Browse ISC2 Certification Guides

ISC2 CISSP Guide: Certified Information Systems Security Professional

ISC2 CISSP exam guide covering the eight domains, risk treatment, and control selection decisions.

This guide targets CISSP, ISC2’s flagship broad-security certification. As of April 13, 2026, ISC2’s current outline page shows the exam still uses the April 15, 2024 outline version with 8 weighted domains, Computerized Adaptive Testing (CAT), 100-150 items, and a 3-hour time limit. This guide follows that current public outline directly.

CBK: Common Body of Knowledge, the eight-domain professional body of knowledge CISSP is built around.

BIA: Business impact analysis, which identifies recovery priorities and business consequences so continuity planning can be designed correctly.

Least privilege: Security principle that grants only the minimum access needed to perform an authorized task.

At a glance

Exam fact Current official signal
Outline effective date April 15, 2024
Exam delivery CAT
Length 3 hours
Number of items 100-150
Passing grade 700 / 1000
Languages on current outline page Chinese, English, German, Japanese, Spanish
Experience requirement 5 years cumulative paid experience across 2 or more domains, with limited waiver paths
Guide model 8 blueprint chapters -> 16 section lessons

CISSP is broad on purpose. Strong answers usually begin by classifying the real decision family first: governance, asset handling, architecture, network, identity, testing, operations, or software security. The trap is often not a silly answer. The trap is choosing a technically plausible answer that ignores policy, risk ownership, auditability, or long-term operability.

The exam habit that usually wins

Read CISSP stems in this order:

  1. decide whether the question is really about governance, ownership, architecture, operations, or software security
  2. identify the decision level before choosing a control: policy, standard, process, architecture, implementation, or response step
  3. prefer the answer that is risk-aware, auditable, and supportable at scale
  4. avoid the tempting technical fix if the stem is really testing lifecycle, due care, evidence handling, or business alignment

How to use this guide

  1. Start with the study plan if you want a weighted route through the eight current domains.
  2. Work the chapters in order, because governance and asset thinking shape the architecture, IAM, operations, and software-security decisions that appear later.
  3. Use the cheat sheet after the lessons, not before them, so the quick pickers reinforce risk-based reasoning instead of replacing it.
  4. Use the faq for current experience, CAT-format, and study-strategy questions.
  5. Use the resources page to re-check the current ISC2 outline and primary frameworks near your exam date.
  6. Use the glossary only when security-model, crypto, IAM, or operations terms start to blur together.

Blueprint-aligned chapter map

ISC2’s current outline page publishes the eight domain weights. This guide follows that map directly.

Domain Weight Chapter Start here
Security and Risk Management 16% 1. Risk 1.1 Governance & Compliance, 1.2 BIA & Continuity
Asset Security 10% 2. Assets 2.1 Classification & Lifecycle, 2.2 Retention & Protection
Security Architecture and Engineering 13% 3. Architecture 3.1 Design Principles & Models, 3.2 Crypto & Resilience
Communication and Network Security 13% 4. Network 4.1 Segmentation & Transit, 4.2 Wireless & Zero Trust
Identity and Access Management (IAM) 13% 5. IAM 5.1 Authentication & MFA, 5.2 Authorization & PAM
Security Assessment and Testing 12% 6. Testing 6.1 Audits & Metrics, 6.2 Pen Testing & Validation
Security Operations 13% 7. Operations 7.1 Incident Response, 7.2 Recovery & Resilience
Software Development Security 10% 8. Software 8.1 SDLC & DevSecOps, 8.2 Secure Coding & APIs 
    flowchart LR
	  A["1. Governance and asset thinking"] --> B["2. Architecture and network decisions"]
	  B --> C["3. Identity and assessment logic"]
	  C --> D["4. Operations and resilience"]
	  D --> E["5. Software security and final review"]

What strong answers usually do

  • choose the control that is risk-aware, scalable, and supportable rather than the most aggressive technical move
  • separate governance decisions from engineering decisions and from incident-response decisions
  • prefer preventive and auditable controls before reactive cleanup
  • think like a security leader or architect, not like a single-tool operator

What weak answers usually do

  • jump to the most technical answer when the real problem is governance or ownership
  • confuse a policy decision with an implementation decision
  • treat incident-response questions like immediate eradication contests instead of evidence-and-order problems
  • pick a control that works locally but does not scale, audit, or align with business risk
  • forget that CISSP often prefers lifecycle discipline and compensating-control logic over “perfect security” instincts

Where candidates usually lose points

Failure pattern Better instinct
treating every hard stem like a network or technical-control question check governance, ownership, and policy boundaries first
mixing security models, access-control models, and business roles into one blur classify the model family before picking the control
jumping to eradication or hardening before preserving evidence and containing impact follow the operational order the scenario requires
choosing a tool without checking whether the answer is really about risk treatment or lifecycle design CISSP usually rewards the broader management and architecture fit

In this section

Revised on Sunday, May 10, 2026
CGRC