CISA Domain 5 Notes: Access Controls and Encryption Explained

CISA Domain 5, Protection of Information Assets, is the largest single block of the CISA exam, worth 26 percent of the current exam outline, and it tests whether you can judge if access controls and encryption actually protect information. This note covers identity and access management, access control models, encryption and public key infrastructure, and the audit tests that turn textbook definitions into exam marks.

Domain 5 is not a test of hacking skill. The exam asks you to think like an auditor: do controls limit access to what each person needs, do teams encrypt sensitive data in the right places, and does monitoring catch abuse fast enough to matter? If you plan your revision around those three questions, most Domain 5 scenarios become easier to read. Use the free study timetable generator to spread this domain across several short sessions instead of one long sitting, since it rewards repeated recall more than a single read-through.

What CISA Domain 5 Tests

CISA Domain 5 tests whether an organization protects information assets through sound access controls, encryption, monitoring, and incident response, with the auditor judging design and operating effectiveness rather than building the controls themselves, across networks, systems, and physical sites, and reporting gaps to management.

The domain splits into two parts. Part A covers information asset security and control, including frameworks, identity and access management, network and endpoint security, data classification, encryption, and public key infrastructure. Part B covers security event management, including awareness, attack methods, vulnerability testing, monitoring, incident response, and evidence handling.

That scope explains the weight. According to the current CISA exam outline summarized by Pocket Prep, Domain 5 carries 26 percent of the exam, sharing the heaviest weight. The exam itself has 150 multiple choice questions over 4 hours, with a scaled passing score of 450 out of 800. Roughly one question in four will touch this domain, so a weak Domain 5 score is hard to offset elsewhere.

Why does this domain matter outside the exam? According to Verizon’s 2025 Data Breach Investigations Report, credential abuse was the initial access vector in 22 percent of breaches analyzed, ahead of vulnerability exploitation at 20 percent. Access control is therefore not a theory topic. It is the control that fails first in real incidents, and the exam reflects that reality.

Identity and Access Management Explained

Identity and access management answers four questions in order: who are you, are you really that person, what are you allowed to do, and can we prove what you did? Those four steps are identification, authentication, authorization, and accountability, and exam questions often test them by swapping two of them.

Identification, Authentication, Authorization, Accountability

Identification is the claim of an identity, usually a username or an employee ID. Authentication verifies that claim, through something you know, something you have, or something you are. Authorization then decides what that verified identity may access. Accountability closes the loop, because logs and unique IDs make actions traceable to one person.

Shared accounts break accountability at the last step. If five administrators share one root password, a log entry proves that someone used the account, but it never proves who. That is why auditors flag shared privileged accounts even when the password itself is strong.

Factors and Single Sign-On

Multi-factor authentication combines two different factor types, for example a password plus a hardware token or a biometric check. Two passwords are not multi-factor authentication, because both belong to the same factor type. Single sign-on improves the user experience and centralizes control, but it also concentrates risk: one compromised credential can open many systems, which makes strong authentication and fast revocation more important, not less.

Access Control Models in CISA Domain 5

Access control models decide who grants permissions. The exam rarely asks for a definition in isolation. It gives a scenario, such as a data owner approving access or a role change after a transfer, and asks which model fits or which control failed.

Model	Who grants access	Best exam clue
Discretionary (DAC)	Data owner, at their discretion	Owner approves a colleague’s request
Mandatory (MAC)	System, based on labels and clearance	Classified data, clearance levels, no owner override
Role-based (RBAC)	Administrator, through roles	Permissions follow the job role, not the person
Attribute-based (ABAC)	Policy engine, based on attributes	Access depends on location, time, or device as well as role

Least privilege is the principle that runs through all four models: each user holds only the access needed for their current job. Privileged access management adds a further layer for administrators, with vaulted passwords, just-in-time elevation, and session recording. An auditor looks for both the policy and the evidence, such as periodic access recertification by data owners.

Worked Example: Joiner, Mover, Leaver

Consider a finance analyst, Priya, who transfers from accounts payable to treasury. On day one of the new role, her old payable approval rights are still active, and she has already gained new treasury payment rights. She now holds both sets of rights, which violates segregation of duties: the same person could create and approve a payment.

The correct control sequence is simple. First, remove the old role rights on the transfer date. Second, grant only the treasury rights her new role requires. Third, have the treasury data owner recertify the new access within an agreed window, such as 30 days. In an exam scenario, the best answer is usually the one that removes the conflicting access first, not the one that adds monitoring afterward.

Leavers need the same discipline in reverse. Managers should revoke access promptly when employment ends, and privileged accounts need priority. A common exam trap is a leaver whose email still works a week later because deprovisioning depended on a manual ticket that nobody chased.

Encryption and Public Key Infrastructure in CISA Domain 5

Encryption protects confidentiality by turning readable data into ciphertext that only a key holder can reverse. Hashing is different: it creates a fixed-length fingerprint of data to prove integrity, and you cannot reverse it to recover the original data. Confusing the two is a reliable way to lose marks.

Technique	What it protects	Key exam point
Symmetric encryption (AES)	Confidentiality, fast bulk encryption	One shared key; key distribution is the hard part
Asymmetric encryption (RSA)	Confidentiality and key exchange	Key pair; public key encrypts, private key decrypts
Hashing (SHA-256)	Integrity	Same input gives the same hash; any change gives a different hash
Digital signature	Authenticity and non-repudiation	Private key signs, public key verifies

Data at Rest, in Transit, and in Use

Teams usually protect data at rest, such as database files and backups, with symmetric encryption like AES-256, because speed matters for large volumes. TLS protects data in transit, such as traffic between a browser and a server, and combines asymmetric key exchange with symmetric session encryption. Data in use is the hardest state to protect, since processing requires decrypting it, which is why access control around the processing environment matters so much.

Public key infrastructure, or PKI, makes asymmetric encryption usable at scale. A certificate authority issues digital certificates that bind a public key to an identity. If a certificate expires, or an authority revokes it, and systems still trust it, the chain of trust breaks. Auditors therefore check certificate inventory, expiry monitoring, and revocation handling, not just the strength of the algorithm.

Worked Example: Spotting the Weak Link

A company encrypts its customer database with AES-256 and proudly reports that fact in its audit response. Auditors still find a high-risk issue: the team stored the encryption key in the same database server, in a plain text configuration file, and three administrators share access to it.

Encryption itself is strong, but key management is weak. Fix it by moving keys to a dedicated key management system or hardware security module, restricting access to key custodians, rotating keys on a schedule, and separating the duties of key creation and key use. In exam terms, the answer is almost never a stronger algorithm when the scenario describes a key handling failure.

Network, Physical, and Monitoring Controls

Network controls in Domain 5 include firewalls, intrusion detection and prevention systems, network segmentation, and endpoint protection. A firewall enforces a policy about which traffic may pass. An intrusion detection system watches and alerts, while an intrusion prevention system can block traffic directly. The distinction matters in exam questions about whether teams stopped an incident or merely noticed it.

Physical and environmental controls protect the hardware that holds the data: badge access, locked server rooms, cameras, and environmental monitoring for heat and water. A perfect logical access design means little if anyone can walk into the server room. Auditors test both layers together, which is why a scenario with a tailgating visitor and an unlocked rack is a physical control failure, not an IT policy failure.

Monitoring ties the layers together. Security information and event management tools collect logs from many sources and flag anomalies. The audit question is usually about completeness: do logs capture privileged actions, do controls protect logs from tampering, do teams review alerts on time, and is there evidence that reviews actually happened?

Security Events, Incidents, and Evidence

When an incident occurs, the auditor checks the sequence, not just the technology. Did teams detect, contain, and report the incident through an approved process? Had managers assigned responsibilities in advance? Did the response preserve evidence before teams rebuilt systems? Finally, did teams find the root cause and apply lessons?

Evidence handling follows a chain of custody: who collected each item, when, where teams stored it, and who accessed it afterward. If that chain breaks, evidence may be unusable even when the technical findings are correct. Digital forensics is therefore a control topic for auditors, not only a technical skill for investigators.

Vulnerability management follows a similar logic. Scanning finds weaknesses, but the audit test is whether teams rate findings by risk, assign owners, and close them within agreed timeframes. An unpatched critical vulnerability with no owner and no deadline is a process failure, and that is the finding an exam scenario usually points toward.

Traps That Cost Marks in CISA Domain 5

First, answering as a manager instead of an auditor. When a scenario says an auditor finds excessive access, the correct next step is to report it to management and recommend action, not to revoke the access yourself. Auditors observe and report; management owns the fix.

Second, picking the strongest control instead of the most appropriate one. A biometric system is not automatically better than a password plus token if the scenario involves remote workers without biometric readers. Fit for the environment beats raw strength.

Third, treating encryption as a cure for access problems. Encryption does not fix excessive permissions, shared accounts, or missing monitoring. If authorized users hold too much access, encryption will protect their misuse from outsiders only, not from the organization itself.

Fourth, confusing preventive, detective, and corrective controls. A firewall prevents, a log review detects, and a backup restore corrects. Exam questions often describe a control and ask for its type, so classify before you choose.

Revision Checklist for Domain 5

Use this checklist in your final pass over the domain, and mark any item you cannot explain in two sentences for a second review session.

• Explain identification, authentication, authorization, and accountability with one example each.
• Distinguish DAC, MAC, RBAC, and ABAC from a scenario clue.
• State the least privilege principle and apply it to a mover scenario.
• Explain segregation of duties and why teams must remove conflicting rights, not just monitor them.
• Distinguish symmetric encryption, asymmetric encryption, hashing, and digital signatures.
• Describe data at rest, in transit, and in use, with the right protection for each state.
• Explain PKI, certificates, expiry, and revocation in plain terms.
• Classify a control as preventive, detective, or corrective on sight.
• Describe the incident response sequence and the chain of custody.
• Recall that Domain 5 is worth 26 percent of the exam and plan revision time to match.

Sources

ISACA exam outline and Domain 5 weight: Pocket Prep, Learn What to Study for the ISACA CISA Examination. Credential abuse findings: Verizon 2025 Data Breach Investigations Report, as summarized by Security Boulevard, Cybersecurity Snapshot: Verizon DBIR Findings. Domain 5 topic structure: CyberMind, CISA Domain 5: Protection of Information Assets.