CISSP — Security and Risk Management, Asset Security flashcards
10 of 78 cards free to study here · 2 topics · the whole deck is built into Willys
CISSP domains 1 and 2 from the manager's chair: ethics canons, governance, due care and diligence, IP and privacy law, BCP and BIA, quantitative risk with worked SLE and ALE, STRIDE and PASTA, supply chain, awareness, data roles, retention and sanitisation.
Learn deck · part of ISC2 CISSP · written against: CISSP exam outline (domains effective April 2024). Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
In what order does the ISC2 Code of Ethics list its four canons?Society, then honour, then principals, then the profession.Security and Risk Management › Professional Ethics
(1) protect society, public trust and infrastructure;
(2) behave honourably, honestly, justly and lawfully;
(3) serve principals diligently and competently;
(4) advance and protect the profession.
Why: older editions of the Code told members to settle a clash between canons in this order; the current published Code keeps the order but no longer states that rule. -
Your employer asks you to stay quiet about a flaw that leaves a regional water utility's controllers exposed, to avoid bad press. Which ISC2 canon most directly weighs against staying silent?The first canon: protect society, the common good, public trust and the infrastructure.Security and Risk Management › Professional Ethics
Why: a water utility is public infrastructure, and ISC2's Code of Professional Conduct makes reporting vulnerabilities that put the public at risk part of a professional's responsibility. Sparing the employer bad press is not a reason to hide one. -
A CISSP accepts a contract to assess an industrial control network despite never having worked with one, and bluffs through it. Which canon is breached?The third canon — providing diligent and competent service to principals. Taking work beyond your competence without disclosing it fails the client.Security and Risk Management › Professional Ethics
Watch out: honesty (canon two) is also strained, but competence is the direct test. -
Mentoring newcomers and refusing to associate the profession with unqualified or disreputable practitioners fall under which ISC2 canon?The fourth canon: advancing and protecting the profession.Security and Risk Management › Professional Ethics
Why: earlier editions of the Code listed training others and avoiding links with disreputable practitioners as guidance under this canon; the current published Code keeps the canon but no longer prints that list. -
The CISSP outline lists authenticity and nonrepudiation beside confidentiality, integrity and availability. What does each add?Authenticity is assurance that data or a party is genuinely what or who it claims to be; nonrepudiation means the originator cannot credibly deny having performed an action, which needs authenticity and integrity bound to a single identity.Security and Risk Management › Security Concepts
-
A company has never classified any of its data. What should happen FIRST?Build an inventory of information assets and assign an owner to each, under a management-approved classification policy. You cannot classify or protect what you have not found.Asset Security › Classification and Ownership
-
What are the main US government classification levels, from highest?Top Secret, Secret, Confidential — the three levels reflect exceptionally grave, serious and ordinary damage to national security if disclosed. Unclassified sits below them and is not itself a classification level.Asset Security › Classification and Ownership
-
What should determine a dataset's classification level?Its value, sensitivity, criticality and the impact of its disclosure or loss, including legal obligations — judged by the data owner.Asset Security › Classification and Ownership
-
A spreadsheet mixes public product names with confidential pricing. At which level should it be classified?At the highest level of any data it contains — confidential. Mixed data inherits the most sensitive element's classification.Asset Security › Classification and Ownership
-
What does a data steward do that a data custodian does not?The steward looks after the data's business meaning, quality and proper use on the owner's behalf; the custodian handles the technical care — storage, backups and implementing controls.Asset Security › Classification and Ownership
Unlock the whole deck
You are studying a free 10-card sample. All 78 cards of CISSP — Security and Risk Management, Asset Security, the other 5 ISC2 CISSP decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More ISC2 CISSP decks
← All ISC2 CISSP decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- ISC2 CISSP exam outline (domains effective April 2024) — topic outline only; no text copied
- Checked against NIST SP 800-88 Rev. 2 (media sanitization, September 2025), SP 800-37 Rev. 2, SP 800-53B, SP 800-34 Rev. 1 and the NIST Cybersecurity Framework 2.0 (public domain), the GDPR (Regulation (EU) 2016/679) and Executive Order 13526 (reference only; no text copied).
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CISSP® is a registered mark of ISC2, Inc. This product is not affiliated with or endorsed by ISC2.
Use of these pages is covered by our Terms of Use.