# CISSP Frameworks & Standards — The Ultimate Exam Cheat Sheet

## What You Really Need to Know for the CISSP Exam

If you're preparing for the **CISSP exam**, frameworks and standards can become one of the most confusing parts of your study plan.

You encounter names such as:

*   ISO/IEC 27001
    
*   ISO/IEC 27002
    
*   ISO/IEC 27034
    
*   ISO/IEC 27701
    
*   ISO 31000
    
*   NIST Cybersecurity Framework
    
*   NIST SP 800-53
    
*   NIST Risk Management Framework
    
*   COBIT
    
*   SABSA
    
*   PCI DSS
    
*   FedRAMP
    
*   SOC 1
    
*   SOC 2
    
*   CIS Controls
    
*   MITRE ATT&CK
    
*   OWASP ASVS
    
*   GDPR
    
*   HIPAA
    
*   SOX
    
*   and many others.
    

At some point, every CISSP candidate asks:

> **"Do I really need to memorize all of these?"**

The answer is **no**.

The CISSP exam is not asking you to become an auditor, compliance specialist, or implementation expert for every framework.

The real skill is understanding:

> **What is this framework? Why does it exist? What problem does it solve? Where does it fit into security governance and risk management? And when would an organization use it?**

The current ISC2 CISSP exam outline places **Security Control Frameworks** under Domain 1 — Security and Risk Management and explicitly gives examples including **ISO, NIST, COBIT, SABSA, PCI and FedRAMP**. Domain 1 also covers governance, legal and regulatory issues, risk management, control assessment, business continuity and continuous improvement.

This article is therefore not an encyclopedia.

It is a **CISSP-focused study guide and revision cheat sheet**.

> **CISSP Instructor Rule:** **Don't memorize the library. Understand the map.**

* * *

# 1\. First Understand What Kind of Thing You're Looking At

One reason frameworks become confusing is that candidates often treat all of them as the same thing.

They aren't.

```text
                         SECURITY & RISK
                              |
          +-------------------+-------------------+
          |                   |                   |
      GOVERNANCE             RISK              CONTROLS
          |                   |                   |
        COBIT             ISO 31000           NIST 800-53
        SABSA             ISO 27001           ISO 27002
                              |
          +-------------------+-------------------+
          |                   |                   |
       PRIVACY              CLOUD              APPSEC
          |                   |                   |
       ISO 27701           FedRAMP             ISO 27034
       GDPR               NIST 800-145         OWASP ASVS
       HIPAA
```

Think about the distinction:

| Type | What it does | Example |
| --- | --- | --- |
| **Framework** | Provides a structured approach to a problem | NIST CSF |
| **Standard** | Provides defined requirements or guidance | ISO 27001 |
| **Control catalog** | Provides security/privacy controls | NIST 800-53 |
| **Risk-management guidance** | Provides principles/processes for managing risk | ISO 31000 |
| **Governance framework** | Helps direct and oversee IT/business alignment | COBIT |
| **Security architecture framework** | Connects business requirements to security architecture | SABSA |
| **Regulation** | Creates legal requirements | GDPR |
| **Industry standard** | Defines sector-specific security requirements | PCI DSS |
| **Authorization program** | Standardizes assessment/authorization for a specific environment | FedRAMP |
| **Maturity model** | Measures/improves organizational capability | SAMM |
| **Assurance report** | Provides independent reporting on controls | SOC 1 / SOC 2 |

This classification is much more useful than memorizing names in isolation.

* * *

# 2\. How Deeply Should You Study Each One?

Use three study levels.

| Priority | Meaning |
| --- | --- |
| 🔴 **HIGH** | Understand well; know relationships and scenario application |
| 🟠 **MEDIUM** | Know purpose, terminology and major concepts |
| 🟡 **LOW** | Recognition-level knowledge; don't spend hours memorizing details |

One important distinction:

> **"Important to understand" does not mean "explicitly listed by name in the exam outline."**

For example, the current ISC2 outline explicitly names the **ISO family broadly**, but it does not separately enumerate every ISO publication such as 27034, 27701 or 31000. Those standards are still valuable because they help you understand the broader ISO ecosystem and can reinforce CISSP concepts.

* * *

# 3\. 🔴 High-Priority CISSP Frameworks & Standards

| Framework / Standard | Full Name | Type | CISSP Memory Hook | What You Should Know |
| --- | --- | --- | --- | --- |
| **ISO/IEC 27001** | Information Security Management Systems — Requirements | ISMS Standard | **ISMS** | Risk-based security management, ISMS, risk assessment/treatment, controls, continual improvement |
| **ISO/IEC 27002** | Information Security Controls | Control Guidance | **Controls** | Guidance for implementing security controls; relationship to 27001 |
| **NIST CSF 2.0** | NIST Cybersecurity Framework | Cybersecurity Framework | **Cybersecurity Risk** | Govern, Identify, Protect, Detect, Respond, Recover; Profiles and Tiers |
| **NIST SP 800-53** | Security and Privacy Controls for Information Systems and Organizations | Control Catalog | **Controls** | Control families, baselines, tailoring, security/privacy controls |
| **NIST SP 800-37 RMF** | Risk Management Framework for Information Systems and Organizations | Risk Framework | **RMF** | Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor |
| **COBIT** | Control Objectives for Information and Related Technologies | IT Governance Framework | **IT Governance** | Governance vs management, business alignment, accountability |
| **PCI DSS** | Payment Card Industry Data Security Standard | Industry Security Standard | **Payment Cards** | Cardholder data, CDE, security requirements, compliance |
| **FedRAMP** | Federal Risk and Authorization Management Program | Federal Cloud Authorization Program | **Federal Cloud** | Standardized assessment/authorization of cloud services for US federal agencies |
| **SABSA** | Sherwood Applied Business Security Architecture | Security Architecture Framework | **Business-Aligned Security** | Business-driven, risk-oriented, top-down security architecture |
| **SOC 1** | Service Organization Control 1 | Assurance Report | **Financial Reporting** | Controls relevant to financial reporting |
| **SOC 2** | Service Organization Control 2 | Assurance Report | **Trust Services** | Security, Availability, Processing Integrity, Confidentiality, Privacy |

These are the concepts I would make very comfortable before moving on to obscure standards.

* * *

# 4\. The ISO Family — Your Essential CISSP Mental Map

The ISO family becomes much easier when you stop thinking of every number as a separate subject.

```text
                         ISO FAMILY
                             |
       +---------------------+---------------------+
       |                     |                     |
       ▼                     ▼                     ▼
   ISO 27001             ISO 27002             ISO 27034
      ISMS                Controls             AppSec
       |
       +---------------------+
       |                     |
       ▼                     ▼
   ISO 27701             ISO 31000
    Privacy                  Risk
   Management             Management
```

Memorize these five associations:

> **ISO 27001 → Information Security Management**

> **ISO 27002 → Security Controls**

> **ISO 27034 → Application Security**

> **ISO 27701 → Privacy Management**

> **ISO 31000 → Risk Management**

That single map eliminates a huge amount of confusion.

* * *

# 5\. ISO/IEC 27001 — Information Security Management

### Think:

> **ISMS**

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an **Information Security Management System**.

For CISSP, know:

*   Information Security Management System (**ISMS**)
    
*   Risk assessment
    
*   Risk treatment
    
*   Security objectives
    
*   Security controls
    
*   Management responsibility
    
*   Continual improvement
    
*   Certification concept
    

A simple mental model:

```text
                    ISO 27001
                        |
                        ▼
                       ISMS
                        |
          +-------------+-------------+
          |             |             |
          ▼             ▼             ▼
        Risk         Controls     Improvement
     Assessment
          |
          ▼
     Risk Treatment
```

### CISSP scenario

> An organization wants a formal information-security management system based on risk and wants the ability to pursue certification.

Think:

**ISO 27001**

* * *

# 6\. ISO/IEC 27002 — Security Controls

Think:

> **Control Guidance**

The easiest exam distinction:

> **27001 = ISMS**

> **27002 = Security-control guidance**

ISO/IEC 27002 supports organizations in implementing information-security controls.

For CISSP, understand:

*   Security controls
    
*   Control guidance
    
*   Control implementation
    
*   Relationship to ISO 27001
    

Don't memorize every control.

* * *

# 7\. ISO/IEC 27034 — Application Security

This standard deserves attention from anyone working in application security.

ISO/IEC 27034 provides guidance for integrating security into processes used to manage applications.

Think:

```text
ISO 27001
    |
    ▼
Information Security Management
    |
    ▼
ISO 27034
    |
    ▼
Application Security
    |
    +---- Development
    +---- Acquisition
    +---- Deployment
    +---- Operation
```

### CISSP memory hook

> **27034 = Application Security**

Know the concept of integrating security into application management and the application lifecycle.

Don't spend time memorizing every document in the ISO 27034 series.

* * *

# 8\. ISO/IEC 27701 — Privacy Management

This is an important update to understand correctly.

The current published edition is **ISO/IEC 27701:2025**, which specifies requirements for establishing, implementing, maintaining and continually improving a **Privacy Information Management System (PIMS)**. It applies to organizations acting as PII controllers and processors.

Think:

```text
                 ISO 27001
                     |
              Information Security
                     |
                     ▼
                 ISO 27701
                     |
                     ▼
              Privacy Management
                     |
                     ▼
                    PIMS
```

Know:

*   Privacy Information Management System (**PIMS**)
    
*   Personally Identifiable Information (**PII**)
    
*   Controllers
    
*   Processors
    
*   Privacy risk
    
*   Accountability
    
*   Privacy controls
    
*   Relationship between security and privacy management
    

### CISSP memory hook

> **27001 = Information Security Management**

> **27701 = Privacy Information Management**

Do not describe 27701 simply as "GDPR certification."

It is a **privacy management-system standard**, not a substitute for privacy law.

* * *

# 9\. ISO 31000 — Risk Management

Think:

> **General Risk Management**

ISO 31000 provides principles and guidelines for managing risk.

Conceptually:

```text
Establish Context
       ↓
Identify Risk
       ↓
Analyze Risk
       ↓
Evaluate Risk
       ↓
Treat Risk
       ↓
Monitor & Communicate
```

Know:

*   Risk identification
    
*   Risk analysis
    
*   Risk evaluation
    
*   Risk treatment
    
*   Monitoring
    
*   Communication
    
*   Risk-based decision-making
    

### Very important distinction

> **ISO 31000 = General risk management**

> **ISO 27001 = Information-security management system**

Don't confuse the two.

* * *

# 10\. NIST — The Family You Absolutely Need to Organize

NIST contains a large ecosystem of publications.

For CISSP, build this mental map:

```text
                          NIST
                            |
         +------------------+------------------+
         |                  |                  |
        CSF                RMF              800-53
         |                  |                  |
   Cybersecurity          Risk              Controls
      Risk             Management           Catalog
   Framework             Process               |
                            |                  |
                            |                  ▼
                            |               800-53A
                            |              Assessment
```

Then memorize:

| NIST Publication | Think |
| --- | --- |
| **NIST CSF 2.0** | Cybersecurity risk |
| **SP 800-37** | Risk Management Framework |
| **SP 800-53** | Security/privacy controls |
| **SP 800-53A** | Control assessment |
| **SP 800-61** | Incident response |
| **SP 800-115** | Security testing |
| **SP 800-145** | Cloud computing |
| **SP 800-171** | Controlled Unclassified Information |
| **SP 800-207** | Zero Trust |

* * *

# 11\. NIST Cybersecurity Framework 2.0

## ⚠️ Important CISSP Update: There Are Now SIX Functions

If you learned the older version, you may remember:

**Identify → Protect → Detect → Respond → Recover**

That is the **CSF 1.1** model.

NIST CSF **2.0** added a sixth function:

> **Govern**

The current CSF 2.0 Functions are:

```text
             GOVERN
                |
        +-------+-------+
        |       |       |
        ▼       ▼       ▼
     IDENTIFY PROTECT DETECT
        |       |       |
        +-------+-------+
                |
             RESPOND
                |
             RECOVER
```

More accurately, the six functions are **concurrent and continuous**, not a strict sequential workflow. NIST explicitly describes CSF 2.0 as having six Functions: **Govern, Identify, Protect, Detect, Respond and Recover**.

### What each Function means

| Function | Think |
| --- | --- |
| **Govern** | Establish cybersecurity strategy, policy, risk tolerance, roles and oversight |
| **Identify** | Understand assets, suppliers and cybersecurity risks |
| **Protect** | Implement safeguards |
| **Detect** | Find and analyze possible attacks/events |
| **Respond** | Take action against cybersecurity incidents |
| **Recover** | Restore affected assets and operations |

### CISSP memory hook

> **CSF 2.0 = GOVERN + IDENTIFY + PROTECT + DETECT + RESPOND + RECOVER**

This is one correction I would consider **mandatory before publishing** because an article published today should not present the five-function CSF 1.1 model as the current NIST CSF.

NIST CSF 2.0 also includes **Organizational Profiles** and **Tiers**, which are useful concepts to recognize, although you do not need to memorize their detailed structure for CISSP.

* * *

# 12\. NIST SP 800-53 — Security and Privacy Controls

Think:

> **800-53 = Controls**

NIST SP 800-53 is a detailed catalog of **security and privacy controls**.

Know:

*   Control families
    
*   Security controls
    
*   Privacy controls
    
*   Control baselines
    
*   Tailoring
    
*   Control selection
    
*   Control implementation
    
*   Control assessment
    

The relationship:

```text
NIST CSF
    |
    | "How do we manage cybersecurity risk?"
    ▼
NIST 800-53
    |
    | "What security/privacy controls can we use?"
    ▼
Controls
```

### CISSP exam trap

Don't confuse:

**NIST CSF** → cybersecurity risk framework

with:

**NIST SP 800-53** → security/privacy control catalog

That distinction is extremely important.

* * *

# 13\. NIST Risk Management Framework — SP 800-37

The classic RMF sequence is:

```text
PREPARE
   ↓
CATEGORIZE
   ↓
SELECT
   ↓
IMPLEMENT
   ↓
ASSESS
   ↓
AUTHORIZE
   ↓
MONITOR
```

### What does each step mean?

| Step | CISSP Meaning |
| --- | --- |
| **Prepare** | Establish organizational/system context and risk considerations |
| **Categorize** | Determine potential impact |
| **Select** | Select appropriate controls |
| **Implement** | Implement controls |
| **Assess** | Assess controls |
| **Authorize** | Make a risk-based authorization decision |
| **Monitor** | Continuously monitor controls and risk |

NIST describes the RMF as a disciplined, structured and flexible process incorporating security and privacy risk, control selection/implementation/assessment, authorization and continuous monitoring.

### ⭐ Critical CISSP concept

> **Authorization is a risk decision.**

The security team provides analysis and evidence.

The **authorizing official / appropriate authority** makes the risk-based decision.

* * *

# 14\. NIST SP 800-53A — Control Assessment

Simple:

> **800-53 = Controls**

> **800-53A = Assessment**

For CISSP, remember the classic assessment methods:

**Examine → Interview → Test**

The distinction is:

```text
800-53
   ↓
Controls
   ↓
800-53A
   ↓
Assessment
   ↓
Are the controls implemented
correctly and effectively?
```

* * *

# 15\. NIST SP 800-61 — Incident Response

Think:

> **Incident Response**

A common conceptual lifecycle is:

```text
Preparation
     ↓
Detection & Analysis
     ↓
Containment
     ↓
Eradication
     ↓
Recovery
     ↓
Lessons Learned
```

For CISSP, concentrate on:

*   Preparation
    
*   Detection
    
*   Analysis
    
*   Containment
    
*   Eradication
    
*   Recovery
    
*   Lessons learned
    

The important exam skill is knowing **what should happen next in a scenario**.

* * *

# 16\. NIST SP 800-145 — Cloud Computing

Think:

> **Cloud Definition**

### Five characteristics

*   On-demand self-service
    
*   Broad network access
    
*   Resource pooling
    
*   Rapid elasticity
    
*   Measured service
    

### Service models

```text
SaaS
PaaS
IaaS
```

### Deployment models

```text
Public
Private
Community
Hybrid
```

For CISSP, connect cloud models to:

*   Shared responsibility
    
*   Data ownership
    
*   Security boundaries
    
*   Control responsibility
    
*   Risk
    

* * *

# 17\. NIST SP 800-171 — Controlled Unclassified Information

Think:

> **CUI**

It addresses protection of **Controlled Unclassified Information** in nonfederal systems and organizations.

For CISSP, recognize:

**CUI + nonfederal environment + security requirements**

Don't memorize all requirement details.

* * *

# 18\. NIST SP 800-207 — Zero Trust

The simplest definition:

> **Never trust, always verify.**

Traditional thinking:

```text
Internet
   ↓
Firewall
   ↓
Trusted Network
   ↓
Users / Systems
```

Zero Trust:

```text
User / Device
      ↓
Verify
      ↓
Policy Decision
      ↓
Least Privilege
      ↓
Resource
      ↓
Continuous Monitoring
```

Know:

*   No implicit trust
    
*   Continuous verification
    
*   Least privilege
    
*   Identity-centric security
    
*   Device/context evaluation
    
*   Policy enforcement
    
*   Continuous monitoring
    

NIST 800-207 is particularly valuable because Zero Trust also appears directly in the current CISSP architecture domain.

* * *

# 19\. COBIT — IT Governance

Think:

> **COBIT = Governance**

COBIT focuses on governing and managing enterprise IT in alignment with organizational objectives.

```text
Business Objectives
        ↓
IT Governance
        ↓
COBIT
        ↓
IT Objectives
        ↓
Business Value
```

### ⭐ Governance vs Management

This distinction matters more than memorizing COBIT process names.

**Governance:**

> **Evaluate → Direct → Monitor**

**Management:**

> **Plan → Build → Run → Monitor**

### CISSP scenario

If the question emphasizes:

**business strategy + IT alignment + accountability + oversight**

Think:

**COBIT**

* * *

# 20\. SABSA — Business-Driven Security Architecture

SABSA stands for:

**Sherwood Applied Business Security Architecture**

Think:

> **Business strategy drives security architecture.**

```text
Business Strategy
       ↓
Business Requirements
       ↓
Security Requirements
       ↓
Security Architecture
       ↓
Security Services
       ↓
Security Controls
```

Know:

*   Business-driven architecture
    
*   Top-down design
    
*   Risk orientation
    
*   Business requirements
    
*   Security requirements
    
*   Security services
    

### Memory hook

> **SABSA = Business-Aligned Security Architecture**

* * *

# 21\. PCI DSS — Payment Card Security

Think:

> **Payment Cards**

```text
Payment Card Data
       ↓
Cardholder Data Environment
       ↓
PCI DSS Requirements
       ↓
Security Controls
       ↓
Assessment / Compliance
```

Know:

*   Cardholder data
    
*   Cardholder Data Environment (**CDE**)
    
*   Security requirements
    
*   Compliance
    
*   Protection of payment information
    

You don't need to memorize every PCI DSS requirement for CISSP.

* * *

# 22\. FedRAMP — Federal Cloud Security Authorization

FedRAMP stands for:

**Federal Risk and Authorization Management Program**

Think:

> **Federal Government + Cloud + Assessment + Authorization**

```text
Cloud Service Provider
          ↓
       FedRAMP
          ↓
 Security Assessment
          ↓
Security Requirements / Controls
          ↓
      Authorization
          ↓
 Federal Cloud Use
```

### Important wording

Avoid saying:

> "FedRAMP is simply a certification."

A better CISSP description is:

> **FedRAMP is a standardized US federal program for security assessment, authorization and ongoing oversight of cloud services.**

### Memory hook

> **FedRAMP = Federal Cloud Authorization**

* * *

# 23\. SOC 1 vs SOC 2

This is a high-value distinction.

|  | **SOC 1** | **SOC 2** |
| --- | --- | --- |
| Primary focus | Financial reporting | Trust Services Criteria |
| Memory hook | **Financial** | **Trust** |
| Typical concern | Controls relevant to financial reporting | Controls relevant to service trust |

SOC 2 covers five Trust Services Criteria:

*   Security
    
*   Availability
    
*   Processing Integrity
    
*   Confidentiality
    
*   Privacy
    

### Memorize:

> **SOC 1 → Financial Reporting**

> **SOC 2 → Trust Services**

* * *

# 24\. 🟠 Medium-Priority Standards and Frameworks

These are useful but should receive less study time than the core set.

| Framework / Standard | Memory Hook | CISSP-Level Knowledge |
| --- | --- | --- |
| **ISO 27034** | Application Security | Integrate security into application management/lifecycle |
| **ISO 27701** | Privacy Management | PIMS, PII, controllers/processors, privacy governance |
| **ISO 31000** | Risk Management | General risk principles/process |
| **NIST 800-53A** | Assessment | Examine, Interview, Test |
| **NIST 800-61** | Incident Response | IR lifecycle |
| **NIST 800-115** | Security Testing | Technical security testing |
| **NIST 800-145** | Cloud | Characteristics and service/deployment models |
| **NIST 800-171** | CUI | Protect CUI |
| **NIST 800-207** | Zero Trust | Continuous verification |
| **CIS Controls** | Prioritized Safeguards | Practical prioritized cybersecurity safeguards |
| **MITRE ATT&CK** | Adversary Behavior | Tactic → Technique → Procedure |
| **OWASP ASVS** | App Verification | Application-security requirements |
| **ISO 22301** | Business Continuity | BCMS, BIA, resilience, recovery |

* * *

# 25\. CIS Controls

Think:

> **Prioritized cybersecurity safeguards**

```text
Security Weaknesses
       ↓
CIS Controls
       ↓
Prioritized Safeguards
       ↓
Practical Security Improvement
```

For CISSP, understand:

*   Prioritization
    
*   Safeguards
    
*   Implementation groups
    
*   Practical security improvement
    

Don't memorize every safeguard.

* * *

# 26\. MITRE ATT&CK

MITRE ATT&CK is a knowledge base for understanding **adversary behavior**.

Remember:

```text
TACTIC
  ↓
Why / Goal

TECHNIQUE
  ↓
How

PROCEDURE
  ↓
Actual Implementation
```

Example:

```text
Tactic
Credential Access
      ↓
Technique
Credential Dumping
      ↓
Procedure
Specific attacker method/tool
```

### Memory hook

> **Tactic = Why**

> **Technique = How**

> **Procedure = Actual Example**

* * *

# 27\. OWASP ASVS vs OWASP Top 10

For application-security professionals, this distinction is worth knowing.

### OWASP Top 10

Think:

> **Application-security risks**

### OWASP ASVS

Think:

> **Application-security verification requirements**

```text
OWASP Top 10
     ↓
"What are common application risks?"

OWASP ASVS
     ↓
"What security requirements should
the application satisfy?"
```

For CISSP, understanding the distinction is more important than memorizing every item.

* * *

# 28\. Privacy and Regulatory Knowledge

CISSP also expects understanding of legal, regulatory and privacy requirements.

For these, use three questions:

> **What does it protect?**

> **Who does it apply to?**

> **Why does it exist?**

| Regulation | Memory Hook |
| --- | --- |
| **GDPR** | EU personal-data privacy |
| **HIPAA** | Healthcare / PHI |
| **SOX** | Financial reporting |
| **GLBA** | Financial privacy |
| **FISMA** | US federal information security |
| **CCPA/CPRA** | California privacy |
| **FERPA** | Education records |
| **COPPA** | Children's online privacy |
| **NERC CIP** | Electric-grid critical infrastructure |

Do not try to become a lawyer while preparing for CISSP.

* * *

# 29\. ISO 22301 — Business Continuity

Think:

> **Business Continuity Management System**

```text
Business Processes
       ↓
Business Impact Analysis
       ↓
Critical Functions
       ↓
Recovery Requirements
       ↓
Continuity / Resilience
```

Know:

*   BIA
    
*   Critical business functions
    
*   Recovery requirements
    
*   Business continuity
    
*   Disaster recovery
    
*   Resilience
    
*   Testing
    

* * *

# 30\. 🔥 The Ultimate CISSP "Don't Confuse These" Table

This is the table I would revise repeatedly.

| When the question says... | Think... |
| --- | --- |
| **Information Security Management System** | **ISO 27001** |
| **Security-control guidance** | **ISO 27002** |
| **Application Security** | **ISO 27034** |
| **Privacy Information Management System** | **ISO 27701** |
| **General risk-management guidelines** | **ISO 31000** |
| **Cybersecurity risk framework** | **NIST CSF 2.0** |
| **Cybersecurity governance within CSF** | **NIST CSF 2.0 — Govern** |
| **Security/privacy control catalog** | **NIST 800-53** |
| **Risk Management Framework** | **NIST 800-37** |
| **Control assessment** | **NIST 800-53A** |
| **Incident response** | **NIST 800-61** |
| **Cloud computing definition** | **NIST 800-145** |
| **Controlled Unclassified Information** | **NIST 800-171** |
| **Zero Trust** | **NIST 800-207** |
| **IT governance** | **COBIT** |
| **Business-aligned security architecture** | **SABSA** |
| **Payment-card security** | **PCI DSS** |
| **Federal cloud authorization** | **FedRAMP** |
| **Financial reporting controls** | **SOC 1** |
| **Trust Services Criteria** | **SOC 2** |
| **Prioritized safeguards** | **CIS Controls** |
| **Adversary behavior** | **MITRE ATT&CK** |
| **Application-security verification** | **OWASP ASVS** |
| **Common web-application risks** | **OWASP Top 10** |
| **Business continuity management system** | **ISO 22301** |
| **EU personal data** | **GDPR** |
| **Healthcare / PHI** | **HIPAA** |
| **Financial reporting** | **SOX** |
| **Financial privacy** | **GLBA** |
| **Federal information security** | **FISMA** |

* * *

# 31\. ⭐ The 20 Associations I Would Memorize

For rapid CISSP revision:

```text
ISO 27001       → ISMS
ISO 27002       → Security Controls
ISO 27034       → Application Security
ISO 27701       → Privacy Management
ISO 31000       → Risk Management

NIST CSF 2.0    → Cybersecurity Risk
NIST 800-53     → Security & Privacy Controls
NIST 800-37     → RMF
NIST 800-53A    → Control Assessment
NIST 800-61     → Incident Response
NIST 800-115    → Security Testing
NIST 800-145    → Cloud
NIST 800-171    → CUI
NIST 800-207    → Zero Trust

COBIT           → IT Governance
SABSA           → Business-Aligned Security Architecture

PCI DSS         → Payment Cards
FedRAMP         → Federal Cloud Authorization

SOC 1           → Financial Reporting
SOC 2           → Trust Services
```

One addition is worth remembering separately:

> **NIST CSF 2.0 = Govern + Identify + Protect + Detect + Respond + Recover**

* * *

# 32\. What You DON'T Need to Memorize

This is where many CISSP candidates waste time.

Don't spend your preparation trying to memorize:

❌ Every ISO 27001 clause

❌ Every ISO 27002 control

❌ Every ISO 27034 detail

❌ Every ISO 27701 requirement

❌ Every ISO 31000 principle word-for-word

❌ Every NIST 800-53 control ID

❌ Every FedRAMP control

❌ Every COBIT process

❌ Every SABSA component

❌ Every PCI DSS requirement

❌ Every MITRE ATT&CK technique

❌ Every OWASP ASVS requirement

❌ Every article of GDPR

Instead, learn:

> **Purpose → Scope → Category → Key Concepts → Relationships → Scenario Application**

* * *

# 33\. How CISSP Scenario Questions Should Be Approached

The exam may not ask:

> **"What is ISO 27001?"**

It may give you a business scenario.

Use this process.

### Step 1 — Identify the problem

Is it primarily:

*   Governance?
    
*   Risk?
    
*   Controls?
    
*   Privacy?
    
*   Cloud?
    
*   Application security?
    
*   Compliance?
    
*   Business continuity?
    
*   Assurance?
    

### Step 2 — Identify the type of framework

Is it:

*   Framework?
    
*   Standard?
    
*   Control catalog?
    
*   Regulation?
    
*   Maturity model?
    
*   Assurance report?
    
*   Authorization program?
    

### Step 3 — Select the best fit

Now choose the framework that actually addresses the problem.

This is much more effective than matching keywords mechanically.

* * *

# 34\. CISSP Scenario Examples

### Example 1 — ISMS

> An organization wants to establish a formal information-security management system based on risk and potentially pursue certification.

**Think: ISO 27001**

* * *

### Example 2 — Security Controls

> An organization requires a detailed catalog of security and privacy controls.

**Think: NIST SP 800-53**

* * *

### Example 3 — Control Assessment

> An organization needs to determine whether its controls are implemented correctly and operating effectively.

**Think: NIST SP 800-53A**

* * *

### Example 4 — Cybersecurity Risk

> Management wants a common structure for communicating and managing cybersecurity risk across the organization.

**Think: NIST CSF 2.0**

* * *

### Example 5 — Governance

> Senior management wants IT activities aligned with business objectives and appropriate governance oversight.

**Think: COBIT**

* * *

### Example 6 — Federal Cloud

> A US federal organization needs a standardized security assessment and authorization process for a cloud service.

**Think: FedRAMP**

* * *

### Example 7 — Payment Cards

> An organization processes payment-card information and needs to address industry security requirements.

**Think: PCI DSS**

* * *

### Example 8 — Application Security

> An organization wants to integrate security into its application-management processes.

**Think: ISO 27034**

* * *

### Example 9 — Privacy Management

> An organization wants a formal management system for managing personally identifiable information and privacy responsibilities.

**Think: ISO 27701**

* * *

### Example 10 — General Risk

> An organization wants internationally recognized principles and guidelines for managing enterprise risk.

**Think: ISO 31000**

* * *

# 35\. A Better Way to Think About the ISO Family

This is perhaps the most useful diagram in the entire article:

```text
                    ┌───────────────────┐
                    │     ISO 27001     │
                    │       ISMS        │
                    └─────────┬─────────┘
                              │
                 Information Security
                              │
              ┌───────────────┼───────────────┐
              │               │               │
              ▼               ▼               ▼
         ISO 27002       ISO 27034       ISO 27701
          Controls         AppSec           Privacy
                                             
                             
                    ISO 31000
                         │
                         ▼
                  General Risk
                   Management
```

Memorize the **purpose**, not the documents.

* * *

# 36\. A Better Way to Think About NIST

```text
                         NIST
                           │
                           ▼
                   CYBER / SECURITY RISK
                           │
         +-----------------+-----------------+
         │                 │                 │
         ▼                 ▼                 ▼
     NIST CSF          NIST 800-37       NIST 800-53
   Cyber Risk             RMF               Controls
         │                                     │
         │                                     ▼
         │                                  800-53A
         │                                 Assessment
         │
         +---- 800-61  → Incident Response
         +---- 800-145 → Cloud
         +---- 800-171 → CUI
         +---- 800-207 → Zero Trust
```

This is the mental model I recommend carrying into the exam.

* * *

# 37\. Framework vs Standard vs Control — The Final Distinction

If you remember only one conceptual section from this article, remember this.

### Framework

A structured approach for managing a problem.

**Example: NIST CSF**

### Standard

Defined requirements or guidance.

**Example: ISO 27001**

### Control

A safeguard that reduces risk.

**Example: access control**

### Regulation

A legally enforceable requirement.

**Example: GDPR**

### Maturity Model

A way to assess and improve capability.

**Example: SAMM**

### Assurance Report

Independent reporting about controls.

**Example: SOC 1 / SOC 2**

### Authorization Program

A standardized process for security assessment and authorization.

**Example: FedRAMP**

* * *

# 38\. The Three-Pass CISSP Study Strategy

## Pass 1 — Recognition

Learn:

> **Framework → Purpose**

Examples:

**ISO 27001 → ISMS**

**COBIT → Governance**

**NIST 800-53 → Controls**

**FedRAMP → Federal Cloud**

* * *

## Pass 2 — Relationships

Understand how they connect.

### ISO

```text
ISO 27001
   ↓
ISMS
   ↓
Risk Management
   ↓
Controls
   ↓
ISO 27002
```

### NIST

```text
NIST CSF 2.0
      ↓
Cybersecurity Risk
      ↓
NIST 800-53
      ↓
Controls
      ↓
NIST 800-53A
      ↓
Assessment
```

### Federal Cloud

```text
Security Requirements / Controls
            ↓
      Security Assessment
            ↓
          FedRAMP
            ↓
        Authorization
```

* * *

## Pass 3 — Scenario Application

Now ask:

> **"If I were the security manager, which framework or concept best solves this problem?"**

This is where CISSP preparation becomes much more effective.

* * *

# 39\. The Final Night-Before-CISSP Revision Sheet

If you have only a few minutes before the exam, remember this:

```text
                   CISSP FRAMEWORK MAP

ISO 27001    → ISMS
ISO 27002    → Security Controls
ISO 27034    → Application Security
ISO 27701    → Privacy Management
ISO 31000    → Risk Management

NIST CSF 2.0 → Govern + Identify + Protect
               + Detect + Respond + Recover

NIST 800-53  → Security & Privacy Controls
NIST 800-37  → Risk Management Framework
NIST 800-53A → Control Assessment
NIST 800-61  → Incident Response
NIST 800-115 → Security Testing
NIST 800-145 → Cloud
NIST 800-171 → CUI
NIST 800-207 → Zero Trust

COBIT        → IT Governance
SABSA        → Business-Aligned Security Architecture

PCI DSS      → Payment Cards
FedRAMP      → Federal Cloud Authorization

SOC 1        → Financial Reporting
SOC 2        → Trust Services

CIS Controls → Prioritized Safeguards
MITRE ATT&CK → Adversary Behavior

OWASP ASVS   → Application Security Requirements
OWASP Top 10 → Application Security Risks
```

* * *

# Conclusion — Understand the Decision, Not Just the Definition

The cybersecurity industry has an enormous number of frameworks, standards, regulations and control catalogs.

You **do not need to memorize the entire cybersecurity standards universe to pass CISSP**.

The current ISC2 exam outline confirms that frameworks are part of the CISSP knowledge base, particularly within **Security and Risk Management**, alongside governance, risk, compliance, privacy, control assessment and business continuity.

Your objective should therefore be to build a **mental map**.

Remember:

> **ISO 27001 manages the ISMS.**

> **ISO 27002 provides security-control guidance.**

> **ISO 27034 focuses on application security.**

> **ISO 27701 focuses on privacy information management.**

> **ISO 31000 provides general risk-management guidance.**

> **NIST CSF 2.0 organizes cybersecurity risk outcomes through Govern, Identify, Protect, Detect, Respond and Recover.**

> **NIST 800-53 provides security and privacy controls.**

> **NIST 800-37 provides the Risk Management Framework.**

> **NIST 800-53A assesses controls.**

> **COBIT focuses on IT governance.**

> **SABSA aligns security architecture with business requirements.**

> **PCI DSS addresses payment-card security.**

> **FedRAMP addresses federal cloud security assessment and authorization.**

> **SOC 1 focuses on financial reporting.**

> **SOC 2 focuses on Trust Services Criteria.**

> **CIS Controls provide prioritized safeguards.**

> **MITRE ATT&CK describes adversary behavior.**

And perhaps the most important lesson:

> **The CISSP exam isn't testing whether you can recite a framework. It is testing whether you can apply security and risk concepts to a business scenario.**

So don't study frameworks as isolated definitions.

Study them as **tools for making security decisions**.

When you see a CISSP scenario, ask:

**What is the business problem?**

**What type of framework or requirement is involved?**

**What risk is being addressed?**

**Who has the authority to make the decision?**

**Which approach best aligns security with business objectives?**

That is the **CISSP mindset**.

**Learn the map.**

**Understand the relationships.**

**Think about risk.**

**Choose the answer that best protects the organization while aligning with business objectives.**

That's how you turn a huge standards landscape into a manageable CISSP study topic.

* * *

## Official References

**ISC2 — CISSP Certification Exam Outline** The current ISC2 outline is the authoritative source for the CISSP exam domains and explicitly lists ISO, NIST, COBIT, SABSA, PCI and FedRAMP among security-control framework examples.

**NIST — Cybersecurity Framework 2.0** The current NIST CSF 2.0 uses six Functions: **Govern, Identify, Protect, Detect, Respond and Recover**.

**ISO — ISO/IEC 27001** ISO/IEC 27001 specifies requirements for an Information Security Management System.

**ISO — ISO/IEC 27701:2025** The current edition specifies requirements and guidance for a Privacy Information Management System.

**NIST — SP 800-37 Risk Management Framework** NIST describes the RMF as a structured and flexible process for managing security and privacy risk, including categorization, control selection, implementation, assessment, authorization and continuous monitoring.

**ISO — ISO 31000** ISO 31000 provides principles and guidelines for general risk management.

* * *

### Final CISSP Rule

> **Don't memorize the standards universe.**
> 
> **Understand what each framework is designed to accomplish.**
> 
> **Understand how it relates to risk, governance, controls and compliance.**
> 
> **Then apply that knowledge to the scenario.**

**That is the CISSP way.**