Establish and maintain a security awareness, education, and training program

Apply supply chain risk management (SCRM) concepts

Understand and apply threat modeling concepts and methodologies

Understand and apply risk management concepts

Contribute to and enforce personnel security policies and procedures

Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements

Develop, document, and implement security policy, standards, procedures, and guidelines

Understand requirements for investigation types

Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

Evaluate, apply, and sustain security governance principles

Understand and apply security concepts

Understand, adhere to, and promote professional ethics

Manage the information system lifecycle

Design site and facility security controls

Apply security principles to site and facility design

Understand methods of cryptanalytic attacks

Select and determine cryptographic solutions

Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

Understand security capabilities of Information Systems

Select controls based upon systems security requirements

Understand the fundamental concepts of security models

Research, implement, and manage engineering processes using secure design principles

Implement secure communication channels according to design

Secure network components

Apply secure design principles in network architectures

Implement authentication systems

Implement and manage authorization mechanisms

Manage the identity and access provisioning lifecycle

Control physical and logical access to assets

Federated identity with a third-party service

Design identification and authentication strategy

Conduct or facilitate security audits

Analyze test output and generate report

Conduct security controls testing

Collect security process data

Design and validate assessment, test, and audit strategies

Operate and maintain detection and preventative measures

Conduct incident management

Apply resource protection

Apply foundational security operations concepts

Perform configuration management (CM)

Conduct logging and monitoring activities

Understand and comply with investigations

Address personnel safety and security concerns

Implement and manage physical security

Participate in Business Continuity (BC) planning and exercises

Test disaster recovery plan (DRP)

Implement disaster recovery (DR) processes

Implement recovery strategies

Understand and participate in change management processes

Implement and support patch and vulnerability management

Define and apply secure coding guidelines and standards

Assess the effectiveness of software security

Assess security impact of acquired software

Understand and integrate security in the Software Development Life Cycle (SDLC)

Identify and apply security controls in software development ecosystems