The CISSP is the senior security certification: eight domains spanning governance, risk, architecture, networks, identity, testing, operations and software security, a three-hour adaptive exam, and a requirement of five years of experience before the credential is awarded. Engineers who arrive from the technical side often struggle, not because the material is hard but because the exam asks a different question than they are used to: not "how would you fix this" but "what should the organisation do", from the point of view of a security manager who weighs risk, cost, people and law. Learning to think that way — the manager's mindset — is most of the preparation. This guide covers the exam mechanics and eligibility, the eight domains as weighted in the outline effective April 15, 2024, the reasoning pattern the questions reward, and a ten-week plan that fits around a job. Confirm details on ISC2's site before booking.
- Describe the CISSP CAT format, scoring, experience requirement and endorsement process
- Summarise the eight domains and their weights, and where each maps to what an engineer already knows
- Apply the manager's mindset to choose the answer the exam intends
- Identify the frameworks, models and vocabulary that questions are built on
- Follow a ten-week plan that prioritises reasoning practice over memorisation
The exam and the credential
The English CISSP uses Computerized Adaptive Testing: 100 to 150 items in up to three hours, with the difficulty of each item chosen from your performance so far, and the test ending once the algorithm is confident you are above or below the standard. You cannot go back to earlier questions. A scaled score of 700 out of 1000 passes; the result is reported only as pass or fail with domain-level feedback on a fail. Passing the exam makes you an Associate of ISC2 until you meet the experience requirement: five years of cumulative, paid, full-time work in two or more of the eight domains, with a relevant degree or an approved credential able to substitute for one year. Certification then requires endorsement by an ISC2 member within nine months, agreement to the code of ethics, an annual maintenance fee, and 120 continuing professional education credits over each three-year cycle.
| Domain | Weight | Engineer's map |
|---|---|---|
| 1. Security and Risk Management | 16% | Governance, risk, compliance, ethics, policy, BCP, awareness — the Cybersecurity track's compliance module, widened |
| 2. Asset Security | 10% | Classification, ownership, handling, retention, data states, privacy — governance from the Data track |
| 3. Security Architecture and Engineering | 13% | Security models, secure design principles, cryptography, physical security, system and cloud architecture |
| 4. Communication and Network Security | 13% | Network models and protocols, secure design, segmentation, wireless, VPNs — network security module |
| 5. Identity and Access Management | 13% | Identification, authentication, authorisation, federation, provisioning lifecycle — identity module |
| 6. Security Assessment and Testing | 12% | Audits, testing strategies, vulnerability assessment, pen testing, log review, metrics |
| 7. Security Operations | 13% | Investigations, logging, incident management, DR, BCP, patching, change management, physical security |
| 8. Software Development Security | 10% | SDLC security, DevSecOps, secure coding, software acquisition — AppSec and supply chain modules |
Because the exam is adaptive, an early run of hard questions is a sign you are doing well, not badly. Keep answering; do not try to guess how you are scoring.
The manager's mindset
CISSP questions are answered from the perspective of a security professional advising the organisation, not an engineer at a keyboard. The intended answer tends to be the one that: protects human safety first, then the business; addresses risk rather than a single vulnerability; is proportionate and cost-justified; follows process (policy, approval, documentation) rather than heroics; involves the right people (senior management sets policy and owns risk, data owners classify, custodians implement, users comply); and comes first in a sequence (assess before implement, contain before eradicate, plan before test). When two answers are both technically right, ask which one the organisation's security manager would choose and defend to the board.
- Who is accountable: senior management owns risk and approves policy; the security function advises and implements; data owners classify; custodians protect; auditors verify independently.
- What comes first: identify assets and risks before choosing controls; get management buy-in before a program; back up before patching; contain before eradicating.
- Risk over fix: the answer that reduces risk to an acceptable level across the organisation beats the one that fixes one system perfectly.
- Due care and due diligence: doing what a reasonable organisation would do, and investigating before acting; negligence is failing either.
- Safety, then legal, then business: in physical security and incident scenarios, people first, evidence and law next, availability after.
Q: A newly appointed security officer discovers that critical servers have never been
patched. What should the officer do FIRST?
A. Apply all outstanding patches immediately
B. Establish a patch management process with testing and change control
C. Perform a risk assessment of the affected systems
D. Report the finding to senior management
Manager's reasoning: acting without understanding impact (A) violates change control;
a process (B) is the eventual fix; reporting (D) is required but not the first technical
step. FIRST is to understand the risk (C): what is exposed, how badly, and therefore how
urgently, which then drives B and D.Domains 1, 2 and 6: governance, assets, assessment
Domain 1 carries the most weight and the most vocabulary: CIA and the extended properties (authenticity, non-repudiation), security governance aligned to business goals, the ISC2 code of ethics (protect society first, act honourably, provide diligent service, advance the profession — questions test it), legal and regulatory categories (criminal, civil, administrative; intellectual property; privacy laws such as GDPR; transborder data flow; import/export controls), investigation types (administrative, criminal, civil, regulatory) and evidence rules, policies/standards/procedures/guidelines/baselines, personnel security (background checks, separation of duties, job rotation, mandatory vacation, termination), risk management (identification, analysis qualitative and quantitative, SLE/ALE, treatment options, control selection, monitoring, frameworks such as NIST RMF and ISO 27005), threat modelling, supply chain risk, awareness and training, and business continuity planning (BIA, MTD/RTO/RPO, plan development, testing).
Domain 2 is the data lifecycle: classification schemes for government (top secret, secret, confidential, unclassified) and commercial (confidential, private, sensitive, public), roles (owner, controller, processor, custodian, user), handling and marking, retention and destruction (clearing, purging, degaussing, destruction; crypto-shredding for cloud), data states and the controls for each (encryption at rest, TLS in transit, homomorphic encryption and enclaves in use), scoping and tailoring of baselines, and privacy principles (collection limitation, purpose, minimisation). Domain 6 covers designing assessment strategies (internal, external, third-party), testing techniques (vulnerability assessment, penetration testing and its phases and box types, log reviews, synthetic transactions, code review, misuse case, test coverage, interface testing, breach and attack simulation, compliance checks), collecting data (accounts, management review, KPIs, KRIs, backup verification, training and awareness, DR/BC), analysing and reporting (remediation, exception handling, ethical disclosure), and audit types (SOC 1/2/3 and their differences).
Learn the numbers that recur: ALE arithmetic, backup rotation, RTO versus MTD (RTO must be shorter), the difference between clearing (overwriting, reusable) and purging (degaussing, not reusable in the same environment), and SOC 2 Type I versus Type II.
Domains 3, 4 and 5: architecture, networks, identity
Domain 3 is the classic academic content: secure design principles (least privilege, defence in depth, secure defaults, fail securely, separation of duties, keep it simple, zero trust, privacy by design, shared responsibility), security models by name and property (Bell-LaPadula for confidentiality with no read up and no write down; Biba for integrity with no read down and no write up; Clark-Wilson with well-formed transactions and separation; Brewer-Nash for conflicts of interest), evaluation criteria (Common Criteria EALs), system components (TPM, HSM, memory protection, virtualisation, trusted computing base, reference monitor), vulnerabilities in client, server, database, cloud, IoT, ICS, microservices and containerised systems, cryptography in depth (symmetric and asymmetric algorithms and key lengths, hashing, digital signatures, PKI, key management lifecycle, cryptanalytic attacks: brute force, birthday, known plaintext, chosen ciphertext, side channel, implementation attacks), and physical security design (site selection, CPTED, fire suppression classes, power, HVAC, access control vestibules, guards).
Domain 4 expects the OSI and TCP/IP models and where attacks and controls live, IP addressing and secure protocols (IPsec modes, TLS, SSH, DNSSEC, secure email), multilayer and converged protocols (FCoE, iSCSI, VoIP, SDN, SD-WAN), micro-segmentation and zero trust, wireless (WPA3, EAP methods), cellular, content distribution, network device security (switches, routers, firewalls by generation, NAC), transmission media, endpoint security, and secure communication channels (VPN, remote access, third-party connectivity). Domain 5 covers physical and logical access control, identification and authentication (factors, biometrics with FAR/FRR/CER, session management, registration and proofing, federation with SAML/OAuth/OIDC, credential management, just-in-time), identity as a service, third-party identity, authorisation models (RBAC, rule-based, MAC, DAC, ABAC, risk-based), the provisioning lifecycle (provisioning, review, deprovisioning, privilege escalation controls), and authentication systems (Kerberos, RADIUS, TACACS+, SAML).
| Model or term | One-line memory hook |
|---|---|
| Bell-LaPadula | Confidentiality: no read up, no write down (simple and star properties) |
| Biba | Integrity: no read down, no write up (the inverse) |
| Clark-Wilson | Integrity through well-formed transactions and separation of duties |
| Brewer-Nash | Chinese wall: prevent conflicts of interest between clients |
| Kerberos | Tickets from a KDC; time-sensitive; symmetric keys |
| CER (crossover error rate) | Where FAR equals FRR; lower is a more accurate biometric |
Domains 7 and 8: operations and software
Domain 7 is broad: investigations (evidence collection and handling, chain of custody, reporting, forensic tools and artefacts), logging and monitoring (SIEM, continuous monitoring, egress monitoring, log management, threat intelligence, UEBA), configuration and change management, foundational concepts (need to know, least privilege, separation of duties, privileged account management, job rotation, SLAs), resource protection (media management), incident management (detection, response, mitigation, reporting, recovery, remediation, lessons learned — in ISC2's order), detective and preventive measures (firewalls, IDS/IPS, allow-listing, sandboxing, honeypots, anti-malware, machine learning tools), patch and vulnerability management, recovery strategies (backup storage, recovery sites, redundancy, high availability, quality of service, fault tolerance), disaster recovery processes and plan testing (read-through, walkthrough, simulation, parallel, full interruption), business continuity, physical security, and personnel safety (duress, travel, emergency management).
Domain 8 applies security across the SDLC: development methodologies (waterfall, agile, DevOps, DevSecOps), maturity models (CMM, SAMM), operations and maintenance, change management, integrated product teams, the security of development environments and toolchains (source control, CI/CD, software configuration management, code repositories), application security testing (SAST, DAST, IAST, RASP), assessing software security effectiveness (auditing and logging changes, risk analysis and mitigation), acquired software (COTS, open source, third-party, managed services), and secure coding guidelines (weaknesses at the source level, APIs, secure practices, software-defined security). The Cybersecurity track's AppSec, supply chain and DevSecOps modules are the technical depth; the exam asks about governance of them.
Incident management (D7): detection -> response -> mitigation -> reporting -> recovery -> remediation -> lessons learned
BC/DR development (D1/D7): project scope & planning -> BIA -> recovery strategy -> plan design & development
-> implementation/testing/training -> maintenance
DR test rigour: read-through/checklist < walkthrough/tabletop < simulation < parallel < full interruption
Risk management (D1): identify assets -> identify threats & vulnerabilities -> analyse -> evaluate/prioritise
-> treat (avoid, transfer, mitigate, accept) -> monitor
Media sanitisation (D2): clearing (overwrite) < purging (degauss) < destruction (physical)The ten-week plan
| Weeks | Focus | Practice |
|---|---|---|
| 1–2 | Domain 1 and 2: governance, risk, law, ethics, BCP, asset lifecycle | 150 questions; write the risk and BCP sequences from memory; ALE drills |
| 3–4 | Domain 3 and 4: design principles, models, cryptography, physical security, networks | 150 questions; model table from memory; OSI layer placement of twenty controls |
| 5–6 | Domain 5 and 6: identity lifecycle, authentication systems, assessment and audit types | 150 questions; explain SOC 1/2/3 and Type I/II; provisioning lifecycle from memory |
| 7–8 | Domain 7 and 8: operations, incident and recovery sequences, software security governance | 150 questions; DR test ladder and incident sequence from memory |
| 9 | Mindset drills: 200 questions answered only by asking 'what would the security manager do first' | Review every miss for which principle you violated |
| 10 | Two full-length simulations with the adaptive-style pacing (no going back); rest | Book the exam for the end of this week |
Use the official ISC2 study guide and practice tests, and one well-regarded question bank; the value is in the explanations, which teach the mindset. Schedule the exam before you start so the ten weeks are real. Because the credential needs endorsement and experience, line up an ISC2 member who knows your work early, and have your employment history ready for the application. On the day: no going back means answer, commit, forget; pace at roughly one item per minute and a half; and when the exam ends early, that is the algorithm having decided, not a sign either way.