Information Systems Security Architecture Professional (ISSAP)

Domain 1: Architect for Governance, Compliance and Risk Management

1.1 Determine legal, regulatory, organizational and industry requirements

1.2 Manage Risk

Domain 2: Security Architecture Modeling

2.1 Identify security architecture approach

2.2 Verify and validate design (e.g., Functional Acceptance Testing (FAT), regression)

Domain 3: Infrastructure Security Architecture

3.1 Develop infrastructure security requirements

3.2 Design defense-in-depth architecture

3.3 Secure shared services (e.g., wireless, e-mail, Voice over Internet Protocol (VoIP), UnifiedCommunications (UC), Domain Name System (DNS), Network Time Protocol (NTP))

3.4 Integrate technical security controls

3.5 Design and integrate infrastructure monitoring

3.6 Design infrastructure cryptographic solutions

3.7 Design secure network and communication infrastructure (e.g., Virtual Private Network(VPN), Internet Protocol Security (IPsec), Transport Layer Security (TLS))

3.8 Evaluate physical and environmental security requirements

Domain 4: Identity and Access Management (IAM) Architecture

4.1 Design identity management and lifecycle

4.2 Design access control management and lifecycle

4.3 Design identity and access solutions)

Domain 5: Architect for Application Security

5.1 Integrate Software Development Life Cycle (SDLC) with application security architecture

(e.g., Requirements Traceability Matrix (RTM), security architecture documentation, secure coding

5.2 Determine application security capability requirements and strategy (e.g., open source,

Cloud Service Providers (CSP), Software as a Service (SaaS)/Infrastructure as a Service (IaaS)/ Platform as a Service (PaaS) environments)

5.3 Identify common proactive controls for applications (e.g., Open Web Application Security Project (OWASP))

Domain 6: Security Operations Architecture

6.1 Gather security operations requirements (e.g., legal, compliance, organizational, and business requirements)

6.2 Design information security monitoring (e.g., Security Information and Event Management (SIEM), insider threat, threat intelligence, user behavior analytics, Incident Response (IR) procedures)

6.3 Design Business Continuity (BC) and resiliency solutions

6.4 Validate Business Continuity Plan (BCP)/Disaster Recovery Plan (DRP) architecture

6.5 Design Incident Response (IR) management