Identify and classify information and assets

Determine and maintain information and asset ownership

Protect privacy

Ensure appropriate asset retention

Determine data security controls

Establish information and asset handling requirements

Implement and manage engineering processes using secure design principles

Understand the fundamental concepts of security models

Select controls based upon systems security requirements.

Understand the security capabilities of information systems

Assess and mitigate the vulnerabilities of security architectures, designs and solution elements

Assess and mitigate vulnerabilities in web-based systems

Assess and mitigate vulnerabilities in mobile systems

Assess and mitigate vulnerabilities in embedded devices

Apply cryptography

Apply security principles to site and facility design

Implement site and facility security controls

Implement secure design principles in network architecture

Secure network components

Implement secure communication channels according to design

Control physical and logical access to assets

Manage identification and authentication of people, devices and services

Integrate identity as a third-party service

Implement and manage authorization mechanisms

Manage the identity and access provisioning lifecycle

Design and validate assessment, test and audit strategies

Conduct security control testing

Collect security process data

Analyze test output and generate reports

Conduct or facilitate security audits

Understand and support investigations

Understand the requirements for different types of investigations

Conduct logging and monitoring activities

Securely provision resources

Understand and apply foundational security operations concepts

Apply resource protection techniques

Conduct incident management

Operate and maintain detective and preventative measures

Implement and support patch and vulnerability management

Understand and participate in change management processes

Implement recovery strategies

Implement disaster recovery (DR) processes

Test disaster recovery plans (DRP)

Participate in business continuity (BC) planning and exercises

Implement and manage physical security

Address personnel safety and security concerns

Understand and apply security in the software development lifecycle

Enforce security controls in development environments

Assess the effectiveness of software security

Assess security impact of acquired software

Define and apply secure coding guidelines and standards