Prep
How to use this CISSP study guide
This CISSP study guide is built around one document: the official ISC2 CISSP exam outline. Every question on the exam maps to one of its eight domains, and ISC2 publishes how much each domain weighs. A good plan spends time in proportion to those weights and then adjusts for your own gaps.
The plan below assumes you already work in security and study part-time alongside a job. If your experience covers only two or three domains, as many candidates' does, expect to spend extra time on the rest. Before you start, check that you meet the experience rules on our CISSP requirements page, or plan to take the Associate of ISC2 route.
Your study materials should be: the official exam outline, one comprehensive official study guide, a set of practice questions large enough to take several full-length tests, and your own notes. You do not need five different books.
| Week | Focus | Domain weight | End-of-week check |
|---|---|---|---|
| 0 | Read the exam outline, take a baseline practice test, set an exam date | - | Baseline score per domain |
| 1-2 | Domain 1: Security and Risk Management (governance, risk analysis, law, ethics, BCP) | 16% | Domain quiz, risk calculations |
| 3 | Domain 2: Asset Security (classification, ownership, data lifecycle, retention) | 10% | Domain quiz |
| 4-5 | Domain 3: Security Architecture and Engineering (models, cryptography, physical security) | 13% | Domain quiz, crypto review |
| 6-7 | Domain 4: Communication and Network Security (network architecture, secure channels) | 13% | Domain quiz |
| 8-9 | Domain 5: Identity and Access Management (IAM) (authentication, authorization, provisioning) | 13% | Domain quiz |
| 10 | Domain 6: Security Assessment and Testing (audits, vulnerability scans, pen tests) | 12% | Domain quiz |
| 11-12 | Domain 7: Security Operations (investigations, incident response, recovery) | 13% | Domain quiz |
| 13 | Domain 8: Software Development Security (SDLC, secure coding, software risk) | 10% | Domain quiz |
| 14 | Full-length timed practice test 1; review every wrong answer | All | Score by domain |
| 15 | Targeted review of the two weakest domains; practice test 2 | All | Score by domain |
| 16 | Light review, management-mindset questions, practice test 3, rest before exam day | All | Consistent result across domains |
The eight domains and their weights
The current exam follows the outline effective April 15, 2024. These are ISC2's average weights:
| Domain | Weight |
|---|---|
| 1. Security and Risk Management | 16% |
| 2. Asset Security | 10% |
| 3. Security Architecture and Engineering | 13% |
| 4. Communication and Network Security | 13% |
| 5. Identity and Access Management (IAM) | 13% |
| 6. Security Assessment and Testing | 12% |
| 7. Security Operations | 13% |
| 8. Software Development Security | 10% |
The weights are close together. No domain is small enough to skip, and the biggest, Security and Risk Management, sets the management mindset the whole exam expects.
The 16-week CISSP study plan
The table at the top of this page is the full plan. It assumes roughly 8 to 10 hours a week. The domain weeks are roughly proportional to the weights: two weeks for the heavier domains, one week for the lighter ones. Here is how to use each week:
- Read the outline objectives for the domain first, so you know what to look for.
- Study the matching chapters of your study guide and write short notes in your own words.
- Test at the end of the week with 50 to 100 questions from that domain. Review every answer, right or wrong, and write down why each wrong option is wrong.
- Revisit earlier domains with a short mixed quiz each weekend, so the first weeks do not fade by week 16.
If a domain is your daily job, compress it to a few days of review and move the saved time to your weakest domain. If you score badly on a domain quiz, add a catch-up week before the final phase rather than pushing on.
Weeks 14 to 16 are for full-length practice. Take timed sets of 100 to 150 questions in three hours to build stamina for the adaptive format. Our free CISSP practice test is a good first check of where you stand before week 1, and again before you book.
Study tips for each domain
Each domain has its own trap. These are the points we suggest paying most attention to:
- Security and Risk Management: learn quantitative risk analysis (single loss expectancy, annualized rate of occurrence, annualized loss expectancy) until you can calculate it quickly, and know who is accountable for what. Senior management owns risk decisions.
- Asset Security: know the data roles (owner, custodian, user) and the data lifecycle, including secure destruction methods that suit each media type.
- Security Architecture and Engineering: security models such as Bell-LaPadula and Biba, and the purpose of each cryptographic tool: hashing for integrity, signatures for origin and integrity, encryption for confidentiality.
- Communication and Network Security: the OSI model, secure protocols and which control fits which attack. Network engineers can usually move fast here.
- Identity and Access Management: access control models, federation, and the full identity lifecycle, including removing access when people change roles.
- Security Assessment and Testing: the difference between audits, vulnerability assessments and penetration tests, and what must be agreed in writing before testing starts.
- Security Operations: incident response steps, evidence handling and order of volatility, and recovery objectives (RTO and RPO) matched to recovery site types.
- Software Development Security: development lifecycle models, common code flaws and the controls that fix the root cause rather than hiding symptoms.
Across all domains, read each question for the role you are playing. If it asks what a security manager should do first, the answer is rarely a technical configuration change.
How hard is CISSP?
CISSP is widely considered one of the harder security exams, for three reasons.
- Breadth. Eight domains run from legal and risk topics to cryptography, networking and secure coding. Very few people work in all of them.
- Judgement questions. Many questions have several plausible answers. The best one usually reduces risk in line with business goals, as a manager or risk adviser would decide, rather than the most technical fix.
- Adaptive format. The exam uses Computerized Adaptive Testing, with 100 to 150 items in three hours. It adjusts difficulty to your answers, so it often feels hard throughout. You need 700 out of 1000 points to pass.
ISC2 does not publish a pass rate on the pages we checked, and we do not quote unofficial ones. The practical test of readiness is consistent performance on full-length, timed practice sets across all eight domains, not a high score in your favourite two.
How long to study for CISSP
How long to study for CISSP depends on how many domains your job already covers. Most experienced candidates plan for a few months of steady study. People with gaps in several domains need longer.
- Broad experience (you work across four or more domains): 8 to 12 weeks may be enough. Compress the domains you know.
- Typical experience (two or three domains): follow the 16-week plan.
- Narrow or early-career (one or two domains, or under five years): plan 20 weeks or more, and consider the Associate of ISC2 route if you lack the required experience.
These are our planning ranges, not ISC2 figures. Whatever your pace, set an exam date early. ISC2 says an exam-only purchase must be scheduled and taken within 365 days, and the Peace of Mind option's two attempts must be used within 180 days of purchase.
The new CISSP outline from April 15, 2027
ISC2 states that effective April 15, 2027, the CISSP exam will be based on a new exam outline, and it links to the upcoming outline documents from its exam outline page. When we checked the ISC2 pages, the new domain weights were not shown in the page text, so we do not list them here.
What this means for you:
- Testing before April 15, 2027: study the current 2024 outline and the weights above.
- Testing on or after April 15, 2027: download the new outline from ISC2 and rebuild this plan around its domains and weights.
- Starting now with a 16-week plan: you would finish in early March 2027, a few weeks before the change. Leave yourself a margin in case you need a second attempt.
Exam-day and after
Standard registration is US$749 in the Americas and regions not priced separately; see CISSP exam cost for regional prices. The exam is offered in Chinese, English, German, Japanese and Spanish.
Passing is not the last step. You must complete the endorsement within nine months of your exam date, then earn 120 CPE credits every three years and pay the US$135 annual maintenance fee. Plan those steps when you book, so a pass turns into a certification without delay.