Policies are used to describe management intent, standards provide a consistent level of security in an organization, and an organization architecture enables the accomplishment of security objectives. Domain 5 addresses computer architecture and system security. Computer architecture involves the aspects of computer organization and configuration that are employed to achieve computer security while system security involves the mechanisms that are used to maintain the security of system programs. PC and LAN security issues, problems, and countermeasures are also in this domain. Domain 6 addresses law, investigation, and ethics.
Law involves the legal and regulatory issues faced in an information security environment.
Investigation consists of guidelines and principles necessary to successfully investigate security incidents and preserve the integrity of evidence. Ethics consists of knowledge of the difference between right and wrong and the inclination to do the right thing. Domain 7 addresses application program security. Application security involves the controls placed within the application program to support the security policy of the organization. Domain 8 addresses cryptography.