D1 — CIA Triad & Security Governance
The vocabulary every other CISSP domain assumes you already have: confidentiality/integrity/availability precisely defined, the policy-standard-procedure-guideline hierarchy, due care vs due diligence, and the manager-vs-technician reflex the whole exam is built around.
Learning Objectives
- → Define confidentiality, integrity, and availability precisely enough to resolve a trade-off between them, not just recite the acronym
- → Place a governance document into the policy / standard / procedure / guideline hierarchy and explain why the distinction matters
- → Distinguish due care from due diligence and explain why the difference has legal weight
- → Apply the CISSP 'best answer for the organization' reasoning to a scenario, instead of the first technically-correct fix that comes to mind
You already run production infrastructure: you've balanced uptime against patching windows, argued for a WAF rule that might block legitimate traffic, and decided when an incident was bad enough to wake someone up at 2am. CISSP is not testing whether you can do that. It's testing whether you can explain why that decision was correct for the organization, using a specific vocabulary — and that vocabulary starts here, in Domain 1, because every other domain quietly assumes you already have it.
The CIA triad, precisely
Three properties, each defined by what violates it:
- Confidentiality — violated by unauthorized disclosure. Not "someone saw data they shouldn't have" in the abstract — specifically, disclosure to a party outside the authorization boundary.
- Integrity — violated by unauthorized or improper modification. Note "improper": a authorized admin making an untracked, unreviewed change to production also violates integrity, even though they had access.
- Availability — violated by denial of authorized access when it's needed. A system that's "up" but too slow to be useful to the people who depend on it has an availability problem, not just a performance one.
These three trade off against each other constantly, and CISSP scenario questions are built to force you to notice the trade-off rather than optimize one property in isolation. Encrypting backups at rest strengthens confidentiality — but if the encryption keys are held by a single person who is unreachable during a disaster, you've traded availability for it without deciding to. A DDoS mitigation rule that's aggressive enough to guarantee availability during an attack can also drop a slice of legitimate traffic — a small, deliberate confidentiality/availability trade you'd want documented as an accepted risk, not discovered afterward.
Governance: who decides, not how it's configured
"Governance" is the CISSP word for the layer above operations: who has the authority to decide something, how that decision gets made and reviewed, and who is accountable if it's wrong. It is expressed through a specific document hierarchy, and the exam expects you to place a given document correctly:
| Level | What it is | Example |
|---|---|---|
| Policy | High-level intent, set by senior management, rarely changes | "All customer data must be encrypted in transit and at rest." |
| Standard | Mandatory, specific implementation requirement derived from a policy | "TLS 1.2 or higher is required for all customer-facing endpoints." |
| Procedure | Step-by-step instructions to meet a standard | "How to rotate a TLS certificate on the edge load balancer." |
| Guideline | Recommended, not mandatory — best-practice advice | "Prefer ECDSA certificates over RSA where client support allows." |
The distinction isn't academic. A CISSP-style question that asks "which document should be updated" is testing whether you understand that changing a procedure doesn't require executive sign-off, but changing the policy it traces back to does — because policies carry organizational authority and accountability that procedures don't.
Due care vs due diligence
These two terms are frequently used interchangeably in casual conversation and are never interchangeable on the exam:
- Due diligence is the investigation — researching a risk before acting on it. Commissioning a risk assessment before selecting a cloud provider is due diligence.
- Due care is the ongoing responsible action — actually implementing and maintaining the safeguards that a reasonable, prudent professional would maintain. Keeping that cloud provider's access controls correctly configured after go-live is due care.
The legal weight: due diligence protects you if something goes wrong despite reasonable investigation. Due care protects you from being found negligent for failing to maintain a safeguard you already knew was necessary. An organization can perform excellent due diligence before a decision and still be found negligent afterward for failing at due care.
The CISSP mindset: manager, not technician
This is the reframe the entire exam is built on, and it will resurface at the end of every lesson in this roadmap. Take a concrete scenario:
A security scan flags a SQL injection vulnerability in a customer-facing application.
The technician answer: patch the vulnerable query immediately — parameterize it, deploy the fix, close the ticket. This isn't wrong, exactly. It's incomplete for what CISSP is asking.
The manager (CISSP) answer: before or alongside the fix — is this vulnerability class present elsewhere in the codebase (scope), what's the actual exposure while it's unpatched (risk), who is the accountable owner for this application (governance), does this reveal a gap in the secure development lifecycle that will keep producing this class of bug (root cause), and does this get logged against the risk register so leadership has visibility into the pattern, not just this one instance (accountability)?
Neither answer skips fixing the bug. The difference is that the technician answer treats the finding as a technical problem with a technical resolution, while the CISSP answer treats it as a signal about the organization's risk posture that happens to have a technical fix attached. On the exam, when two answer choices both "solve" the immediate problem, the correct one is almost always the one that addresses the organizational, governance-level cause — not the one that's merely a faster technical patch. Every lesson from here on will end by naming this contrast explicitly for that lesson's topic, until it becomes reflexive.
An on-call engineer, under pressure during an incident, directly edits a production database row to unblock a customer — bypassing the normal change-review process, though they had valid database credentials to do so. No data was leaked and the edit was technically correct. Which CIA property was violated, and why does having valid credentials not resolve the problem?
Which CIA property was violated here, and why doesn't having valid credentials resolve it?
Your security team writes a one-page document: 'When rotating a TLS certificate on the edge load balancer, first stage the new cert in the secondary pool, verify SNI routing, then cut over during the lowest-traffic window.' Which level of the governance hierarchy is this, and what would have to change about it for it to instead be a policy?
Which level of the governance hierarchy is this document, and what would make it a policy instead?
Before selecting a third-party payment processor, your organization commissions an independent security assessment of the vendor's controls. Eighteen months later, an auditor finds that the vendor's access-control configuration — approved at onboarding — has since drifted out of compliance with the original agreement, and nobody had been checking. Label each half of this scenario as due diligence or due care, and explain which one the organization failed at.
Which half is due diligence, which is due care, and which did the organization fail at?