CISSP Final Review & Memory Aids

1. Process Sequences

Most misses were "what comes NEXT" questions. Lock in the order, not just the steps.

Threat Modeling

• Identify objectives — define what's being protected and why: security goals, compliance drivers, business context
• Survey — build a high-level architecture overview of the application/system
• Decompose — break the system into components, map trust boundaries, entry/exit points, and data flows in detail
• Identify threats — enumerate threats per component, commonly using STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege)
• Identify vulnerabilities — pinpoint the specific weaknesses that would let each identified threat actually succeed

BCP Development

• Project scope & planning — secure management sponsorship, form the BCP team, define scope/objectives, allocate budget and resources
• BIA — identify critical business functions, their resource dependencies, and calculate downtime tolerance (see BIA breakdown below)
• Continuity planning — select and design the actual strategies/controls (redundant systems, alternate sites, backup power, data backups) to protect the critical path the BIA identified
• Plan approval & implementation — get formal management sign-off, document the plan, roll it out organization-wide, then train and test it

BIA Steps (the second step of BCP, above)

The official 8 steps, grouped into 5 phases so they're easier to hold in your head:

• Gather — Select individuals to interview → Create data-gathering techniques (surveys, interviews, workshops)
• Identify — Identify the organization's critical business functions → Identify the resources those functions depend on
• Calculate MTD — Calculate how long each function can survive without those resources (Maximum Tolerable Downtime)
• Assess risk — Identify threats/vulnerabilities to those functions → Calculate the risk for each function
• Document — Document findings and report them to management

Risk Assessment

• Identify threat sources/events — catalog who or what could cause harm (threat actors, natural events, system failures) and the specific events that could occur
• Identify vulnerabilities — find the weaknesses those threat sources could actually exploit
• Determine likelihood — estimate the probability that a given threat will exploit a given vulnerability
• Determine impact — estimate the severity of consequences if it happens (financial, operational, reputational)
• Determine overall risk — combine likelihood × impact into a risk rating and use it to prioritize response

E-Discovery (EDRM)

• Information governance — ongoing policies for how records are created, retained, and disposed of, before litigation even arises
• Identification — locate information potentially relevant to the matter
• Preservation — place a litigation hold so data can't be altered, deleted, or lost
• Collection — gather the identified, preserved data into a central repository
• Processing — reduce volume, remove duplicates, convert to reviewable formats
• Review — examine documents for relevance and privilege
• Analysis — evaluate content and patterns to build the case
• Production — deliver the relevant, non-privileged data to the opposing party or court
• Presentation — display the evidence at deposition, hearing, or trial

PASTA (7 steps)

PASTA = the framework that specifically aligns business objectives with technical requirements while accounting for compliance. If a question mentions all three of those words together, think PASTA before Risk Assessment or SDLC.

• 1. Define objectives — business objectives and security requirements
• 2. Define technical scope — inventory the application/infrastructure components involved
• 3. Application decomposition — map data flows and trust boundaries
• 4. Threat analysis — identify relevant threat agents and their capabilities
• 5. Vulnerability & weakness analysis — correlate threats to actual weaknesses in the system
• 6. Attack modeling / simulation — simulate the identified attack scenarios
• 7. Risk & impact analysis — quantify impact and recommend countermeasures

2. Confusable Term Clusters

3. Qualifier-Reading Strategy

Nearly every miss came from a FIRST / NEXT / BEST / LEAST question where two or more answers were technically true. Before picking an answer:

• Find where the question stem places you in a process (what's already been done, what hasn't)
• Rule out anything that's already happened or hasn't happened yet
• Between remaining options, pick the one that matches the exact scope named in the stem (e.g. "encryption in transit" not "encryption" generally; "breach notification" not "PHI protection" generally)
• If it's a LEAST question, look for the option that is one step removed from actually solving the problem (communication/awareness steps rank below direct remediation steps)

4. Exam Day Checklist

• No new content tonight — 30–45 minutes max reviewing this page, then stop
• Sleep matters more than another review pass
• Eat before the exam — it's long, and fatigue hurts qualifier-reading accuracy specifically
• On sequence questions, mentally recite the order before reading the answer choices
• When stuck between two "correct-sounding" answers, ask: which one matches the precise scope/timing/purpose in the stem?