Domain 1 is governance: how an organization decides what to protect, who is accountable for it, which laws and frameworks apply, and how risk is assessed and treated. The exam tests it through management scenarios and not technology. What should the security leader do first, and who owns the decision?
Case Study: The "Meridian Financial" ATM Network Breach (2025)
Meridian Financial Services is a fast-growing regional bank with a fleet of 1,200 "NextGen" ATMs. Maintenance is outsourced to TechSafe Solutions, whose technicians reach Meridian's ATM management server over a vendor VPN. The contract carries a right-to-audit clause that has never been exercised. Meridian's business impact analysis rates ATMs as "Medium impact" assets, a rating written with physical theft in mind: one machine, one safe, one night.
A targeted phishing email took the VPN credentials of a TechSafe technician. TechSafe did not enforce multi-factor authentication, so the password was enough. From the vendor portal the attackers pivoted to the ATM management server and pushed a jackpotting script to the fleet.
Meridian's security operations center saw alerts for unusual remote-desktop activity on the vendor VPN. Nobody at the SOC had a way to check whether TechSafe was working that night, so the alerts were closed as scheduled maintenance. For fourteen days the malware dispensed cash on command and recorded card data as customers used the machines. Local police noticed a pattern of people emptying Meridian ATMs at 3 AM and called the bank. Direct cash loss: $2.5 million. Card records exfiltrated: more than 50,000.
The shape of this attack is the one the ATM industry has been documenting for a decade. The white paper's section on malware-based attacks describes fleet-wide jackpotting deployed over a compromised bank network, with cash collected by money mules on a schedule (the Tyupkin strain was written to run only at night and on weekends). Its section on backend compromise describes the same entry technique, spear phishing, used to reach the payment switch itself.
One organization each, three to six questions apiece in the printed examination. Nothing here gives an answer away — the scenario is what the question hands you before it asks.
Meridian Financial Services, a regional bank of 2,400 staff, is buying Ridgeline Savings, a 40-branch thrift with its own core banking platform and a customer analytics contract with a processor in Bangalore. The deal signs in six weeks. Ridgeline has never had a CISO, and its board minutes record one penetration test, in 2021. Meridian's board has told the CISO that security must not delay the closing. The examiner will review the combined entity nine months after close. Ridgeline's analytics contract renews automatically thirty days after any change of control.
Meridian Financial Services · acquiring Ridgeline Savings, 40 branches
Meridian's new CISO inherits a document set that grew by accident. There is a thirty-page information security policy last approved in 2019, four standards that contradict it on password length, a wiki of procedures written by whoever last did the task, and a recommended practices page nobody can say is binding. The board approved the policy; nobody can say who approved the standards. Meanwhile two branch regions are merging and 300 staff are changing roles, and the awareness program still teaches a threat catalog written before the bank used any cloud service at all.
Meridian Financial Services · 2,400 staff
Every one of Meridian Financial Services' 1,200 cash machines is administered through a single management server, and the forensic team is mapping each stage of the attack that reached it against a defense chosen for that stage. Investigators also established that the supplier's technicians all shared one set of VPN credentials, so the bank cannot establish which technician was phished or tie any session to a person. The malware did two things once installed: it dispensed cash on command, and it silently recorded card details from live transactions.
Meridian Financial Services · ATM estate
Two years into a rebuilt awareness program, Lowell Savings Bank sees annual quiz pass rates of 98 percent, yet a red team's pretext phone calls still talk staff into disclosing internal details. The steering committee is debating what the program's true measure of success should be. The bank is also designing its first internal phishing simulation, and human resources has proposed docking the bonuses of anyone who clicks. An auditor reviewing the assessment calendar wants the quarterly deceptive-email exercise correctly categorized alongside the network scans and exploit-based tests, and the supplier ecosystem gets one awareness investment this year.
Lowell Savings Bank · 1,100 staff
The vendor contract is not a control. A practitioner exercises the audit clause, makes MFA a condition of any remote path into the bank, and confines vendor sessions to a jump host that can reach the management server and nothing else. The compromised account should have been able to do very little.
The BIA needs a second scenario next to "one ATM robbed": "every ATM told to dispense at once." The white paper's risk matrix rates malware jackpotting at Critical severity and High overall risk, which puts the ATM management plane in the same protection tier as the core ledger. Segment it that way.
Incident response needs a verification step for off-hours vendor activity: a named vendor contact to call back, and a change-ticket reference the analyst can check before closing an alert. Alerts from the vendor VPN get an owner.
On compliance, the unmonitored vendor access maps to PCI DSS Requirement 8 (identify and authenticate access to system components) and Requirement 12 (maintain an information security policy for all personnel), and to the FFIEC's expectations for third-party relationship management. Awareness training applies on both sides of the contract: the technician who clicked, and the analysts who closed the alerts.
Containment meant revoking every TechSafe credential, isolating the management server, and re-imaging the fleet. The card records went to reissue. The regulator's first question was why the audit clause had never been used. The cash loss was recoverable in a way the customer trust was not.
Questions built on a scenario like this ask who is accountable for third-party risk (senior management and the data owner, never the vendor), whether the unexercised audit clause is a failure of due care or due diligence, which risk response Meridian actually chose by leaving the clause unused (acceptance, by default and undocumented), and the order of the incident management steps: detection, response, mitigation, reporting, recovery, remediation, lessons learned.
The institutions in this scenario are composites. The attack mechanics are documented in: