The Certified Information Systems Security Professional (CISSP)® from ISC2 is one of the most respected cybersecurity credentials, and its exam has a reputation to match. It covers eight broad domains, from risk management and cryptography to network design and secure software, so it’s normal to wonder where to even start. The good news is that ISC2 publishes exactly what it tests, and a study plan built on that examination outline gives you a clear route to passing on your first try.

In this guide, we’ll walk you through the exam format, all eight domains and their weights, the official resources worth using, and the questions candidates ask most often.

What Is the ISC2 CISSP Exam?

The CISSP is an advanced, vendor-neutral certification for security practitioners, managers, and leaders. ISC2 describes it as proof that you can design, implement, and manage a top-tier cybersecurity program. The credential is accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024 and approved under U.S. Department of Defense Manual (DoDM) 8140.03.

The exam is famously described as “a mile wide and an inch deep.” You won’t be asked to configure a firewall, but you will be asked which control, policy, or decision best fits a business scenario. Many questions reflect a security manager’s perspective, so the best answer usually protects people first, then manages risk in line with business goals.

What Is the ISC2 CISSP Exam Format?

Here is the exam at a glance, based on the ISC2 CISSP® Guide and the ISC2 FAQ:

  • Format: Computerized Adaptive Testing (CAT). The exam adapts to your performance.
  • Questions: 100 to 150 items.
  • Time: Up to 3 hours.
  • Question types: Multiple-choice and advanced, innovative items, such as drag-and-drop and hotspot.
  • Passing score: 700 out of 1,000 (a scaled score).
  • Languages: English, Chinese, German, Japanese, and Spanish.
  • Delivery: In person at ISC2-authorized Pearson VUE test centers, year-round. ISC2 does not offer online proctoring.
  • Results: You usually get a provisional result before you leave the test center. Official results can take up to 72 business hours and will be emailed by ISC2.
  • Fee: U.S. $749 in the Americas, per the ISC2 exam pricing page. Rescheduling costs $50 and canceling costs $100.

One CAT rule surprises many candidates: you must answer items in order, with no skipping or returning later.

What Content Outline Does the CISSP Exam Use?

The current exam is based on the ISC2 CISSP® Certification Exam Outline, effective April 15, 2024. It organizes the Common Body of Knowledge (CBK) into eight domains.

Here are the average weights, with approximate item counts assuming a 150-item exam (a shorter CAT exam scales down proportionally):

  • Domain 1, Security and Risk Management: 16% (about 24 items)
  • Domain 2, Asset Security: 10% (about 15 items)
  • Domain 3, Security Architecture and Engineering: 13% (about 20 items)
  • Domain 4, Communication and Network Security: 13% (about 20 items)
  • Domain 5, Identity and Access Management (IAM): 13% (about 20 items)
  • Domain 6, Security Assessment and Testing: 12% (about 18 items)
  • Domain 7, Security Operations: 13% (about 20 items)
  • Domain 8, Software Development Security: 10% (about 15 items)

Domain 1: Security and Risk Management (16%)

The largest domain sets the managerial mindset for the whole exam.

  • The ISC2 Code of Ethics, the CIA triad plus authenticity and nonrepudiation, and security governance.
  • Legal and regulatory issues: due care and due diligence, intellectual property, transborder data flow, and privacy laws such as GDPR, CCPA, PIPL, and POPIA.
  • Policies, standards, procedures, and guidelines; business continuity requirements; and personnel security.
  • Risk management (threats, vulnerabilities, risk response, control types), threat modeling, supply chain risk, and security awareness training.

Study tip: Know the difference between due care (doing the right thing) and due diligence (verifying it’s being done). It shows up in many scenarios.

Domain 2: Asset Security (10%)

This domain is about knowing what you have and protecting it throughout its life.

  • Information and asset classification, ownership, and inventory.
  • Data roles (owner, controller, custodian, processor, subject) and data states (at rest, in transit, in use).
  • The data lifecycle, retention, data remanence, and secure destruction.
  • Scoping and tailoring baselines and protection methods such as DRM, DLP, and CASB.

What questions look like: A scenario asks who is ultimately accountable for classifying a data set. The answer is the data owner, not the custodian who manages it day to day.

Domain 3: Security Architecture and Engineering (13%)

This is the most technical domain and the one many candidates fear most.

  • Secure design principles such as least privilege, defense in depth, secure defaults, fail securely, zero trust, privacy by design, and secure access service edge (SASE).
  • Security models such as Bell-LaPadula and Biba, and system capabilities like memory protection and the Trusted Platform Module (TPM).
  • Vulnerabilities in cloud, ICS, IoT, microservices, containers, embedded, and virtualized systems.
  • Cryptography (symmetric, asymmetric, elliptic curve, quantum), PKI, key management, digital signatures, and cryptanalytic attacks.
  • Site and facility design, including fire suppression, power, and HVAC.

Study tip: Practice which key does what. Encrypting for confidentiality uses the recipient’s public key; signing uses the sender’s private key.

Domain 4: Communication and Network Security (13%)

This domain covers securing networks and communication channels.

  • The OSI and TCP/IP models, IPv4 and IPv6, and segmentation (VLANs, micro-segmentation, air gaps).
  • Wireless, cellular, CDNs, software-defined networking (SDN), SD-WAN, and virtual private clouds.
  • Network access control, endpoint security, and monitoring.
  • Secure protocols (IPsec, SSH, TLS), converged protocols such as iSCSI and VoIP, and secure remote access.

Study tip: Map common protocols and attacks to OSI layers.

Domain 5: Identity and Access Management (IAM) (13%)

IAM covers who can access what and how they prove it.

  • Physical and logical access control and identification and authentication strategy.
  • Federated identity, single sign-on (SSO), multifactor and passwordless authentication, and just-in-time access.
  • Authorization models: RBAC, MAC, DAC, ABAC, rule-based, and risk-based access control.
  • The provisioning lifecycle: onboarding, transfers, offboarding, access reviews, and service accounts.

What questions look like: An employee changes departments and keeps old permissions. The issue is privilege creep, and the fix is a deprovisioning step in the transfer process plus periodic access reviews.

Domain 6: Security Assessment and Testing (12%)

This domain asks how you prove controls work.

  • Designing assessment, testing, and audit strategies (internal, external, and third-party).
  • Vulnerability assessments, penetration testing (red, blue, and purple teams), log reviews, synthetic transactions, and breach attack simulations.
  • Key performance and risk indicators, reporting, remediation, and ethical disclosure.

Study tip: Get written authorization before any penetration test. On the exam, testing without approval is almost never the right answer.

Domain 7: Security Operations (13%)

This domain has the most objectives (15) and covers day-to-day security work.

  • Investigations, evidence handling, and digital forensics.
  • Logging and monitoring: SIEM, IDPS, threat intelligence, and user and entity behavior analytics (UEBA).
  • Configuration, patching, vulnerability management, and change management.
  • Incident management, recovery strategies, DR testing (read-through to full interruption), and BC exercises.

What questions look like: Expect to order incident response steps correctly and to pick the right recovery site (hot, warm, or cold) for a stated recovery time.

Domain 8: Software Development Security (10%)

This domain covers building and buying software securely.

  • Security in the SDLC across Agile, Waterfall, DevOps, DevSecOps, and the Scaled Agile Framework, plus maturity models such as CMM and SAMM.
  • Development ecosystem controls: CI/CD pipelines, code repositories, libraries, and software configuration management.
  • Testing methods (SAST, DAST, IAST, software composition analysis) and API security.
  • The security impact of acquired software, including COTS, open source, and cloud services.

Study tip: You don’t need to write code, but you should know common weaknesses like SQL injection and buffer overflows and which control stops each.

How Should You Use the CISSP Outline to Build a Study Plan?

The weights are fairly even, so no domain is safe to skip.

  1. Take a mixed baseline. Answer questions from all eight domains before reviewing.
  2. Rate every objective. Mark each numbered objective (1.1 through 8.5) as strong, developing, or weak.
  3. Prioritize by weight and weakness. A weak score in Security and Risk Management (16%) deserves more time than the same score in Asset Security (10%).
  4. Map every miss to an objective. Note which objective it tests and why the right answer was better.
  5. Train the manager’s mindset. Finish with mixed, timed sets where you answer in order without going back, just like the CAT exam.

What Official Resources Should You Use?

Commonly used CISSP study textbooks:

  • (ISC)² Certified Information Systems Security Professional (CISSP) Official Study Guide, 10th Edition (ISBN 978-1394254699)
  • The Official (ISC)2 CISSP CBK Reference, 6th Edition (ISBN 978-1119789994)
  • CISSP All-in-One Exam Guide, 9th Edition (ISBN 978-1260467376)

Frequently Asked Questions About the ISC2 CISSP Exam

What is the passing score for the CISSP?
You need a scaled score of 700 out of 1,000. Because the exam is adaptive, the number of questions you see doesn’t tell you whether you passed or failed. Candidates who fail receive a domain-by-domain performance breakdown.

Did the CISSP exam outline change recently?
The current outline took effect April 15, 2024. It kept the same eight domains, nudged Security and Risk Management up to 16% and Software Development Security down to 10%, and added newer topics such as SASE, quantum cryptography, and AI in security awareness content.

Can I take the CISSP exam before I have five years of experience?
Yes. If you pass without the required experience, you become an Associate of ISC2 and have six years to earn it.

Can I take the CISSP exam online?
No. ISC2 tested online proctoring but concluded it didn’t meet its exam security standards, so it offers the CISSP only at Pearson VUE test centers.

What happens if I fail the CISSP?
You can retest 30 days after your first attempt, with longer waits after later attempts. Each attempt requires a new exam fee unless you purchased Peace of Mind Protection. See the ISC2 FAQ for current policies.

How do I maintain the CISSP once I earn it?
You earn 120 continuing professional education (CPE) credits every three years and pay a U.S. $135 annual maintenance fee.

Start Preparing for the ISC2 CISSP Exam With Pocket Prep

Pocket Prep’s ISC2 CISSP practice questions include 1,300 questions across all eight domains, each with a detailed explanation, plus three full-length mock exams to rehearse for test day. Start with a mixed Quick 10 to set your baseline, then let the Weakest Subject quiz point you to where your study time matters most. With consistent studying, you can walk into exam day with confidence.