Last updated:
CISSP domain
How should you study CISSP Domain 1: Security and Risk Management (16%)?
Direct answer
CISSP Domain 1, Security and Risk Management, is 16% of the exam under the outline in force since 15 April 2024, the largest of the eight domains. It covers professional ethics, security concepts, governance, legal and compliance issues, investigations, policy, business continuity requirements, personnel security, risk management, threat modeling, supply chain risk and security awareness. ISC2's new outline, effective 15 April 2027, renames it Security Governance and Risk Management, weighted 13.6%.
CISSP Domain 1: a practical decision framework
| Check | How to use it |
|---|---|
| Objective | Build authority and risk trade-offs from official objectives, then test them in unfamiliar scenarios that cross domain boundaries. |
| First move | map the current Domain 1 objectives against first-attempt evidence and job-experience blind spots |
| Common trap | Memorizing Domain 1 terms without checking actor, authority, objective, qualifier, constraints, and decision level. |
CISSP Domain 1 in practice
A technical lead recommends accepting a material risk because the control is expensive, although only the accountable business owner has acceptance authority.
The stronger response identifies the accountable actor and current decision stage, then applies the Domain 1 principle without exceeding authority or skipping required sequence.
What Domain 1 covers
The 2024 outline splits Domain 1 into 12 objectives, from 1.1 professional ethics to 1.12 security awareness, education and training.
- Ethics and governance: the ISC2 Code of Ethics, security concepts, governance principles, and due care and due diligence.
- Law and investigations: legal, regulatory and compliance issues, privacy, and investigation types.
- Policy and people: security policies, standards, procedures and guidelines, and personnel security.
- Risk and continuity: business continuity requirements, risk management, threat modeling and supply chain risk.
- Awareness: security awareness, education and training programs.
How Domain 1 questions work
Domain 1 scenarios usually turn on who should decide, and on what basis, rather than on how a control works.
Expect scenarios where a technical fix is available but the decision belongs to a business owner, a risk has to be assessed before a control is chosen, or a policy has to exist before a tool can enforce it. Read the stem for the actor's authority and the organization's objective before judging the options.
The common mistake in Domain 1
Choosing the most technically complete answer when the stem asks for a governance decision.
An engineer may want to deploy the control at once. The better answer often has management assess the risk, the owner accept it, or a policy set the requirement first.
What changes on 15 April 2027
ISC2's new outline renames Domain 1 Security Governance and Risk Management and lowers its weight from 16% to 13.6%.
If you sit the exam before 15 April 2027, study to the 2024 outline. If you sit it on or after that date, use the new outline's objectives and weights. ISC2's exam outline page links both versions.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
How should you study CISSP Domain 1: Security and Risk Management (16%)?
CISSP Domain 1, Security and Risk Management, is 16% of the exam under the outline in force since 15 April 2024, the largest of the eight domains. It covers professional ethics, security concepts, governance, legal and compliance issues, investigations, policy, business continuity requirements, personnel security, risk management, threat modeling, supply chain risk and security awareness. ISC2's new outline, effective 15 April 2027, renames it Security Governance and Risk Management, weighted 13.6%.
What should I study first in CISSP Domain 1?
Map the current Domain 1 objectives against first-attempt evidence and job-experience blind spots. Use the current official objectives as the coverage boundary and practice changed scenarios after learning the concepts.
How does CISSP Domain 1 connect to other CISSP domains?
Build authority and risk trade-offs from official objectives, then test them in unfamiliar scenarios that cross domain boundaries. Cross-domain questions often connect governance, assets, architecture, identity, assessment, operations, and software decisions.
What is a common CISSP Domain 1 study error?
Memorizing Domain 1 terms without checking actor, authority, objective, qualifier, constraints, and decision level. Review the miss by concept and decision error instead of rereading the entire domain.
How do I know CISSP Domain 1 is improving?
Look for stable performance on unfamiliar items, better confidence calibration, clearer option elimination, and fewer repeated error types. A single percentage is insufficient.
