CISSP study guide
The Certified Information Systems Security Professional (CISSP) from ISC2 is one of the most recognized credentials for experienced security practitioners, managers, and architects. It tests breadth more than depth: the exam is often described as "a mile wide and an inch deep."
Exam details change. Always confirm the current exam version, objectives, length, and passing score on the certification body's official website before you schedule.
Eligibility requirements
- Experience: five years of cumulative, paid, full-time work experience in at least two of the eight CISSP domains.
- One-year waiver: a four-year degree (or regional equivalent) in computer science, IT, or a related field, or an ISC2-approved credential such as CompTIA Security+, CISM, SSCP, or CCSP, can count toward one year. The waiver is capped at one year in total.
- Part-time work and internships count. Part-time work is 20–34 hours per week, and 2,080 part-time hours equal one year. Paid or unpaid internships count with documentation on company or school letterhead.
- No experience yet? Pass the exam to become an Associate of ISC2. You then have six years to earn the required experience.
- Endorsement: after passing, an active ISC2 credential holder must endorse your application to confirm your experience. You must also agree to the ISC2 Code of Ethics.
Exam format & cost
| Format | Computerized Adaptive Testing (CAT) in English |
|---|---|
| Length | 100–150 questions, 3 hours |
| Passing score | 700 out of 1000 |
| Exam fee | $749 (US; varies by region) |
| Annual maintenance fee | $135 per year (covers all your ISC2 certifications) |
| Continuing education | 120 CPE credits per three-year cycle |
| Recognition | ANAB-accredited (ISO/IEC 17024), approved under DoD 8140 |
With CAT, the difficulty adjusts to your answers, and the test can end early once the system is confident whether you've passed or failed. You can't go back to change earlier answers, so commit to each one.
The eight domains
| Domain | Approx. weight |
|---|---|
| 1. Security and Risk Management | 16% |
| 2. Asset Security | 10% |
| 3. Security Architecture and Engineering | 13% |
| 4. Communication and Network Security | 13% |
| 5. Identity and Access Management (IAM) | 13% |
| 6. Security Assessment and Testing | 12% |
| 7. Security Operations | 13% |
| 8. Software Development Security | 10% |
Think like a manager
The most common advice from people who've passed is to answer from the point of view of a risk-focused advisor, not a hands-on technician. When several answers seem technically correct, choose the one that:
- protects human safety first,
- aligns with business objectives and senior management direction,
- addresses the root cause or policy rather than a single symptom, and
- follows due care and due diligence.
Topics that trip people up
- Security models. Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson, and Brewer-Nash.
- Risk math. SLE = AV × EF, and ALE = SLE × ARO.
- Cryptography. Symmetric vs. asymmetric, the key-count formulas, what provides non-repudiation, and PKI components.
- BCP/DR terms. RPO, RTO, MTD/MAD, WRT, and the backup types.
- Roles. Owner vs. custodian vs. steward, and who is ultimately accountable.
A study approach that works
- Read one comprehensive reference end to end so you've seen every topic.
- Do domain-focused practice sets, and read the explanation for every question, including ones you got right.
- Keep a "missed concepts" list and revisit it weekly. Our retry missed questions feature helps with this.
- In the final two weeks, take timed mixed sessions to build stamina and pacing.
Ready to test yourself on CISSP?
Start CISSP practice