These include several topics. Policies, procedures, baselines, and guidelines are needed to assure a reasonable and consistent level of security through an organization. Information classification is used to ensure that the sensitivity of information is protected. Security awareness training is important to enable an understanding of the need for compliance with policies and procedures. An understanding of organization architecture helps identify the appropriate place for the information security function.
Risk management is the management tool that makes it possible to apply resources most effectively.
This edition focuses on security awareness, organization architecture, and risk management. Domain 4 addresses applications and systems development security. This edition focuses on application security. Application and system development security involves the various controls available and used within systems and applications software and the procedures used in their development. Domain 5 addresses cryptography.