CISSP Domain 2 study guide
What Asset Security tests
Domain 2 follows information and assets through their full lifecycle. The exam tests whether protection matches classification, ownership, privacy obligations, handling requirements, and business value—not whether every asset receives the strongest possible control.
Domain 2 objectives
Use these official objective areas as a coverage checklist, then combine them in scenario practice.
Identify and classify assets
Determine sensitivity, criticality, ownership, and the business impact of loss or disclosure.
Establish handling requirements
Define labeling, storage, transmission, access, sharing, and destruction requirements.
Provision resources securely
Apply secure acquisition, allocation, inventory, ownership, and acceptable-use practices.
Manage the data lifecycle
Protect data during creation, use, sharing, storage, archival, and destruction.
Ensure appropriate retention
Balance legal, regulatory, contractual, operational, and litigation-hold requirements.
Determine data security controls
Select controls based on data state, classification, jurisdiction, and compliance needs.
High-yield distinctions
Data owner
Accountable for classification, access requirements, and protection decisions.
Data custodian
Implements and operates safeguards on the owner’s behalf.
Controller
Determines why and how personal data is processed.
Processor
Processes personal data for the controller.
Clearing
Logical techniques protect against ordinary recovery attempts.
Purging
Makes recovery infeasible even with advanced laboratory techniques.
Common exam trap
Do not choose a control until you know who owns the information, how it is classified, where it is in the lifecycle, and which obligations apply.
How to study Domain 2
Step 1: Learn asset and privacy roles.
Step 2: Map controls to data at rest, in use, and in transit.
Step 3: Compare retention, archival, and legal hold.
Step 4: Practice media sanitization decisions.
Step 5: Connect classification to IAM and cryptography.