Appendix C: Certification Mapping#
This appendix demonstrates how the twenty chapters of this textbook cover the official examination domains of eight widely held security certifications: (ISC)2 CISSP, CompTIA Security+ (SY0-701), EC-Council CEH v13, ISACA CISA, (ISC)2 CGRC (formerly CAP, aligned to the NIST Risk Management Framework), (ISC)2 SSCP, (ISC)2 Certified in Cybersecurity (CC), and GIAC GREM (Reverse Engineering Malware, aligned to SANS FOR610).
Domain titles and weightings below reflect the published exam outlines current as of 2026. Always confirm against the certifying body latest outline before sitting an exam, because vendors revise objectives periodically; for example CompTIA CySA+ moved from CS0-003 to CS0-004 in mid 2026, and the (ISC)2 CC outline effective September 1, 2026 renamed and reweighted all five domains and folds AI security into every one of them. The mapping helps an instructor or self-study learner locate the chapters that develop each domain in depth.
Course alignment. The authors four Fall 2026 courses each map to one of these credentials: LaGuardia MAC 237 Computer Security to the (ISC)2 CC (Section C.7), MAC 246 Advanced Network Security to CompTIA Security+ SY0-701 (Section C.2), MAC 247 Advanced Systems Security to the (ISC)2 SSCP (Section C.6), and Bowie State COSC 332 Software Reverse Engineering to the GIAC GREM (Section C.8).
A chapter listed in bold is the primary home of that domain; lighter listings indicate supporting coverage.
C.1 (ISC)2 CISSP - 8 Domains#
# |
CISSP Domain (weight) |
Primary chapters |
Supporting |
|---|---|---|---|
D1 |
Security and Risk Management (15%) |
5, 19 |
1, 18 |
D2 |
Asset Security (10%) |
5, 18 |
2, 19 |
D3 |
Security Architecture and Engineering (13%) |
1, 2, 11 |
9, 17 |
D4 |
Communication and Network Security (13%) |
3, 11 |
12, 17 |
D5 |
Identity and Access Management (13%) |
11 |
5, 19 |
D6 |
Security Assessment and Testing (12%) |
6, 8 |
7, 9, 10 |
D7 |
Security Operations (13%) |
12, 13, 14 |
11, 15 |
D8 |
Software Development Security (11%) |
10 |
9, 17 |
Cryptographic solutions and cryptanalytic attacks (Domain 3) are developed fully in Chapter 2, including the advanced primitives (homomorphic, post-quantum, functional encryption) in Chapters 2 and 17. Site and facility security (Domain 3) appears in Chapter 11. Investigations and digital forensics (Domains 1 and 7) are in Chapter 13.
C.2 CompTIA Security+ SY0-701 - 5 Domains#
# |
Security+ Domain (SY0-701 weight) |
Primary chapters |
Supporting |
|---|---|---|---|
1.0 |
General Security Concepts (12%) |
1, 2 |
11, 19 |
2.0 |
Threats, Vulnerabilities and Mitigations (22%) |
4, 9, 15 |
7, 8, 10 |
3.0 |
Security Architecture (18%) |
3, 11 |
2, 17 |
4.0 |
Security Operations (28%) |
12, 13, 14 |
11, 6, 8 |
5.0 |
Security Program Management and Oversight (20%) |
5, 19 |
18 |
The CIA triad and control types (Domain 1.0) are introduced in Chapter 1 and applied throughout. Cryptographic solutions (Domain 1.0) are in Chapter 2. Zero trust, IoT, OT, and cloud content updated in SY0-701 appears in Chapters 11, 17, and 20.
C.3 EC-Council CEH v13 - 9 Domains#
# |
CEH Domain (weight) |
Primary chapters |
Supporting |
|---|---|---|---|
D1 |
Information Security and Ethical Hacking Overview (6%) |
1, 6 |
5 |
D2 |
Reconnaissance Techniques (17%) |
7, 8 |
6 |
D3 |
System Hacking Phases and Attack Techniques (15%) |
9, 15 |
8 |
D4 |
Network and Perimeter Hacking (24%) |
3, 9, 12 |
11 |
D5 |
Web Application Hacking (14%) |
10 |
9 |
D6 |
Wireless Network Hacking (5%) |
3 |
9, 11 |
D7 |
Mobile, IoT and OT Hacking (10%) |
17, 20 |
9 |
D8 |
Cloud Computing (5%) |
17 |
11 |
D9 |
Cryptography (5%) |
2 |
17 |
The five ethical-hacking phases (recon, scanning, gaining access, maintaining access, covering tracks) are developed across Chapters 6 through 9. Sniffing, session hijacking, and DoS (Domain 4) are in Chapters 3 and 9. IDS/firewall/honeypot evasion (Domain 4) is in Chapters 9 and 12.
C.4 ISACA CISA - 5 Domains#
# |
CISA Domain (2024 weight) |
Primary chapters |
Supporting |
|---|---|---|---|
D1 |
Information Systems Auditing Process (18%) |
19 |
5, 6 |
D2 |
Governance and Management of IT (18%) |
19 |
5, 18 |
D3 |
IS Acquisition, Development and Implementation (12%) |
10, 19 |
9, 17 |
D4 |
IS Operations and Business Resilience (26%) |
14 |
11, 12, 13 |
D5 |
Protection of Information Assets (25-26%) |
2, 18 |
11, 13 |
Audit standards and frameworks (COBIT) and internal-controls evaluation (Domain 1) are in Chapter 19. Business continuity and disaster recovery (Domains 2 and 4) are in Chapters 5 and 14. Encryption and DLP (Domain 5) are in Chapters 2 and 11; privacy and security laws (Domain 5) are in Chapter 18.
C.5 (ISC)2 CGRC / CAP - 7 Job Practice Areas (NIST RMF)#
# |
CGRC Practice Area (weight) |
RMF step |
Primary chapters |
Supporting |
|---|---|---|---|---|
P1 |
Information Security Risk Management Program (16%) |
Prepare |
5, 19 |
18 |
P2 |
Scope of the Information System (11%) |
Categorize |
5 |
19 |
P3 |
Selection and Approval of Security/Privacy Controls (15%) |
Select |
19 |
5, 18 |
P4 |
Implementation of Security/Privacy Controls (16%) |
Implement |
11, 19 |
2, 12 |
P5 |
Assessment/Audit of Security/Privacy Controls (16%) |
Assess |
6, 19 |
8, 10 |
P6 |
Authorization/Approval of Information System (10%) |
Authorize |
19 |
5 |
P7 |
Continuous Monitoring (16%) |
Monitor |
12, 14, 19 |
13 |
The full NIST RMF lifecycle (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) is presented as an integrated workflow in Chapter 19, with risk inputs from Chapter 5 and operational monitoring from Chapters 12 and 14.
C.6 (ISC)2 SSCP - 7 Domains#
Required text for MAC 247 Advanced Systems Security. Weightings are from the current (ISC)2 SSCP exam outline (Domain 1 was renamed to Security Concepts and Practices).
# |
SSCP Domain (weight) |
Primary chapters |
Supporting |
|---|---|---|---|
D1 |
Security Concepts and Practices (16%) |
1, 5 |
19 |
D2 |
Access Controls (15%) |
11 |
5, 19 |
D3 |
Risk Identification, Monitoring, and Analysis (15%) |
5, 6, 8 |
12 |
D4 |
Incident Response and Recovery (14%) |
14 |
13 |
D5 |
Cryptography (9%) |
2 |
17 |
D6 |
Network and Communications Security (16%) |
3, 11 |
12 |
D7 |
Systems and Application Security (15%) |
10, 15 |
17 |
C.7 (ISC)2 Certified in Cybersecurity (CC) - 5 Domains#
Entry-level credential aligned to MAC 237 Computer Security, and free to students through the (ISC)2 One Million Certified in Cybersecurity program. Weightings are from the outline effective September 1, 2026, which renamed and reweighted every domain, added a dedicated governance domain, folded cloud security into the networking domain, and integrated foundational AI concepts across all five domains.
# |
CC Domain (weight) |
Primary chapters |
Supporting |
|---|---|---|---|
D1 |
Security Principles (24%) |
1, 5 |
2, 19 |
D2 |
Security Governance (17.3%) |
5, 19 |
4, 14, 18 |
D3 |
Identity and Access Management (IAM) Concepts (20%) |
11 |
5, 9 |
D4 |
Networking and Cloud Security Concepts (21.3%) |
3, 11 |
12, 17 |
D5 |
Security Operations and Incident Response (17.3%) |
12, 13, 14 |
2, 6, 15 |
C.8 GIAC GREM (Reverse Engineering Malware) - Topic Areas#
Aligned to Bowie State COSC 332 Software Reverse Engineering and to the SANS FOR610 curriculum. GREM publishes topic areas rather than percentage-weighted domains. Chapter 15 is the primary home; the dedicated COSC 332 course materials (Appendix K) extend it.
Area |
GREM topic |
Primary chapters |
Supporting |
|---|---|---|---|
1 |
Malware analysis fundamentals and safe handling |
15 |
13 |
2 |
Static analysis: PE structure, strings, disassembly |
15 |
10 |
3 |
Dynamic and behavioral analysis |
15 |
12 |
4 |
x86 and x64 assembly and debugging |
15 |
- |
5 |
Unpacking, anti-analysis, and self-defending malware |
15 |
- |
6 |
Malicious documents, scripts, and web-based malware |
15 |
10 |
7 |
Reporting, and AI-assisted analysis with verification |
15 |
13, 17 |
C.9 Chapter-to-Certification Coverage Matrix#
The matrix confirms every chapter contributes to at least one certification and every certification domain is covered by at least one chapter. The SSCP, CC, and GREM outlines added in Sections C.6 through C.8 map to the same chapters and are omitted from the five-column table below only to keep it readable.
Ch |
Title |
CISSP |
Sec+ |
CEH |
CISA |
CGRC |
|---|---|---|---|---|---|---|
1 |
Introduction |
D1,D3 |
1.0 |
D1 |
- |
- |
2 |
Cryptography |
D3 |
1.0,3.0 |
D9 |
D5 |
P4 |
3 |
Networking |
D4 |
3.0 |
D4,D6 |
- |
- |
4 |
Social Engineering |
D1 |
2.0 |
D4 |
- |
- |
5 |
Risk Management |
D1,D2 |
5.0 |
D1 |
D1,D2 |
P1,P2,P6 |
6 |
Pentest Methodology |
D6 |
4.0 |
D1 |
D1 |
P5 |
7 |
Reconnaissance |
D6 |
2.0 |
D2 |
- |
- |
8 |
Scanning |
D6 |
2.0,4.0 |
D2,D3 |
- |
P5 |
9 |
Exploitation |
D6,D8 |
2.0 |
D3,D4,D5 |
D3 |
- |
10 |
Web Security |
D8 |
2.0 |
D5 |
D3 |
P5 |
11 |
Network Defense |
D3,D4,D5 |
3.0,4.0 |
D4 |
D4,D5 |
P4 |
12 |
IDS/IPS |
D7 |
4.0 |
D4 |
D4 |
P7 |
13 |
Forensics |
D7 |
4.0 |
D3 |
D4,D5 |
P7 |
14 |
Incident Response |
D7 |
4.0 |
- |
D4 |
P7 |
15 |
Malware |
D7 |
2.0 |
D3 |
- |
- |
16 |
CTF |
D6 |
2.0 |
D2-D5 |
- |
- |
17 |
Emerging Topics |
D3 |
3.0 |
D7,D8,D9 |
D3 |
- |
18 |
Privacy and Law |
D1,D2 |
5.0 |
- |
D1,D2,D5 |
P1,P3 |
19 |
Governance and Compliance |
D1 |
5.0 |
- |
D1,D2,D3 |
P1,P3,P5,P6,P7 |
20 |
ICS/OT Security |
D4 |
3.0 |
D7 |
- |
- |
All eight CISSP domains, all five Security+ domains, all nine CEH domains, all five CISA domains, and all seven CGRC practice areas are covered across the twenty chapters.