1.1 – Understand, adhere to, and promote professional ethics

1.2 – Understand and apply security concepts

1.3 – Evaluate and apply security governance principles

1.4 – Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

1.5 – Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)

1.6 – Develop, document, and implement security policy, standards, procedures, and guidelines

1.7 – Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements

1.8 – Contribute to and enforce personnel security policies and procedures

1.9 – Understand and apply risk management concepts

1.10 – Understand and apply threat modeling concepts and methodologies

1.11 – Apply Supply Chain Risk Management (SCRM) concepts

1.12 – Establish and maintain a security awareness, education, and training program

2.1 – Identify and classify information and assets

2.2 – Establish information and asset handling requirements

2.3 – Provision information and assets securely

2.4 – Manage data lifecycle

2.5 – Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)

2.6 – Determine data security controls and compliance requirements

3.1 – Research, implement and manage engineering processes using secure design principles

3.2 – Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)

3.3 – Select controls based upon systems security requirements

3.4 – Understand security capabilities of Information Systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)

3.5 – Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

3.6 – Select and determine cryptographic solutions

3.7 – Understand methods of cryptanalytic attacks

3.8 – Apply security principles to site and facility design

3.9 – Design site and facility security controls

3.10 – Manage the information system lifecycle

4.1 – Apply secure design principles in network architectures

4.2 – Secure network components

4.3 – Implement secure communication channels according to design

5.1 – Control physical and logical access to assets

5.2 – Design identification and authentication strategy (e.g., people, devices, and services)

5.3 – Federated identity with a third-party service

5.4 – Implement and manage authorization mechanisms

5.5 – Manage the identity and access provisioning lifecycle

5.6 – Implement authentication systems

6.1 – Design and validate assessment, test, and audit strategies

6.2 – Conduct security control testing

6.3 – Collect security process data (e.g., technical and administrative)

6.4 – Analyze test output and generate report

6.5 – Conduct or facilitate security audits

8.1 – Understand and integrate security in the Software Development Life Cycle (SDLC)

8.2 – Identify and apply security controls in software development ecosystems

8.3 – Assess the effectiveness of software security

8.4 – Assess security impact of acquired software

8.5 – Define and apply secure coding guidelines and standards