If you're preparing for the CISSP exam, frameworks and standards can become one of the most confusing parts of your study plan.

You encounter names such as:

• ISO/IEC 27001

• ISO/IEC 27002

• ISO/IEC 27034

• ISO/IEC 27701

• ISO 31000

• NIST Cybersecurity Framework

• NIST SP 800-53

• NIST Risk Management Framework

• COBIT

• SABSA

• PCI DSS

• FedRAMP

• SOC 1

• SOC 2

• CIS Controls

• MITRE ATT&CK

• OWASP ASVS

• GDPR

• HIPAA

• SOX

• and many others.

At some point, every CISSP candidate asks:

"Do I really need to memorize all of these?"

The answer is no.

The CISSP exam is not asking you to become an auditor, compliance specialist, or implementation expert for every framework.

The real skill is understanding:

What is this framework? Why does it exist? What problem does it solve? Where does it fit into security governance and risk management? And when would an organization use it?

The current ISC2 CISSP exam outline places Security Control Frameworks under Domain 1 — Security and Risk Management and explicitly gives examples including ISO, NIST, COBIT, SABSA, PCI and FedRAMP. Domain 1 also covers governance, legal and regulatory issues, risk management, control assessment, business continuity and continuous improvement.

This article is therefore not an encyclopedia.

It is a CISSP-focused study guide and revision cheat sheet.

CISSP Instructor Rule: Don't memorize the library. Understand the map.

1. First Understand What Kind of Thing You're Looking At

One reason frameworks become confusing is that candidates often treat all of them as the same thing.

They aren't.

                         SECURITY & RISK
                              |
          +-------------------+-------------------+
          |                   |                   |
      GOVERNANCE             RISK              CONTROLS
          |                   |                   |
        COBIT             ISO 31000           NIST 800-53
        SABSA             ISO 27001           ISO 27002
                              |
          +-------------------+-------------------+
          |                   |                   |
       PRIVACY              CLOUD              APPSEC
          |                   |                   |
       ISO 27701           FedRAMP             ISO 27034
       GDPR               NIST 800-145         OWASP ASVS
       HIPAA

Think about the distinction:

This classification is much more useful than memorizing names in isolation.

2. How Deeply Should You Study Each One?

Use three study levels.

One important distinction:

"Important to understand" does not mean "explicitly listed by name in the exam outline."

For example, the current ISC2 outline explicitly names the ISO family broadly, but it does not separately enumerate every ISO publication such as 27034, 27701 or 31000. Those standards are still valuable because they help you understand the broader ISO ecosystem and can reinforce CISSP concepts.

3. 🔴 High-Priority CISSP Frameworks & Standards

These are the concepts I would make very comfortable before moving on to obscure standards.

4. The ISO Family — Your Essential CISSP Mental Map

The ISO family becomes much easier when you stop thinking of every number as a separate subject.

                         ISO FAMILY
                             |
       +---------------------+---------------------+
       |                     |                     |
       ▼                     ▼                     ▼
   ISO 27001             ISO 27002             ISO 27034
      ISMS                Controls             AppSec
       |
       +---------------------+
       |                     |
       ▼                     ▼
   ISO 27701             ISO 31000
    Privacy                  Risk
   Management             Management

Memorize these five associations:

ISO 27001 → Information Security Management

ISO 27002 → Security Controls

ISO 27034 → Application Security

ISO 27701 → Privacy Management

ISO 31000 → Risk Management

That single map eliminates a huge amount of confusion.

5. ISO/IEC 27001 — Information Security Management

Think:

ISMS

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System.

For CISSP, know:

• Information Security Management System (ISMS)

• Risk assessment

• Risk treatment

• Security objectives

• Security controls

• Management responsibility

• Continual improvement

• Certification concept

A simple mental model:

                    ISO 27001
                        |
                        ▼
                       ISMS
                        |
          +-------------+-------------+
          |             |             |
          ▼             ▼             ▼
        Risk         Controls     Improvement
     Assessment
          |
          ▼
     Risk Treatment

CISSP scenario

An organization wants a formal information-security management system based on risk and wants the ability to pursue certification.

Think:

ISO 27001

6. ISO/IEC 27002 — Security Controls

Think:

Control Guidance

The easiest exam distinction:

27001 = ISMS

27002 = Security-control guidance

ISO/IEC 27002 supports organizations in implementing information-security controls.

For CISSP, understand:

• Security controls

• Control guidance

• Control implementation

• Relationship to ISO 27001

Don't memorize every control.

7. ISO/IEC 27034 — Application Security

This standard deserves attention from anyone working in application security.

ISO/IEC 27034 provides guidance for integrating security into processes used to manage applications.

Think:

ISO 27001
    |
    ▼
Information Security Management
    |
    ▼
ISO 27034
    |
    ▼
Application Security
    |
    +---- Development
    +---- Acquisition
    +---- Deployment
    +---- Operation

CISSP memory hook

27034 = Application Security

Know the concept of integrating security into application management and the application lifecycle.

Don't spend time memorizing every document in the ISO 27034 series.

8. ISO/IEC 27701 — Privacy Management

This is an important update to understand correctly.

The current published edition is ISO/IEC 27701:2025, which specifies requirements for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS). It applies to organizations acting as PII controllers and processors.

Think:

                 ISO 27001
                     |
              Information Security
                     |
                     ▼
                 ISO 27701
                     |
                     ▼
              Privacy Management
                     |
                     ▼
                    PIMS

Know:

• Privacy Information Management System (PIMS)

• Personally Identifiable Information (PII)

• Controllers

• Processors

• Privacy risk

• Accountability

• Privacy controls

• Relationship between security and privacy management

CISSP memory hook

27001 = Information Security Management

27701 = Privacy Information Management

Do not describe 27701 simply as "GDPR certification."

It is a privacy management-system standard, not a substitute for privacy law.

9. ISO 31000 — Risk Management

Think:

General Risk Management

ISO 31000 provides principles and guidelines for managing risk.

Conceptually:

Establish Context
       ↓
Identify Risk
       ↓
Analyze Risk
       ↓
Evaluate Risk
       ↓
Treat Risk
       ↓
Monitor & Communicate

Know:

• Risk identification

• Risk analysis

• Risk evaluation

• Risk treatment

• Monitoring

• Communication

• Risk-based decision-making

Very important distinction

ISO 31000 = General risk management

ISO 27001 = Information-security management system

Don't confuse the two.

10. NIST — The Family You Absolutely Need to Organize

NIST contains a large ecosystem of publications.

For CISSP, build this mental map:

                          NIST
                            |
         +------------------+------------------+
         |                  |                  |
        CSF                RMF              800-53
         |                  |                  |
   Cybersecurity          Risk              Controls
      Risk             Management           Catalog
   Framework             Process               |
                            |                  |
                            |                  ▼
                            |               800-53A
                            |              Assessment

Then memorize:

11. NIST Cybersecurity Framework 2.0

⚠️ Important CISSP Update: There Are Now SIX Functions

If you learned the older version, you may remember:

Identify → Protect → Detect → Respond → Recover

That is the CSF 1.1 model.

NIST CSF 2.0 added a sixth function:

Govern

The current CSF 2.0 Functions are:

             GOVERN
                |
        +-------+-------+
        |       |       |
        ▼       ▼       ▼
     IDENTIFY PROTECT DETECT
        |       |       |
        +-------+-------+
                |
             RESPOND
                |
             RECOVER

More accurately, the six functions are concurrent and continuous, not a strict sequential workflow. NIST explicitly describes CSF 2.0 as having six Functions: Govern, Identify, Protect, Detect, Respond and Recover.

What each Function means

CISSP memory hook

CSF 2.0 = GOVERN + IDENTIFY + PROTECT + DETECT + RESPOND + RECOVER

This is one correction I would consider mandatory before publishing because an article published today should not present the five-function CSF 1.1 model as the current NIST CSF.

NIST CSF 2.0 also includes Organizational Profiles and Tiers, which are useful concepts to recognize, although you do not need to memorize their detailed structure for CISSP.

12. NIST SP 800-53 — Security and Privacy Controls

Think:

800-53 = Controls

NIST SP 800-53 is a detailed catalog of security and privacy controls.

Know:

• Control families

• Security controls

• Privacy controls

• Control baselines

• Tailoring

• Control selection

• Control implementation

• Control assessment

The relationship:

NIST CSF
    |
    | "How do we manage cybersecurity risk?"
    ▼
NIST 800-53
    |
    | "What security/privacy controls can we use?"
    ▼
Controls

CISSP exam trap

Don't confuse:

NIST CSF → cybersecurity risk framework

with:

NIST SP 800-53 → security/privacy control catalog

That distinction is extremely important.

13. NIST Risk Management Framework — SP 800-37

The classic RMF sequence is:

PREPARE
   ↓
CATEGORIZE
   ↓
SELECT
   ↓
IMPLEMENT
   ↓
ASSESS
   ↓
AUTHORIZE
   ↓
MONITOR

What does each step mean?

NIST describes the RMF as a disciplined, structured and flexible process incorporating security and privacy risk, control selection/implementation/assessment, authorization and continuous monitoring.

⭐ Critical CISSP concept

Authorization is a risk decision.

The security team provides analysis and evidence.

The authorizing official / appropriate authority makes the risk-based decision.

14. NIST SP 800-53A — Control Assessment

Simple:

800-53 = Controls

800-53A = Assessment

For CISSP, remember the classic assessment methods:

Examine → Interview → Test

The distinction is:

800-53
   ↓
Controls
   ↓
800-53A
   ↓
Assessment
   ↓
Are the controls implemented
correctly and effectively?

15. NIST SP 800-61 — Incident Response

Think:

Incident Response

A common conceptual lifecycle is:

Preparation
     ↓
Detection & Analysis
     ↓
Containment
     ↓
Eradication
     ↓
Recovery
     ↓
Lessons Learned

For CISSP, concentrate on:

• Preparation

• Detection

• Analysis

• Containment

• Eradication

• Recovery

• Lessons learned

The important exam skill is knowing what should happen next in a scenario.

16. NIST SP 800-145 — Cloud Computing

Think:

Cloud Definition

Five characteristics

• On-demand self-service

• Broad network access

• Resource pooling

• Rapid elasticity

• Measured service

Service models

SaaS
PaaS
IaaS

Deployment models

Public
Private
Community
Hybrid

For CISSP, connect cloud models to:

• Shared responsibility

• Data ownership

• Security boundaries

• Control responsibility

• Risk

17. NIST SP 800-171 — Controlled Unclassified Information

Think:

CUI

It addresses protection of Controlled Unclassified Information in nonfederal systems and organizations.

For CISSP, recognize:

CUI + nonfederal environment + security requirements

Don't memorize all requirement details.

18. NIST SP 800-207 — Zero Trust

The simplest definition:

Never trust, always verify.

Traditional thinking:

Internet
   ↓
Firewall
   ↓
Trusted Network
   ↓
Users / Systems

Zero Trust:

User / Device
      ↓
Verify
      ↓
Policy Decision
      ↓
Least Privilege
      ↓
Resource
      ↓
Continuous Monitoring

Know:

• No implicit trust

• Continuous verification

• Least privilege

• Identity-centric security

• Device/context evaluation

• Policy enforcement

• Continuous monitoring

NIST 800-207 is particularly valuable because Zero Trust also appears directly in the current CISSP architecture domain.

19. COBIT — IT Governance

Think:

COBIT = Governance

COBIT focuses on governing and managing enterprise IT in alignment with organizational objectives.

Business Objectives
        ↓
IT Governance
        ↓
COBIT
        ↓
IT Objectives
        ↓
Business Value

⭐ Governance vs Management

This distinction matters more than memorizing COBIT process names.

Governance:

Evaluate → Direct → Monitor

Management:

Plan → Build → Run → Monitor

CISSP scenario

If the question emphasizes:

business strategy + IT alignment + accountability + oversight

Think:

COBIT

20. SABSA — Business-Driven Security Architecture

SABSA stands for:

Sherwood Applied Business Security Architecture

Think:

Business strategy drives security architecture.

Business Strategy
       ↓
Business Requirements
       ↓
Security Requirements
       ↓
Security Architecture
       ↓
Security Services
       ↓
Security Controls

Know:

• Business-driven architecture

• Top-down design

• Risk orientation

• Business requirements

• Security requirements

• Security services

Memory hook

SABSA = Business-Aligned Security Architecture

21. PCI DSS — Payment Card Security

Think:

Payment Cards

Payment Card Data
       ↓
Cardholder Data Environment
       ↓
PCI DSS Requirements
       ↓
Security Controls
       ↓
Assessment / Compliance

Know:

• Cardholder data

• Cardholder Data Environment (CDE)

• Security requirements

• Compliance

• Protection of payment information

You don't need to memorize every PCI DSS requirement for CISSP.

22. FedRAMP — Federal Cloud Security Authorization

FedRAMP stands for:

Federal Risk and Authorization Management Program

Think:

Federal Government + Cloud + Assessment + Authorization

Cloud Service Provider
          ↓
       FedRAMP
          ↓
 Security Assessment
          ↓
Security Requirements / Controls
          ↓
      Authorization
          ↓
 Federal Cloud Use

Important wording

Avoid saying:

"FedRAMP is simply a certification."

A better CISSP description is:

FedRAMP is a standardized US federal program for security assessment, authorization and ongoing oversight of cloud services.

Memory hook

FedRAMP = Federal Cloud Authorization

23. SOC 1 vs SOC 2

This is a high-value distinction.

SOC 2 covers five Trust Services Criteria:

• Security

• Availability

• Processing Integrity

• Confidentiality

• Privacy

Memorize:

SOC 1 → Financial Reporting

SOC 2 → Trust Services

24. 🟠 Medium-Priority Standards and Frameworks

These are useful but should receive less study time than the core set.

25. CIS Controls

Think:

Prioritized cybersecurity safeguards

Security Weaknesses
       ↓
CIS Controls
       ↓
Prioritized Safeguards
       ↓
Practical Security Improvement

For CISSP, understand:

• Prioritization

• Safeguards

• Implementation groups

• Practical security improvement

Don't memorize every safeguard.

26. MITRE ATT&CK

MITRE ATT&CK is a knowledge base for understanding adversary behavior.

Remember:

TACTIC
  ↓
Why / Goal

TECHNIQUE
  ↓
How

PROCEDURE
  ↓
Actual Implementation

Example:

Tactic
Credential Access
      ↓
Technique
Credential Dumping
      ↓
Procedure
Specific attacker method/tool

Memory hook

Tactic = Why

Technique = How

Procedure = Actual Example

27. OWASP ASVS vs OWASP Top 10

For application-security professionals, this distinction is worth knowing.

OWASP Top 10

Think:

Application-security risks

OWASP ASVS

Think:

Application-security verification requirements

OWASP Top 10
     ↓
"What are common application risks?"

OWASP ASVS
     ↓
"What security requirements should
the application satisfy?"

For CISSP, understanding the distinction is more important than memorizing every item.

28. Privacy and Regulatory Knowledge

CISSP also expects understanding of legal, regulatory and privacy requirements.

For these, use three questions:

What does it protect?

Who does it apply to?

Why does it exist?

Do not try to become a lawyer while preparing for CISSP.

29. ISO 22301 — Business Continuity

Think:

Business Continuity Management System

Business Processes
       ↓
Business Impact Analysis
       ↓
Critical Functions
       ↓
Recovery Requirements
       ↓
Continuity / Resilience

Know:

• BIA

• Critical business functions

• Recovery requirements

• Business continuity

• Disaster recovery

• Resilience

• Testing

30. 🔥 The Ultimate CISSP "Don't Confuse These" Table

This is the table I would revise repeatedly.

31. ⭐ The 20 Associations I Would Memorize

For rapid CISSP revision:

ISO 27001       → ISMS
ISO 27002       → Security Controls
ISO 27034       → Application Security
ISO 27701       → Privacy Management
ISO 31000       → Risk Management

NIST CSF 2.0    → Cybersecurity Risk
NIST 800-53     → Security & Privacy Controls
NIST 800-37     → RMF
NIST 800-53A    → Control Assessment
NIST 800-61     → Incident Response
NIST 800-115    → Security Testing
NIST 800-145    → Cloud
NIST 800-171    → CUI
NIST 800-207    → Zero Trust

COBIT           → IT Governance
SABSA           → Business-Aligned Security Architecture

PCI DSS         → Payment Cards
FedRAMP         → Federal Cloud Authorization

SOC 1           → Financial Reporting
SOC 2           → Trust Services

One addition is worth remembering separately:

NIST CSF 2.0 = Govern + Identify + Protect + Detect + Respond + Recover

32. What You DON'T Need to Memorize

This is where many CISSP candidates waste time.

Don't spend your preparation trying to memorize:

❌ Every ISO 27001 clause

❌ Every ISO 27002 control

❌ Every ISO 27034 detail

❌ Every ISO 27701 requirement

❌ Every ISO 31000 principle word-for-word

❌ Every NIST 800-53 control ID

❌ Every FedRAMP control

❌ Every COBIT process

❌ Every SABSA component

❌ Every PCI DSS requirement

❌ Every MITRE ATT&CK technique

❌ Every OWASP ASVS requirement

❌ Every article of GDPR

Instead, learn:

Purpose → Scope → Category → Key Concepts → Relationships → Scenario Application

33. How CISSP Scenario Questions Should Be Approached

The exam may not ask:

"What is ISO 27001?"

It may give you a business scenario.

Use this process.

Step 1 — Identify the problem

Is it primarily:

• Governance?

• Risk?

• Controls?

• Privacy?

• Cloud?

• Application security?

• Compliance?

• Business continuity?

• Assurance?

Step 2 — Identify the type of framework

Is it:

• Framework?

• Standard?

• Control catalog?

• Regulation?

• Maturity model?

• Assurance report?

• Authorization program?

Step 3 — Select the best fit

Now choose the framework that actually addresses the problem.

This is much more effective than matching keywords mechanically.

34. CISSP Scenario Examples

Example 1 — ISMS

An organization wants to establish a formal information-security management system based on risk and potentially pursue certification.

Think: ISO 27001

Example 2 — Security Controls

An organization requires a detailed catalog of security and privacy controls.

Think: NIST SP 800-53

Example 3 — Control Assessment

An organization needs to determine whether its controls are implemented correctly and operating effectively.

Think: NIST SP 800-53A

Example 4 — Cybersecurity Risk

Management wants a common structure for communicating and managing cybersecurity risk across the organization.

Think: NIST CSF 2.0

Example 5 — Governance

Senior management wants IT activities aligned with business objectives and appropriate governance oversight.

Think: COBIT

Example 6 — Federal Cloud

A US federal organization needs a standardized security assessment and authorization process for a cloud service.

Think: FedRAMP

Example 7 — Payment Cards

An organization processes payment-card information and needs to address industry security requirements.

Think: PCI DSS

Example 8 — Application Security

An organization wants to integrate security into its application-management processes.

Think: ISO 27034

Example 9 — Privacy Management

An organization wants a formal management system for managing personally identifiable information and privacy responsibilities.

Think: ISO 27701

Example 10 — General Risk

An organization wants internationally recognized principles and guidelines for managing enterprise risk.

Think: ISO 31000

35. A Better Way to Think About the ISO Family

This is perhaps the most useful diagram in the entire article:

                    ┌───────────────────┐
                    │     ISO 27001     │
                    │       ISMS        │
                    └─────────┬─────────┘
                              │
                 Information Security
                              │
              ┌───────────────┼───────────────┐
              │               │               │
              ▼               ▼               ▼
         ISO 27002       ISO 27034       ISO 27701
          Controls         AppSec           Privacy
                                             
                             
                    ISO 31000
                         │
                         ▼
                  General Risk
                   Management

Memorize the purpose, not the documents.

36. A Better Way to Think About NIST

                         NIST
                           │
                           ▼
                   CYBER / SECURITY RISK
                           │
         +-----------------+-----------------+
         │                 │                 │
         ▼                 ▼                 ▼
     NIST CSF          NIST 800-37       NIST 800-53
   Cyber Risk             RMF               Controls
         │                                     │
         │                                     ▼
         │                                  800-53A
         │                                 Assessment
         │
         +---- 800-61  → Incident Response
         +---- 800-145 → Cloud
         +---- 800-171 → CUI
         +---- 800-207 → Zero Trust

This is the mental model I recommend carrying into the exam.

37. Framework vs Standard vs Control — The Final Distinction

If you remember only one conceptual section from this article, remember this.

Framework

A structured approach for managing a problem.

Example: NIST CSF

Standard

Defined requirements or guidance.

Example: ISO 27001

Control

A safeguard that reduces risk.

Example: access control

Regulation

A legally enforceable requirement.

Example: GDPR

Maturity Model

A way to assess and improve capability.

Example: SAMM

Assurance Report

Independent reporting about controls.

Example: SOC 1 / SOC 2

Authorization Program

A standardized process for security assessment and authorization.

Example: FedRAMP

38. The Three-Pass CISSP Study Strategy

Pass 1 — Recognition

Learn:

Framework → Purpose

Examples:

ISO 27001 → ISMS

COBIT → Governance

NIST 800-53 → Controls

FedRAMP → Federal Cloud

Pass 2 — Relationships

Understand how they connect.

ISO

ISO 27001
   ↓
ISMS
   ↓
Risk Management
   ↓
Controls
   ↓
ISO 27002

NIST

NIST CSF 2.0
      ↓
Cybersecurity Risk
      ↓
NIST 800-53
      ↓
Controls
      ↓
NIST 800-53A
      ↓
Assessment

Federal Cloud

Security Requirements / Controls
            ↓
      Security Assessment
            ↓
          FedRAMP
            ↓
        Authorization

Pass 3 — Scenario Application

Now ask:

"If I were the security manager, which framework or concept best solves this problem?"

This is where CISSP preparation becomes much more effective.

39. The Final Night-Before-CISSP Revision Sheet

If you have only a few minutes before the exam, remember this:

                   CISSP FRAMEWORK MAP

ISO 27001    → ISMS
ISO 27002    → Security Controls
ISO 27034    → Application Security
ISO 27701    → Privacy Management
ISO 31000    → Risk Management

NIST CSF 2.0 → Govern + Identify + Protect
               + Detect + Respond + Recover

NIST 800-53  → Security & Privacy Controls
NIST 800-37  → Risk Management Framework
NIST 800-53A → Control Assessment
NIST 800-61  → Incident Response
NIST 800-115 → Security Testing
NIST 800-145 → Cloud
NIST 800-171 → CUI
NIST 800-207 → Zero Trust

COBIT        → IT Governance
SABSA        → Business-Aligned Security Architecture

PCI DSS      → Payment Cards
FedRAMP      → Federal Cloud Authorization

SOC 1        → Financial Reporting
SOC 2        → Trust Services

CIS Controls → Prioritized Safeguards
MITRE ATT&CK → Adversary Behavior

OWASP ASVS   → Application Security Requirements
OWASP Top 10 → Application Security Risks

Conclusion — Understand the Decision, Not Just the Definition

The cybersecurity industry has an enormous number of frameworks, standards, regulations and control catalogs.

You do not need to memorize the entire cybersecurity standards universe to pass CISSP.

The current ISC2 exam outline confirms that frameworks are part of the CISSP knowledge base, particularly within Security and Risk Management, alongside governance, risk, compliance, privacy, control assessment and business continuity.

Your objective should therefore be to build a mental map.

Remember:

ISO 27001 manages the ISMS.

ISO 27002 provides security-control guidance.

ISO 27034 focuses on application security.

ISO 27701 focuses on privacy information management.

ISO 31000 provides general risk-management guidance.

NIST CSF 2.0 organizes cybersecurity risk outcomes through Govern, Identify, Protect, Detect, Respond and Recover.

NIST 800-53 provides security and privacy controls.

NIST 800-37 provides the Risk Management Framework.

NIST 800-53A assesses controls.

COBIT focuses on IT governance.

SABSA aligns security architecture with business requirements.

PCI DSS addresses payment-card security.

FedRAMP addresses federal cloud security assessment and authorization.

SOC 1 focuses on financial reporting.

SOC 2 focuses on Trust Services Criteria.

CIS Controls provide prioritized safeguards.

MITRE ATT&CK describes adversary behavior.

And perhaps the most important lesson:

The CISSP exam isn't testing whether you can recite a framework. It is testing whether you can apply security and risk concepts to a business scenario.

So don't study frameworks as isolated definitions.

Study them as tools for making security decisions.

When you see a CISSP scenario, ask:

What is the business problem?

What type of framework or requirement is involved?

What risk is being addressed?

Who has the authority to make the decision?

Which approach best aligns security with business objectives?

That is the CISSP mindset.

Learn the map.

Understand the relationships.

Think about risk.

Choose the answer that best protects the organization while aligning with business objectives.

That's how you turn a huge standards landscape into a manageable CISSP study topic.

Official References

ISC2 — CISSP Certification Exam Outline The current ISC2 outline is the authoritative source for the CISSP exam domains and explicitly lists ISO, NIST, COBIT, SABSA, PCI and FedRAMP among security-control framework examples.

NIST — Cybersecurity Framework 2.0 The current NIST CSF 2.0 uses six Functions: Govern, Identify, Protect, Detect, Respond and Recover.

ISO — ISO/IEC 27001 ISO/IEC 27001 specifies requirements for an Information Security Management System.

ISO — ISO/IEC 27701:2025 The current edition specifies requirements and guidance for a Privacy Information Management System.

NIST — SP 800-37 Risk Management Framework NIST describes the RMF as a structured and flexible process for managing security and privacy risk, including categorization, control selection, implementation, assessment, authorization and continuous monitoring.

ISO — ISO 31000 ISO 31000 provides principles and guidelines for general risk management.

Final CISSP Rule

Don't memorize the standards universe.

Understand what each framework is designed to accomplish.

Understand how it relates to risk, governance, controls and compliance.

Then apply that knowledge to the scenario.

That is the CISSP way.

Security Node is my space to explore how modern systems work, where they break, and how we can build them better.

I'll be writing about application security, product security, cloud security, APIs, Kubernetes, AI security, vulnerability research, and the occasional rabbit hole that starts with "I wonder what happens if..."

Some posts will be practical. Some will be deep dives. Some will simply document something interesting I learned while breaking or analyzing a system.

No promises of perfectly polished tutorials. Just practical security engineering, research, experiments, and lessons learned.

Welcome to Security Node.

Security Engineering for the Modern Stack.