CC: Certified in Cybersecurity

Module 1: Security Principles

1.1: Understand Cybersecurity Concepts

• Confidentiality
• Integrity
• Availability
• Authentication, Authorization, Accounting (AAA)
• Non-repudiation
• Privacy

1.2: Understand Risk Management Concepts

• Risk management lifecycle
• Risk management processes

1.3: Understand Governance Concepts

• Regulations and laws
• Frameworks and guidelines
• Policies, standards (e.g., International Organization for Standardization (ISO), Center for Internet Security), procedures

1.4: Understand Cybersecurity Controls

• Technical controls
• Administrative controls
• Physical controls

1.5: Maintain Professional and Ethical Conduct

• Professional code of conduct
• Due care and due diligence
• ISC2 Code of Ethics

Module 2: Security Governance

2.1: Plan Governance, Risk, and Compliance (GRC)

• Purpose
• Importance
• Frameworks and tools

2.2: Understand Redundancy

• Business Continuity (BC)
• Disaster Recovery (DR)

2.3: Understand Security Awareness

• Organizational culture (e.g., importance of security, security leadership)
• Concepts (e.g., social engineering, password protection, phishing)

2.4: Measure Cybersecurity Effectiveness

• Key metrics, Key Risk Indicators (KRI)
• Dashboards, score cards, reports

Module 3: Identity and Access Management (AIM) Concepts

3.1: Understand Identity Life Cycle Management

• Roles definition
• Provision
• Review
• Deprovision
• Frameworks and tools

3.2: Understand Logical Access Controls

• Principle of Least Privilege (PoLP)
• Separation of Duties (SoD)
• Access control models
• CC Certification Exam Outline

Module 4: Network and Cloud Security Concepts

4.1: Understand Network Security

• Concepts (e.g., Open Systems Interconnection (OSI) model, Transmission Control Protocol/Internet Protocol (TCP/IP) model, Internet Protocol version 4 (IPv4), Internet Protocol version 6 (IPv6), Virtual Private Network (VPN))
• Firewalls (e.g., ports, applications)
• Wireless (e.g., Wi-Fi, Bluetooth)
• Embedded systems (e.g., Industrial Control System (ICS)), Internet Of Things (IoT)

4.2: Understand Network Security Architecture

• Comprehending network segmentation (e.g., Firewall zones, Virtual Local Area Network (VLAN), micro-segmentation)
• Defense in Depth
• Zero Trust (ZT)

4.3: Understand Cloud Security

• Characteristics (e.g., Broad network access, rapid elasticity, measured service, on-demand self-service, resource pooling)
• Service models
• Deployment models
• Shared security model (e.g., roles and responsibilities)

Module 5: Security Operations and Incident Response

5.1: Understand Data Security

• Data handling (e.g., classification, labeling, masking, and sanitization)
• Encryption (e.g., symmetric, asymmetric, hashing, quantum resistant cryptography)

5.2: Understand Security Operations

• Logging and monitoring security events
• Security event triage (e.g., incident use cases, prioritization, correlation)
• Threat actors (e.g., types, motivations)
• Cyber threat intelligence
• Threat frameworks

5.3: Understand Incident Response (IR)

• Data handling policy implementing Incident Response Plan (IRP)
• Incident Response (IR) exercises (e.g., testing, tabletop)

5.4: Understand Asset Protection

• Asset lifecycle management (e.g., End Of Life (EOL) software and devices)
• Configuration and change management

5.5: Understand Security Testing

• Security readiness testing (e.g., blue teaming, purple teaming, red teaming)
• Application testing (e.g., vulnerability scanning, static analysis, dynamic analysis, threat modeling)
• Physical penetration testing (e.g., phishing, tailgating, impersonation)