CISA Domain 5: Protection of Information Assets : Part A

A Practical Revision Guide for Information Asset Security and Controls in CISA Domain 5

CISA Domain 5 (Part A) · Protection of Information Assets · Updated October 2026

CISA Domain 5 focuses on protecting organizational information assets through appropriate security controls. This Part A study guide explains information asset security frameworks, identity and access management, physical security, encryption, network protection, and cloud security from an IT auditor’s perspective

Information is one of an organization’s most valuable assets. Customer records, financial information, intellectual property, business applications, operational technology, and communication systems all require protection against unauthorized access, alteration, disclosure, destruction, and disruption.

The objective of information security is not simply to deploy security technologies. It is to ensure that appropriate governance, policies, processes, and technical, physical, and environmental controls protect information assets in accordance with business requirements and risk.

This article is a consolidated revision of Domain 5, Part A: Information Asset Security and Control, with an emphasis on the concepts an IT auditor needs to understand.

Understanding Information Asset Security

What Is an Information Asset?

An information asset is information or a resource that supports the organization’s business objectives and requires protection. An asset may contain information directly or provide the means to store, process, transmit, or protect information. Examples include:

customer and employee databases, financial and accounting records, business applications, source code, and operating systems servers

The CIA Triad

The three fundamental objectives of information security are

A control that improves one security objective may affect another. For example, highly restrictive access controls may improve confidentiality but could reduce availability if legitimate users cannot access information when needed.

Policies, Frameworks, Standards, and Guidelines

Security policies establish management’s direction. Frameworks organize security practices. Standards define mandatory requirements, while procedures explain how activities are performed.

Policies, Standards, Procedures, and Guidelines

What Should an Auditor Examine?

An effective information security policy framework should have:

• management approval and sponsorship;
• clear scope and applicability;
• defined roles and responsibilities;
• alignment with business objectives and risk appetite;
• requirements for access, data protection, incident reporting, and compliance;
• defined exceptions and approval mechanisms;
• communication to relevant personnel;
• periodic review and update;
• evidence of implementation and enforcement.

A policy that exists only as a document, without implementation or monitoring, does not demonstrate effective security governance.

Information Security Frameworks

A framework provides a structured approach to managing security risks and implementing controls. Common frameworks and standards include

Risk-Based Control Selection

Organizations cannot implement every possible security control at the same level. Controls should be selected based on:

asset criticality threats vulnerabilities business impact

Physical and Environmental Controls

Information security is not limited to software and networks. Physical and environmental threats can compromise information assets, even when logical controls are strong.

Physical Security Controls

Physical controls protect facilities, equipment, media, and personnel from unauthorized access, theft, damage, or disruption.

An auditor may review:

Physical access authorization lists access card logs. visitor records CCTV retention and monitoring periodic access reviews physical security incidents data center entry procedures access revocation for departed employees

Environmental Controls

Environmental controls protect information assets against conditions that can damage equipment or interrupt operations.

UPS versus Generator

A generator may not provide uninterrupted power during the time required to start. Therefore, a UPS is commonly used to bridge the gap.

Industrial Control System (ICS) Security

Industrial Control Systems are used to monitor and control physical processes. ICS environments include technologies such as:

• SCADA: Supervisory Control and Data Acquisition systems
• PLC: Programmable Logic Controllers
• DCS: Distributed Control Systems
• HMI: Human-Machine Interfaces
• RTU: Remote Terminal Units
• industrial sensors and actuators

Why ICS Security Is Different

Traditional IT systems generally prioritize information confidentiality, integrity and availability. ICS environments must also consider:

human safety physical process safety equipment protection continuous operation real-time requirements reliability and deterministic behavior

A security control that is appropriate for an office network may not be suitable for a production control system. Important security objectives include:

1. Identify critical devices, systems and dependencies.
2. Limit unauthorized movement between environments.
3. Prevent unauthorized vendor or engineer access.
4. Restrict communication between critical systems.
5. Reduce unnecessary services and insecure settings.
6. Restrict unauthorized software execution.
7. Reduce malware and unauthorized data-transfer risks.
8. Ensure security actions do not create safety hazards.

ICS Patching: An Important Audit Issue

In a conventional IT environment, applying security patches quickly may be desirable. In an ICS environment, patching may require:

vendor approval testing in a representative environment planned maintenance windows safety assessment operational approval rollback planning

Identity and Access Management (IAM)

Identity and Access Management ensures that the right individuals and systems receive the right access to the right resources at the right time.

Identification, Authentication, Authorization and Accountability

These terms are frequently tested in CISA examinations.

Authentication Factors

Multifactor authentication requires authentication factors from at least two different categories. A password combined with a hardware token is an example of multifactor authentication.

Authorization and Access-Control Principles

• Least privilege: users and systems should receive only the access necessary to perform authorized duties.
• Need to know: access to information should be granted only when the user has a legitimate business requirement to know it.
• Segregation of duties: critical activities should be divided among individuals so that one person cannot improperly control an entire transaction or process.
• Privileged accounts have elevated permissions, such as administrator, database administrator or root access, and need tighter control.

User Access Lifecycle

IAM should cover the complete identity lifecycle:

Joiner → Mover → Leaver

Auditor’s evidence may include:

HR records access request forms approval workflows user-account listings privileged-account reports access review records termination reports system access logs periodic recertification

Access-Control Models

Zero Trust Architecture (ZTA)

Zero Trust is a security approach based on the principle that no user, device, application or network location should automatically be trusted.

Traditional security models often relied heavily on a trusted internal network and an untrusted external network. Zero Trust recognizes that threats may exist inside or outside organizational boundaries. A Zero Trust approach generally emphasizes:

verify explicitly least-privilege access assume breach continuously evaluate risk policy based on identity, device, resource and context

Zero Trust does not mean that every request must necessarily use a password. It means that access decisions should be based on appropriate verification and policy rather than implicit trust.

Information Security and External Parties

Organizations depend on suppliers, contractors, consultants, cloud providers, managed service providers and business partners. Security must be managed across the whole relationship:

1. Due diligence. Before engaging a third party, assess its security capabilities, relevant certifications and independent assurance reports, and data protection practices.
2. Contractual requirements. Contracts should address security responsibilities, confidentiality, access controls, data protection, incident notification, audit and assurance rights, vulnerability management, subcontractor controls, data retention and deletion, business continuity, and termination and data return.
3. Ongoing monitoring. Security assurance should continue after contract signing.
4. Termination. When a relationship ends, access should be revoked, organizational assets returned, data returned or securely destroyed as applicable, and credentials and certificates invalidated.

When services are outsourced, the organization does not automatically outsource its accountability. The exact responsibilities depend on the service model and contract.

Remote Access Security

Remote access allows users, administrators, vendors and contractors to connect to organizational systems from outside the organization’s physical premises. Common remote-access risks include:

stolen credentials unmanaged devices insecure Wi-Fi malware on endpoints weak authentication excessive privileges uncontrolled vendor access unencrypted communication split tunneling risks inadequate logging

Remote Administration

Administrative remote access should receive stronger controls than ordinary user access. An auditor may examine whether:

• administrative access is approved;
• MFA is enforced;
• access is restricted to authorized devices;
• sessions are recorded or logged where appropriate;
• access is time-limited;
• vendor activity is monitored;
• emergency access is controlled.

Federated Identity Management

Federated identity management allows users to access services across organizational or system boundaries using trusted identity relationships.

Instead of creating a separate account in every application, an organization may rely on an identity provider to authenticate the user and provide trusted identity information to a service provider. For example, an employee signs in through the organization’s identity provider and then accesses an approved external business application without creating a separate password for that application.

Common Technologies

Network and Endpoint Security

Network and endpoint controls protect communication infrastructure, devices, applications and the information flowing through them. Common network controls include:

firewalls intrusion detection and prevention network access control secure network configuration network segmentation secure routing access-control lists secure protocols network monitoring DDoS protection secure DNS services network device hardening

Endpoint security controls may include:

secure configuration anti-malware / EDR patch management host-based firewalls disk encryption application control USB restrictions device management vulnerability management local administrator restrictions security logging

VPN Protocols and Secure Communication

A Virtual Private Network creates a protected communication channel over an underlying network, often the public internet.

Content Delivery Networks (CDNs)

A Content Delivery Network is a distributed network of servers that delivers web content and services closer to end users. A CDN may cache static content, distribute traffic and provide edge-based security services.

Security risks include:

incorrect caching of sensitive information misconfigured origin servers exposed origin IP addresses improper TLS configuration insecure API access cache poisoning inadequate access controls incorrect cache invalidation

Network Infrastructure Security

Network infrastructure includes routers, switches, firewalls, wireless controllers, DNS servers, load balancers and other communication components.

Common network infrastructure risks:

default credentials unnecessary services insecure management protocols weak administrative access poor configuration management unpatched firmware flat networks inadequate logging unauthorized configuration changes single points of failure

Auditor’s evidence:

network diagrams device inventories configuration baselines firewall rules change records configuration backups vulnerability reports access-control lists administrative logs high-availability test results

Unified Threat Management (UTM)

Unified Threat Management refers to security solutions that combine several security functions within a single platform. A UTM appliance may provide:

firewall services intrusion prevention antivirus / malware filtering web filtering email security VPN application control traffic monitoring

Network Segmentation

Network segmentation divides a network into separate logical or physical zones to control communication and reduce security exposure.

Data Loss Prevention (DLP)

Data Loss Prevention technologies and processes help identify, monitor and prevent unauthorized disclosure, transmission or misuse of sensitive information.

Data Encryption, Hashing and Digital Signatures

Encryption primarily supports confidentiality, although authenticated encryption can also provide integrity and authenticity protections. For example:

• Symmetric: a database is encrypted using AES. The authorized application uses the appropriate key to decrypt data when required.
• Asymmetric: a sender encrypts information using the recipient’s public key. The recipient uses the corresponding private key to decrypt it.

Hashing

A cryptographic hash function converts data into a fixed-length digest. Hashing is generally designed to be one-way, meaning it should be computationally infeasible to recover the original input from the digest. Examples of cryptographic hash functions include SHA-256 and SHA-3.

Digital Signatures

A digital signature provides mechanisms for:

• integrity;
• authentication of the signing entity;
• non-repudiation-related assurance, subject to the legal and technical context.

Key Management

Encryption is only as strong as the protection of its keys.

Public Key Infrastructure (PKI)

Public Key Infrastructure is a system of technologies, processes, policies and trusted entities used to manage public-key cryptography and digital certificates.

An auditor should examine:

CA governance certificate issuance controls identity verification private-key protection certificate inventory renewal processes revocation procedures CRL or OCSP availability certificate-policy compliance root and intermediate CA protection

Cloud and Virtualized Environments

Cloud computing provides on-demand access to computing resources such as servers, storage, applications and networks. Common cloud service models are:

Cloud Deployment Models

• Public cloud: services are provided through shared provider infrastructure.
• Private cloud: cloud infrastructure is dedicated to a particular organization.
• Hybrid cloud: combines private and public cloud environments.
• Community cloud: infrastructure is shared by organizations with common requirements.

Cloud security responsibilities are divided between the provider and the customer. The exact division depends on the service model, architecture, contract and provider.

Virtualization Security

Virtualization allows multiple virtual machines to operate on a physical host. Components may include:

hypervisor virtual machines virtual networks virtual storage virtual switches management consoles templates and images

Security controls include:

• harden hypervisors;
• restrict management access and apply MFA;
• separate management networks;
• secure virtual-machine templates;
• patch hosts and guest systems;
• control snapshots and images;
• monitor administrative actions;
• segment virtual networks;
• review resource and access configurations.

Secure Cloud Migration

Cloud migration involves transferring applications, data, services or infrastructure from an existing environment to a cloud environment. Security should be integrated into the migration lifecycle rather than addressed after migration.

1. Assessment and planning → 2. Architecture and design → 3. Migration preparation → 4. Migration execution → 5. Post-migration validation

Mobile, Wireless and IoT Devices

Mobile devices include smartphones, tablets and portable computing devices used to access organizational resources. Mobile security controls include:

Mobile Device Management (MDM) Enterprise Mobility Management (EMM) Mobile Application Management (MAM) device encryption strong authentication screen-lock policies remote lock and wipe application restrictions secure configuration patch management device compliance checks separation of business and personal data

BYOD: Bring Your Own Device

BYOD allows employees to use personally owned devices for organizational activities. An auditor should examine whether:

• BYOD is formally authorized;
• security requirements are defined;
• organizational data can be separated from personal data;
• remote wipe is appropriately managed;
• privacy requirements are considered;
• access is revoked when employment ends;
• devices must meet minimum security standards.

Wireless Security

Wireless networks provide connectivity without physical network cables but introduce risks such as unauthorized access, eavesdropping, rogue access points and misconfiguration. Wireless security practices include using current, appropriately configured wireless security protocols, avoiding obsolete encryption mechanisms and enforcing strong authentication.

Internet of Things (IoT)

IoT devices are connected devices that collect, transmit or process data and may interact with the physical environment. IoT security risks include:

default passwords insecure firmware limited patching capability poor asset visibility weak encryption insecure APIs unnecessary network exposure lack of device identity physical tampering vendor dependency privacy concerns

20 High-Value CISA Exam Reminders

1. Security controls should be risk-based. The most expensive control is not necessarily the most appropriate control.
2. A policy is not evidence of implementation.
3. Authentication verifies identity; authorization determines permissions.
4. Accountability requires traceability of actions to users or entities.
5. Least privilege reduces unnecessary access.
6. Segregation of duties reduces the risk of unauthorized activity.
7. MFA requires different authentication factors, not merely multiple credentials.
8. Zero Trust does not mean automatically trusting internal networks.
9. Cloud security follows a shared-responsibility model.
10. Outsourcing a service does not automatically outsource the organization’s accountability.
11. A VLAN alone does not guarantee effective security segmentation.
12. Encryption protects confidentiality; hashing supports integrity verification.
13. Digital signatures are not the same as encryption.
14. PKI depends on certificate and private-key management.
15. DLP works best when sensitive data is identified and classified.
16. ICS security must consider safety, availability, and operational constraints.
17. Immediate patching is not always feasible in ICS environments; risk-based compensating controls may be necessary.
18. A CDN improves delivery and may provide security services, but it does not automatically secure the origin application.
19. A UTM appliance does not eliminate the need for proper configuration, monitoring and resilience.
20. Security controls must be tested for design and operating effectiveness.

The Big Picture

An effective IT auditor should be able to move beyond the question “Does the organization have this security control?” and ask:

That is the central perspective needed to understand and audit information asset security.

References and Further Reading

This article is structured around the subject areas in ISACA’s CISA examination content outline. Useful resources for further study:

• ISACA — CISA Exam Content Outline: defines the current five domains and the detailed topics under Domain 5.
• ISO/IEC 27001 and ISO/IEC 27002: information security management systems and control implementation guidance.
• NIST Cybersecurity Framework: cybersecurity risk-management framework.
• NIST SP 800-53: security and privacy controls.
• NIST SP 800-207: Zero Trust Architecture.
• NIST SP 800-82: Guide to Operational Technology Security.
• NIST SP 800-57: Key Management.
• NIST SP 800-63: Digital Identity Guidelines.
• Cloud Security Alliance Cloud Controls Matrix: cloud security controls and responsibilities.

Note: this is an independent educational revision guide, not official ISACA study material. Candidates should use the current ISACA Review Manual, official practice questions and examination guidance for comprehensive preparation.

https://thecyberskills.com/category/learn-train/cisa/