Review why every answer fits or fails.
Pass reports describe explaining each option rather than counting completed questions. Use wrong answers to find the concept or distinction you missed.
Certified Information Systems Security Professional (CISSP) Exam Guide
Validates knowledge of designing and managing security programs, including risk, architecture, access control, operations and software security.
Prepare across all eight domains, including the ones outside your day-to-day role. Learn how technical controls support business needs, then practise choosing the best response to a security scenario. The adaptive exam requires a decision on each question before you move on.
Understand the exam
Syllabus
1Security and risk management16%
- 1.1Understand, adhere to, and promote professional ethics
- 1.2Understand and apply security concepts
- 1.3Evaluate and apply security governance principles
- 1.4Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context
- 1.5Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)
- 1.6Develop, document, and implement security policy, standards, procedures, and guidelines
- 1.7Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements
- 1.8Contribute to and enforce personnel security policies and procedures
- 1.9Understand and apply risk management concepts
- 1.10Understand and apply threat modeling concepts and methodologies
- 1.11Apply supply chain risk management (SCRM) concepts
- 1.12Establish and maintain a security awareness, education, and training program
Example scenario: A business unit wants a costly security tool. What information would you gather to decide whether it addresses the organization’s most important risks?
2Asset security10%
- 2.1Identify and classify information and assets
- 2.2Establish information and asset handling requirements
- 2.3Provision information and assets securely
- 2.4Manage data lifecycle
- 2.5Ensure appropriate asset retention
- 2.6Determine data security controls and compliance requirements
3Security architecture and engineering13%
- 3.1Research, implement and manage engineering processes using secure design principles
- 3.2Understand the fundamental concepts of security models
- 3.3Select controls based upon systems security requirements
- 3.4Understand security capabilities of Information Systems (IS)
- 3.5Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements
- 3.6Select and determine cryptographic solutions
- 3.7Understand methods of cryptanalytic attacks
- 3.8Apply security principles to site and facility design
- 3.9Design site and facility security controls
- 3.10Manage the information system lifecycle
4Communication and network security13%
- 4.1Apply secure design principles in network architectures
- 4.2Secure network components
- 4.3Implement secure communication channels according to design
5Identity and access management (IAM)13%
- 5.1Control physical and logical access to assets
- 5.2Design identification and authentication strategy
- 5.3Federated identity with a third-party service
- 5.4Implement and manage authorization mechanisms
- 5.5Manage the identity and access provisioning lifecycle
- 5.6Implement authentication systems
Example scenario: A manager transfers departments but keeps access to the old team’s customer records. Which account-lifecycle controls should address this?
6Security assessment and testing12%
- 6.1Design and validate assessment, test, and audit strategies
- 6.2Conduct security control testing
- 6.3Collect security process data
- 6.4Analyze test output and generate report
- 6.5Conduct or facilitate security audits
7Security operations13%
- 7.1Understand and comply with investigations
- 7.2Conduct logging and monitoring activities
- 7.3Perform configuration management (CM)
- 7.4Apply foundational security operations concepts
- 7.5Apply resource protection
- 7.6Conduct incident management
- 7.7Operate and maintain detection and preventative measures
- 7.8Implement and support patch and vulnerability management
- 7.9Understand and participate in change management processes
- 7.10Implement recovery strategies
- 7.11Implement disaster recovery (DR) processes
- 7.12Test disaster recovery plans (DRP)
- 7.13Participate in Business Continuity (BC) planning and exercises
- 7.14Implement and manage physical security
- 7.15Address personnel safety and security concerns
Example scenario: A recovery exercise restores backups but misses the business’s recovery-time target. What should the team review next?
8Software development security10%
- 8.1Understand and integrate security in the Software Development Life Cycle (SDLC)
- 8.2Identify and apply security controls in software development ecosystems
- 8.3Assess the effectiveness of software security
- 8.4Assess security impact of acquired software
- 8.5Define and apply secure coding guidelines and standards
The eight domains stay, with weights evened out between 11.2% and 13.6%. New topics include AI ethics and threats, passkeys, post-quantum cryptography and SBOMs.
1Security Governance and Risk Management13.6%
- 1.1Understand, adhere to, and promote professional ethics
- 1.2Understand and apply security concepts
- 1.3Evaluate, apply, and sustain security governance principles
- 1.4Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context
- 1.5Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory)
- 1.6Develop, document, and implement security policy, standards, procedures, and guidelines
- 1.7Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements
- 1.8Contribute to and enforce personnel security policies and procedures
- 1.9Understand and apply risk management concepts
- 1.10Understand and apply threat modeling concepts and methodologies
- 1.11Apply Supply Chain Risk Management (SCRM) concepts
- 1.12Establish, maintain, and measure a security awareness, education, and training program
2Asset Security12%
- 2.1Identify and classify information and assets
- 2.2Establish information and asset handling requirements
- 2.3Provision information and assets securely
- 2.4Manage data lifecycle
- 2.5Ensure appropriate asset management (e.g., End of Life (EOL), End of Support (EOS))
- 2.6Determine data security controls and compliance requirements
3Security Architecture and Engineering12.8%
- 3.1Research, implement, and manage engineering processes using secure design principles
- 3.2Understand the fundamental concepts of security models (e.g., Biba, Star, Bell-LaPadula)
- 3.3Select controls based upon systems security requirements
- 3.4Understand security capabilities of information systems (e.g., memory protection, Trusted Platform Module (TPM), Hardware Security Module (HSM), encryption/decryption)
- 3.5Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements
- 3.6Select and determine cryptographic solutions
- 3.7Understand methods of cryptanalytic attacks
- 3.8Apply security principles to site and facility design
- 3.9Design site and facility security controls
- 3.10Manage the information system lifecycle
4Communication and Network Security12.8%
- 4.1Apply secure design principles in network architectures
- 4.2Secure network components
- 4.3Implement secure communication channels according to design
5Identity and Access Management (IAM)13.6%
- 5.1Manage physical and logical access to assets (e.g., provision, control, review, revoke)
- 5.2Design identification and authentication strategy (e.g., people, devices, and services)
- 5.3Federated identity with a third-party service
- 5.4Implement and manage authorization mechanisms
- 5.5Manage the identity and access provisioning lifecycle
- 5.6Implement authentication and authorization systems
6Security Assessment and Testing11.2%
- 6.1Design and validate assessment, test, and audit strategies
- 6.2Conduct security controls testing
- 6.3Collect security process data (e.g., technical, administrative)
- 6.4Analyze test/audit output and generate report
- 6.5Conduct or facilitate security audits
7Security Operations12.8%
- 7.1Understand and comply with investigations
- 7.2Conduct logging and monitoring activities
- 7.3Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)
- 7.4Apply foundational security operations concepts (e.g., Defense in Depth (DiD))
- 7.5Apply resource protection
- 7.6Conduct incident management
- 7.7Operate and maintain detection and preventative measures
- 7.8Implement and support patch and vulnerability based management
- 7.9Understand and participate in change management processes
- 7.10Implement recovery strategies
- 7.11Implement Disaster Recovery (DR) processes
- 7.12Test disaster recovery plans (DRP)
- 7.13Participate in Business Continuity (BC) planning exercises
- 7.14Implement and manage physical security
- 7.15Address personnel safety and security concerns
8Software Development Security11.2%
- 8.1Understand and integrate security in the Software Development Life Cycle (SDLC)
- 8.2Identify and apply security controls in software development ecosystems
- 8.3Assess the effectiveness of software security
- 8.4Assess security impact of acquired software
- 8.5Define and apply secure coding guidelines and standards
Format
- Questions
- 100–150
- Duration
- 3h
- Passing score
- 700 / 1000
- Delivery
- Test centre
- Languages
- English, Chinese, German, Japanese, Spanish
Question types
Choose the single best answer from four options; one is correct and three are distractors.
CertUp example
A company's CEO asks why a proposed backup project is ranked above a new firewall. What should the security manager show first?
Show answer
The business impact and likelihood of the risks each project would reduce. Security spending is prioritised by the risk it addresses, not by features or price alone.
Drag each item from a list into the matching slot or category; the item is correct only when every placement is right.
CertUp example
Drag each incident response step into the order it normally happens, from first to last.
Show answer
Detection, containment, eradication, recovery. You must confirm and limit an incident before removing its cause and restoring service.
Click the area of a diagram, table or screen that answers the question; there are no written options.
CertUp example
A network diagram shows the internet, a perimeter firewall, a DMZ web server, an internal database and the staff LAN. Click the location where a database holding customer records should sit.
Show answer
The internal network behind the firewall. A database should not be reachable directly from the internet or from the DMZ web tier.
Eligibility and booking
Create an ISC2 account and schedule with Pearson VUE. After passing, submit the endorsement application and pay your first annual fee.
Make a study plan
Map your experience to the outline first. Use one main course or guide, then focus your review on the domains you know least well.
Most candidates spend 120–250 hours. Plan for the low end if you work across most of the eight domains; plan for the high end if you have gaps in several domains or are returning to study after a long break.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.10 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.120 h
- 4Practice with mock examsTake timed practice tests and review every mistake.60 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.10 h
Learn the core concepts
Choose one full course or book for coverage. Use MindMaps to connect topics and review the larger picture.
Best structured courseCISSP Masterclass
Best official courseOfficial ISC2 CISSP Online Self-Paced Training
Best bookCISSP Official Study Guide, 10th editionApply the question’s role. Identify what the question asks you to do. A governance decision, an incident response and a technical configuration need different actions.
Practice with mock exams
Use a question bank to find weak concepts and review the reasoning behind each option. Add timed practice so you can make decisions without returning to earlier questions.
See all 7 CISSP practice tests →Are you ready?
- You can explain the main concepts across all eight domains.
- You can connect a control choice to the risk or business objective in the scenario.
- You can finish timed sets without relying on backtracking.
Prepare for exam day
CISSP is taken at an authorized test centre. Prepare for the check-in and adaptive format.
- Bring the accepted identification listed in your Pearson VUE confirmation, with names matching the booking.
- Arrive at the stated check-in time and expect security checks, including palm-vein scanning where used.
- Read each question carefully before submitting; you cannot revisit it.
- Keep track of your three-hour limit. The clock continues during breaks.
- Collect your provisional result and follow ISC2’s instructions for endorsement or Associate status.
Advice from exam takers
Keep your attention on the next question.
Candidates report passing at different question counts, including the full 150. Practise staying focused when the exam continues longer than expected.