ISC2 CISSP
ISC2 CISSP is the cybersecurity industry's broadest senior-level credential. Eight domains spanning risk management, asset security, architecture, network security, IAM, assessment, operations, and software development security. 100 to 150 adaptive multiple-choice and advanced-format questions, 3 hours, passing score 700 on a scaled 100-1000 scale. Requires five years of paid experience in two or more domains, waivable by one year with an approved degree or credential.
Exam fee at last check: $749, per the vendor. The official objectives are at www.isc2.org/certifications/cissp/cissp-certification-exam-outline. Verified 2026-09-26.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
- Security and Risk Management16%
- Asset Security10%
- Security Architecture and Engineering13%
- Communication and Network Security13%
- Identity and Access Management (IAM)13%
- Security Assessment and Testing12%
- Security Operations13%
- Software Development Security10%
Source: Vendor exam objectives. Checked 2026-09-26. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
What's on the exam
Security and Risk Management 16%
The largest domain. Risk management concepts, security governance, legal and regulatory compliance, and personnel security.
- Risk responses: accept, mitigate, transfer, avoid
- Policy, standard, guideline, and procedure hierarchy
- Regulatory compliance: GDPR, SEC cybersecurity disclosure, sector-specific requirements
- Third-party and supply chain risk management
- Personnel security: onboarding, offboarding, separation of duties, job rotation
Primary sources: NIST SP 800-37 Rev. 2, Risk Management Framework, NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices, GDPR
Asset Security 10%
Data classification, ownership, retention, and secure handling and disposal of information assets.
- Data classification schemes and the data owner vs data custodian distinction
- Media sanitization: Clear, Purge, Destroy (NIST SP 800-88)
- Data retention and secure destruction policy
- PCI DSS scope reduction via network segmentation
Primary sources: NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization, PCI DSS v4.0
Security Architecture and Engineering 13%
Formal security models, cryptography, evaluation criteria, and physical security engineering.
- Bell-LaPadula (confidentiality) and Biba (integrity) formal models
- Common Criteria (ISO/IEC 15408) and Evaluation Assurance Levels
- Symmetric vs asymmetric cryptography, AES, TLS
- Physical security: fire suppression, data center controls
Primary sources: NIST FIPS 197, Advanced Encryption Standard, ISO/IEC 15408, Common Criteria
Communication and Network Security 13%
Secure network architecture, segmentation, remote access, and protocol security.
- DMZ and network segmentation for containment
- VPN technologies (IPsec, TLS-based)
- TLS vs deprecated SSL, secure protocol selection
- OT/ICS network isolation from IT networks
Primary sources: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy, NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Identity and Access Management (IAM) 13%
Access control models, authentication factors, and federated identity.
- RBAC, ABAC, DAC, and MAC access control models
- Multi-factor authentication and factor categories
- Federated identity and SSO (SAML)
- Zero-trust principles applied to access decisions
Primary sources: NIST SP 800-63B, Digital Identity Guidelines: Authentication, NIST SP 800-162, Guide to Attribute Based Access Control (ABAC)
Security Assessment and Testing 12%
Testing methodologies (SAST/DAST, black/white/gray-box) and business continuity plan validation.
- SAST vs DAST
- Black-box, white-box, and gray-box penetration testing
- BCP/DR test types: tabletop, parallel, full interruption
Primary sources: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, NIST SP 800-34 Rev. 1, Contingency Planning Guide
Security Operations 13%
Incident response, digital forensics, and continuous monitoring.
- Chain of custody and order of volatility
- RTO and RPO in disaster recovery planning
- Threat hunting and dwell-time reduction
Primary sources: RFC 3227, Guidelines for Evidence Collection and Archiving, NIST SP 800-137, Information Security Continuous Monitoring
Software Development Security 10%
Secure SDLC practices, common vulnerability classes, and supply chain integrity for software.
- Shifting security left in CI/CD
- OWASP Top 10 vulnerability classes (injection, XSS, CSRF)
- Software Bill of Materials (SBOM)
- Separation of duties in code review
Primary sources: NIST SP 800-218, Secure Software Development Framework, OWASP Top 10:2021
Exam-day strategy
CISSP uses computerized adaptive testing (CAT): the exam length (100-150 questions) and difficulty adjust based on your performance, so you cannot skip and return to earlier questions.
Answer from an ISC2/management perspective, not just a technical one. CISSP frequently rewards the answer that reflects proper process, policy, and risk management over a purely technical fix.
When two options both sound technically correct, look for the one that matches the exact model or framework named in the question (e.g., Bell-LaPadula vs Biba, RTO vs RPO).
Domain 1 (Security and Risk Management) is the single largest domain at 16%. Know risk response types and the policy/standard/guideline/procedure hierarchy cold.
Do not confuse SAST (static, no execution) with DAST (dynamic, requires execution), or RBAC (role-based) with ABAC (attribute-based, contextual); these pairs are common distractors for each other.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of ISC2. CISSP is a trademark of ISC2. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.