Security Domains & NIST’s Risk Management Framework

Security frameworks get dismissed in some corners as bureaucratic overhead, too slow, too theoretical, not aligned with how attacks actually work. That frustration is real, and often earned. But it’s usually aimed at how frameworks get implemented, not at what they’re designed to do.

The security teams that consistently perform well under pressure aren’t necessarily the ones with the largest budgets or the newest platforms. What distinguishes them is harder to buy: everyone shares the same mental model of what they’re defending, why it matters, and what the plan is when something goes wrong. An analyst can escalate to an architect without spending ten minutes explaining fundamentals. Risk decisions happen faster because the vocabulary is already shared. In a live incident, that shared understanding isn’t a soft advantage; it’s everything.

In most professional security environments, that shared model rests on two things: the eight CISSP Security Domains and NIST’s Risk Management Framework. This guide covers both, updated for where the field actually stands in 2025, not where the textbooks were when they were written several years ago.

Security Posture: Your Organization’s Immune System

Security posture gets invoked constantly and explained poorly. Simply: it’s your organization’s overall capacity to defend its critical assets, detect threats when they materialize, and recover without catastrophic loss of data, operations, or public trust.

The immune system comparison holds up reasonably well. A healthy immune system doesn’t prevent every infection; it identifies threats faster, limits how far they spread, and restores normal function quickly. An unhealthy one lets a minor exposure become a systemic crisis. The same dynamics apply: the goal isn’t to prevent every attack (an impossible standard that guarantees only frustration); it’s to make attacks recoverable. Organizations that confuse “compliance” with “security posture” tend to find out the difference at the worst possible time.

The 8 CISSP Security Domains

The eight domains map the full scope of a security organization's responsibilities. They aren’t independent silos; each one depends on and reinforces the others. A weakness in Domain 5 (Identity & Access Management) can make Domain 7 (Security Operations) nearly unworkable overnight. Good architecture in Domain 3 makes testing in Domain 6 dramatically more effective. You won’t specialize in all eight, but understanding how your specialization fits the larger system is what separates good practitioners from great ones.

“You can’t protect what you don’t know you have. You can’t detect what you haven’t defined. The domains exist to ensure nothing falls through the organizational gaps.”

Domain 01 — Security & Risk Management

Domain 1 sets direction for the entire security program. It covers defining security goals, risk mitigation procedures, regulatory compliance, business continuity planning, and professional ethics. Without a functioning Domain 1, security efforts become reactive and internally disconnected, each team optimizing locally while the organization drifts.

What’s changed in the past two years: quite a bit. The SEC’s cybersecurity disclosure rules, effective as of December 2023, now require publicly traded companies to disclose material incidents within 4 business days after determining materiality. This fundamentally changes how security teams coordinate with legal counsel and executive leadership during an active incident, and it’s driving a wave of tabletop exercises focused on legal communications coordination that weren’t common before.

The EU NIS2 Directive became fully enforceable in October 2024, expanding the original NIS scope to more sectors (food production, waste management, digital infrastructure) with stricter breach reporting timelines and genuine board-level accountability. For organizations operating in European markets, it’s not optional, and the gap between “we have a policy” and “we can demonstrate continuous compliance” has real financial consequences.

And in February 2024, NIST released the Cybersecurity Framework 2.0, the first major update since 2018. The most significant addition is a sixth function called Govern, which formally recognizes that security governance and risk strategy must precede operational functions. It also gave supply chain risk management significantly more explicit attention, a response to SolarWinds, Log4j, and the growing recognition that your security posture is only as strong as your least secure vendor. The compliance burden in this domain is genuinely heavy, and it’s not easing anytime soon.

Domain 02 — Asset Security

Asset security covers identifying, classifying, and managing all organizational assets throughout their entire lifecycle, from creation through secure disposal. Storage, maintenance, retention policies, and physical destruction of hardware. The challenge has grown significantly more complex as the definition of “asset” keeps expanding.

SaaS sprawl is real and underappreciated. The average enterprise now runs over a hundred SaaS applications, many adopted department by department without IT visibility. Each app is a potential data store requiring classification and governance. Shadow IT in the AI era is a specific variant of this: employees feeding company data into unauthorized AI tools is a behavioral pattern that’s proving very difficult to govern without blocking productivity entirely. Most organizations are still figuring this out.

Software Bill of Materials (SBOM) requirements initially driven by a 2021 U.S. Executive Order on cybersecurity are now spreading from federal contractors into private-sector expectations. An SBOM is an ingredient list for software: every open-source component, every dependency, every library, every version. The XZ Utils backdoor discovered in early 2024 demonstrated exactly why tracking software supply chain provenance matters. A sophisticated threat actor spent roughly two years building trust in an open-source project before inserting a backdoor that, had it gone undetected, would have compromised SSH authentication on millions of Linux systems.

Hardware lifecycle management remains less glamorous and equally critical. Physical destruction of high-sensitivity media is not just wiping. Wiped drives can be forensically recovered; physically destroyed ones cannot. That distinction matters when the data in question is clinical, financial, or export-controlled.

Domain 03 — Security Architecture & Engineering

This domain ensures that tools, systems, and processes protecting your organization are built correctly from the start rather than retrofitted after deployment. The core principle of shared responsibility for security across all teams is increasingly reflected in platform engineering and how modern organizations structure their cloud estates.

• Zero Trust: Never trust, always verify. No user or device is granted default trust based on network location. Zero Trust sounds elegant in architecture diagrams. In production, it’s operationally demanding; most organizations are mid-implementation rather than done, and that’s honest.
• Defense in Depth: Multiple overlapping layers so no single failure results in total compromise. The layers include technical controls, process controls, and human factors working together.
• Least Privilege + Just-in-Time Access: Users receive only the access they need; temporary elevated access is granted on-demand rather than persistently. This significantly reduces the blast radius when credentials are compromised.
• Post-Quantum Cryptography: NIST finalized its first post-quantum cryptographic standards in August 2024 — ML-KEM, ML-DSA, and SLH-DSA. Quantum computers capable of breaking RSA or elliptic curve cryptography at scale don’t exist yet. But “harvest now, decrypt later” attacks, where adversaries collect encrypted traffic today to decrypt once quantum capability matures, are already happening. Organizations with long-lived sensitive data need migration timelines now, not when the threat is imminent.
• CNAPP and SASE: Cloud-Native Application Protection Platforms have become the dominant framework for securing cloud workloads, consolidating what were previously separate tools (CSPM, CWPP, CIEM) into unified platforms. SASE (Secure Access Service Edge) is the corresponding consolidation pattern for network security.

Domain 04 — Communication & Network Security

Every byte of data travels over some form of network, wired, wireless, or cloud-based. This domain covers all those transmission channels: firewalls, intrusion detection, wireless configurations, and protocols protecting data in transit.

The headline shift: traditional VPN is functionally obsolete as a primary remote access strategy. Zero Trust Network Access (ZTNA) replaces the perimeter model entirely. Instead of establishing a network tunnel that grants broad access, ZTNA validates identity and device posture for each application access request individually. The difference matters in a world where “on the corporate network” no longer implies “trusted.” Legacy VPNs that granted sweeping lateral access are exactly how attackers move after initial compromise. ZTNA architecturally constrains that movement.

IoT and OT network security are growing rapidly as operational concerns. As industrial and healthcare devices increasingly connect to enterprise networks, the attack surface extends into historically air-gapped environments. Security properties on these devices are often poor, and patch cycles are measured in years. The convergence of IT and OT security is one of the less glamorous and more genuinely difficult problems in the field right now.

Domain 05 — Identity & Access Management (IAM)

The right people get the right access, nothing more, nothing less

IAM controls who can access what within your organization, identifying, authenticating, and authorizing users before they interact with any system or data. From an attacker’s perspective, identity is consistently the most valuable target: most major breaches in recent years involved identity as either the initial access vector or the primary lateral movement mechanism.

Passkeys and FIDO2 passwordless authentication are moving from early adopter to mainstream. Apple, Google, and Microsoft all support passkeys natively now. Enterprise adoption is accelerating partly because passkeys directly address MFA fatigue attacks where attackers flood users with authentication push requests until one gets approved in frustration. The Uber breach demonstrated this beautifully: a $30 credential from a dark web marketplace, some social engineering, and a MFA push approved by an exhausted employee. Passkeys make that attack class structurally impossible.

Non-human identities — service accounts, API keys, OAuth tokens, and machine credentials are now growing faster than human identities in most enterprise environments. Securing them is significantly harder: they don’t have faces, they don’t have managers who notice when they leave the company, and they frequently carry excessive privileges from when they were originally provisioned. PAM (Privileged Access Management) extending to machine identities is one of the fastest-growing sub-disciplines in this domain, and one of the most underinvested.

Key tools: FIDO2 / Passkeys · PAM · LDAP / Azure AD · OAuth 2.0 · SCIM · JIT Access Provisioning

Domain 06 — Security Assessment & Testing

Systematic testing and evaluation of security controls, penetration testing, vulnerability scanning, audits, and data analysis. The goal: find weaknesses before adversaries do, and verify that existing controls actually work, not just that they’re documented as being in place. Those two things are different more often than most organizations would like to admit.

The discipline has matured considerably. Beyond traditional point-in-time penetration tests, leading security teams now run:

• Breach and Attack Simulation (BAS): Automated, continuous simulation of known attack techniques against production defenses. It isn’t a replacement for human red teams, but it’s a forcing function for control validation at scale without the scheduling overhead of a full engagement.
• Purple Team Exercises: Red and blue teams working collaboratively rather than adversarially, the explicit goal being improved detection and response capability, not just demonstrating compromise. More valuable per hour spent than traditional red team engagements for most organizations.
• AI and LLM Security Testing: OWASP published its LLM Top 10 in 2023, covering prompt injection, training data poisoning, insecure output handling, and other risks specific to AI applications. Any organization integrating large language models into products needs a dedicated testing methodology for these vectors; existing AppSec processes don’t automatically cover them.
• API Security Testing: APIs are now the dominant attack surface in web applications. They’re often less visible, less monitored, and less consistently secured than traditional application surfaces. API-specific scanning and testing have become a required component of any mature AppSec program.

Domain 07 — Security Operations

Security operations cover the day-to-day work of monitoring, detecting, investigating, and responding to incidents. Speed is the core constraint: every minute of an active attack means more data at risk, more systems potentially compromised, more forensic evidence potentially overwritten.

The tooling landscape has consolidated significantly. SIEM isn’t disappearing, but XDR (Extended Detection and Response) has emerged as the dominant architecture for organizations that can afford to consolidate. XDR aggregates signals from endpoints, networks, email, identity, and cloud into a unified detection and investigation surface, removing the correlation burden that used to fall on analysts manually pivoting between six different consoles. It doesn’t eliminate analyst judgment. It makes analyst time significantly more productive.

SOAR (Security Orchestration, Automation, and Response) platforms are increasingly table stakes at mid-to-large organizations. Repetitive tier-1 tasks, IP lookups, URL detonation, initial alert triage, and notifications are automated, freeing analysts for work that actually requires human reasoning.

Agentic AI in security operations is early but real. Several XDR and SIEM vendors now offer AI agents capable of initiating and completing investigation workflows autonomously, querying logs, correlating indicators, and drafting incident summaries with human review at decision points. The human role in security isn’t going away. It’s shifting toward oversight, exception handling, and risk authorization decisions that require contextual judgment. That shift requires stronger investigation skills and security reasoning, not weaker ones.

Domain 08 — Software Development Security

Every application your organization builds or uses is a potential attack surface. This domain requires security to be woven into every phase of the Software Development Lifecycle, from threat modeling in design, to secure code review during development, to penetration testing before deployment, to dependency monitoring post-release. The challenge has intensified in the past two years for two specific reasons.

First: AI-generated code. GitHub Copilot, Claude, and similar tools accelerate development meaningfully, but they introduce new security review challenges, suggestions that compile cleanly but contain subtle vulnerabilities, patterns learned from insecure public repositories, and a developer confidence that can exceed what the code actually warrants. AppSec teams are actively adapting their review processes for a world where developers produce significantly more code, faster, through AI assistance.

Second: supply chain security. The XZ Utils incident in early 2024 was a very close call. A sophisticated threat actor spent roughly two years building credibility in an open-source project before inserting a backdoor that would have enabled remote code execution on systems running it. It was caught because an engineer noticed an anomalous performance regression in non-production testing, not by any automated scanner. SBOM (Software Bill of Materials) requirements are one systemic response: if you know precisely what’s in your software stack, you can respond faster when a component is compromised.

The OWASP LLM Top 10 now exists alongside the traditional OWASP Top 10 for organizations building AI-integrated applications. Prompt injection, insecure output handling, and model denial of service are distinct attack classes that standard web application testing won’t surface.

Threats, Risks, and Vulnerabilities

These three terms get conflated constantly. Separating them precisely matters because the response to each is fundamentally different.

The critical insight: risk only exists when both a threat and a vulnerability are present. Remove either one, and the risk disappears. This is why mature security teams don’t just monitor external threats; they actively work to reduce internal vulnerabilities in parallel, rather than treating the two activities as separate and unrelated functions.

NIST CSF 2.0 and the RMF: Two Tools, One Mission

Before diving into the RMF’s seven steps, one distinction worth making explicit: the Cybersecurity Framework (CSF) and the Risk Management Framework (RMF) are related but serve different purposes. Organizations often treat them as interchangeable and lose the value of both.

Most professional environments use both: CSF for organizational strategy and communication with leadership, RMF for system-level risk management and formal authorization. CSF 2.0’s new Govern function is particularly significant; it formalizes that the board, executive leadership, and security leadership must align on risk appetite, resources, and accountability before any operational security program can function effectively. That was always true. NIST finally said it explicitly.

NIST’s Risk Management Framework: The Seven Steps

NIST is a U.S. federal agency that develops standards and frameworks adopted globally, often by organizations with no U.S. federal obligations, because the quality of the work justifies it. The RMF transforms security from a one-time compliance project into a continuous operational discipline. Organizations that run the full RMF cycle properly experience significantly fewer high-severity incidents than those operating without structured risk management. The data consistently supports it, even accounting for industry and size variation.

Security Domains in the 2025 Threat Landscape