CISSP Domain 2 Master Cheat Sheet: Asset Security

1. Asset Classification

Why Classification Matters

Organizations cannot protect all information equally.

Classification ensures security controls match the value and sensitivity of information.

Typical Classification Levels

Level	Description	Example
Public	No restrictions	Marketing brochure
Internal	Internal business use	Company policies
Confidential	Significant damage if disclosed	HR records
Restricted / Highly Confidential	Severe damage if disclosed	Encryption keys, trade secrets

Classification Principles

Data Owner determines classification.
Custodian implements controls.
Users follow handling requirements.
Classification should be reviewed periodically.

2. Data Ownership & Responsibilities

Roles

Role	Responsibility
Data Owner	Classifies data and approves access
Business Owner	Determines business value
System Owner	Responsible for system operations
Custodian	Implements security controls
User	Uses information according to policy
Privacy Officer	Oversees privacy compliance

CISSP Tip

Owners classify.

Custodians protect.

Users comply.

3. Information Lifecycle

Every piece of information passes through a lifecycle.

Create
   ↓
Store
   ↓
Use
   ↓
Share
   ↓
Archive
   ↓
Destroy

Security controls should exist during every phase.

4. Data States

Information exists in three states.

State	Protection Examples
Data at Rest	Disk encryption
Data in Transit	TLS, VPN
Data in Use	Memory protection, secure processing

CISSP Remember

Protect data regardless of where it exists.

5. Asset Handling

Proper handling reduces accidental disclosure.

Handling includes:

Labeling
Storage
Transmission
Backup
Archiving
Sanitization
Destruction

Examples

Confidential documents

Locked cabinets
Encryption
Access logging

Highly sensitive files

MFA
Encryption
Limited access

6. Data Labeling

Labels communicate classification.

Examples

PUBLIC

INTERNAL

CONFIDENTIAL

RESTRICTED

Labeling Rules

Physical media

Electronic files

Emails

Backups

Cloud storage

7. Data Retention

Organizations retain information based on:

Legal requirements
Business needs
Regulatory compliance
Contracts

Retention Policy Should Define

Retention period

Storage location

Archive method

Secure destruction

Legal holds

8. Data Remanence

Deleted data often remains recoverable.

Residual information is called: Data Remanence

Risks

Recovered hard drives

Cloud storage

Old backups

Recycled devices

9. Secure Data Destruction

Different media require different destruction methods.

Method	Used For
Secure Wipe	SSD/HDD
Cryptographic Erase	Self-encrypting drives
Degaussing	Magnetic media
Pulverizing	HDD
Shredding	Paper
Incineration	Highly sensitive media

CISSP Tip

Simply deleting a file is NOT secure destruction.

10. Media Sanitization

NIST SP 800-88 defines three primary sanitization methods.

Method	Description
Clear	Logical overwrite
Purge	Degauss or crypto erase
Destroy	Physical destruction

11. Data Security Controls

Protect data using:

Encryption

Access Control

MFA

DLP

Tokenization

Masking

Logging

Backups

Integrity Checking

12. Data Loss Prevention (DLP)

Purpose

Prevent unauthorized disclosure.

DLP Monitors

USB devices

Cloud uploads

Printing

Clipboard

Network traffic

DLP Policies

Detect

Monitor

Alert

Block

Quarantine

13. Privacy Protection

Asset Security closely supports privacy.

Common sensitive data includes:

PII

PHI

Financial information

Biometric data

Customer records

Privacy Principles

Data Minimization

Purpose Limitation

Accuracy

Consent

Transparency

Accountability

14. Data Masking & Tokenization

Data Masking

Hides sensitive values.

Example

XXXX-XXXX-XXXX-1234

Tokenization

Replaces sensitive information with non-sensitive tokens.

Often used for:

Credit cards

Payment systems

Healthcare

15. Cloud Asset Security

Organizations remain responsible for protecting data stored in the cloud.

Consider:

Encryption

Key Management

Backups

Access Reviews

Logging

Data Residency

Shared Responsibility Model

16. Mobile & Portable Media Security

Protect:

Laptops

USB drives

Smartphones

External drives

Controls include:

Encryption

Remote wipe

MFA

Device inventory

MDM

17. Common CISSP Domain 2 Mistakes

❌ Confusing Data Owner with Custodian

❌ Forgetting the information lifecycle

❌ Assuming deletion equals destruction

❌ Ignoring data in use

❌ Selecting technical solutions before considering classification

18. CISSP Domain 2 Exam Tips

Always determine:

Who owns the data?

What is its classification?

Where is it stored?

How is it transmitted?

How should it be destroyed?

The CISSP exam often expects the answer that protects the information throughout its lifecycle—not merely one phase.

19. Quick Revision Checklist

□ Data Classification

□ Data Ownership

□ Information Lifecycle

□ Data States

□ Labeling

□ Retention

□ Sanitization

□ Data Remanence

□ DLP

□ Privacy

□ Encryption

□ Tokenization

□ Cloud Data Security

20. Memory Aids

Topic	Memory Trick
Information Lifecycle	Create → Store → Use → Share → Archive → Destroy
Data States	Rest • Transit • Use
Sanitization	Clear • Purge • Destroy
Roles	Owner Classifies • Custodian Protects
Classification	Public → Internal → Confidential → Restricted
DLP	Detect • Monitor • Block

21. Five CISSP-Style Practice Questions

Question 1

Who is primarily responsible for classifying organizational data?

A. Custodian

B. User

C. Data Owner

D. System Administrator

Answer: C. Data Owner

Explanation: The Data Owner determines the value, classification, and handling requirements for information. Custodians implement the required security controls.

Question 2

Which NIST SP 800-88 sanitization method provides the highest assurance that sensitive information cannot be recovered?

A. Clear

B. Purge

C. Destroy

D. Archive

Answer: C. Destroy

Explanation: Physical destruction (such as shredding or pulverizing) provides the highest assurance that data cannot be reconstructed or recovered.

Question 3

An organization replaces credit card numbers with randomly generated values while storing the original numbers securely in a separate system. Which technique is being used?

A. Encryption

B. Hashing

C. Tokenization

D. Data Masking

Answer: C. Tokenization

Explanation: Tokenization substitutes sensitive data with non-sensitive tokens, reducing exposure while maintaining usability for business processes.

Question 4

Which data state is protected by Transport Layer Security (TLS)?

A. Data at Rest

B. Data in Transit

C. Data in Use

D. Archived Data

Answer: B. Data in Transit

Explanation: TLS encrypts information while it is transmitted across a network, protecting confidentiality and integrity during communication.

Question 5

Which role is responsible for implementing the security controls defined by the Data Owner?

A. Data Custodian

B. Business Owner

C. Privacy Officer

D. Internal Auditor

Answer: A. Data Custodian

Explanation: Custodians are responsible for implementing and maintaining technical and operational controls based on the requirements established by the Data Owner.

22. Related CISSP Articles

Data Classification
Identity and Access Management (IAM)
Security Controls
Cryptography
Privacy Fundamentals
GDPR
HIPAA
Data Loss Prevention (DLP)
Zero Trust Architecture
Risk Management
Business Continuity Planning
Disaster Recovery Planning

GoCyberNinja Master Cheat Sheet Series

Maintain a consistent naming convention across all eight domains to reinforce your brand and improve discoverability:

Continue Your CISSP Journey with GoCyberNinja

Reading about secure software development is only the beginning. The CISSP exam evaluates your ability to apply security principles, assess business risk, and make informed management decisions across the entire software lifecycle.

GoCyberNinja CISSP Exam Prep helps reinforce Domain 8 through realistic, scenario-driven practice designed to build both technical understanding and executive-level decision-making.

Strengthen Your Domain 8 Knowledge

✅Realistic CISSP Practice Questions covering all eight CISSP domains

✅ 1,200 Full Mock Exam Questions across eight comprehensive practice exams

✅ 400+ Scenario-Based Questions designed to develop the CISSP manager's mindset

✅ 1,040+ Flashcards for rapid review and long-term retention

✅ Adaptive Smart Review that automatically focuses on your weakest topics

✅ Performance Analytics to measure readiness and identify knowledge gaps

✅ Personalized Study Plans based on your learning progress

✅ Three Free CISSP Readiness Tests to benchmark your preparation before attempting full-length exams

Practice. Analyze. Master.

The CISSP is not a programming exam—it is a security leadership and risk management exam. Success comes from understanding how secure software supports business objectives, protects organizational assets, and reduces enterprise risk.

With GoCyberNinja CISSP Exam Prep, you'll build the judgment, confidence, and practical decision-making skills expected of a CISSP professional.

Practice smarter. Analyze deeper. Master the CISSP.

Take the FREE CISSP Readiness Tests to evaluate your knowledge, identify weak areas, and receive a personalized study roadmap before tackling the full question bank.