Browse ISC2 Certification Guides

Security Principles

Study ISC2 CC Security Principles: CIA, authentication, privacy, risk, controls, ethics, governance, and policy basics.

Security Principles is the largest current CC domain. It gives you the vocabulary and judgment pattern that the rest of the exam reuses: protect the right objective, understand risk, classify the control, and respect governance.

Current weight

ISC2 weights this domain at 26% of the current CC exam outline.

Work this domain in order

  1. Information Assurance for confidentiality, integrity, availability, authentication, non-repudiation, and privacy.
  2. Risk, Controls, Ethics, and Governance for risk treatment, control types, ISC2 Code of Ethics, policies, procedures, standards, regulations, and laws.

What this domain is really testing

Scenario signal Best first question
data was exposed Is this confidentiality or privacy?
data was changed Is this integrity, authorization, or change control?
service is down Is this availability, continuity, or recovery?
a user claims they did not perform an action Is non-repudiation or accountability the missing objective?
a risk is identified Should the organization avoid, mitigate, transfer, or accept it?
a rule exists but nobody follows it Is the missing layer procedure, standard, training, monitoring, or enforcement?

CC answer habit

Do not jump from risk to tool. CC wants the control objective first:

    flowchart TD
	  S["Scenario"] --> O["Security objective"]
	  O --> R["Risk and impact"]
	  R --> C["Control type"]
	  C --> G["Governance or evidence"]

If you can explain the objective and the evidence, the tool choice becomes much easier.

Common traps

  • Treating confidentiality, privacy, and encryption as the same thing.
  • Calling every security problem a vulnerability when the stem is really about threat or impact.
  • Choosing a technical control when the question asks for policy, procedure, or governance.
  • Forgetting that professional conduct matters on ISC2 exams, even at the entry level.

In this section

  • Information Assurance
    Study ISC2 CC information assurance: confidentiality, integrity, availability, authentication, non-repudiation, and privacy.
  • Risk, Controls, Ethics, and Governance
    Study ISC2 CC risk management, control types, ISC2 Code of Ethics, policies, procedures, standards, laws, and governance.
Revised on Monday, June 15, 2026
2. BC, DR, and IR