Post
JA EN

CS Fundamentals or Domain Knowledge First? A Cross-Industry Checklist

Posted
By
21 min read
CS Fundamentals or Domain Knowledge First? A Cross-Industry Checklist
  • Intended audience: Software engineers who want a concrete sense of what to study next, and anyone weighing a job change or a specialization
  • Prerequisites: Practical software development experience. No specific domain knowledge required
  • Reading time: 20 minutes

Overview

Cognitive science has consistently shown that computer science knowledge accelerates learning by acting as a schema, and only turns into real expertise once deliberate practice converts it into experience. That framing raises the next, more practical question: what, specifically, should you learn? “CS” covers a lot of ground, and actual work always happens inside a particular industry domain, whether that’s e-commerce, finance, healthcare, or gaming. CS knowledge alone won’t help you avoid the pitfalls specific to that industry.

This article maps out an answer. The first half organizes the CS fundamentals every software engineer should know, regardless of industry, around Computer Science Curricula 2023 (CS2023), the curriculum standard jointly developed by ACM, IEEE, and AAAI. The second half lists the technical concerns, key standards and regulations, and typical failure patterns across eleven industry domains: e-commerce, video streaming, audio streaming, finance, healthcare, logistics, gaming, SaaS, adtech, edtech, and IoT.

One caveat up front. CS fundamentals can be organized largely around primary academic sources (official curriculum standards, peer-reviewed papers), but domain knowledge, by its nature, draws heavily on trade media and company engineering blogs alongside official standards documents. Each item below notes how strong its sourcing is. None of this needs to be memorized. Treat it as a map, and use it to decide where to place your own bets.

Part 1: CS Fundamentals - What to Learn

The 17 Knowledge Areas in the Official Curriculum

Computer Science Curricula 2023 (CS2023, finalized in 2024), produced by a joint task force of ACM, IEEE Computer Society, and AAAI, organizes the core knowledge of a CS education into 17 areas1.

AreaContent
Algorithmic FoundationsAlgorithms and complexity analysis
Architecture and OrganizationComputer architecture
Artificial IntelligenceFundamentals of AI and machine learning
Data ManagementDatabases and data management
Foundations of Programming LanguagesProgramming language theory and type systems
Networking and CommunicationNetworking and communications
Operating SystemsOS, processes, and memory management
Parallel and Distributed ComputingParallel and distributed processing
SecuritySecurity
Software Development FundamentalsFoundations of software development
Software EngineeringSoftware engineering
Systems FundamentalsSystems fundamentals

(The table above is a selection, drawn from the original 17 areas, of the ones most frequently relevant on the job regardless of industry. The full standard also defines Graphics and Interactive Techniques, HCI, Mathematical and Statistical Foundations, Society, Ethics, and the Profession, and Specialized Platform Development1.)

CS2023 is a revision of CS2013 (the 2013 edition), and it expands the weight given to AI, cybersecurity, and parallel and distributed computing1. The direction of that revision itself is a signal of which areas matter relatively more in practice.

The Basics of Distributed Systems: The CAP Theorem

One thing you can’t avoid when designing a modern system made of multiple interconnected services is the CAP theorem, first proposed by Eric Brewer in 2000 and formally proven by Gilbert and Lynch in 20022. A distributed system cannot simultaneously guarantee all three of Consistency, Availability, and Partition tolerance. Every distributed system design comes down, at some level, to the choice of whether to sacrifice consistency or availability when a network partition occurs. Brewer himself qualified the “pick two” simplification in 20122. Designing a distributed system without understanding this theorem tends to produce ad hoc fixes during an incident, without being able to explain why both properties can’t hold at once.

The Practical Standard for Security: OWASP Top 10

For security fundamentals with practical teeth, there’s the OWASP Top 10. The 2025 edition is based on an analysis of over 175,000 CVEs and 589 CWEs, and organizes the most significant risks to web applications3. Broken Access Control has held the top spot for several editions running, and Security Misconfiguration climbed from fifth to second place in the 2025 edition3. A recent trend worth noting: the focus has shifted from individual coding mistakes toward weaknesses in the overall design and development process.

How Understanding Complexity Connects to Performance Bugs

There’s direct empirical research on how understanding computational complexity pays off in practice. A study presented at ICSE 2016 analyzed 98 fixed performance issues across 16 major JavaScript projects and found that inefficient API usage was the most frequent root cause4. Most fixes involved only a few lines of code, but only 42.68% of them consistently improved performance across all subsequent versions4. A separate study points out that locating performance bugs requires both a high-level understanding of algorithmic complexity and a low-level understanding of implementation details5.

Part 2: Domain Knowledge - An Industry-by-Industry Checklist

If CS fundamentals are the foundation that transfers across any industry, this section covers the additional knowledge worth having if you work in a specific one. For each of eleven domains, the checklist below covers the representative technical concerns, the key standards or regulations, and typical failure patterns.

E-commerce

Technical concerns: Inventory management goes well beyond tracking quantities. It means reconciling reservations, cancellations, substitutions, backorders, and returns across multiple systems. Payments need to handle cards plus wallets like Apple Pay and Google Pay, region-specific payment methods, and the full authorization/capture/refund/chargeback flow.

Key standards: PCI DSS (the security standard for payment card data). Tokenizing card numbers instead of storing raw data is standard practice across the industry6.

Typical failure: A meta-analysis by the Baymard Institute, combining 50 separate studies, puts the global average cart abandonment rate at 70.22%, with “extra costs (shipping, taxes) higher than expected” as the single most common reason (roughly 39%). The root cause is when cost information gets disclosed, not a surface-level UX flaw, and the same research estimates it costs US and EU markets a combined $260 billion in lost sales annually7.

Video Streaming

Technical concerns: Adaptive bitrate streaming, built on segment delivery (chunking video into 2-10 second pieces), is the basic architecture. Codec choice is a direct tradeoff between bandwidth cost and encoding cost.

Key standards: The two dominant delivery protocols are HLS (Apple’s ecosystem) and DASH (used by YouTube and others). Three separate DRM systems coexist: Widevine (Android/Chrome), FairPlay (Apple), and PlayReady (Windows/Xbox)8.

Typical failure: Netflix has published its Per-Title Encode Optimization approach on its official engineering blog, which tunes bitrate and resolution individually based on each video’s complexity9. A one-size-fits-all bitrate scheme wastes bandwidth on some content and degrades quality on other content, depending on which title you’re encoding.

Audio Streaming

Technical concerns: Low latency, minimizing the time before playback starts, is the core challenge. Regional licensing has to be handled at the delivery layer: a track blocked in one country but not another requires geo-based access control that doesn’t add delay to playback start.

Key standards: Opus (standardized by the IETF as RFC 6716), a royalty-free, low-latency codec, is well suited to interactive streaming10.

Typical failure: Regional licensing and royalty settlement tend to be two sides of the same problem. Even when geo-based access control works correctly, the definition of a “qualifying play” (thresholds like minimum seconds listened) differs across platforms, and loose tracking implementations can cause rights holders to be paid too little or too much. Sourcing in this area leans heavily on trade media, with limited primary-data verification available.

Finance / Fintech

Technical concerns: Managing transaction processing latency and real-time fraud detection. The core difficulty in fraud detection is handling severe class imbalance, since legitimate transactions vastly outnumber fraudulent ones.

Key standards: PCI DSS, and ISO 8583 (the international standard for financial transaction messaging used in the majority of ATM and point-of-sale transactions)11.

Typical failure: A fraud detection model that ignores the class imbalance skewed toward legitimate transactions will miss the minority-class fraud patterns it’s supposed to catch. Detection accuracy also degrades sharply when the underlying data isn’t accurate or fresh enough12.

Healthcare / Health Tech

Technical concerns: Interoperability of data exchange across different electronic health record (EHR) vendors.

Key standards: HL7 FHIR (the current RESTful, JSON/XML-based interoperability standard)13. In the US, the HIPAA Security Rule defines five categories of technical safeguards: access control, audit controls, integrity controls, person or entity authentication, and transmission security (45 CFR §164.312)14. In Japan, the Ministry of Health, Labour and Welfare’s guidelines on the security management of medical information systems serve as the compliance baseline.

Typical failure: A vendor’s FHIR support that’s only partially compliant can lead to data being misinterpreted across facilities. A lack of semantic interoperability can occur in practice even when a standard has technically been adopted13.

Logistics

Technical concerns: Integrating three layers, ERP, WMS (warehouse management system), and TMS (transportation management system), along with real-time shipment tracking.

Key standards: EDI (ANSI X12, EDIFACT) is the de facto standard for data exchange in international logistics15.

Typical failure: Trade publications commonly point out that most system integration failures aren’t caused by API outages but by inconsistent master data models, for example, an ERP using internal codes, a WMS using GS1 barcodes, and a TMS using carrier-specific numbering. There are also estimates that siloed supply chain systems represent a major cost, though none of these figures could be traced back to primary data, so treat them as directional rather than precise16.

Game Development

Technical concerns: A client-server architecture where the server is authoritative, client-side prediction and server reconciliation hide perceived latency, and lag compensation keeps things fair across players with different connection quality17.

Typical failure: Skipping the server-authoritative principle leaves the game vulnerable to modified packets and cheat proxies18. “Never trust the client” is the core principle behind anti-cheat design.

SaaS / B2B Systems

Technical concerns: Multi-tenancy design (some hybrid of row-level security, schema separation, and database separation), plus per-tenant observability, billing, and SLA design19.

Typical failure: Weak security boundaries that lead to cross-tenant data leaks. Insufficient handling of the “noisy neighbor” problem, where one tenant’s overload degrades performance for others1920.

Advertising / Adtech

Technical concerns: Real-time bidding (RTB), and the shift toward privacy-preserving technologies as third-party cookies are phased out.

Key standards: OpenRTB (the primary specification, maintained by IAB Technology Labs, for automated transactions between SSPs and DSPs)21.

Typical failure: A design that doesn’t plan for the deprecation of third-party cookies risks having existing audience-targeting features stop working overnight22.

Education / Edtech

Technical concerns: Knowing when to use each of three standards: SCORM (legacy content packaging for LMS platforms), xAPI (a standard for recording learning experiences, including mobile and VR), and LTI 1.3 (grade passback)23.

Key standards: In the US, student data falls under FERPA and COPPA, which require an architecture that cryptographically isolates personal information24.

Typical failure: Reports point to cases where designs that share learning data with third parties (analytics tools, ad SDKs) were implemented without meeting FERPA/COPPA consent requirements, with the compliance violation only surfacing later. Without a review process that checks regulatory requirements alongside functional ones, this kind of gap in a design handling personal data is easy to miss.

IoT / Embedded Systems

Technical concerns: Low-power communication over lightweight protocols like MQTT and CoAP, securely delivering over-the-air (OTA) updates, and reducing latency through edge computing.

Typical failure: Firmware tampering via man-in-the-middle attacks during OTA updates. There’s peer-reviewed research on secure, MQTT-based approaches to OTA updates25. A lack of interoperability across a wide range of device lifespans and heterogeneous protocols is another common pitfall.

CS Knowledge and Domain Knowledge Aren’t Learned the Same Way

Knowledge that transfers across industries, like CS, is what cognitive science calls domain-general knowledge. Knowledge that only applies within a specific industry or company is domain-specific knowledge. The two checklists above map onto these two categories, and the way you learn each one is fundamentally different.

CS fundamentals (domain-general knowledge) are systematized by official curricula like CS2023, so they can be learned in a structured way through textbooks, lectures, and peer-reviewed papers. Cognitively, this is the stage where knowledge accumulates as schemas: chunks of knowledge held in long-term memory that serve as a foundation for absorbing new information efficiently26.

Domain knowledge (domain-specific knowledge) works differently. There’s no unified curriculum equivalent to CS2023, and as the checklist above shows, information is scattered across industry standards documents, company engineering blogs, and trade reports. And just as with CS knowledge, there’s a gap between “knowing what HL7 FHIR is” and “understanding why FHIR support in the field so often ends up only partially compliant.” That gap closes only through the experience of actually building systems in that industry, running into its regulatory and legacy-system constraints, and observing why things go wrong. What management scholar Dorothy Leonard-Barton called “deep smarts,” the contextual insight built up through years of practical experience, applies with particular force to domain knowledge27.

That said, deep smarts don’t grow automatically just because you rack up experience. Psychologists Kahneman and Klein, arguing from opposite sides of a long debate, agreed that intuition is only reliable in “an environment of sufficient regularity” combined with “an opportunity to learn these regularities through prolonged practice,” meaning fast, clear feedback28. Within domain knowledge, some areas meet that condition and some don’t. A metric like e-commerce cart abandonment gets feedback from A/B tests within days or weeks, so experience there steadily turns into good judgment. Credit scoring in finance or interoperability design in healthcare systems, on the other hand, can take years before problems even surface. Having been in an industry a long time doesn’t automatically mean your judgment about that industry is good.

flowchart TB
    A["CS Fundamentals<br>Domain-general knowledge"] --> B["Accumulates as schemas<br>learnable through formal curricula"]
    C["Domain Knowledge<br>Domain-specific knowledge"] --> D["Accumulates through experience<br>no unified curriculum exists"]
    B --> E["CS as the foundation"]
    D --> F["Domain expertise as<br>deep smarts<br>requires fast feedback"]
    E --> G["Combined, they become<br>real-world judgment"]
    F --> G

Putting This to Use: Where to Place Your Bets

CS fundamentals are worth learning as common ground no matter which industry you end up in. Deepening all 17 CS2023 areas at once isn’t realistic, but algorithms and complexity, OS and networking basics, data management, and security are the four areas that come up most often across industries.

Domain knowledge is a different story. You can’t go deep on all eleven domains at once. The practical approach is to pick one or two industries you’re already working in, or want to work in, and start by actually reading that industry’s primary standards documents (PCI DSS, HL7 FHIR, the OpenRTB spec, and others cited in this article). Trade blogs and industry reports are useful as a rough map of where problems tend to show up, but the habit of going to primary sources is itself the training that builds judgment in that industry.

Limitations of This Article

A few caveats are worth stating plainly.

First, the eleven domains aren’t exhaustive. Real estate, travel, insurance, manufacturing, and many other industries aren’t covered here. This is a set of representative examples, and if your industry isn’t listed, the same framework (technical concerns, standards/regulations, typical failures) should work fine for organizing it yourself.

Second, within the domain knowledge section, the official standards documents (PCI DSS, HL7 FHIR, the OpenRTB spec, the HIPAA Security Rule, and so on) are highly reliable, but some of the failure patterns and statistics rely on trade media and company blogs, and some of those are hard to trace back to primary data. Read each item with that source quality in mind.

Third, technical standards change. DRM, codecs, and privacy regulations are areas that move especially fast, so treat this article as a snapshot as of when it was written.

Summary

  • CS fundamentals are organized into 17 areas by the ACM/IEEE/AAAI CS2023 curriculum. Algorithms, OS/networking, data management, and security in particular are important foundations across every industry1
  • The CAP theorem, the OWASP Top 10, and the link between complexity understanding and performance bugs are representative examples of how CS fundamentals pay off in practice234
  • Domain knowledge (domain-specific knowledge) varies enormously by industry, and no unified curriculum exists. This article organized the representative technical concerns, standards/regulations, and failure patterns for eleven domains: e-commerce, video streaming, audio streaming, finance, healthcare, logistics, gaming, SaaS, adtech, edtech, and IoT
  • CS knowledge (domain-general knowledge) can be learned systematically as schemas, but domain knowledge (domain-specific knowledge) can only be built as deep smarts, through experience. The learning process itself is different2627
  • Even acquiring domain knowledge isn’t automatic just from accumulating experience. In areas with fast, clear feedback, experience turns into judgment; in areas with slow feedback, experience mostly just builds confidence28
  • The first practical step is to lock down the four CS fundamentals as a base, narrow your focus to one or two industries, and actually read that industry’s primary sources (official standards and regulatory documents)

More on this topic:

References

References below are numbered to match the citation markers in the text.

Additional References (Not Cited in the Text)

  1. Computer Science Curricula 2023 (CS2023) - Joint task force of ACM, IEEE Computer Society, and AAAI (2024 final edition). The official curriculum standard defining the 17 core knowledge areas of a CS education. Reliability: High (official curriculum standard) ↩︎ ↩︎2 ↩︎3 ↩︎4

  2. Brewer’s Conjecture and the Feasibility of Consistent, Available, Partition-Tolerant Web Services - Gilbert, S. & Lynch, N., ACM SIGACT News, 33, 51-59 (2002). The paper that formally proved the CAP theorem under an asynchronous network model. Reliability: High (peer-reviewed, foundational text in distributed systems theory) ↩︎ ↩︎2 ↩︎3

  3. OWASP Top 10:2025 - OWASP Foundation (2025). A ranking of the most significant web application security risks, based on analysis of over 175,000 CVEs and 589 CWEs. Reliability: High (industry standard, continuously updated by a nonprofit organization) ↩︎ ↩︎2 ↩︎3

  4. Performance issues and optimizations in JavaScript: an empirical study - ICSE 2016 (38th International Conference on Software Engineering). Analyzed 98 fixed performance issues across 16 projects and identified inefficient API usage as the most common root cause. Reliability: High (peer-reviewed, top-tier conference) ↩︎ ↩︎2 ↩︎3

  5. Navigate, Understand, Communicate: How Developers Locate Performance Bugs - arXiv:1706.10118 (2017). Argues that locating performance bugs requires both high-level understanding of complexity and low-level understanding of implementation. Reliability: Medium-high (academic research, preprint) ↩︎

  6. Payment Card Industry Data Security Standard - PCI Security Standards Council. Official documentation for the payment card data security standard. Reliability: High ↩︎

  7. 50 Cart Abandonment Rate Statistics - Baymard Institute. A meta-analysis combining 50 studies. Puts the global average cart abandonment rate at 70.22% and estimates $260 billion in annual lost sales across US and EU markets; the most common reason for abandonment (about 39%) is costs that turn out higher than expected. Reliability: High (well-established industry research firm) ↩︎

  8. YouTube Tech Stack Architecture - VDOcipher. Explains the HLS/DASH delivery protocols and the Widevine/FairPlay/PlayReady DRM systems. Reliability: Medium (vendor engineering blog) ↩︎

  9. Per-Title Encode Optimization - Netflix Technology Blog. Describes bitrate optimization tuned to each video’s complexity. Reliability: High (official Netflix engineering blog, primary source) ↩︎

  10. RFC 6716 (Opus Audio Codec) - IETF. The standard for a royalty-free, low-latency audio codec. Reliability: High (IETF standard) ↩︎

  11. ISO 8583:2023 Financial services — Messages for financial transaction card originated messages - ISO. The official specification for the international standard used in most ATM and point-of-sale financial transaction messaging. Reliability: High (primary source, standards body) ↩︎

  12. Discover Data Engineering Challenges in Handling Large Volumes of Fraud Detection Data - Merchant Risk Council (2024). Covers class imbalance and data quality challenges in fraud detection. Reliability: Medium ↩︎

  13. HL7 FHIR (Fast Healthcare Interoperability Resources) - HL7 International. The official specification for the RESTful API standard for healthcare data exchange. Multiple studies and articles point to implementations that stop at partial compliance. Reliability: High (the standard itself is a primary source) ↩︎ ↩︎2

  14. Security Rule Technical Safeguards - U.S. Department of Health and Human Services. The technical safeguards of the HIPAA Security Rule (45 CFR §164.312), defining five categories: access control, audit controls, integrity controls, person/entity authentication, and transmission security. Reliability: High (primary source, government agency) ↩︎

  15. ASC X12 and UN/EDIFACT - Accredited Standards Committee X12 / UNECE. Official sites of the standards bodies for North American (X12) and international (EDIFACT) electronic data interchange. Reliability: High (primary source, standards bodies) ↩︎

  16. A collection of trade media articles on logistics system integration. Claims that master data inconsistency is a leading cause of integration failure, and estimates of supply-chain siloing costs, could not be traced back to primary data. Treat as directional context only. Reliability: Unverified (via trade media, primary data not confirmed) ↩︎

  17. Client-Server Game Architecture / Client-Side Prediction and Server Reconciliation / Lag Compensation - Gabriel Gambetta. A practical explanation of client-side prediction, server reconciliation, and lag compensation in multiplayer games. Reliability: Medium-high (widely cited technical explainer in the industry) ↩︎

  18. Latency Compensating Methods in Client/Server In-game Protocol Design - Valve Developer Community. Covers server-authoritative design and anti-cheat measures. Reliability: High (technical documentation grounded in a real game engine implementation) ↩︎

  19. SaaS Architecture Fundamentals — Re-defining multi-tenancy - Official AWS whitepaper. Multi-tenancy design patterns. Reliability: High ↩︎ ↩︎2

  20. Let’s Architect! Building multi-tenant SaaS systems - AWS Architecture Blog. Design challenges in multi-tenant SaaS, including the noisy neighbor problem. Reliability: High (official) ↩︎

  21. OpenRTB API Specification - IAB Technology Laboratory. The primary specification for real-time bidding. Reliability: High ↩︎

  22. IAB Tech Lab Updates OpenRTB to Support Privacy Sandbox’s Protected Audience API - IAB Canada. Coverage of the industry’s response to the deprecation of third-party cookies. Reliability: Medium-high ↩︎

  23. All About the LMS: Standards and Specifications - EdTechBooks. Explains how SCORM, xAPI, and LTI are used and where they differ. Reliability: Medium-high (academic edtech resource) ↩︎

  24. Protecting Student Privacy - Official U.S. Department of Education resource. Primary source on FERPA. COPPA, the separate law on children’s online privacy, falls under the FTC. Reliability: High ↩︎

  25. MUP: Simplifying Secure Over-The-Air Update with MQTT for Constrained IoT Devices - Paper hosted on PMC. A secure, MQTT-based approach to OTA updates. Reliability: High (presumed peer-reviewed) ↩︎

  26. A Complete Guide to Schema Theory and its Role in Education - Education Corner. An overview of schema theory, on how existing knowledge accelerates new learning. Reliability: Medium ↩︎ ↩︎2

  27. Deep Smarts: How to Cultivate and Transfer Enduring Business Wisdom - Dorothy Leonard-Barton & Walter C. Swap, Harvard Business Review Press (2005). ISBN-13: 978-1-59139-528-7. Introduces the concept of “deep smarts,” experience-based practical wisdom. Reliability: High (well-established business book in management studies) ↩︎ ↩︎2

  28. Conditions for Intuitive Expertise: A Failure to Disagree - Kahneman, D., & Klein, G. (2009). American Psychologist, 64(6), 515-526. Two researchers from opposing camps agree on the conditions under which intuition can be trusted: environmental regularity plus fast feedback. Reliability: High (peer-reviewed, a joint statement from both sides of a long debate) ↩︎ ↩︎2

AI・Technology
AI Computer Science Domain Knowledge Career Learning Strategy
This post is licensed under CC BY 4.0 by the author.