ISC2 CC Domain 1 Security Principles

Domain 1 is the largest published CC domain at 24% of the September 2026 outline. It establishes the vocabulary used throughout the rest of the exam: what security is trying to protect, how organizations think about risk, where governance requirements come from, what kinds of controls reduce risk, and how a security professional is expected to behave.

The official outline contains five Domain 1 objectives. Learn them as connected decisions rather than five isolated lists. A privacy requirement can create governance obligations. Governance requirements influence policies and controls. Controls change risk. Professional conduct affects how those decisions are made and documented.

1. Domain 1 map

Objective	Official focus	Useful question
1.1	Cybersecurity concepts: confidentiality, integrity, availability, Authentication, Authorization, Accounting (AAA), non-repudiation, privacy	Which security property or accountability need is the scenario trying to preserve?
1.2	Risk management lifecycle and risk management processes	What risk is being evaluated, treated, monitored, or communicated?
1.3	Regulations and laws; frameworks and guidelines; policies, standards, and procedures	What source of authority or guidance applies, and what kind of document turns it into action?
1.4	Technical controls, administrative controls, and physical controls	How is the safeguard implemented?
1.5	Professional code of conduct, due care, due diligence, ISC2 Code of Ethics	What responsible, lawful, competent action fits the professional obligation?

2. Security concepts: know what must be protected

The Confidentiality, Integrity, and Availability (CIA) triad is a useful starting model because many security decisions protect one or more of these properties.

Property	Protects against	Typical safeguards or evidence
Confidentiality	Unauthorized disclosure or exposure	Access restrictions, encryption, masking, controlled distribution
Integrity	Unauthorized or undetected alteration	Hashes, digital signatures, validation, change control, audit evidence
Availability	Loss of timely, authorized access	Redundancy, capacity planning, backups, failover, recovery procedures

A single control can support more than one property. Encryption can protect confidentiality, while other cryptographic mechanisms can support integrity or authenticity. Backups support availability, but a backup that is readable by unauthorized people can create a confidentiality problem.

Read the scenario for the requirement, not merely the technology named in the answer choices.

A payroll file was viewed by an unauthorized person: confidentiality is the primary issue.
A software package was modified after release: integrity is central.
A critical service cannot be reached during an outage: availability is the immediate concern.

3. Authentication, authorization, and accounting

Authentication, Authorization, and Accounting (AAA) describe different parts of access and accountability.

AAA function	Question it answers	Example
Authentication	Can the system verify the claimed identity?	A user proves control of an account with approved authentication factors.
Authorization	What is the authenticated identity allowed to do?	A role permits viewing records but not approving payments.
Accounting	What activity was recorded for review or accountability?	A protected log records successful access and administrative actions.

The sequence matters. A system normally determines who or what is requesting access before deciding what that identity may do. Accounting then provides records that can support monitoring, investigations, audits, and accountability.

Do not use authentication as a catch-all word for access control. A person can authenticate successfully and still be denied an action because authorization does not permit it.

4. Privacy and non-repudiation

Privacy is broader than keeping data secret

Confidentiality asks whether information is protected from unauthorized disclosure. Privacy asks broader questions about information concerning people: whether it should be collected, how it is used, who receives it, how long it is retained, and which obligations apply.

The two concepts overlap, but they are not interchangeable. A dataset can remain confidential while still being collected or used in a way that violates a privacy requirement.

Non-repudiation supports accountable evidence

Non-repudiation is about evidence that supports attribution of an action or communication so a party cannot plausibly deny involvement later. Digital signatures, protected audit records, timestamps, and controlled processes can contribute to that evidence.

Accounting and non-repudiation are related but different:

Accounting records activity.
Non-repudiation is the stronger assurance goal that the action can be attributed with evidence that resists later denial.

A log entry is useful evidence, but its strength depends on how the log is protected, generated, synchronized, and associated with an identity.

5. Risk management: move from uncertainty to a decision

The CC outline names the risk management lifecycle and risk management processes without prescribing one exam-only sequence. Use a practical lifecycle that keeps the purpose clear:

Establish context. Identify the business objective, assets, stakeholders, requirements, and assumptions.
Identify risk. Determine relevant threats, vulnerabilities, exposures, and possible consequences.
Analyze risk. Estimate likelihood, impact, uncertainty, and the effect of existing safeguards.
Prioritize and decide. Compare the risk with organizational criteria and determine which risks need action first.
Treat risk. Avoid, reduce, transfer or share, or accept risk under appropriate authority.
Monitor and communicate. Track changes, control performance, incidents, exceptions, and new information that may change the decision.

NIST describes risk assessment as one part of an overall risk-management process that provides leaders with information for deciding how to respond to identified risk. That is a useful study perspective: an assessment is not the final business decision.

Risk is not normally reduced to zero. Controls change likelihood, impact, exposure, or confidence. Residual risk remains after safeguards are applied and still needs an authorized decision.

Threat, vulnerability, likelihood, and impact

Keep these terms separate:

Threat: something with the potential to cause harm.
Vulnerability: a weakness or condition that can be exploited or contribute to harm.
Likelihood: an estimate of how probable the harmful event is under the stated conditions.
Impact: the consequence if the event occurs.
Risk: the uncertainty and potential effect that the organization must evaluate and manage.

A vulnerability without a meaningful threat or consequence may be lower priority than a smaller weakness on a critical exposed system. Risk management adds context to technical findings.

6. Governance concepts: know where requirements come from

Governance provides direction, accountability, and oversight. Domain 1 expects you to recognize several sources of requirements and guidance.

Source	What to remember
Laws and regulations	External legal obligations can require specific protections, reporting, retention, privacy practices, or other actions.
Frameworks	Structured approaches organize cybersecurity outcomes, practices, or control areas so an organization can manage risk consistently.
Guidelines	Guidance helps an organization choose or implement practices but does not automatically have the same authority as law or internal mandatory requirements.
Policies, standards, procedures	Internal governance documents translate direction into organizational requirements and repeatable work.

The outline names the International Organization for Standardization (ISO) and the Center for Internet Security (CIS) as examples in the standards/framework context. For CC, focus on recognizing the role such material can play rather than memorizing a catalog of document numbers.

Compliance and security overlap, but satisfying one requirement does not prove that every relevant risk is adequately controlled. Governance should connect obligations to the organization's actual risks and objectives.

7. Policy, standard, and procedure

These terms are common distractors because all three can describe organizational expectations.

Document	Primary role	Example question
Policy	Sets management direction, intent, responsibilities, or high-level rules.	What must the organization require or achieve?
Standard	Defines a specific mandatory requirement or approved baseline.	What exact rule, configuration, format, or minimum must be followed?
Procedure	Describes the steps used to perform a task consistently.	How does someone carry out the required activity?

A procedure should support policy and standards rather than inventing its own authority. If a scenario asks for high-level direction, a detailed step-by-step procedure is too narrow. If it asks how to perform a repeatable task, a high-level policy is not enough.

8. Technical, administrative, and physical controls

The CC outline classifies controls by how they are implemented.

Control type	How it works	Examples
Technical	Uses technology or logical mechanisms to enforce or support protection.	Authentication settings, encryption, firewall rules, endpoint protection, logging controls
Administrative	Uses governance, people, process, and management activities.	Policies, risk assessments, training, access-review processes, change approval
Physical	Protects people, facilities, equipment, and physical access.	Locks, barriers, guards, controlled entrances, environmental protections

Do not confuse control type with control purpose. A technical or physical control may prevent an event, detect it, support correction, or provide evidence. Domain 1 specifically asks you to recognize the technical, administrative, and physical categories.

A layered design often combines control types. Protecting a server room may involve a physical access barrier, an administrative authorization process, and technical access logging.

9. Professional and ethical conduct

The September 2026 outline explicitly includes professional codes of conduct and the ISC2 Code of Ethics.

ISC2 publishes four mandatory canons. In practical study terms, they emphasize:

protecting society, public trust, and infrastructure;
acting honorably, honestly, responsibly, legally, and justly;
providing competent and diligent service to the people or organizations a professional represents;
advancing and protecting the profession.

Treat ethics as a decision framework, not a slogan-matching exercise. A security professional may have access, authority, or technical ability that does not automatically create permission to use it.

Useful questions include:

Is the action authorized and lawful?
Could it unnecessarily harm people, customers, systems, or public trust?
Is the person performing the work competent for the task or appropriately supervised?
Are evidence and important findings being represented honestly?
Is escalation needed because duties or interests conflict?

For example, discovering a serious weakness does not automatically authorize testing beyond the agreed scope. Professional conduct still requires respect for authorization, evidence, safety, and reporting responsibilities.

10. Due care and due diligence

These terms are close enough to become easy distractors.

Due care is the responsibility to take reasonable and appropriate steps to protect people, assets, and interests from foreseeable harm.
Due diligence is the ongoing process of investigating, verifying, monitoring, and documenting whether those safeguards remain appropriate and effective.

A simple memory aid:

Care acts. Diligence checks and keeps checking.

Examples:

Requiring access reviews is an exercise of reasonable care.
Performing and documenting the reviews is part of continuing diligence.
Establishing a vendor-security requirement shows care.
Evaluating evidence and monitoring the vendor over time demonstrates diligence.
Approving an incident-response plan shows care.
Exercising it and correcting discovered gaps demonstrates diligence.

The concepts reinforce each other. A policy that is never implemented is not enough. A control that was reasonable years ago may no longer be adequate after technology, threats, laws, or business operations change.

11. Common Domain 1 exam traps

Authentication is not authorization

Successful login proves or supports identity. It does not prove that the identity is allowed to perform every requested action.

Accounting is not the same as non-repudiation

Accounting records activity. Non-repudiation requires stronger evidence supporting attribution and resistance to later denial.

Privacy is not just confidentiality

Keeping personal information secret does not answer whether collecting, using, retaining, or sharing it is appropriate.

A framework is not automatically a law

Frameworks can organize cybersecurity work. Laws and regulations carry legal authority. Internal policies and standards may make selected framework practices mandatory inside an organization.

Policy is not a procedure

Policy sets direction. Procedures describe how to perform work. Standards define specific mandatory requirements or baselines.

Control category and control purpose are different questions

"Technical" tells you how a control is implemented. "Preventive" or "detective" describes what it is intended to accomplish.

Risk management does not mean eliminating all risk

Security decisions balance risk, requirements, resources, and business objectives. Controls reduce or change risk; authorized decision-makers still address the residual risk.

Due diligence is not a one-time document

A signed policy or completed assessment can be evidence, but diligence requires continuing verification and attention as conditions change.

12. Rapid review checklist

Before leaving Domain 1, make sure you can explain each item without relying on a memorized phrase:

[ ] Confidentiality, integrity, and availability
[ ] Authentication, authorization, and accounting
[ ] Non-repudiation versus ordinary logging/accounting
[ ] Privacy versus confidentiality
[ ] Threat, vulnerability, likelihood, impact, and risk
[ ] A practical risk-management lifecycle
[ ] Laws/regulations versus frameworks/guidelines
[ ] Policy, standard, and procedure
[ ] Technical, administrative, and physical controls
[ ] Why one security objective may need several control types
[ ] Professional codes of conduct and the role of the ISC2 Code of Ethics
[ ] Due care versus due diligence

If two concepts still feel interchangeable, write a one-sentence scenario where only one of them is the best fit. That exposes weak distinctions faster than rereading the definitions.

13. Official and primary references

Use the ISC2 outline as the authoritative scope for this domain:

Primary references that add context without changing the CC scope:

These supporting references provide deeper context for risk, governance, controls, and privacy. They do not replace the ISC2 exam outline as the coverage checklist.

CertHappens is an independent study resource and is not affiliated with or endorsed by ISC2.