Checking sign-in status...
Study Plan
A condensed 8-week plan for the CISSP exam. Master all eight domains of cybersecurity governance, risk management, security architecture, operations, and software development security.
Stay consistent by setting a target date for this certification.
Set targetHow to use this plan
Week-by-Week Breakdown
Week 1
This week is about mapping your current knowledge against the eight exam domains, understanding the CAT format, and internalizing the ISC2 Code of Ethics, which is tested directly and also informs the correct answer on ethics-adjacent questions.
Topics
Activities
Week 2
Domains 1 and 2 are the governance foundation of CISSP. Domain 1 (Security and Risk Management) is the conceptual backbone of the entire exam: risk assessment, business continuity, compliance, and privacy. Domain 2 (Asset Security) covers data classification, retention, and protection. Together they represent a quarter of the exam and frame how every other domain should be evaluated.
Topics
Week 3
This domain covers the technical foundations of secure system design: cryptographic controls, security models, secure design principles, and physical security. It is the most conceptually dense domain because cryptography alone covers symmetric, asymmetric, hashing, PKI, digital signatures, and key management. Take the time to understand the "why" behind each control, not just the "what."
Topics
Week 4
Network security is tested at the architectural level. The exam does not ask you to configure a firewall. It asks you to design a network architecture that segments critical assets, defends against common attack vectors, and supports secure remote access. Know the OSI model, common protocols, and the security implications of each layer.
Topics
Week 5
Domains 5 and 6 are studied together because they represent two sides of the same discipline: controlling who has access (IAM) and verifying that controls work (assessment and testing). IAM covers authentication, authorization, federation, and privileged access. Assessment covers vulnerability scanning, penetration testing, audits, and BC/DR testing.
Topics
Week 6
Domains 7 and 8 are studied together because modern security operations increasingly overlap with software development. Incident response, forensics, and SOC operations (Domain 7) connect directly to secure SDLC, DevSecOps, and supply chain security (Domain 8). The exam tests both operational maturity and development security awareness.
Topics
Week 7
This is the week that separates candidates who know the material from candidates who pass the exam. CISSP questions frequently span multiple domains and require you to evaluate trade-offs from a business perspective. This week practices that skill: reading a scenario, identifying the binding constraint, and choosing the answer that best serves the organization.
Topics
Activities
Week 8
Your final push. This week is full exam simulation mode using Legend mode. The CAT format means you cannot go back to questions, so you need to practice making confident, final decisions under time pressure.
Topics
Activities
Daily Study Routine
Suggested 2–3 Hour Day
| Time | Activity |
|---|---|
| 15 min | Look over yesterday's wrong answers. For each one, identify whether the miss was a knowledge gap or a mindset gap. |
| 30 min | Read the ISC2 Official Study Guide or equivalent material for this week's domain |
| 30 min | Review flashcards (concepts, frameworks, acronyms, port numbers) |
| 30 min | Take an ExamOS quiz (Challenger or Legend mode, depending on the week) |
| 15 min | Log missed concepts and review them the next morning |
Stay consistent by setting a target date for this certification.
Set targetActivities
Activities
Activities
Activities
Activities
The CISSP is the most widely recognized certification in cybersecurity. It validates your ability to design, implement, and manage a cybersecurity program at the enterprise level. It is not a technical certification. It is a managerial certification that tests whether you can make risk-balanced, governance-aware decisions that protect an organization's assets while enabling business objectives.
This is the single most important thing to understand about CISSP: the correct answer is almost always the one that best serves the business, not the one that is most technically thorough. Candidates with deep technical backgrounds consistently struggle with this shift. If you find yourself choosing the most secure option without considering cost, feasibility, or business impact, you are answering the wrong question.
| Domain | Weight |
|---|---|
| Security and Risk Management | ~15% |
| Asset Security | ~10% |
| Security Architecture and Engineering | ~13% |
| Communication and Network Security | ~13% |
| Identity and Access Management | ~13% |
| Security Assessment and Testing | ~12% |
| Security Operations | ~13% |
| Software Development Security | ~11% |
A note on the CAT format: The CISSP uses Computerized Adaptive Testing. This means the exam adapts to your performance in real time. If you answer correctly, the next question is harder. If you answer incorrectly, the next question is easier. The exam ends when it has determined with 95% statistical confidence that you are above or below the passing threshold, or when you reach 175 questions. This has several implications for your test-taking strategy:
Recommended experience: 5+ years of cumulative, paid work experience in 2 or more of the 8 CISSP domains. If you have a 4-year college degree or an approved certification (such as CompTIA Security+, CISA, or CISM), you can substitute 1 year of experience. You can take the exam without the required experience and earn Associate of ISC2 status, then have up to 6 years to accumulate the full experience requirement.
A note on the managerial mindset: This plan will repeatedly ask you to choose the answer that serves the business, not the answer that is most technically secure. This is not a suggestion. It is the fundamental lens through which every CISSP question must be evaluated. When in doubt, ask: "What would a CISO recommend to the board?"
No. You can take the exam at any time. If you pass without the required experience, you earn Associate of ISC2 status and have up to 6 years to accumulate the 5 years of work experience. A 4-year college degree or an approved certification (CompTIA Security+, CISA, CISM, etc.) can substitute for 1 year of experience.
The CAT format means you cannot go back to previous questions. Each answer is final. This requires a different mindset than a linear exam: you must be confident in your first answer and move on. Do not second-guess yourself. The adaptive algorithm means that harder questions are a sign you are performing well, not a sign you are failing. The exam ends when it has determined with 95% confidence whether you are above or below the passing threshold.
At least 1,000 unique questions across all domains. Focus on questions that explain why each answer is right and why the others are wrong. For CISSP, the explanation matters more than the question itself because the exam tests reasoning, not recall.
Once you are consistently hitting 80% or above on Legend mode across two or more sessions, and you feel confident applying the managerial mindset to cross-domain scenarios, you are ready. Trust your preparation.
3 hours for 100 to 150 questions in the CAT format. The exam ends when the algorithm has determined your competency level with 95% statistical confidence, which may be before you reach 150 questions. The minimum is 100 items. Candidates who pass with high confidence often finish at 100 questions. Most candidates finish in 2 to 3 hours. Budget your time for the full 3 hours, but do not be alarmed if the exam ends earlier.
The adaptive algorithm uses a scaled scoring model. The difficulty of questions you receive adapts to your performance, so the raw number of correct answers needed varies. Do not try to calculate how many questions you can afford to miss.
Yes. If English is not your primary language, you may request a one-time 25-question, 60-minute extension by contacting ISC2 before your exam appointment. This accommodation is available for the English-language exam only and must be requested in advance through the ISC2 accommodations process.
No. The CISSP exam is closed-book. You cannot access documentation, websites, or any external resources during the test. All questions are designed to be answerable from your professional knowledge and the study materials you have reviewed.
The CISSP tests governance-aware, risk-balanced decision-making. The most common failure mode for technical practitioners is defaulting to the most technically secure answer rather than the answer that best balances security with business objectives. When evaluating answer choices, ask: "What would a CISO recommend to the board?" The correct answer protects the business, complies with regulations, and is feasible to implement.
Yes. CISSP is valid for 3 years. To renew, you must earn 120 CPE credits during the 3-year cycle (minimum 40 Category A credits, with the remainder in Category B or C). You must also pay an annual maintenance fee ($125/year). If you do not meet the CPE requirements, your certification lapses and you must retake the exam.
For the full, always-current list, visit the official CISSP exam outline.
| Domain | Key Skills |
|---|---|
| Security and Risk Management (~15%) | Security governance (policies, standards, procedures, guidelines), risk management (identification, assessment, treatment: avoid/transfer/mitigate/accept), compliance and legal frameworks (GDPR, HIPAA, PCI-DSS, SOX, NIST), BCP and DRP (RTO, RPO, MTD, BIA), privacy principles (PII, PHI, data sovereignty), ISC2 Code of Ethics, security awareness training, supply chain risk management |
| Asset Security (~10%) | Data classification (government and commercial models), data lifecycle (creation, storage, use, sharing, archival, destruction), data retention policies, data protection controls (encryption, masking, tokenization, DLP), asset inventory and management, data remanence and sanitization |
| Security Architecture and Engineering (~13%) | Secure design principles (defense in depth, least privilege, zero trust, fail secure, separation of duties), security models (Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash), cryptography (symmetric, asymmetric, hashing, PKI, digital signatures, key management), cloud security (shared responsibility, IaaS/PaaS/SaaS), secure hardware (TPM, HSM, secure enclaves), site and facility security (physical controls, environmental controls) |
| Communication and Network Security (~13%) | OSI and TCP/IP models (security at each layer), network devices (firewalls, IDS/IPS, WAF, proxies, load balancers), network attacks (DoS/DDoS, MITM, ARP spoofing, DNS poisoning), network segmentation (VLANs, microsegmentation, SDN), wireless security (WPA2, WPA3, 802.1X, EAP), VPN (IPsec transport/tunnel mode, SSL/TLS), SASE and zero trust network access |
| Identity and Access Management (~13%) | Authentication (factors, biometrics, MFA, passwordless), identity federation (SAML 2.0, OAuth 2.0, OpenID Connect, RADIUS, LDAP), access control models (DAC, MAC, RBAC, ABAC, rule-based), identity lifecycle (provisioning, review, deprovisioning), privileged access management (PAM, just-in-time, just-enough-access), directory services and identity providers |
| Security Assessment and Testing (~12%) | Vulnerability assessment (scanning, prioritization, reporting), penetration testing (black-box, white-box, gray-box, rules of engagement), security audits (internal, external, third-party, SOC reports), test types (synthetic transactions, misconfiguration review, code review), BC/DR testing (tabletop, walkthrough, simulation, full interruption), log reviews and data analytics |
| Security Operations (~13%) | Incident response (preparation, detection, containment, eradication, recovery, lessons learned), digital forensics (evidence handling, chain of custody, acquisition methods, legal hold), SOC operations (monitoring, triage, threat hunting, SIEM), patch and vulnerability management, change and configuration management, physical security (CCTV, access badges, mantraps), personnel security (background checks, onboarding, offboarding) |
| Software Development Security (~11%) | Secure SDLC (security requirements, threat modeling, secure design, secure coding, security testing, secure deployment), OWASP Top 10 (injection, broken auth, XSS, CSRF, SSRF), security testing (SAST, DAST, IAST, RASP, fuzzing), DevSecOps (CI/CD security gates, infrastructure as code scanning), software supply chain (SBOM, code signing, repository security), secure coding practices (input validation, output encoding, parameterized queries, error handling) |