CISA Domain 5 · Protection of Information Assets

Exam

CISA

Exam weight

26%

What it covers

Security frameworks, physical and environmental controls, identity and access, network and endpoint security, DLP, encryption and PKI, cloud and virtualization, mobile and IoT, awareness, attacks, testing, monitoring, incident response and forensics.

What the exam rewards

Least privilege and accountable access
Strong, phishing-resistant authentication
Key management and evidence integrity
Containment before recovery

Common traps

Choosing the newest technology over the right control
Confusing which key signs and which encrypts
Rebooting a compromised system and losing evidence

Official subtopics

Information Asset Security and Control

Information Asset Security Frameworks, Standards, and Guidelines
Physical and Environmental Controls
Identity and Access Management
Network and End-Point Security
Data Loss Prevention
Data Encryption
Public Key Infrastructure
Cloud and Virtualized Environments
Mobile, Wireless, and Internet-of-Things Devices

Security Event Management

Security Awareness Training and Programs
Information System Attack Methods and Techniques
Security Testing Tools and Techniques
Security Monitoring Tools and Techniques
Security Incident Response Management
Evidence Collection and Forensics

How to study it

Know the cryptography basics (which key does what) and the incident sequence. Then practice access control scenarios.