CISA D5: Protection of Information Assets
Domain 5 (26% weight, tied for the largest) covers the controls that protect information: security frameworks and policies, privacy, physical and environmental controls, identity and access management, network and endpoint security, encryption and PKI, data classification and loss prevention, security testing, and monitoring and incident response. Much of it overlaps CISSP, usually at a less technical depth. What changes is the question: CISA asks which control best addresses a risk, whether it is working, and what evidence proves it.
Identity and access management
Identification (claiming an identity), authentication (proving it), authorization (deciding what that identity may do), and accountability (logging what it did). Access should follow least privilege and need to know, be approved by the data owner, and be removed promptly on termination or role change.
Periodic access reviews
Data owners or managers recertify who has access on a set schedule. The auditor tests whether reviews happened, whether the reviewer had the authority to decide, and whether inappropriate access found in the review was actually removed. Terminated users with active accounts are among the most common findings.
Multi-factor authentication
Combines factors from different categories: something you know, something you have, something you are. Two passwords are still single-factor. NIST SP 800-63B is the common reference for authenticator strength.
Encryption and digital signatures
Symmetric encryption (one shared key) is fast and suits bulk data; asymmetric encryption (public/private key pair) solves key distribution. Encrypting with the recipient's public key provides confidentiality; signing a hash with the sender's private key provides integrity, authentication, and nonrepudiation. Key management, not the algorithm, is usually where the audit finding is.
Physical and environmental controls
Layered physical access (perimeter, building, data center, rack), environmental monitoring (temperature, humidity, water detection), UPS and generators for power, and fire suppression. Dry-pipe and pre-action sprinklers reduce water-damage risk in data centers compared to wet-pipe; clean-agent gas systems avoid water entirely.
Data classification and DLP
Data owners classify information, and the classification determines which controls apply. Data loss prevention tools enforce it at endpoints, email, and network egress. Without reliable classification, DLP rules have nothing dependable to act on.
Security monitoring and evidence handling
Logs from critical systems feed a SIEM, and alerts are triaged by defined procedures. Logs must be protected from alteration, including by administrators. During an investigation, evidence must be handled with a documented chain of custody to remain usable.
Authentication vs. authorization
Authentication proves who you are; authorization determines what you may do once your identity is proven. A user who logs in correctly but can reach data outside their role is an authorization failure, not an authentication one.
Vulnerability scan vs. penetration test
A vulnerability scan is automated and broad, identifying known weaknesses without exploiting them. A penetration test is goal-driven and actually attempts exploitation to demonstrate real impact. A penetration test needs written authorization and a defined scope before it begins.
IDS vs. IPS
An intrusion detection system monitors and alerts; an intrusion prevention system sits inline and can block traffic. An IPS carries the added risk of blocking legitimate traffic on a false positive; an IDS carries the risk that nobody acts on the alert.
Sources: ; ;
CISA practice exams are in development. Get every CISA domain in one printable guide, free with an account.
Get the Complete Guide