3 things that surprise me about CISSP Domain 1: Security and Risk Management

I thought I knew risk management… CISSP Domain 1 proved me wrong. Or did it really?

When I started studying for CISSP, I thought Domain 1 would be the easiest.

After all, I work as a Cybersecurity Manager, so risk, compliance, and policies are what I do.

But this domain quickly reminded me that “knowing” risk management in practice and understanding it the CISSP way are two different things.

Of course, the general principles still apply, and knowing how risk management works definitely helps, but it wasn’t nearly enough for this exam.

I quickly realized that this exam wants you to have a really broad background, and regardless of your experience, you probably do not have the knowledge of all kinds of frameworks and laws from this domain.

Subscribe to get weekly posts that turn complex topics into something you can actually use.

So here are 3 things that will hopefully set up the right mindset for the exam.

1. Yes, you need to know so many laws

Maybe you didn’t need to know any laws until now.
Well, neither did I.

But CISSP expects you to understand the major legal and regulatory frameworks that can impact your organization, especially around privacy, data protection, and intellectual property.

But here is the catch:

It’s not about memorizing every clause, but about knowing which laws apply and why they matter.

So do not spend too much time trying to be a lawyer. Simply remember to whom this law applies and what the main idea is. I tried to summarize it in the picture below!

2. Frameworks, frameworks everywhere

If you already work in cybersecurity, you’ve probably heard of a few frameworks - ISO 27001, NIST, maybe COBIT.

Want me to share a Domain 1 study checklist? Drop a comment below and I’ll make it happen.

I thought I would ace this part because I’m more than familiar with the ISO 2700x series and ISO 21343.
Well, I was wrong.

Again, Domain 1 expects you to see the big picture.

You’re supposed to understand how these frameworks fit together, what purpose they serve, and when you would use each one.

CISSP doesn’t care if you can quote a control number from ISO.
Being an expert in one framework won’t help you much here.

What matters is whether you know why an organization would choose ISO 27001 over NIST CSF, or how governance frameworks like COBIT relate to security frameworks like ISO.

Think of frameworks as different toolsets for aligning security with business goals.
The key is not to dive too deep, but to understand the intent and structure behind each one.

That mindset shift makes a huge difference on the exam.

⚠️ Side note: Despite everything I just said, I would recommend a deeper dive into NIST RMF and ISO 27001/27005.

3. Risk assessment frameworks – but from a governance perspective

I’ve worked with risk assessment models like STRIDE or DREAD before.
So when I saw them in the CISSP outline, I didn’t think much of it.

But what surprised me was how the exam expects you to approach them.
It’s not about running a technical threat model, it’s about understanding their governance and decision-making context.

You’re supposed to know why a particular organization would choose one model over another, and how that decision aligns with business objectives, compliance requirements, and overall risk strategy.

It’s less about identifying the specific vulnerabilities and more about showing that you understand the process, ownership, and accountability behind each model.

Conclusion

You’re starting to see a pattern here, right?

The most important thing for this exam is mindset.
You have to think like a CISO, not a cybersecurity analyst.

CISSP isn’t about how deep your technical skills go, it’s about how well you can connect the dots between risk, law, and strategy. The exam tests whether you can assess a situation and make the right strategic decision.

I’m not saying you shouldn’t care about how the frameworks work.
But don’t forget to see the bigger picture.
Because in the end, that’s what really counts here.

If you’re interested in Cybersecurity materials for Domain 1, drop a comment below and subscribe to get more insights!