Domain 2 addresses telecommunications and network security. This domain involves ensuring the integrity and confidentiality of information transmitted via telecommunications media as well as ensuring the availability of the telecommunications media itself. Domain 3 addresses security management practices. These include several topics. Policies, procedures, baselines, and guidelines are needed to assure a reasonable and consistent level of security through an organization.
Information classification is used to ensure that the sensitivity of information is protected.
Security awareness training is important to enable an understanding of the need for compliance with policies and procedures. An understanding of organization architecture helps identify the appropriate place for the information security function. Risk management is the management tool that makes it possible to apply resources most effectively. This edition focuses on security awareness, organization architecture, and risk management. Domain 4 addresses applications and systems development security.