2. Domain 1 — Security and Risk Management (16%)

Security and Risk Management is the CISSP's foundational domain — not because it's tested most (though at 16% it is), but because it establishes the decision-making framework every other domain assumes. The manager-first thinking from Phase 1 lives here in concrete form: governance structures, legal obligations, risk frameworks, and the human systems that make technical controls meaningful. Every other domain's controls exist to support the goals defined in this domain.

⚠️ Domain Trap: Domain 1 questions frequently present ethical dilemmas or scenarios with organizational political pressure. The CISSP answer always prioritizes protecting society and the public over organizational interests — and always follows established process before taking independent action, except when there is clear, immediate, illegal harm.