Use the eight-domain map to identify gaps, learn the adaptive exam rules before test day and practise applying security concepts to a stated task. This guide covers the current outline, the experience and application routes, and an original access-control example with a worked answer.
What the exam covers and which outline applies
The CISSP covers eight domains of security knowledge. Start with the official outline, then use its objectives to build your preparation plan.
ISC2 describes the CISSP as validating deep technical and managerial knowledge for professionals who design, engineer, and manage an organization's security posture. As checked on 14 September 2026, the current outline is effective 15 April 2024. Match your study resources to that outline.
ISC2's current page integrates AI security topics across the eight existing domains. These include model and dataset classification, securing AI workloads and AI-assisted testing; they do not form a ninth domain.
Official sources: Review the ISC2 CISSP Certification Exam Outline — Effective date April 15, 2024; domain weights; CISSP exam information
The eight domains and how to study each
Each domain pairs a body of named concepts with verbs like understand, apply, design, and assess. Study each row by doing its task, not by rereading summaries.
The topic summaries follow the official outline. The study tasks are optional ways to practise its objectives; use the full outline and supporting references for detailed coverage.
| Domain | Weight | Outline focus | Study task |
|---|---|---|---|
| Security and Risk Management | 16% | Ethics, governance, legal and privacy issues, risk concepts, business continuity requirements, personnel security, supply chain risk, awareness programs | Connect a stated business objective, risk and control; explain what evidence a decision needs. |
| Asset Security | 10% | Classification, handling requirements, ownership and inventory, data lifecycle, retention, data-state controls | Match protections to data states: in use, in transit, at rest |
| Security Architecture and Engineering | 13% | Secure design principles, security models, cryptography, system vulnerabilities, site and facility design, system lifecycle | Explain the purpose and assumptions of a secure design principle in a given scenario. |
| Communication and Network Security | 13% | OSI and TCP/IP models, secure protocols, segmentation, wireless and cellular, SDN, secure communication channels | Explain what each segmentation type isolates and when the outline's secure protocols apply |
| Identity and Access Management | 13% | Authentication strategy, federation, access control models, provisioning lifecycle, authentication systems | Distinguish authentication from authorization and least privilege using the exercise below |
| Security Assessment and Testing | 12% | Assessment design, control testing, security process data, reporting, audits | Map each test type to the evidence it produces and who can perform it |
| Security Operations | 13% | Investigations, logging and monitoring, configuration management, incident management, recovery strategies, physical security | Explain what detection, response, recovery and lessons learned each contribute in a given incident scenario. |
| Software Development Security | 10% | SDLC security, development ecosystem controls, acquired software, secure coding guidelines | Trace security controls through each SDLC phase, including testing types in CI/CD pipelines |
Official sources: Review the ISC2 CISSP Certification Exam Outline — Effective date April 15, 2024; domain weights; CISSP exam information
Eligibility, waivers, and the Associate of ISC2 route
Full certification requires five years of cumulative full-time experience in two or more of the eight domains. A relevant degree or an approved credential can waive one year, and only one year. You can pass the exam first and become an Associate of ISC2 while you gain experience.
Document experience across at least two domains. ISC2 counts full-time experience at a minimum of 35 hours per week for four weeks to accrue one month. Part-time work of 20–34 hours per week and paid or unpaid internships can also count under its documented conditions.
A post-secondary degree in computer science, IT, or a related field, or one credential from ISC2's approved list, can each satisfy up to one year. You cannot combine a degree and a credential to waive two years. ISC2 revised the waiver list effective April 1, 2026, so check the current list rather than relying on older third-party summaries.
If you pass without the required experience, you can become an Associate of ISC2 and have up to six years to earn the five years needed. This is not CISSP certification. Complete the initial certification application process within nine months of your exam date; you can submit only after receiving the passing notification.
Full certification requires experience verification, acceptance of the Code of Ethics and payment of the first annual maintenance fee after application approval. An ISC2-certified professional in good standing can endorse your experience. If you do not know one, ISC2 can endorse you with proof of employment. Keep accurate records for any application audit.
If you already hold an ISC2 certification, you do not pay an additional annual maintenance fee for the new certification.
Official sources: Experience Needed for the ISC2 CISSP Certification — Experience requirements, waivers, part-time and internship rules; ISC2 CISSP Experience Waiver Updates Requirements — April 1, 2026 waiver list revision; single-waiver rule; Become an Associate of ISC2 While You Gain Experience — Associate designation duration and upgrade process; Endorsement | Online Endorsement Application | ISC2 — Nine-month application window, endorser, audit
Exam format: how computerized adaptive testing works
The exam allows up to three hours for 100–150 items. You cannot revisit a finalized answer, so practise pacing for the maximum length, including breaks.
Computerized adaptive testing (CAT) selects items using an updated estimate of your ability. Perceived difficulty and the stopping point do not reliably reveal the result: stopping at 100 can mean pass or fail, and reaching 150 is not automatic failure.
After the 100-item minimum, the exam may end when the ability estimate lies above or below the passing standard with 95% statistical confidence. If that rule has not ended the exam, the maximum-length and time-out rules compare the final ability estimate with the standard. Running out of time before completing 75 scored plus 25 pretest items is an automatic fail.
The 700/1000 passing standard is not a raw 70% target. You receive a pass/fail result without a numeric score; failing candidates receive domain feedback. Breaks count toward the three hours, and finalized answers cannot be changed.
Retakes require 30 test-free days after the first attempt, 60 after the second, and 90 after the third and subsequent attempts. You may attempt the exam at most four times within a 12-month period.
- 100 to 150 multiple-choice and advanced items; 25 of the minimum 100 are unscored pretest items you cannot identify.
- Available in Chinese, English, German, Japanese, and Spanish; Chinese-language exams run only in March, June, September, and December appointment windows.
- Delivered at ISC2-authorized Pearson Professional Centers and PVTC Select test centers only; there is no at-home option.
- Pace yourself for the full 150 items within three hours rather than planning to finish at 100.
Official sources: Review the ISC2 CISSP Certification Exam Outline — Effective date April 15, 2024; domain weights; CISSP exam information; Computerized Adaptive Testing (ISC2) — CAT FAQ: item counts, scoring rules, retakes, item review
Authentication, authorization, and least privilege
Authentication verifies a claimed identity. Authorization determines permitted access, and least privilege limits it to what the assigned task needs.
NIST's glossary defines authentication as verifying the identity of a user, process, or device, often as a prerequisite to allowing access. In the access-control sense, authorization is the decision to permit or deny a subject access to objects such as data, applications, or services. Least privilege restricts access privileges to the minimum necessary to accomplish assigned tasks.
A successful sign-in does not establish permission for every requested action. Compare the resource, action and duration in the authorization with what the person needs to do. The original example below supplies the policy and approval explicitly.
Practice exercise
An analyst has just authenticated successfully. Under this exercise's stated policy, the reporting dataset's owner has approved the analyst to read one named dataset for one week, and an administrator implements approved access. Which access should the analyst receive? A) Read access to that one dataset, ending after the approved week B) Read access to every company dataset, with no end date C) Edit and administrative rights to the reporting dataset, indefinitely
Show answer
A
Authentication verified the analyst's identity, but only the authorization decision defines what that identity may do. Least privilege limits access to the minimum needed for the assigned task, and the stated approval covers one dataset for one week. Option B exceeds the approved scope, and option C exceeds both the approved actions and duration, so neither is justified by the premises. Note that the owner-approval step and the one-week period are premises of this exercise for practice, not rules quoted from an ISC2 document.
Official sources: authentication - Glossary | CSRC — NIST definition of authentication; authorization - Glossary | CSRC — NIST access-control definition of authorization; least privilege - Glossary | CSRC — NIST definition of least privilege
Reading scenario questions without keyword shortcuts
Answer the question the stem actually asks, in its stated context. Neither a policy-flavored answer nor a technically sophisticated one is automatically correct, because ISC2 explicitly tests both managerial and technical knowledge.
The outline itself says the CISSP validates deep technical and managerial knowledge, and its objectives range from governance and risk to cryptography and network protocols. So no keyword, whether 'policy' or 'firewall', decides an answer by its presence.
A workable habit: identify who is acting, what decision is requested, and which constraints or priorities the stem states. Then apply the relevant domain knowledge to those facts and compare the options against them. This is preparation advice for practicing, not a claimed exam scoring rule.
When you review a practice set, spend your time on wrong answers. Work out why each incorrect option fails against the stem's stated facts, and map the question back to its outline topic. That review, done with legitimately obtained questions, builds the judgment the domains describe.
Official sources: Review the ISC2 CISSP Certification Exam Outline — Effective date April 15, 2024; domain weights; CISSP exam information
A study sequence and final checklist
Build a plan around your gaps and the full outline. These steps are study advice, not a readiness score or a promise of passing.
Use the domain weights alongside your own gaps. For each objective, explain a concept or decision, attempt legitimate practice questions and review why the alternatives fit or fail the stated facts. Revisit the relevant source when you cannot explain an answer.
Finish with timed mixed practice that allows for up to 150 items in three hours. Use practice results to locate gaps; they do not convert directly into CAT scores or establish a guaranteed readiness threshold.
- Cover all eight domains, including weaker topics with smaller weights.
- Keep an error log of misunderstood concepts, missed constraints and unsupported assumptions.
- Explain authentication, authorization and least privilege using a new example.
- Confirm your experience or Associate route, current waiver list, test center and application timeline.
Official sources: Review the ISC2 CISSP Certification Exam Outline — Effective date April 15, 2024; domain weights; CISSP exam information; Computerized Adaptive Testing (ISC2) — CAT FAQ: item counts, scoring rules, retakes, item review
Budget for registration and maintaining the credential
Check regional registration fees and taxes before booking. After certification, CISSP holders meet CPE requirements and pay an annual maintenance fee.
ISC2's pricing page lists regional CISSP fees, including U.S. $749 in several regions, EUR 719.04 for EMEA and GBP 606.69 for the United Kingdom. Check the row and taxes applicable to your exam location, plus current rescheduling and cancellation terms, before paying.
CISSP holders earn 120 continuing professional education (CPE) credits over each three-year cycle, including at least 90 from Group A; the remaining 30 can be Group A or B. The annual maintenance fee is U.S. $135 and covers multiple ISC2 certifications. Pay the first fee after application approval and before certification is granted.
Official sources: How Much Do ISC2 Certification Exams Cost? — Regional CISSP pricing; rescheduling and cancellation fees; ISC2 Member Policies — CISSP CPE requirements and Annual Maintenance Fee; Endorsement | Online Endorsement Application | ISC2 — Nine-month application window, endorser, audit
Official sources
Exam facts verified against ISC2 sources:
- Review the ISC2 CISSP Certification Exam Outline
- Experience Needed for the ISC2 CISSP Certification
- Computerized Adaptive Testing (ISC2)
- Endorsement | Online Endorsement Application | ISC2
- How Much Do ISC2 Certification Exams Cost?
- ISC2 Member Policies
- Become an Associate of ISC2 While You Gain Experience
- ISC2 CISSP Experience Waiver Updates Requirements
- least privilege - Glossary | CSRC
- authentication - Glossary | CSRC
- authorization - Glossary | CSRC