Study guide · ISC2 CISSP
CISSP study guide: exam structure, 2024 outline and a 6-week plan
CISSP tests whether you can make sound security decisions across an entire organization, not just recall definitions. This guide explains the exam format, the current outline and a six-week way to prepare.
How the exam is structured
Every CISSP exam is delivered with computerized adaptive testing (CAT): each item is chosen based on how you answered the ones before it. You have up to 3 hours, and you cannot go back to review or change earlier items, so each answer has to be your final one.
The outline is split into eight domains that build on each other. Security and Risk Management sets the governance and risk lens; the architecture, network, identity and software domains apply it to how systems are built; assessment and operations cover how you verify controls and run security day to day.
Items often describe a scenario and ask for the best, first or most appropriate action. Several options can be technically correct, so the exam rewards judgment about priorities, business impact and risk. Experience requirements, endorsement and the passing standard are set by ISC2, so check ISC2's exam page for them.
Exam domains
| Domain | Share of exam |
|---|---|
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
Source: ISC2 CISSP Certification Exam Outline, Effective April 15, 2024 (opens in a new tab)
What changed in the current outline
The current outline is the ISC2 CISSP Certification Exam Outline, effective April 15, 2024. It is organized into eight domains, each with its own weight, and every exam built on it is delivered adaptively.
To spot outdated material, check that a book or course says it follows the outline effective April 15, 2024. For what changed between versions, check ISC2's exam page.
A 6-week study approach
Week 1: Diagnose and anchor in risk
Take a diagnostic across all eight domains to see where you stand. Then start with Security and Risk Management, since governance, risk analysis, ethics and policy frame the rest of the exam.
Week 2: Assets and architecture
Cover Asset Security (classification, ownership, data lifecycle, retention) and Security Architecture and Engineering (secure design principles, security models, cryptography). Practice by domain and read the explanation for every miss.
Week 3: Networks and identity
Work through Communication and Network Security (secure network design, protocols, secure channels) and Identity and Access Management (IAM), including authentication, authorization models and the identity lifecycle. Focus on choosing the right control for a situation, not on memorizing port lists.
Week 4: Assessment, operations and software
Study Security Assessment and Testing, Security Operations (incident response, investigations, recovery and continuity) and Software Development Security. Link each topic back to risk: why a test, a response step or a secure coding practice matters to the business.
Week 5: Mixed practice and weak domains
Switch to mixed sets that pull from every domain, answering each item once without going back, as the real exam requires. Use your results to return to the two or three weakest domains.
Week 6: Full mocks and review
Sit full mock exams under timed conditions to build stamina for a sitting of up to 3 hours. Spend the last days reviewing explanations and your notes on the manager's view, not cramming new detail.
Common traps
Answering like a technician
The best answer is often the one that addresses risk, policy or business priorities first, not the most hands-on technical fix. Ask what a security manager advising leadership would do.
Expecting to go back and review
With adaptive delivery you cannot return to earlier items. Practice committing to an answer after reading carefully, rather than flagging items to revisit.
Studying only your strongest domains
Every domain is assessed, so a gap in one area can hurt you even if you know others deeply. Let diagnostic and practice results decide where your time goes.
Using material built for an older outline
A book or course that does not name the April 15, 2024 outline may not match the current domains. Confirm which outline a resource follows before relying on it.
Memorizing without understanding why
Scenario items rarely ask for a definition on its own. Make sure you can explain why one control or process fits a situation better than the alternatives.
How CandiCerts helps
- A free diagnostic across the eight CISSP domains shows where you stand before you commit study time.
- Your study plan is built from your diagnostic results, so weaker domains get more of your time.
- Practice by domain comes with explanations, and mock exams follow the outline weights in a fixed format rather than simulating the adaptive delivery.
- A tutor explains concepts and answer choices whenever a topic or explanation does not click.
Questions about this guide
Which CISSP outline is current?
The ISC2 CISSP Certification Exam Outline effective April 15, 2024, with eight domains.
How long is the CISSP exam?
Up to 3 hours. Every CISSP exam uses computerized adaptive testing, and you cannot go back to earlier items.
Does CandiCerts simulate the adaptive exam?
No. CandiCerts practice uses a fixed format and does not simulate adaptive delivery, so use it to build domain knowledge and judgment.
What experience do I need to become certified?
Experience requirements and endorsement are set by ISC2, so check ISC2's CISSP page for the current rules.
Last reviewed: