Certified Information Systems Security Professional (CISSP) Exam Guide 2026: Domains, Format, and How to Prepare

What the CISSP exam covers

The CISSP exam is built around eight domains defined by (ISC)². Each domain carries a specific, published weight that determines roughly how much of the exam is devoted to that subject area. These weights are set by the certification body and should be treated as the most reliable guide to where study time belongs.

• Security and Risk Management — 16%
• Asset Security — 10%
• Security Architecture and Engineering — 13%
• Communication and Network Security — 13%
• Identity and Access Management (IAM) — 13%
• Security Assessment and Testing — 12%
• Security Operations — 13%
• Software Development Security — 10%

A few observations that follow directly from these numbers:

• Security and Risk Management is the single heaviest domain at 16%, making it the largest concentration of exam content in one area.
• Four domains — Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), and Security Operations — are each weighted at 13%, forming a cluster of similarly-important technical and operational domains.
• Asset Security and Software Development Security are tied as the lowest-weighted domains at 10% each, though "lowest-weighted" does not mean skippable — together they still represent a fifth of the exam.
• Security Assessment and Testing sits in the middle at 12%.

For current, authoritative details on exam objectives, eligibility, and any updates to these weights, consult the certification body's official exam outline page: https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline.

How the exam is scored

CISSP uses a scaled scoring model rather than a simple percentage-correct calculation. Raw performance on the exam is converted onto a standardized scale, and candidates must reach a cutoff score of 700 on that scale to pass.

A few practical implications of this model:

• Because scoring is scaled, not every question necessarily contributes the same weight to a candidate's final score, and the conversion process is managed by the certification body rather than being a simple raw-count average.
• A cutoff score of 700 means the exam is pass/fail relative to that fixed threshold — there is no separate "grading curve" a candidate needs to guess at beyond meeting that scaled cutoff.
• Because the exact mechanics of scaling, question-level weighting, and any adaptive elements are determined and administered by (ISC)², candidates should not rely on rough estimates or forum guesses about "how many questions you can miss." Treat 700 as the target and focus on broad, cross-domain competence rather than trying to reverse-engineer the scoring formula.

For the authoritative description of exam scoring, format, and administration, refer to the official exam outline linked above.

How much to study

There is no official study-hours requirement published for CISSP, and any number offered here is a reasoned estimate, not a fact. That said, a few structural features of the exam make it possible to plan a study timeline sensibly:

• The exam spans eight distinct domains, several of which (Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), Security Operations) are weighted almost identically at 13%. This suggests a fairly broad, evenly distributed body of knowledge rather than one or two dominant topics.
• Because Security and Risk Management carries the largest single weight (16%), it reasonably deserves the largest individual block of study time relative to other domains.
• Domains at 10% (Asset Security, Software Development Security) can reasonably receive a smaller — but still non-trivial — share of study time, since together they still make up a fifth of the exam.

As a rough planning heuristic, many candidates preparing for a broad, multi-domain security exam like this one budget somewhere in the range of two to four months of part-time study, adjusting up or down based on prior professional experience with security operations, network security, and risk management concepts. Candidates newer to information security topics, or without hands-on experience across most of the eight domains, should expect to need more time than those already working in security-related roles. Again, treat this as a planning estimate to adjust based on your own background — not a fixed requirement.

How to prepare

Because the exam weight is spread across eight domains with no single overwhelming majority, an effective study plan generally does the following:

• Start with the heaviest domain. Since Security and Risk Management is weighted highest at 16%, build a strong foundation here first — governance, compliance, risk frameworks, and legal/regulatory concepts recur conceptually throughout the other domains, so understanding this domain well tends to make the rest of the material easier to contextualize.
• Don't neglect the mid-weighted cluster. Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), and Security Operations are all weighted at 13% each — collectively they make up over half the exam. Treat these four as a connected group rather than four separate silos, since access control, network design, and operational security concepts overlap in practice.
• Give the lighter domains real attention, not a skim. Asset Security and Software Development Security are each weighted at 10%, the lowest individual weights on the exam, but skipping them outright still risks losing a meaningful fraction of available points. Allocate proportionally less time than for Security and Risk Management, but don't treat them as optional.
• Use Security Assessment and Testing as a bridge topic. At 12%, this domain connects directly to both the technical domains (testing architecture and networks) and the risk/governance domain (assessment reporting and audit), so reviewing it after the technical domains can help reinforce material already studied.
• Practice retrieval, not just re-reading. Working through practice questions helps surface which of the eight domains need more review before exam day. CandiCerts practice questions are written independently from the public exam blueprint, not sourced from the certification body's proprietary exam content — useful for gauging domain-by-domain readiness rather than for memorizing specific answers.
• Check official sources before finalizing a study timeline. Pricing, registration windows, and any updates to domain weights or scoring are determined solely by the certification body and change over time. Confirm current details at https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline before registering.