In Domain 2, discussions center around protecting organizational assets and, more importantly, how security practitioners must approach them. This includes identifying and classifying assets, data handling, as well as storage and disposal of assets. Also discussed is implementing and enforcing access controls to protect sensitive information. These controls ensure the confidentiality, integrity, and availability of all organizational assets, but undoubtedly the focus is on data. Exam topics covered include data classification, ownership, and handling, as well as the enforcement of asset management policies. Understanding the data management lifecycle in combination with the state of the data helps determine appropriate security controls whether physical, logical/technical, or administrative. Finally, data ownership and retention are discussed in depth. The topics covered, provide ample real-world examples to ensure you understand and can apply Asset Security concepts that the CISSP examination will test you on.
