CISSP Resources · Domain 2 — 10% of the exam

CISSP Domain 2 Guide: Asset Security

Domain 2 is 10% of the exam and unusually easy to score well on, because most of it reduces to two questions: who owns this data, and what does its classification require?

What Domain 2 covers

Identifying and classifying information and assets
Data roles: owner, controller, custodian, processor, steward, user
The data lifecycle from creation to destruction
Retention requirements and legal hold
Data remanence and secure disposal
Data states — at rest, in transit, in use — and the controls for each
Privacy: data minimisation, purpose limitation, and residency

Classification and ownership

Classification is a business decision made by the data owner based on the impact of disclosure, alteration, or loss — never a technical decision made by IT.

Role	Decides or does
Data owner	Classifies data, defines protection requirements, approves access
Data custodian	Implements the controls the owner specified — backups, patching, provisioning
Data controller	Determines the purposes and means of processing personal data (privacy law)
Data processor	Processes personal data on documented instructions from the controller
Data steward	Maintains data quality and business meaning
User	Follows acceptable use; no authority over classification

The most common Domain 2 mistake

Answering 'security team' or 'IT' for who classifies data. The owner classifies; everyone else implements or follows.

The data lifecycle

Create / acquire — classify at this point, not later.
Store — apply encryption and access control appropriate to the classification.
Use — protect data in use; control who can see and export it.
Share — contracts, agreements, and transfer controls.
Archive — retention schedule applies.
Destroy — verified, documented destruction.

Remanence and destruction

Method	What it does	When to use
Clearing / overwriting	Overwrites data; media reusable	Reuse inside the organisation
Purging	Removes data beyond laboratory recovery	Reuse outside the security boundary
Degaussing	Destroys magnetic fields; useless on SSDs	Magnetic media only
Cryptographic erase	Destroys the key so ciphertext is unrecoverable	SSDs and cloud storage
Physical destruction	Shredding, incineration	Highest classification data

Deleting a file removes the pointer, not the data. Formatting is not destruction. SSD wear levelling means overwriting cannot be guaranteed — cryptographic erase or physical destruction is the correct answer.

Exam traps in Domain 2

Retention is set by legal and regulatory requirements first, business need second. Keeping data 'just in case' is a liability.
Legal hold suspends normal destruction schedules — immediately and without exception.
Labelling follows classification; you cannot label what has not been classified.
Data in use is the state people forget. Controls include masking, tokenisation, and secure enclaves.

Study checklist

Explain the difference between owner, custodian, controller and processor in one sentence each.
Order the six lifecycle stages and name the control focus of each.
Match each destruction method to the media type and classification it suits.
Explain why cryptographic erase is preferred for SSDs.

Frequently asked questions

Who is responsible for classifying data in CISSP terms?

The data owner — a senior business role. Custodians implement the resulting controls but do not decide classification.

What is the best way to destroy data on an SSD?

Cryptographic erase or physical destruction. Degaussing does nothing to flash memory, and overwriting is unreliable because of wear levelling.

Get the ownership questions right every time

Domain 2 questions on Domain Eight target exactly the role and lifecycle distinctions the exam uses as distractors.

Start free View pricing

Related guides

More CISSP study material from Domain Eight: browse all resources.