Domain 5 is the largest and most technically rich domain — where IS audit meets cybersecurity most directly. Part A, Asset Security & Control, covers the frameworks and the protective controls: physical and environmental, identity and access, network and endpoint, encryption and PKI, data loss prevention, and the cloud/mobile/IoT surface.
Domain 5 is tied for the heaviest weight at 26%, so it splits naturally across two lessons. Part A is about the controls that protect assets: choosing a framework, hardening the facility, governing identity and access, defending the network and endpoints, encrypting data (and managing the keys), preventing data loss, and securing the cloud/mobile/IoT surface. The lens stays the auditor's — evaluate whether the right controls exist, suit the risk, and actually work. The recurring themes are defense in depth, independent access review, and the key management behind encryption.
Learning Objectives
By the end of this lesson you will be able to…
Evaluate information security frameworks, standards, and their application to the IS audit. Bloom: Evaluate
Assess physical and environmental controls for adequacy and effectiveness. Bloom: Evaluate
Evaluate identity and access management programs for completeness and control quality. Bloom: Evaluate
Assess network, endpoint, encryption, PKI, and data-loss-prevention controls. Bloom: Evaluate
👈 Read the term, recall the definition, then click or press Enter to check yourself.
Lesson Content
Study the material
1
Security Frameworks, Standards & Guidelines
Domain 5 protects information assets, and it starts with the frameworks that define what “secure” means. The auditor checks that a framework was deliberately chosen and that its controls are documented, implemented, and monitored.
ISO/IEC 27001 (ISMS; Plan-Do-Check-Act; Annex A controls — 93 controls in 4 themes in the 2022 update) and ISO/IEC 27002 (implementation guidance).
NIST CSF: under CSF 1.1, five functions — Identify, Protect, Detect, Respond, Recover. CSF 2.0 (2024) adds a sixth function, Govern, and ISACA content is moving to reflect it — know both and note which version a question assumes.
NIST SP 800-53 (comprehensive control catalog); CIS Controls (18 controls; Implementation Groups IG1–IG3); COBIT 2019 security objectives (APO13, DSS05).
Auditor: a framework formally adopted; appropriate to size, industry, and risk; controls documented, implemented, monitored; a gap analysis exists.
📚
Explore furtherThe Five Pillars — the CIA triad plus authenticity and non-repudiation, the foundation of every framework.
Physical and environmental controls protect the facilities that house information assets — and the exam tests them through the lens of defense in depth.
Layers: perimeter (fencing, CCTV, guards), building (reception, badge access, visitor logs), data center (mantraps, biometrics, anti-tailgating), racks (locked cabinets).
Environmental: temperature/humidity monitoring (ASHRAE), precision cooling, raised flooring, fire suppression (clean agent FM-200/Novec 1230; VESDA early warning), water-leak detection.
Auditor: access logs reviewed and reconciled; visitor logs and escorts; environmental alerts tested; fire suppression inspected and certified; generator tests documented.
💡 Exam TipPhysical security hinges on defense in depth — multiple independent layers so one failure doesn't expose the asset. A single locked door is not defense in depth; look for at least two independent controls at each security-zone boundary.
Defense in depth layers independent controls around the asset — policy and people on the outside, then physical, network, host, and application controls around the data at the core. No single layer is trusted alone; an attacker must defeat every layer, so one failure never exposes the asset.
Try it — why one strong control is never enough
The diagram above is the idea; here is the math. Toggle layers on and off and watch the chance an attack gets all the way through — because each independent layer only has to be passed, the breach probability is the layers multiplied together. Raise the threat and every layer weakens at once.
Interactive · adjust & explore
Your defenses
Each layer blocks a share of attacks. Stack them.
40% · Moderate
A stronger adversary slips past every layer more easily.
Security layers — click to toggle
The odds
Layers active
—
Best single layer
—
Attacks blocked
—
Breach probability
—
——Toggle layers to see the odds change.
How far an attack gets
Of 100 attacks, the red line is the share still alive after each layer — it drops as layers compound, and each new layer removes less than the last (diminishing returns).
🔎 In practice
The model multiplies the layers as if each were independent — a teaching simplification (a phished credential can defeat several at once). The exam point holds regardless: no single control is trusted alone, and because prevention is never 100%, defense in depth pairs preventive layers with detection and response so a failure is caught, not fatal.
3
Identity & Access Management
IAM ensures the right people have the right access for the right reasons — and access recertification is one of Domain 5's most-tested controls.
Identity lifecycle: provisioning (approved need, tied to HR), modification (role changes), recertification (periodic owner review), de-provisioning (prompt revocation on termination).
Authentication factors: Type 1 knowledge (password/PIN), Type 2 possession (token, authenticator app), Type 3 inherence (biometrics); MFA combines two or more categories.
Privileged access management: least privilege, separate privileged accounts, privileged access workstations, password vaulting and session recording, just-in-time access.
SSO & federation: SAML, OAuth 2.0, OpenID Connect; identity providers and service providers.
💡 Exam TipAccess recertification (user access review) is heavily tested. Auditors look for: (1) reviews on a defined schedule, (2) reviews performed by the business manager (not IT), and (3) evidence that inappropriate access was actually revoked — not just rubber-stamped.
📚
Explore furtherAccess Control, Biometrics, and Kerberos — interactive modules on authorization, authentication factors, and network authentication.
Remote access: VPN with MFA, Zero Trust Network Access (identity + device-posture verification), PAM for admin access.
Endpoint: EDR, current anti-malware, host firewall, full-disk encryption, Mobile Device Management.
Auditor: firewall rules reviewed on a schedule; all endpoints under EDR and current AV; full-disk encryption on portables; deprecated protocols disabled; remote connections logged.
📚
Explore furtherFirewalls, IDS/IPS, and VPN — interactive modules on network filtering, intrusion monitoring, and secure remote access.
Certificate revocation: a CRL (Certificate Revocation List) is a periodically published list of revoked certificates and may be stale between updates; OCSP (Online Certificate Status Protocol) checks a single certificate's status in real time.
Auditor: data encrypted at rest and in transit; current algorithms (AES-256, RSA-2048+, SHA-256+); formalized key management with rotation and revocation; keys stored separately from data; certificate expiration monitored; private keys in HSMs.
In asymmetric encryption the keys are a linked pair: anyone can encrypt with the recipient’s public key, but only the matching private key — which never leaves the recipient — can decrypt. The exam’s recurring finding isn’t weak math, it’s weak key management.
💡 Exam TipEncryption is necessary but not sufficient. The most common encryption finding isn't that encryption is missing — it's inadequate key management. Keys stored with the data, never rotated, or with no revocation process undermine the whole control.
📚
Explore furtherCryptography — an interactive deep-dive on symmetric/asymmetric encryption and hashing.
Policy: data identification (card numbers, SSNs, health records), detection rules (regex, fingerprinting, ML classification), response actions (block, quarantine, alert, encrypt, log).
Auditor: DLP policies aligned to the data classification scheme; coverage complete (network + endpoint + cloud); alerts reviewed and investigated; exceptions documented and approved.
7
Cloud, Virtualization, Mobile, Wireless & IoT
Modern environments extend far beyond the data center. Each new surface — cloud, virtualization, mobile, wireless, IoT — adds controls the auditor must evaluate.
Cloud: the shared-responsibility model — the customer always owns the data, and responsibility shifts up the stack from IaaS to SaaS; CASB, cloud-native security, identity federation with MFA, IaC configuration scanning.
Virtualization: hypervisor hardening, VM isolation (prevent VM escape), virtual micro-segmentation.
Wireless: WPA3 is current; WPA2 carries the KRACK key-reinstallation weakness, so keep firmware patched. Audit procedures include wireless site surveys, rogue-AP detection, WPA2-Enterprise with RADIUS, and guest-network isolation.
IoT: change default credentials, manage firmware updates, segment onto a separate VLAN; inventory and discovery are hard.
Auditor: shared responsibility documented; cloud configs scanned (CIS benchmarks); MFA for cloud consoles; mobile under MDM; wireless on WPA2-Enterprise/WPA3; IoT inventoried and segmented.
📚
Explore furtherWireless Security — an interactive module on WEP/WPA/TKIP and wireless encryption standards.
Select the best answer for each question, then submit for your score and the rationale. Watch defense in depth, independent access review, and key management.