The Systems Security Certified Practitioner (SSCP)

Domain 1: Security Operations and Administration

1.1 Comply with codes of ethics

1.2 Understand security concepts

1.3 Identify and implement security controls

1.4 Document and maintain functional security controls

1.5 Participate in asset management lifecycle (hardware, software and data)

1.6 Participate in change management lifecycle

1.7 Participate in implementing security awareness and training (e.g., social engineering/phishing)

1.8 Collaborate with physical security operations (e.g., data center assessment, badging)

Domain 2: Access Controls

2.1 Implement and maintain authentication methods

2.2 Support internetwork trust architectures

2.3 Participate in the identity management lifecycle

2.4 Understand and apply access controls

Domain 3: Risk Identification, Monitoring and Analysis

3.1 Understand the risk management process

3.2 Understand legal and regulatory concerns (e.g., jurisdiction, limitations, privacy)

3.3 Participate in security assessment and vulnerability management activities

3.4 Operate and monitor security platforms (e.g., continuous monitoring)

3.5 Analyze monitoring results

Domain 4: Incident Response and Recovery

4.1 Support incident lifecycle e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO)

4.2 Understand and support forensic investigations

4.3 Understand and support business continuity plan (BCP) and disaster recovery plan (DRP)

Domain 5: Cryptography

5.1 Understand cryptography

5.2 Apply cryptography concepts

5.3 Understand and implement secure protocols

5.4 Understand public key infrastructure (PKI)

Domain 6: Network and Communications Security

6.1 Understand and apply fundamental concepts of networking

6.2 Understand network attacks (e.g., distributed denial of service (DDoS), man-in-the-middle (MITM), Domain Name System (DNS) poisoning) and countermeasures (e.g., content delivery networks (CDN))

6.3 Manage network access controls

6.4 Manage network security

6.5 Operate and configure network-based security devices

6.6 Secure wireless communications

Domain 7: Systems and Application Security

7.1 Identify and analyze malicious code and activity

7.2 Implement and operate endpoint device security

7.3 Administer Mobile Device Management (MDM)

7.4 Understand and configure cloud security

7.5 Operate and maintain secure virtual environments