures
- Audit results of the decommissioning and disposal process
- Implement data retention policies
|
| Official Information |
|
https://www.isc2.org/certifications/issep/issep-certification-exam-outline#Domain%205:%20Secure%20Operations,%20Change%20Management%20and%20Disposal |
