Security Principles

Security Principles has an average weight of 24% in the ISC2 Certified in Cybersecurity (CC) exam outline, the largest of the five CC domain weights. The outline lists five objectives under this domain: 1.1 Understand cybersecurity concepts, 1.2 Understand risk management concepts, 1.3 Understand governance concepts, 1.4 Understand cybersecurity controls and 1.5 Maintain professional and ethical conduct. Objective 1.1 names what is protected, using confidentiality, integrity and availability (the CIA triad) plus privacy for information, and authentication, authorization and accounting (AAA, where accounting means recording what an actor did) plus non-repudiation (evidence that stops someone falsely denying an action) for the people and systems that act.

Risk management (objective 1.2) weighs how likely and how severe harm would be, following the cycle of frame, assess, respond and monitor that the US National Institute of Standards and Technology (NIST) describes in Special Publication 800-39 (SP 800-39). SP 800-39 lists the responses as accept, avoid, mitigate, share or transfer, where transfer shifts the entire risk responsibility or liability to another organization, for example an insurance company, and sharing shifts a portion of it. Transfer reduces neither the likelihood of harmful events nor the harm they do to the organization's operations and assets (SP 800-39, section 3.3). Governance (objective 1.3) traces direction from laws and regulations, through frameworks and published standards, to the policies, standards, procedures and guidelines an organization writes for itself. Objective 1.4 sorts each security control (also called a safeguard or countermeasure in the NIST glossary) by what performs the protection. Technical controls are implemented and executed by the system through its hardware, software or firmware (NIST glossary: technical controls). Administrative controls are defenses such as policies and procedures that direct people, not settings an IT administrator configures, and physical controls are defenses such as gates and guards (NIST Special Publication 800-12 Revision 1 (SP 800-12r1), section 2.6). Professional and ethical conduct (objective 1.5) covers the ISC2 Code of Ethics, the broader Code of Professional Conduct, due care (the duty to protect) and due diligence (the checking that shows that care is working). The ISC2 Code of Ethics has only four mandatory canons, high-level guidance that is not intended to be a substitute for the ethical judgment of the professional.

Accepting a system's risk is an official management decision given by a senior organizational official (SP 800-39, Appendix B), not a choice for whoever found the risk. A policy exception goes through the approver the organization's policy names (SP 800-12r1, section 5.3.2), not the IT staff member who is able to switch the control off. Authority covers those two decisions, not what a finding says: the ISC2 Code of Ethics canon "Act honorably, honestly, justly, responsibly, and legally" is why an unfavorable audit finding is reported as found, even when a manager asks for a change. Evidence comes before action: organizations respond to risk once a risk assessment has determined it (SP 800-39, section 2.1), and due diligence checks that a control really works. New technology changes none of this: ISC2's CC exam outline states that AI tools require a blend of technical, administrative and physical controls and are subject to the same organizational policies and legal requirements as traditional software.