CISSP Study Guide

The ISC2 CISSP is the gold-standard certification for security leadership. It spans eight domains — from risk management and asset security through cryptography, network security, identity, testing, operations, and software security — and consistently ranks among the highest-paying certifications in IT. It is not an entry-level exam, and it does not pretend to be.

Who should take it

CISSP requires five years of cumulative, paid work experience across two or more of the eight domains (a four-year degree or an approved certification such as Security+ waives one year). You can pass the exam first and become an Associate of ISC2 while you accumulate the experience. The ideal candidate is a security engineer, consultant, or manager moving into architecture or leadership.

How the exam works

The English-language exam is computer-adaptive (CAT). The difficulty of each question adjusts to your performance, you cannot go back and revisit anything, and the exam ends when the engine is statistically confident about you either way. Scoring is on a 1,000-point scale with 700 to pass.

Two consequences follow, and both matter:

You cannot flag and return. Every answer is final. This changes your strategy completely — there is no "come back to it later," so you must commit, breathe, and move on. Dwelling costs you nothing but time and confidence.

The exam ending early tells you nothing. It can end at the minimum item count because you are clearly passing or clearly failing. Candidates torture themselves over this. Ignore it.

Because it is adaptive, it will find your weakest domain and keep probing it. There is no hiding a bad domain behind a strong one, which is exactly why breadth beats depth here.

Check the official ISC2 CISSP page for the current item count, time limit, and exam outline — ISC2 revises the format periodically, and the outline is the authoritative scope document.

Think like a manager, not an engineer

This is the single most important thing to understand about the CISSP, and it is why brilliant engineers fail it.

The exam rewards the managerially correct answer. The hierarchy, in order:

1. Human safety always comes first. If any option protects life, it is the answer. There is no debate and no cost-benefit analysis.
2. Assess before you act. Understand the risk and the scope before you change anything.
3. Follow the process. Policy, procedure, documented change management, and appropriate authorisation beat a technically superior improvisation.
4. Only then, the technical fix.

When a question asks what you should do FIRST or what is MOST important, the engineer's instinct — patch it, block it, isolate it, rebuild it — is very often a distractor placed there specifically to catch you. The correct answer usually assesses, communicates, or follows the documented process.

The practical drill: on every practice question, before you look at the options, ask yourself "what would a CISO do here, who is accountable to a board and a regulator?" Then look. You will catch yourself reaching for the technical fix a dozen times before it stops happening, and that is the point.

The eight domains

Domain 1 — Security and Risk Management (16%) is the foundation and the heaviest-weighted, and its mindset infects every other question. Governance, the risk lifecycle, legal and regulatory concepts, and business continuity. Know the risk maths (SLE = AV × EF; ALE = SLE × ARO) and the four risk responses: accept, avoid, transfer, mitigate. Know the difference between a policy (mandatory, high-level), a standard (mandatory, specific), a guideline (optional), and a procedure (step-by-step). BCP/DRP terminology — RTO, RPO, MTD, BIA — is reliably tested, and the business impact analysis comes first in the BCP process.

Domain 2 — Asset Security (10%) covers data classification, ownership roles, retention, and destruction. Learn the roles precisely, because they are easy marks and easy to confuse: the data owner classifies and is accountable; the data custodian implements the controls day to day; the data processor acts on the controller's instructions; the data subject is the person the data is about.

Domain 3 — Security Architecture and Engineering (13%) is security models, secure design principles, cryptography, and physical security. Know which mechanism gives confidentiality (encryption), integrity (hashing), authentication, and non-repudiation (a digital signature — and only a digital signature, because it uses a private key only one person holds). Key management matters more than algorithms.

Domain 4 — Communication and Network Security (13%) is secure architecture, segmentation, VPNs and TLS, and network attacks. The OSI model appears and you should be able to place devices and attacks on the correct layer.

Domain 5 — Identity and Access Management (13%) covers identification, authentication, authorisation, and accountability. Federation, SSO, SAML, OIDC, and Kerberos. Know the access-control models with their canonical use cases: DAC (the owner decides), MAC (the system enforces labels and clearances — think military), RBAC (permissions attach to a job role), and ABAC (decisions from attributes and context).

Domain 6 — Security Assessment and Testing (12%) is audits, vulnerability assessment versus penetration testing, and — importantly — the distinction between them and who they report to. Know that an audit's independence is part of its value.

Domain 7 — Security Operations (13%) covers incident response, forensics, logging and monitoring, and disaster recovery. Know the incident-response phases in order and the order of volatility for evidence collection. Chain of custody is reliably tested.

Domain 8 — Software Development Security (10%) is where technical candidates unexpectedly lose marks, because it is framed managerially: SDLC models, secure coding practices, change management, third-party and supply-chain risk, and software acquisition — not code.

How to prepare

Most successful candidates study three to six months.

Read broadly first. The CISSP punishes narrow expertise and almost everyone has two or three genuinely weak domains out of eight. Identify yours honestly and early, then allocate time by weakness rather than by interest — the temptation to keep revising the domain you already enjoy is the most common way people waste a month.

Then drill practice questions in volume, reviewing the rationale even for the ones you got right. The core exam skill is eliminating options that are true but not BEST, and that skill only develops from reading rationales. If you get a question right for the wrong reason, you have learned nothing.

In the final weeks, build stamina. Do full-length timed sessions. Three adaptive hours with no ability to review is mentally punishing in a way that ninety-minute exams are not, and a real proportion of CISSP failures are late-exam concentration failures, not knowledge failures.

Common pitfalls

Answering as a technician is the classic failure mode and it accounts for more failures than any knowledge gap.

Beyond that: underestimating the legal, privacy, and governance material because it is dry; second-guessing your first managerial instinct (it is usually right — changing answers on this exam tends to make things worse); and burning out in the final hour.

And a psychological one worth naming: the adaptive format is designed to feel hard. It keeps pushing until it finds your ceiling, so it should feel uncomfortable throughout. Candidates walk out convinced they failed and discover they passed. Do not let question 90 feeling brutal change how you answer question 91.

After you pass

Passing the exam is not the end. You will need your experience endorsed by an ISC2 member within nine months, and the certification requires continuing-education credits across each three-year cycle.

It is a real investment — and it remains the credential that most reliably opens doors to senior security roles.