CISSP Domain

Domain 1 – Security and Risk Management

CISSP Objective

Personnel security policies and procedures; security awareness, education, and training program concepts

Focus

Personnel Security Lifecycle, Human Risk, Insider Risk, Security Awareness, Training & Education

Summary

Master personnel security and security awareness for the CISSP exam. This Domain 1 guide covers personnel screening, onboarding, least privilege, separation of duties, job rotation, mandatory vacations, insider threats, role changes, termination, and security awareness, training, and education.

CISSP Domain 1 — Security and Risk Management

Technology can enforce access controls, encrypt information, detect attacks, and record security events. But organizations still depend on people to make decisions, handle sensitive information, administer systems, follow policies, recognize threats, and protect business assets.

That makes personnel security and security awareness fundamental components of organizational risk management.

For the CISSP exam, this topic is not simply about conducting annual awareness training. Candidates need to understand how security applies throughout the personnel lifecycle, how responsibilities should be divided, how access should change when roles change, and how awareness, training, and education reduce human-related risk.

The central CISSP principle is:

1. Personnel Security as a Risk Management Function

Personnel security consists of policies, processes, and controls designed to reduce risks associated with employees, contractors, consultants, temporary workers, and other individuals who interact with organizational assets.

These risks can arise from:

• Human error

• Excessive privileges

• Fraud

• Social engineering

• Negligence

• Misuse of information

• Insider threats

• Conflicts of interest

• Poor security awareness

• Inadequate onboarding or termination

• Failure to revoke access

• Unauthorized disclosure

A CISSP candidate should therefore view personnel security as part of the organization's overall security and risk-management program, rather than an isolated HR responsibility.

2. The Personnel Security Lifecycle

A useful CISSP model is:

SCREEN → HIRE → ONBOARD → AUTHORIZE → TRAIN → MONITOR → CHANGE → TERMINATE

Security requirements should follow the individual through every stage.

This lifecycle is important because personnel risk changes over time.

Someone may require one level of access when hired, different privileges after promotion, and no access immediately after termination.

3. Before Employment: Screening and Background Checks

Personnel security begins before an individual receives access to organizational assets.

Depending on legal requirements, organizational policy, job responsibilities, and risk, pre-employment screening may include:

• Identity verification

• Employment-history verification

• Education verification

• Professional credential verification

• Reference checks

• Criminal-history checks where legally appropriate

• Financial checks where relevant and permitted

• Conflict-of-interest reviews

CISSP Principle

The depth of screening should be appropriate to the sensitivity and risk of the position.

An administrator with privileged access to critical systems may justify more extensive screening than an employee whose role provides no access to sensitive systems or information.

The best answer is therefore generally risk-based screening, not maximum screening for every employee.

4. Employment Agreements and Security Responsibilities

Security responsibilities should be communicated before or when access is granted.

Relevant documents may include:

• Employment agreements

• Acceptable Use Policies (AUPs)

• Confidentiality agreements

• Non-Disclosure Agreements (NDAs)

• Codes of conduct

• Intellectual-property agreements

• Privacy requirements

• Security policies

Employees should understand what is expected of them and what activities are prohibited.

Exam Thinking

A policy is much more defensible when personnel:

1. Are informed of it.

2. Can access it.

3. Understand their responsibilities.

4. Acknowledge it where appropriate.

5. Receive appropriate training.

5. Onboarding

Onboarding should provide individuals with only the resources and privileges necessary for their approved responsibilities.

Security activities may include:

• Identity creation

• Account provisioning

• Role assignment

• Access authorization

• MFA enrollment

• Equipment issuance

• Policy acknowledgement

• Security awareness

• Confidentiality requirements

• Physical-access provisioning

The governing principle is:

6. Least Privilege

Least privilege means providing users with only the minimum access required to perform authorized responsibilities.

If an employee requires read access, write access should not automatically be granted.

If privileged access is needed temporarily, permanent administrative privileges may not be appropriate.

Least privilege reduces:

• Accidental damage

• Unauthorized disclosure

• Fraud opportunities

• Malware impact

• Insider risk

• Attack surface

For CISSP questions, granting broad access "just in case" is usually inconsistent with sound security practice.

7. Need to Know

Least privilege and need to know are closely related.

Least privilege concerns the minimum privileges required to perform a function.

Need to know concerns whether an individual has a legitimate requirement to access particular information.

An employee may have sufficient system privileges to access information but still lack a legitimate business need to view it.

Authorization therefore requires more than technical capability.

8. Separation of Duties

Separation of Duties (SoD) divides sensitive responsibilities among multiple individuals so that one person cannot independently complete a high-risk process.

For example, the person who requests a payment should not necessarily be the same person who approves and executes it.

SoD helps reduce:

• Fraud

• Abuse

• Unauthorized transactions

• Errors

• Conflicts of interest

CISSP Exam Principle

This is particularly important in financial, administrative, security, and privileged-access processes.

9. Dual Control

Dual control requires two authorized individuals to participate in or approve a sensitive activity.

Examples could include:

• Accessing highly sensitive material

• Performing certain critical administrative operations

• Handling cryptographic key material

• Approving high-risk transactions

Separation of Duties vs. Dual Control

They are related but not identical.

Separation of duties: divides responsibilities.

Dual control: requires multiple individuals to complete or authorize an action.

10. Job Rotation

Job rotation periodically moves personnel among responsibilities or positions.

From a security perspective, job rotation can:

• Reduce dependency on one individual

• Expose irregularities

• Discourage long-term concealment of fraud

• Improve cross-training

• Support succession planning

If one employee has secretly manipulated a process for years, moving another employee into that responsibility may expose inconsistencies.

11. Mandatory Vacations

Mandatory vacations require personnel in certain sensitive positions to be absent from their responsibilities for a defined period.

Why can this be a security control?

Some fraudulent activities require continuous intervention to remain concealed.

When another individual assumes the responsibilities, the fraud may become visible.

High-Yield CISSP Distinction

Separation of Duties → prevents excessive control.

Job Rotation → changes responsibilities.

Mandatory Vacation → interrupts continuous control and may reveal concealed activity.

These distinctions are frequently useful in exam scenarios.

12. Privileged Users Require Greater Control

Administrators, security engineers, database administrators, cloud administrators, and other privileged users can have extraordinary access.

Controls may include:

• Separate administrative accounts

• Privileged Access Management (PAM)

• MFA

• Session logging

• Activity monitoring

• Approval workflows

• Time-limited privileges

• Periodic access reviews

• Separation of administrative duties

The greater the privilege, the greater the potential impact of misuse or compromise.

Therefore:

13. Contractors, Consultants, and Temporary Personnel

Personnel security is not limited to permanent employees.

Contractors and third parties may have:

• Network access

• Cloud access

• Physical access

• Privileged accounts

• Confidential information

• Customer information

• Source code

Organizations should establish appropriate:

• Screening

• Contracts

• Confidentiality requirements

• Access controls

• Security training

• Supervision

• Monitoring

• Termination procedures

The employment arrangement does not remove the organization's responsibility to manage access and risk.

14. Changes in Employment and Role

A major personnel-security risk occurs when an employee changes jobs but retains previous privileges.

This can produce privilege accumulation or privilege creep.

Example:

An employee moves from Finance to IT.

New IT privileges are granted, but old Finance privileges remain.

The individual now has access that may violate least privilege and separation of duties.

Correct Security Response

Role changes should trigger:

Access Review → Remove Unneeded Access → Approve New Access → Verify

This is often called a mover process within Joiner-Mover-Leaver lifecycle management.

15. Joiner-Mover-Leaver (JML)

A useful identity and personnel lifecycle model is:

JOINER

New individual enters the organization.

Security priorities:

• Verify identity

• Establish authorized role

• Provision minimum necessary access

• Provide security awareness

• Record approvals

MOVER

Individual changes responsibilities.

Security priorities:

• Reassess access

• Remove obsolete privileges

• Grant newly approved privileges

• Check for conflicts

LEAVER

Individual leaves the organization.

Security priorities:

• Revoke access

• Recover assets

• Disable credentials

• Protect organizational information

• Preserve required records

The CISSP candidate should recognize that access must follow business responsibility throughout the lifecycle.

16. Termination and Offboarding

Termination is one of the highest-risk stages of the personnel lifecycle.

The process should be coordinated among appropriate functions such as:

• Management

• Human Resources

• Security

• IT

• Physical security

• Legal, where appropriate

Activities may include:

• Disable accounts

• Revoke remote access

• Revoke privileged access

• Recover devices

• Recover badges and keys

• Remove physical access

• Revoke certificates or tokens

• Transfer organizational information

• Preserve required records

• Remind individuals of continuing confidentiality obligations

CISSP Exam Principle

The timing of access revocation should reflect the risk.

For an involuntary or high-risk termination, access may need to be disabled at or before the termination notification, according to organizational procedures.

The objective is to prevent an individual from retaining unauthorized access after the relationship changes or ends.

17. Employee Departure Does Not End All Obligations

Certain obligations may survive employment.

Examples include:

• Confidentiality

• Protection of trade secrets

• Intellectual-property obligations

• Data handling requirements

• Legal restrictions

This is why exit procedures may include reminders about continuing obligations.

18. Security Awareness, Training, and Education

These terms are related but have different objectives.

Awareness

Awareness focuses on attention and behavior.

Goal:

Examples:

• Phishing awareness

• Password hygiene

• Reporting suspicious activity

• Social engineering

• Physical security

• Data handling

Training

Training develops specific skills required to perform a job securely.

Examples:

• Secure system administration

• Incident-handling procedures

• Secure coding

• Data-classification procedures

• Privileged-access procedures

Education

Education provides broader knowledge and understanding.

It develops deeper security competence rather than teaching only a specific task.

CISSP Memory Aid

Awareness → Know

Training → Do

Education → Understand

19. Security Awareness Is a Program, Not an Annual Event

One of the most important CISSP concepts is that awareness should be continuous and measurable.

A mature awareness program may use:

• Initial onboarding training

• Periodic refreshers

• Short awareness messages

• Phishing simulations

• Role-specific content

• Policy updates

• Security reminders

• Incident lessons

• Reinforcement activities

A once-a-year presentation alone does not necessarily create lasting security behavior.

20. Role-Based Security Training

Not everyone requires identical security training.

Examples:

General Users

Phishing, passwords, reporting, data handling and acceptable use.

Developers

Secure coding, application vulnerabilities and secure development practices.

Administrators

Privileged access, hardening, logging and secure configuration.

Executives

Governance, business risk, incident responsibilities and regulatory implications.

Incident Responders

Investigation, containment, evidence handling and response procedures.

CISSP Principle

21. Social Engineering Awareness

Attackers frequently target people rather than technical controls.

Common social-engineering techniques include:

• Phishing

• Spear phishing

• Business email compromise

• Pretexting

• Impersonation

• Tailgating

• Baiting

• Vishing

• Smishing

Awareness programs should help personnel:

Recognize → Verify → Resist → Report

The goal is not simply to make employees afraid of clicking links. It is to create predictable, secure behavior.

22. Phishing Simulations

Phishing simulations can help evaluate and reinforce awareness.

Useful measurements may include:

• Reporting rate

• Interaction rate

• Repeat susceptibility

• Improvement over time

• Department or role trends

However, the objective should be risk reduction and learning, not embarrassing employees.

If users repeatedly fail simulations, appropriate responses may include additional targeted training and reinforcement.

23. Measuring Awareness Effectiveness

A security awareness program should be evaluated.

Possible measures include:

• Training completion

• Phishing reporting rates

• Simulation results

• Repeat failure patterns

• Security incident trends

• Policy violations

• Knowledge assessments

• Reporting behavior

Important CISSP Distinction

Completion is not the same as effectiveness.

Knowing that 100% of employees completed training tells management about participation.

It does not necessarily prove that security behavior improved.

The better question is:

24. Security Culture

The long-term objective of awareness is not merely compliance.

It is to create a culture where personnel:

• Recognize security as part of their responsibilities

• Report suspicious behavior

• Protect information

• Follow established processes

• Challenge unusual requests

• Understand business impact

• Make risk-aware decisions

Security culture requires management support.

If leadership routinely bypasses security policies, employees are unlikely to treat those policies seriously.

25. Management's Role

Senior management is ultimately responsible for establishing organizational expectations and supporting the security program.

Management should:

• Approve security policies

• Define responsibilities

• Provide resources

• Establish accountability

• Support awareness

• Reinforce security expectations

• Review effectiveness

This reflects a recurring CISSP principle:

Security professionals advise, design, implement, monitor, and report—but organizational accountability rests with management.

26. Insider Threats

Insider threats may involve:

• Malicious employees

• Negligent personnel

• Compromised accounts

• Contractors

• Former employees

• Privileged users

Potential controls include:

• Least privilege

• Separation of duties

• Monitoring

• Access reviews

• Data-loss controls

• Mandatory vacations

• Job rotation

• Strong offboarding

• Security awareness

• Incident reporting mechanisms

The CISSP approach is defense in depth.

There is rarely one control capable of eliminating insider risk.

27. Privacy and Personnel Monitoring

Organizations may monitor personnel activity for legitimate security and business purposes.

However, monitoring should consider:

• Applicable laws

• Privacy requirements

• Organizational policies

• Employee notice

• Business necessity

• Proportionality

• Data protection

The CISSP candidate should not assume that technically possible monitoring is automatically appropriate or lawful.

28. Acceptable Use Policies

An Acceptable Use Policy (AUP) defines appropriate and prohibited use of organizational systems and resources.

It may address:

• Internet use

• Email

• Devices

• Software

• Data handling

• Remote access

• Personal use

• Prohibited activities

An effective AUP helps establish clear expectations and supports accountability.

29. Personnel Security and Physical Security

People also interact with physical controls.

Relevant practices can include:

• Identification badges

• Visitor procedures

• Restricted areas

• Anti-tailgating awareness

• Clean desk practices

• Device protection

• Secure document disposal

• Reporting lost badges or equipment

CISSP questions may deliberately combine personnel, physical, and information-security considerations.

Think about the risk, not merely which domain the control belongs to.

30. CISSP Exam Thinking: What Should Happen FIRST?

Personnel-security questions frequently test sequence.

Scenario

An employee is transferring to another department and will receive access to a new set of systems. What should the security professional do FIRST?

A. Add the employee to the new department's groups

B. Provide administrator access temporarily

C. Review the employee's access requirements based on the new role

D. Wait for the next quarterly access review

Best Answer: C

First determine what access is appropriate for the new responsibilities.

Then remove unnecessary old access and provision approved new access.

The CISSP sequence is:

31. CISSP Scenario: Termination

A privileged administrator is being involuntarily terminated. What is the MOST important security consideration?

A. Conduct the annual security-awareness survey

B. Coordinate timely revocation of logical and physical access

C. Rotate the administrator to another position

D. Review the employee's original background check

Best Answer: B

The immediate risk is continued unauthorized access.

The response should be coordinated with the organization's termination process so access is revoked at the appropriate time.

32. CISSP Scenario: Awareness

An organization reports that 100% of employees completed mandatory phishing training, but successful phishing attacks continue to increase. What should the security manager do NEXT?

A. Consider the awareness program successful because completion is 100%

B. Terminate employees who fail simulations

C. Evaluate training effectiveness and adjust the program based on observed behavior and risk

D. Eliminate phishing simulations

Best Answer: C

The purpose of awareness is risk reduction, not merely completion.

This illustrates an important CISSP distinction:

Common CISSP Exam Traps

Trap 1 — More access is more convenient

Convenience does not override least privilege.

Trap 2 — Access automatically follows the employee forever

Access follows current business responsibilities, not employment history.

Trap 3 — Annual training equals an effective awareness program

Completion does not prove effectiveness.

Trap 4 — HR owns personnel security

Personnel security requires coordination among management, HR, security, IT, legal, and other appropriate functions.

Trap 5 — Background checks eliminate insider threats

Screening reduces risk; it does not eliminate it.

Trap 6 — Technical controls alone solve human risk

Personnel security requires administrative, technical, physical, and behavioral controls.

Trap 7 — Terminate the account after completing all HR procedures

For high-risk terminations, access revocation may need to be coordinated to occur at or before notification.

Trap 8 — Everyone needs identical training

Training should be role-based and risk-based.

High-Yield CISSP Comparisons

Personnel Security Exam Memory Map

Remember:

JOIN → WORK → CHANGE → LEAVE

JOIN

Screen → Authorize → Provision → Train

WORK

Least Privilege → Separation of Duties → Awareness → Monitor → Review

CHANGE

Reassess → Remove Old Access → Approve New Access → Verify

LEAVE

Disable → Revoke → Recover → Preserve → Confirm

And throughout the entire lifecycle:

Key CISSP Takeaways

For the exam, remember:

1. Personnel security is a lifecycle process.

2. Screening should be appropriate to the position's risk.

3. Access should be authorized according to business need.

4. Apply least privilege and need to know.

5. Use separation of duties to reduce excessive individual control.

6. Job rotation and mandatory vacations can help detect concealed misconduct.

7. Role changes require access reassessment.

8. Terminations require coordinated and timely access revocation.

9. Contractors and temporary personnel require appropriate security controls too.

10. Awareness, training, and education serve different purposes.

11. Security awareness should be continuous and measurable.

12. Training should be appropriate to the individual's role.

13. Training completion does not prove training effectiveness.

14. Insider risk requires defense in depth.

15. Management establishes accountability and security expectations.

16. Human-related risk should be managed like other organizational risk.

Final CISSP Exam Perspective

Personnel questions on the CISSP exam are rarely about simply remembering an HR procedure.

They test whether you understand how people, access, responsibility, governance, and risk interact throughout the personnel lifecycle.

When several answers appear technically possible, look for the one that best demonstrates:

business need before access, authorization before provisioning, least privilege, separation of duties, risk-based controls, management accountability, continuous awareness, timely access review, and coordinated termination.

And for awareness questions, remember:

That distinction captures much of the CISSP mindset behind Personnel Security & Security Awareness.

Related Topics