CISSP: Think Like a Security Manager

Introduction

30 Second Summary

Experienced IT professionals often fail the CISSP exam not because they lack technical knowledge, but because they answer questions the way they would solve problems at work.

In this project, you will build a Security Program Assessment for a fictional healthcare organization that suffered a data breach. You'll make management-level recommendations across all 8 CISSP domains, training the decision-making mindset the exam actually rewards.

What You'll Build

A multi-section Security Program Assessment document in Google Docs, with realistic scenario-based decisions that practice choosing the management answer over the technician answer.

By the end of this project, you'll have:

• A completed Security Program Assessment covering all 8 CISSP domains with management-level analysis and recommendations for a fictional healthcare organization.
• 16+ scenario-based decisions with documented justifications that train the "think like a manager" instinct the exam rewards over technical implementation.
• A personal CISSP Decision Framework reference card you can review before exam day to counteract the technician trap.
• Secret Mission: Face a cross-domain ransomware crisis scenario that forces you to integrate thinking across all 8 domains simultaneously under time pressure.

Are there any prerequisites?

You need working knowledge of IT security concepts like networking, operating systems, and access controls. No specific certifications are required.

This project is document-based and uses only Google Docs. No technical tooling or lab environments are needed.

Before We Start

Before We Start...

Set Up Your Assessment Document

Every security assessment needs a clear structure before you begin analyzing findings. Your document framework maps directly to the eight CISSP domains, giving you a repeatable template that mirrors how real consultants deliver reports to a Board of Directors.

In this step, you'll create your assessment document in Google Docs, absorb the scenario context for Meridian Health Systems, and write your first management-level analysis. This Executive Summary is your first test of the "think like a CISO" mindset.

In this step, get ready to:

• Create your Security Program Assessment document with domain-mapped section headings.
• Paste and read the Meridian Health Systems scenario brief.
• Write an Executive Summary that frames the assessment from a management perspective.

Create your assessment document

Your assessment document needs six sections that map to the CISSP domain groupings. This structure forces you to think about security holistically, the same way the exam tests you across all domains rather than in isolation.

• Open Google Docs in your browser.
• Click Blank document to create a new document.
• Click the Untitled document field at the top left of the page.
• Type Meridian Health Systems - Security Program Assessment as your document title.

• Add the following six section headings to your document, each on its own line. Use Heading 2 formatting for each one by selecting the text and choosing Heading 2 from the styles dropdown:

Executive Summary

Governance, Risk & Compliance (Domains 1 & 2)

Architecture & Network Security (Domains 3 & 4)

Access Control & Security Testing (Domains 5 & 6)

Operations & Software Security (Domains 7 & 8)

CISSP Decision Framework (Personal Reference)

Why these six sections?

The CISSP has eight domains, but they naturally pair by theme. Domains 1 and 2 both deal with governance and risk. Domains 3 and 4 cover how systems are designed and how they communicate. Domains 5 and 6 focus on who gets access and how you verify controls work.

Domains 7 and 8 address ongoing operations and how software is built securely. The final section is your personal exam-day reference. This pairing reflects how a CISO actually thinks about a security program.

• Confirm your document now shows all six headings in a clear hierarchy. Each heading should appear in a larger, bold font that distinguishes it from body text.

Read and paste the scenario brief

Every decision you make in this assessment is grounded in a single scenario. Read this brief carefully. The stakeholder dynamics and regulatory context will determine which answers are "management-level" and which fall into the technician trap.

• Place your cursor at the very top of your document, above the Executive Summary heading.
• Paste the following scenario brief:

SCENARIO BRIEF: Meridian Health Systems

Organization: Mid-size healthcare provider, 2,000 employees across 5 facilities. Handles PHI (Protected Health Information) for 500,000+ patients. Subject to HIPAA, state breach notification laws, and contractual obligations with insurance partners.

Situation: Three weeks ago, a database containing patient records was found exposed on a misconfigured cloud storage bucket. An external researcher reported it. Approximately 12,000 patient records (names, SSNs, diagnosis codes) were accessible for an estimated 6 days. The incident made local news.

Your Role: You are an independent security consultant brought in by the Board of Directors to assess the overall security program and make recommendations. You report to the Board, not to IT.

Key Stakeholders:
- CEO (business continuity focused)
- General Counsel (liability focused)
- CISO (newly hired 4 months ago, inherited legacy systems)
- CFO (cost-conscious, skeptical of security spending)
- Chief Medical Officer (patient care first)

What should I focus on in this brief?

Notice the stakeholder priorities. Each person at the table has a different concern. The CEO cares about keeping the business running. General Counsel is worried about lawsuits and fines. The CFO questions every dollar spent on security.

Your role reports to the Board, not to IT. This is critical. You are making recommendations as a strategic advisor, not implementing fixes as a technician. Every scenario decision in this project should pass the test: "Would a consultant present this to a Board of Directors?"

• Verify that your document now shows the scenario brief at the top, followed by your six section headings below it.

Formatting looks off after pasting?

If the pasted text picks up unexpected formatting, select all the scenario brief text, then go to Format > Clear formatting. Then reapply Normal text style from the styles dropdown.

help me fix my document formatting in Google Docs

Write your Executive Summary

The Executive Summary is your first opportunity to practice the management mindset. A CISO presenting to the Board would never open with "we had a misconfigured S3 bucket." They would frame the situation in terms of organizational risk, regulatory exposure, and program maturity.

• Click into the space below your Executive Summary heading.
• Write 3-4 sentences that answer the following questions:

• What is the business risk to Meridian? Think organizational exposure, not the technical vulnerability.
• What is your assessment scope? What are you evaluating and for whom?
• What governance principle guides your recommendations? What lens are you applying to every finding?

What is the technician trap here?

If your Executive Summary mentions specific technologies, configurations, patches, or tools, you've fallen into the technician trap. Phrases like "fix the S3 bucket," "implement encryption," or "deploy a firewall" belong in implementation plans, not executive communication.

Your summary should reference organizational risk, regulatory exposure (HIPAA breach notification obligations), stakeholder trust, and program maturity. These are the concepts a Board cares about.

Give it a try on your own. If you want to compare your approach, check below.

✔️ I'll try it first

Write your 3-4 sentence Executive Summary now. Remember: no technology names, no specific fixes. Frame everything as organizational risk and program-level findings.

ⓧ Let me check my work

Here is an example of a management-level Executive Summary. Yours does not need to match this exactly, but it should hit similar themes:

Meridian Health Systems faces significant organizational risk following a data exposure incident affecting approximately 12,000 patient records. The incident reveals systemic gaps in the security program's maturity, governance structure, and operational controls rather than an isolated technical failure. This assessment evaluates Meridian's security program across all operational domains, with findings and recommendations presented to the Board of Directors. All recommendations are guided by the principle of risk-proportional governance: controls must align with the organization's risk appetite, regulatory obligations, and operational capacity for sustainable improvement.

Notice how this example never names a specific technology or tool. It frames the incident as a program maturity problem and positions the consultant as a strategic advisor.

Your document structure is set and your management mindset is activated. Next up, you'll dive into your first domain scenarios. Governance and risk management carry the heaviest weight on the CISSP exam at 16%, and you'll see exactly why.

Complete Governance, Risk & Compliance Scenarios

Your Executive Summary established the big picture for Meridian's assessment. Now it's time to dig into the first two CISSP domains: Security and Risk Management (Domain 1) and Asset Security (Domain 2).

Together, these domains account for 26% of the exam. They test whether you approach security decisions as a governance leader or a hands-on technician. In this step, you'll work through six realistic scenarios that force you to choose the management answer over the instinctive technical one.

In this step, get ready to:

• Work through four Domain 1 scenarios covering risk management, accountability, regulatory obligations, and cost-benefit analysis.
• Complete two Domain 2 scenarios on data classification and privacy requirements.
• Validate your thinking against the CISSP management mindset framework.

Work through Domain 1 scenarios

Domain 1 (Security and Risk Management) carries the heaviest weight on the exam at 16%. It tests your ability to think about security spending, accountability, regulatory compliance, and cost-benefit tradeoffs from an organizational leadership perspective.

• Navigate to your Governance, Risk & Compliance (Domains 1 & 2) section in your Google Doc.
• Paste the following four scenarios into your document:

DOMAIN 1: SECURITY AND RISK MANAGEMENT

SCENARIO 1.1: The CFO asks, "How much should we spend on security?" Which is the BEST response?

A) Benchmark against industry peers and spend 8-12% of IT budget on security.
B) Conduct a risk assessment to determine the organization's risk appetite, then align spending to residual risk tolerance.
C) Calculate the cost of the breach ($12K records x $180/record average) and spend up to that amount on prevention.
D) Implement all controls recommended by the NIST Cybersecurity Framework regardless of cost.

SCENARIO 1.2: The Board wants to know who is accountable for the data exposure. What is the FIRST action?

A) Review the cloud administrator's access logs to identify who misconfigured the bucket.
B) Determine whether a formal data governance policy existed that assigned data ownership and custodianship responsibilities.
C) Fire the IT staff member who provisioned the cloud storage.
D) Hire a forensics firm to establish a chain of custody for evidence.

SCENARIO 1.3: General Counsel asks whether Meridian must notify affected patients. What PRIMARILY governs this decision?

A) The organization's internal incident response policy.
B) The CISO's technical assessment of whether data was actually accessed.
C) Applicable legal and regulatory requirements (HIPAA Breach Notification Rule and state laws).
D) The PR team's recommendation on reputational impact.

SCENARIO 1.4: The CISO proposes purchasing a $2M Data Loss Prevention (DLP) suite. The annual loss expectancy from data breaches is estimated at $800K. What is the BEST recommendation?

A) Approve it because patient safety is paramount.
B) Reject it because the cost of the control exceeds the expected loss, and recommend exploring controls proportional to the risk.
C) Approve it because regulatory fines could exceed $800K.
D) Table the discussion until after the current incident investigation is complete.

• For each scenario, write your chosen answer letter and a 2-3 sentence explanation of why the other options are wrong from a management perspective.

What is the technician trap?

Every scenario includes at least one option that a skilled sysadmin would instinctively pick. Checking logs (1.2, option A) or encrypting everything (1.4, option A) are technically valid actions. But the CISSP rewards the answer that establishes governance first and enables everything else downstream.

Ask yourself: "What would a CISO present to the board?" A CISO would never walk into a board meeting and say "I checked the logs." They would say "I confirmed whether we had governance structures that assign accountability."

Once you've written your answers for all four Domain 1 scenarios, check your work below.

✔️ I'll try it first

Take your time with each scenario. Remember the management mindset: governance before technology, assess before you act, and cost-effective risk reduction over maximum security.

ⓧ Let me check my work

Here are the correct answers with management-level reasoning:

Scenario 1.1: Answer B. Risk appetite drives spending decisions. Option A (benchmarking) ignores Meridian's unique risk profile. Option C (breach cost math) is reactive and only addresses one threat. Option D (implement everything) ignores cost-effectiveness entirely. A risk assessment determines what the organization is willing to accept, then spending aligns to close the gap.

Scenario 1.2: Answer B. Before assigning blame, determine whether the governance structure existed to prevent this. Option A (checking logs) is an investigation step, not an accountability step. Option C (firing someone) is punitive without understanding root cause. Option D (forensics) is important but secondary to understanding governance gaps.

Scenario 1.3: Answer C. Legal and regulatory requirements are non-negotiable. The HIPAA Breach Notification Rule has specific triggers and timelines. Option A (internal policy) cannot override law. Option B (CISO assessment) informs the decision but does not govern it. Option D (PR recommendation) is a business consideration, not a compliance driver.

Scenario 1.4: Answer B. The cost of the control ($2M) exceeds the annual loss expectancy ($800K). This violates fundamental risk management economics. Option A (patient safety) is an emotional appeal that bypasses analysis. Option C (regulatory fines) is speculative and does not change the cost-benefit math. Option D (table it) avoids the decision entirely.

Picked option A on scenario 1.2?

This is the most common technician trap in Domain 1. Your sysadmin instinct says "check the logs first." But the CISSP is asking about accountability, not investigation. You cannot hold someone accountable if the governance structure never assigned responsibility in the first place.

Update your answer to B and note in your justification why governance must precede investigation.

Help me understand why governance comes before investigation on the CISSP

Work through Domain 2 scenarios

Domain 2 (Asset Security) accounts for 10% of the exam. It focuses on how organizations classify, handle, and protect information throughout its lifecycle.

• Below your Domain 1 answers, paste these two scenarios:

DOMAIN 2: ASSET SECURITY

SCENARIO 2.1: Meridian has no formal data classification policy. Patient records, cafeteria menus, and board meeting minutes are all stored with the same access controls. What is the FIRST step?

A) Encrypt all data at rest regardless of classification.
B) Implement role-based access controls on all file shares.
C) Establish a data classification policy that categorizes information by sensitivity and assigns handling requirements.
D) Deploy a DLP tool to automatically tag sensitive data.

SCENARIO 2.2: The CMO wants research staff to use patient data for a quality improvement study. What is the MOST important consideration?

A) Ensuring the data is de-identified per HIPAA Safe Harbor or Expert Determination methods before use.
B) Getting the research staff to sign NDAs.
C) Storing the research data in an encrypted database.
D) Limiting access to only senior researchers.

• Write your chosen answer and management-perspective justification for each scenario, just as you did for Domain 1.

Why does classification come before encryption?

Scenario 2.1 tests a pattern you'll see repeatedly on the CISSP: you cannot apply appropriate controls without first understanding what you're protecting. Encrypting everything (option A) treats cafeteria menus the same as patient records. That wastes resources and still misses the root problem.

Classification is the foundation that all other data security controls depend on. Without it, every subsequent decision is arbitrary.

Check your Domain 2 answers below.

✔️ I'll try it first

Apply the same framework: what is the foundational governance step that enables everything else? Write your answers, then come back to check.

ⓧ Let me check my work

Scenario 2.1: Answer C. You must know what you have before you can protect it appropriately. Option A (encrypt everything) is expensive overkill that treats all data equally. Option B (RBAC) is a control that requires classification to implement correctly. Option D (DLP tool) is technology deployed without a policy framework to guide it.

Scenario 2.2: Answer A. HIPAA's Safe Harbor and Expert Determination methods are the legally recognized standards for de-identification. Option B (NDAs) does not address the regulatory requirement. Option C (encryption) protects data in storage but research staff still access the identifiable data. Option D (senior researchers only) reduces exposure but does not satisfy the legal standard for using PHI in research.

Validate your thinking

Now that you've answered all six scenarios, review your responses against these four criteria. This self-check builds the reflexive thinking pattern you need on exam day.

• Review each answer and confirm: did you choose the option that addresses organizational risk over technical fixes?
• Check whether you identified governance, policy, or legal requirements before jumping to technology.
• For questions that ask "FIRST," verify you picked the foundational step that everything else depends on.
• For questions that ask "BEST," verify you picked the option that balances risk, cost, and organizational needs.

Spotting your personal technician traps

With your background as a sysadmin, your instinct on 1.2 is likely to check logs (option A). On 2.1, your instinct is likely to encrypt everything (option A). Both are technically valid actions. They just skip the governance step the CISSP requires first.

If you picked any technician-trap answers, add a note next to your corrected answer explaining what pulled you toward the technical option. These notes become gold when you build your personal Decision Framework in Step 5.

Your governance foundation is solid. Next, you'll apply the same management lens to security architecture and network design decisions in Domains 3 and 4.

Complete Architecture and Network Security Scenarios

Your Governance, Risk & Compliance section established a critical pattern: governance before technology, and assessment before action.

Now you'll apply that same thinking to architecture and network design decisions. These domains test whether you can evaluate technical proposals through a management lens. The temptation here is strong because architecture questions describe real systems you've worked with. Your job is to resist jumping to implementation and instead recommend the process that leads to the right implementation.

In this step, get ready to:

• Work through three Domain 3 (Security Architecture and Engineering) scenarios.
• Work through two Domain 4 (Communication and Network Security) scenarios.
• Validate your management-level thinking against CISSP patterns.

Work through Domain 3 scenarios on security architecture

Domain 3 covers how organizations design, implement, and manage security architecture. At the management level, this means evaluating proposals for technical changes and ensuring decisions are risk-informed rather than reactive.

• In your Google Doc, scroll to the Architecture & Network Security (Domains 3 & 4) section heading.
• For each scenario below, write your chosen answer letter and a 2-3 sentence justification explaining why the other options are wrong from a management perspective.

SCENARIO 3.1: The CISO wants to redesign Meridian's architecture after the breach. The legacy EHR (Electronic Health Record) system runs on Windows Server 2016 with no vendor support. What is the BEST recommendation?

• A) Immediately migrate to a cloud-based EHR system.
• B) Conduct a risk assessment of the legacy system, evaluate compensating controls, and present migration options with cost-benefit analysis to leadership for a risk-informed decision.
• C) Isolate the EHR system on its own network segment and apply host-based firewalls.
• D) Accept the risk and document it until the next budget cycle.

SCENARIO 3.2: A security architect proposes implementing Zero Trust across all systems within 6 months. What is the MOST appropriate response?

• A) Approve it. Zero Trust is the current best practice and eliminates implicit trust.
• B) Assess the organization's current maturity level, identify critical assets for prioritization, and develop a phased roadmap that demonstrates value incrementally.
• C) Reject it. Zero Trust is too disruptive for a healthcare environment where clinicians need fast access.
• D) Implement Zero Trust only for cloud resources and keep the internal network trust-based.

SCENARIO 3.3: During the architecture review, you discover the organization uses a single shared encryption key for all database encryption. What is the PRIMARY risk?

• A) If the key is compromised, all encrypted data across all databases is exposed simultaneously.
• B) Key rotation would require downtime across all systems.
• C) It violates PCI-DSS key management requirements.
• D) A single key is computationally weaker than multiple keys.

• Write your chosen answer and justification for each of the three Domain 3 scenarios before moving on.

What pattern connects these three scenarios?

Notice how each scenario presents a technically correct option alongside a management-correct option. Option C in 3.1 (network segmentation) is solid security work. Option A in 3.2 (Zero Trust is best practice) is technically true. But the CISSP rewards the answer that involves assessment, planning, and risk-informed decision-making before committing to any implementation path.

Work through Domain 4 scenarios on network security

Domain 4 focuses on how organizations design and protect network communications. The management perspective here means understanding that network problems often have non-network root causes, and that governance controls address systemic issues better than technical band-aids.

• Continue writing in the same Architecture & Network Security (Domains 3 & 4) section of your document.

SCENARIO 4.1: Meridian's five facilities are connected via site-to-site VPNs over the public internet. Clinicians at remote offices report slow EHR access. The network team proposes upgrading to dedicated MPLS circuits at $15K/month. What should you recommend FIRST?

• A) Approve the MPLS upgrade because patient care depends on reliable connectivity.
• B) Assess whether the performance issue is a bandwidth problem, a latency problem, or an application architecture problem before recommending infrastructure investment.
• C) Implement SD-WAN as a cheaper alternative.
• D) Prioritize EHR traffic with QoS policies on the existing VPN.

SCENARIO 4.2: The cloud storage exposure happened because a developer provisioned a storage bucket directly, bypassing IT. What BEST prevents recurrence?

• A) Block all developer access to cloud management consoles.
• B) Implement cloud security posture management (CSPM) tooling that continuously monitors configurations against policy and alerts on deviations.
• C) Require all cloud provisioning to go through a formal change management process with security review.
• D) Deploy a cloud access security broker (CASB) to monitor all cloud traffic.

• Write your chosen answer and justification for both Domain 4 scenarios.

What is the CISSP umbrella rule?

Scenario 4.2 is a case where both B and C are defensible. The CISSP "umbrella rule" helps you choose: when process/governance and technology are both valid, favor the governance answer. It covers more ground.

Option C (change management with security review) addresses the root cause, which is unauthorized provisioning. Option B (CSPM) is a detective control that catches problems after they occur. For the exam, lean toward the governance answer when process vs. technology is the choice. In practice, you'd implement both.

Add a note about this umbrella rule in your document. It will become part of your Decision Framework later.

Validate your architecture and network thinking

Now review your answers against the management-level patterns the CISSP rewards.

• Re-read each of your five answers and check them against these questions:

• Did you resist the urge to name specific products or vendors? The CISSP rarely rewards brand-name answers.
• On "BEST" questions, did you choose the approach that involves assessment and phased planning over immediate deployment?
• Did you consider cost-effectiveness and organizational readiness, not just technical correctness?

Your endpoint management background is an asset here

Your Tanium background gives you a key insight: visibility (knowing what you have) must come before enforcement (controlling what happens). That's the assessment-before-action pattern the CISSP rewards in every architecture question.

• If any of your answers jumped straight to a technical implementation without an assessment step, revise them now.
• Make sure your justifications explain why the governance/process answer is more broadly protective than the technical option.

Stuck between two strong answers?

When two options both seem technically correct, ask: "Which one would a CISO present to the Board?" The Board does not care about specific technologies. They care about risk reduction, cost justification, and organizational readiness. The answer that addresses those concerns wins.

Help me understand how to choose between two technically correct CISSP answers using the management perspective.

You now have two complete sections of your assessment document. Next up, you'll tackle the domains that hit closest to your operational experience: Identity and Access Management and Security Testing. These are where the technician trap is strongest because you've lived these problems daily.

Complete Access Control and Security Testing Scenarios

Your architecture and network security assessment exposed a pattern: Meridian jumps to technology before establishing governance.

Now you'll tackle the domains that hit closest to the original breach. The data exposure happened because someone had access they shouldn't have had, and no one detected the misconfiguration for 6 days. These are IAM and security testing failures.

In this step, get ready to:

• Analyze three Identity and Access Management scenarios where technical instincts mislead.
• Work through three Security Assessment and Testing scenarios that distinguish program thinking from event thinking.
• Validate your Domain 5 and 6 answers against the management mindset checklist.

Work through Domain 5 scenarios on Identity and Access Management

Domain 5 covers who gets access to what, how you verify their identity, and how you manage access throughout an employee's lifecycle. The technician trap here is jumping to specific authentication technology before asking who needs what level of assurance.

• Navigate to your Access Control & Security Testing (Domains 5 & 6) section in your Google Doc.
• Read each scenario below carefully. For each one, write in your document: (A) your chosen answer, and (B) why the other options are wrong from a management perspective.

Here are your Domain 5 scenarios:

SCENARIO 5.1: After the breach, the Board mandates "stronger authentication."
The IT team proposes hardware tokens for all 2,000 employees at $85/token.
What is the BEST approach?

A) Approve hardware tokens for all staff because the Board directed stronger
   authentication.
B) Conduct a risk-based assessment to determine which roles require what level
   of authentication assurance, implement MFA proportional to access privileges
   and data sensitivity.
C) Implement biometric authentication because it's more secure than tokens.
D) Require 20-character passwords instead, which is cheaper and eliminates
   token management overhead.

SCENARIO 5.2: The EHR system supports RBAC but currently 43% of clinical
staff have "physician-level" access despite being nurses, techs, or admin
staff. What is the FIRST step to remediate?

A) Immediately revoke all excess privileges and reset to minimum access.
B) Conduct an access review/recertification with department managers to
   validate business need for current access levels before making changes.
C) Implement attribute-based access control (ABAC) to replace the broken
   RBAC model.
D) Create an audit log of who is using physician-level access and for what
   purpose.

SCENARIO 5.3: A terminated employee's VPN credentials were used to access
a file share 3 days after their last day. What is the MOST important finding
from a program perspective?

A) The file share had inadequate logging and monitoring.
B) The VPN did not use multi-factor authentication.
C) The organization lacks a reliable identity lifecycle process that ensures
   timely deprovisioning upon separation.
D) The terminated employee committed unauthorized access and should be
   reported to law enforcement.

What is the technician trap in Domain 5?

Your instinct from operational experience will pull you toward specific technologies. Hardware tokens, biometrics, ABAC systems, or audit logs are all valid tools. But the CISSP asks what a manager does first.

The management answer always starts with understanding the current state (who has what, who needs what, what process is broken) before selecting a control.

• Write your answers for all three Domain 5 scenarios before checking the reference below.

Once you've written your analysis for all three scenarios, check your reasoning:

✔️ I'll give it a go!

Take your time analyzing each scenario. Remember: the CISSP rewards answers that assess the situation, involve stakeholders, and apply controls proportional to risk.

ⓧ Maybe a little help...

Here are the management-level answers with reasoning:

• 5.1 = B. Risk-based assessment first. A blanket $170K spend on hardware tokens treats all roles as equal risk. A nurse accessing a scheduling system doesn't need the same assurance level as an admin with database access. MFA should be proportional to privilege and data sensitivity.
• 5.2 = B. Access review with department managers. Revoking access immediately (A) could disrupt patient care if staff actually need certain access for their roles. You must validate business need before making changes. The RBAC model isn't necessarily broken. It may just be misconfigured.
• 5.3 = C. Identity lifecycle process gap. The question asks for the "MOST important finding from a program perspective." Logging (A), MFA (B), and law enforcement (D) are all valid responses, but the root cause is a broken deprovisioning process. Fix the process, and credentials get revoked on time regardless of which systems are involved.

Work through Domain 6 scenarios on Security Assessment and Testing

Domain 6 is where many experienced professionals stumble. Your background gives you hands-on testing experience, which makes the technician trap stronger here. The CISSP views security testing as a strategic program, not a one-time event.

• Continue in the same section of your document. Read each scenario below and write: (A) your chosen answer, and (B) why the other options fall short from a management perspective.

SCENARIO 6.1: The Board asks you to "test our security." What is the BEST
recommendation?

A) Commission an external penetration test of all internet-facing assets.
B) Develop a comprehensive security assessment strategy that includes
   vulnerability assessments, penetration testing, code reviews, and control
   validation, aligned with the organization's risk priorities and conducted
   on a recurring schedule.
C) Run an automated vulnerability scan across the network and present
   findings.
D) Conduct a red team exercise simulating a nation-state adversary.

SCENARIO 6.2: A vulnerability scan reveals 4,200 findings across Meridian's
environment. The CISO asks for your recommendation on prioritization. What
is MOST important?

A) Remediate all critical and high findings within 30 days per industry best
   practice.
B) Prioritize remediation based on risk context: which vulnerabilities affect
   systems processing PHI, which are exploitable from the internet, and which
   have compensating controls already in place.
C) Focus on the vulnerabilities that match known threat actor TTPs for the
   healthcare sector.
D) Address the findings that are easiest to fix first to reduce the total
   count quickly.

SCENARIO 6.3: The security team wants to conduct a social engineering test
(phishing simulation) but the General Counsel objects, saying it could
"damage employee morale." What is the BEST path forward?

A) Cancel the test. Legal concerns override security testing needs.
B) Conduct the test anyway because security takes priority.
C) Obtain executive sponsorship, define clear scope and rules of engagement,
   ensure results are used for training improvement rather than punishment,
   and communicate the program's educational purpose to leadership.
D) Conduct an anonymous survey about phishing awareness instead.

What separates a testing program from a testing event?

A single penetration test or vulnerability scan is an event. The CISSP rewards answers that describe a program: multiple testing types, recurring schedules, alignment to risk priorities, and results that feed back into improvement.

Notice how option B in scenario 6.1 includes vulnerability assessments AND penetration testing AND code reviews AND control validation. That breadth signals program-level thinking.

• Write your answers for all three Domain 6 scenarios before checking the reference below.

Ready to compare your reasoning?

✔️ I'll give it a go!

Focus on which answer treats security testing as a sustainable, recurring program rather than a single point-in-time event. Also watch for answers that navigate organizational politics through governance, not by overriding stakeholders.

ⓧ Maybe a little help...

Here are the management-level answers with reasoning:

• 6.1 = B. Comprehensive assessment strategy. A single pentest (A) or scan (C) or red team (D) are all individual testing activities. The Board asked broadly ("test our security"), so the best response is a program that covers multiple testing methods on a recurring schedule. One test type alone gives an incomplete picture.
• 6.2 = B. Risk-context prioritization. "Fix all criticals in 30 days" (A) sounds disciplined but ignores context. A critical finding on an isolated test server matters less than a medium finding on an internet-facing system processing PHI. Prioritize based on what systems hold sensitive data, what's exploitable externally, and what already has compensating controls.
• 6.3 = C. Executive sponsorship with clear scope and educational framing. Neither canceling (A) nor overriding legal (B) is acceptable. The management answer navigates organizational politics: get leadership buy-in, define rules of engagement, position results as training data (not "gotcha" punishment), and communicate purpose transparently.

Validate your thinking across Domains 5 and 6

Before moving on, review your six answers against the patterns the CISSP consistently rewards in these domains.

• Re-read each of your Domain 5 answers. Check: did you choose risk-proportional controls over maximum-security-for-everyone approaches?
• Check: did you favor process-based solutions (access reviews, lifecycle management) over purely technical controls?
• Re-read each of your Domain 6 answers. Check: did you treat security testing as a program (strategic, recurring, comprehensive) rather than an event (one-time pentest)?
• For any answer where you chose the technical option first, add a note in your document explaining what the management answer is and why.

Why does the CISSP care about process over technology in IAM?

Technology fails silently. RBAC with 43% misconfigured roles is technically "implemented" but functionally useless. A process (regular access recertification with managers) catches drift over time.

The same logic applies to deprovisioning. You can deploy the most sophisticated identity management platform available, but if no one triggers the offboarding workflow when HR processes a termination, credentials stay active. Process is the foundation that makes technology effective.

Domain 5 maps directly to the breach

Meridian's original data exposure (a developer provisioning a storage bucket directly, bypassing IT) is fundamentally an access control failure. The developer had privileges to provision cloud resources without security review. Keep this connection explicit in your written justifications. It demonstrates cross-domain thinking that the CISSP rewards.

You've now covered the two domains most directly connected to Meridian's breach. Next, you'll close out the assessment with Security Operations and Software Development Security, then build your personal decision framework for exam day.

Complete Operations, Software Security, and Decision Framework

Your Access Control and Security Testing section proved you can think about identity and assessment as programs, not one-time fixes. Now it's time to tackle the final two domains and synthesize everything into a reusable decision framework.

Domains 7 and 8 cover how an organization actually runs its security day-to-day (operations) and how it builds security into the software it creates. After these scenarios, you'll distill the thinking pattern you've practiced across all 16+ decisions into a personal reference card for exam day.

In this step, get ready to:

• Work through three Security Operations scenarios (Domain 7) covering incident response and continuous improvement.
• Work through three Software Development Security scenarios (Domain 8) covering SDLC integration and secure coding governance.
• Synthesize your learning into a personal CISSP Decision Framework reference section.

Work through Domain 7 scenarios

Domain 7 (Security Operations) carries 13% of the exam weight and tests how you manage incidents, investigations, and ongoing operational security. These scenarios hit the heart of what you likely do every day at Tanium, which means the technician trap is especially strong here.

• Navigate to the Operations & Software Security (Domains 7 & 8) section of your Google Doc.
• For each scenario below, write in your document: (A) your chosen answer, and (B) why the other options are wrong from a management perspective.

Scenario 7.1: A nurse reports that patient monitors on the cardiac floor are displaying unusual error messages. The IT help desk determines the monitors are communicating with an unfamiliar external IP address. What should happen FIRST?

• A) Disconnect the monitors from the network immediately to stop potential data exfiltration.
• B) Activate the incident response plan and assemble the incident response team to assess the situation, considering both patient safety and containment needs.
• C) Image the monitors' memory for forensic analysis before any changes are made.
• D) Contact the monitor vendor to determine if the external IP is a legitimate update server.

Scenario 7.2: During the incident response, the IR team determines the cardiac monitors were compromised via an unpatched vulnerability. The patch has been available for 8 months. What is the MOST important finding for your assessment?

• A) The vulnerability scanning program failed to identify the unpatched devices.
• B) The patch management program does not adequately cover medical devices, indicating a gap in the organization's configuration management and asset inventory processes.
• C) The biomedical engineering team did not apply the patch in a timely manner.
• D) The network should have prevented the monitors from reaching external IPs.

Scenario 7.3: The CEO asks, "How do we make sure this never happens again?" What is the BEST response?

• A) Implement network segmentation for all medical devices and deploy an intrusion prevention system.
• B) Conduct a lessons-learned review, update the incident response plan based on findings, improve the patch management program to cover OT/IoT, and present a roadmap for continuous improvement. Acknowledge that zero risk is not achievable but the goal is reducing risk to an acceptable level.
• C) Engage a managed security services provider (MSSP) for 24/7 monitoring.
• D) Deploy an endpoint detection and response (EDR) tool on all devices capable of supporting an agent.

What patterns should I look for in my answers?

For Domain 7, the CISSP consistently rewards process-first answers. Activating the IRP before any technical containment (even when patient monitors are involved) is the management answer because it ensures the right people are coordinating the response.

For "MOST important finding" questions, look for the answer that identifies a program-level gap rather than blaming an individual or naming a single missing tool. Program gaps explain why multiple failures can occur. A single tool only fixes one symptom.

Work through Domain 8 scenarios

Domain 8 (Software Development Security) carries 10% of the exam weight and is one of the self-identified areas where you want more confidence. These scenarios test whether you can govern a development process without micromanaging it.

• Continue writing in the same Operations & Software Security (Domains 7 & 8) section of your document.
• For each scenario, write your chosen answer and why the other options miss the management perspective.

Scenario 8.1: Meridian is developing a patient portal in-house. The development team uses an agile methodology with 2-week sprints. Security has never been involved in the SDLC. What is the BEST recommendation?

• A) Require a comprehensive security review before each release, blocking deployment until security signs off.
• B) Integrate security activities into the existing SDLC: threat modeling during design, static analysis in the CI/CD pipeline, security acceptance criteria in user stories, and periodic penetration testing of releases.
• C) Hire an application security team to conduct code reviews on all commits.
• D) Require all developers to complete secure coding training before writing any more code.

Scenario 8.2: The patient portal stores session tokens in local storage. A developer argues this is fine because "we use HTTPS everywhere." What is the PRIMARY risk the developer is not considering?

• A) Cross-site scripting (XSS) attacks can steal tokens from local storage regardless of HTTPS, because HTTPS protects data in transit, not data accessible to client-side scripts.
• B) Local storage persists after browser close, extending the session window.
• C) HTTPS certificates can be spoofed with a compromised CA.
• D) Local storage has size limitations that could cause token truncation.

Why is Scenario 8.2 different from the others?

This is one of the rare CISSP scenarios where the correct answer IS the technical one (A). The exam does test technical knowledge. The key difference is that you are identifying a security risk as a governance concern ("what risk is the developer not considering?"), not implementing a fix yourself.

The management mindset here means understanding the vulnerability well enough to make informed policy decisions about it. A CISO needs to know why local storage is risky even if they never write JavaScript.

Scenario 8.3: The development team wants to use an open-source library for handling patient data encryption. The library is popular (50K+ GitHub stars) but has not been updated in 14 months. What is the BEST governance approach?

• A) Reject it. Any library without active maintenance is unacceptable for healthcare data.
• B) Assess the library against the organization's software acquisition criteria: known vulnerabilities, licensing compliance, community activity, and availability of alternatives. Make a risk-informed decision with documented acceptance criteria.
• C) Approve it only if the development team commits to monitoring the library for future vulnerabilities.
• D) Fork the library and maintain it internally.

How does Domain 8 test management thinking?

The CISSP views security in the SDLC as a program, not a gate. Option A in Scenario 8.1 (blocking deployment until security signs off) sounds secure but creates a bottleneck that teams will eventually bypass. Option B integrates security into the existing workflow, making it sustainable.

For library governance (8.3), the management answer is never "blanket reject" or "blanket approve." It is always "assess against criteria and document the decision." This pattern appears across every domain.

Write your CISSP Decision Framework

You have now worked through 16+ scenarios across all 8 domains. Patterns have emerged. This final section turns those patterns into a one-page personal reference you can review before exam day.

• Navigate to the CISSP Decision Framework (Personal Reference) section of your document.
• Write out the three components described below, drawing on the patterns you noticed in your own scenario answers.

Component 1: The Manager's Checklist

Write these 4 questions to ask yourself before every CISSP answer:

• What is the business risk to the organization?
• What would a CISO do FIRST? (Assess, plan, delegate. Not implement.)
• Which answer protects the organization most broadly? (Policy over product.)
• Which answer is sustainable long-term? (Process over one-time fix.)

Component 2: Priority Hierarchy

Write out this hierarchy for when multiple answers seem correct. The item higher on the list wins:

• Protect human life and safety.
• Prevent the problem (preventive controls beat detective controls, which beat corrective controls).
• Governance before technology.
• Assess before you act.
• Cost-effective risk reduction over maximum security.

Component 3: Your Personal Technician Traps

Review all the scenarios you answered across this document. List 3-5 specific scenarios where you initially gravitated toward the technical answer before catching yourself. For each one, write what your instinct was and what the management answer was instead.

Common traps for your background

With your Army 25B and DOD sysadmin experience, you likely caught yourself wanting to check logs first (1.2), encrypt everything as a default (2.1), or disconnect devices immediately (7.1). Those instincts make you effective in operations. The CISSP rewards the step that comes before those actions.

How long should this framework be?

Your decision framework should fit on approximately one page. It is your quick-reference before exam day. If it is longer than one page, you are overcomplicating it. The goal is a cheat sheet you can scan in 60 seconds, not a comprehensive study guide.

How does this framework map to the actual exam?

The CISSP uses Computerized Adaptive Testing (CAT) with 125-150 items over 3 hours. You cannot skip or revisit questions. This means you need a reliable mental model that works immediately on each question without second-guessing.

The framework you just wrote is that model. When you see a scenario on exam day, run through the Manager's Checklist. When two options both seem correct, apply the Priority Hierarchy. When you feel your hands-on instinct pulling you toward a technical fix, remember your Personal Technician Traps.

Your assessment document is complete. You have practiced thinking like a CISO across all 8 CISSP domains and captured your decision-making patterns in a reusable framework. Next up, you will face a cross-domain crisis that tests whether you can integrate all 8 domains simultaneously under time pressure.

Secret mission

Cross-Domain Crisis Integration

Think you can handle all 8 CISSP domains at once? A ransomware attack hits Meridian during an active cloud migration, and you have 15 minutes to write a crisis response that proves you can integrate thinking across every domain simultaneously under pressure.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely in Google Docs, so there are no ongoing costs or running processes to worry about. Decide whether to keep your assessment document, or delete it entirely.

Resources you used:

• Google Docs document: "Meridian Health Systems - Security Program Assessment" (including the Cross-Domain Crisis Response section).

Keep everything running

No action needed. Choose this if you plan to keep reviewing your scenarios, refining your CISSP Decision Framework, or adding more practice scenarios before exam day.

• Your Google Doc stays in your Google Drive and is accessible anytime.
• Consider bookmarking the document for quick access during study sessions.

Pause - I'll come back to this later

Since this is a Google Doc with no running processes, there is nothing to pause. Your document remains in Google Drive at no cost until you return.

• No action required. Google Docs does not consume resources or incur costs while idle.

Delete - I don't want to use this again

Remove your assessment document entirely if you no longer need it.

• Open Google Drive.
• Locate the file named "Meridian Health Systems - Security Program Assessment."
• Right-click the file and select Move to trash.
• To permanently delete it, click Trash in the left sidebar, then right-click the file and select Delete forever.

Nice Work!

Nice Work!

You just completed a full Security Program Assessment for a healthcare organization, making management-level recommendations across all 8 CISSP domains. That is exactly the thinking pattern the exam rewards.

You've learned how to:

• Built a multi-section Security Program Assessment covering all 8 CISSP domains with management-level analysis instead of technical fix lists.
• Practiced 16+ CISSP-style scenario decisions, training the "think like a manager" instinct by identifying governance and risk-based answers over technical implementations.
• Created a personal CISSP Decision Framework reference card with a manager's checklist, priority hierarchy, and your own technician-trap patterns to watch for on exam day.
• Secret Mission: Integrated cross-domain thinking under time pressure on a ransomware-during-cloud-migration crisis scenario, mirroring the adaptive exam's multi-domain questions.

Ready to quiz yourself?