Updated October 16, 2026. This is our CISSP study hub: exam facts, the eight domains and their weights, a 12-week plan, five practice questions and an FAQ. Exam facts come from ISC2’s CISSP exam outline page and exam pricing page, checked on that date.
The CISSP is the ISC2 certification most security managers, architects and senior engineers end up needing. It is broad rather than deep, and it asks you to think like the person accountable for risk, not the person running the tool. If you want one writer’s first-hand account, read how I passed the CISSP without reading any books. This page is the reference you can come back to while you study.
CISSP exam facts at a glance
| Item | CISSP |
|---|---|
| Format | Computerized Adaptive Testing (CAT) for all exams |
| Questions | 100 to 150 |
| Time | 3 hours |
| Question types | Multiple choice and advanced item types |
| Passing score | 700 out of 1000 |
| Cost (standard registration) | US$749 in the Americas, Asia Pacific, Middle East and Africa; EUR 719.04 in EMEA; GBP 606.69 in the UK |
| Languages | English, Chinese, German, Japanese, Spanish |
| Where | Pearson VUE test centers |
| Experience to certify | Five years of cumulative full-time work in two or more of the eight domains (one year can be waived) |
Two things catch people out. First, the exam is adaptive, so it can stop anywhere between 100 and 150 questions, and stopping early does not mean you failed. Our guide to the CISSP adaptive exam explains how that works. Second, passing the exam does not make you a CISSP by itself. You still need the experience, or you become an Associate of ISC2 and have six years to earn it.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The eight CISSP domains and their weights
| Domain | Average weight |
|---|---|
| 1. Security and Risk Management | 16% |
| 2. Asset Security | 10% |
| 3. Security Architecture and Engineering | 13% |
| 4. Communication and Network Security | 13% |
| 5. Identity and Access Management (IAM) | 13% |
| 6. Security Assessment and Testing | 12% |
| 7. Security Operations | 13% |
| 8. Software Development Security | 10% |
Domain 1 is the largest and sets the tone for the whole exam: governance, risk, ethics, law and business continuity. The other seven sit close together, so there is no domain you can safely skip.
Outline change coming: ISC2 says the CISSP exam will be based on a new exam outline from April 15, 2027. If you plan to test after that date, download the upcoming outline from the ISC2 page above and study against it. ISC2 also says it now weaves AI-related security tasks through all eight domains.
A 12-week CISSP study plan
This assumes you already work in security and can give it 8 to 10 hours a week. If you are newer, stretch it to 16 to 20 weeks.
- Week 1: set up. Download the ISC2 outline. Rate yourself 1 to 5 on every sub-objective. Pick one main course or book and one question bank, and stop shopping.
- Weeks 2 to 3: Domain 1. Risk analysis, governance, policy, law, ethics and business continuity. Learn the ISC2 Code of Ethics canons in order.
- Week 4: Domains 2 and 8. Data roles, classification, retention and destruction, then secure SDLC, code review and testing types.
- Weeks 5 to 6: Domains 3 and 4. Security models, cryptography, cloud and physical security, then networking, segmentation and secure protocols.
- Week 7: Domain 5. Access control models, federation, SSO and the identity lifecycle.
- Week 8: Domains 6 and 7. Testing and audits, logging, incident management, DR testing types and recovery sites.
- Weeks 9 to 10: mixed practice. 75 to 100 questions a day across all domains. For every miss, write one line on why the right answer is right.
- Week 11: full-length practice. Two timed runs of 150 questions in 3 hours. Fix your weakest two domains.
- Week 12: light review and rest. Re-read your notes on why you missed questions. No new material in the last 48 hours.
Still picking your one main book? The ISC2 CISSP Official Study Guide is in the ExpertEdge by Packt library, alongside a guided Cybersecurity Analyst path, so your main reading and your study plan live in one place.
Get the ISC2 CISSP Official Study Guide on ExpertEdge (affiliate link). Code CYBEREX50 takes 50% off the first year of a yearly plan ($60 instead of $120).
Affiliate disclosure: we may earn a commission if you sign up through this link, at no cost to you.
The habit that helps most is reading every question as a manager would. When two answers both work, the CISSP usually wants the one that protects people first, follows policy, and deals with the root cause rather than the symptom. If you have already failed once, this guide to a second attempt covers the usual reasons.
CyberExperts Certification Lab. Free certification practice for 12 cybersecurity exams. No card needed.
Start practicing: CISSP sample questions Always free
5 CISSP practice questions with explanations
These are original practice questions in the CISSP style, not real exam items. Try each one before you open the answer.
Question 1. A fire alarm goes off in the data center during a critical database migration. What should the security manager do first?
- Make sure the migration is saved and can be rolled back
- Make sure everyone leaves the building safely
- Activate the disaster recovery plan
- Call the fire department and the CIO
Show answer
Answer: B. Human safety always comes first in CISSP questions. Data, systems and notifications all come after people are out of harm’s way.
Question 2. Who is ultimately responsible for deciding the classification of a set of customer records?
- The data custodian
- The data owner
- The security administrator
- The end user
Show answer
Answer: B. The data owner, usually a senior business leader, decides classification and who can access the data. The custodian carries out the technical protection the owner asks for.
Question 3. A company calculates that a server worth $50,000 has a 20% exposure factor to flooding and that a flood is expected once every 10 years. What is the annualized loss expectancy (ALE)?
- $1,000
- $10,000
- $5,000
- $500
Show answer
Answer: A. SLE = asset value x exposure factor = $50,000 x 0.2 = $10,000. ARO = 1 in 10 years = 0.1. ALE = SLE x ARO = $10,000 x 0.1 = $1,000.
Question 4. Which disaster recovery test runs the recovery site’s systems on real data while the primary site keeps operating normally?
- Tabletop exercise
- Walkthrough
- Parallel test
- Full interruption test
Show answer
Answer: C. A parallel test brings up the recovery site and processes real work alongside production, without shutting production down. A full interruption test actually shuts down the primary site, which is the riskiest option.
Question 5. Users in a company can share files they create with anyone they choose. Which access control model is this?
- Mandatory access control (MAC)
- Discretionary access control (DAC)
- Role-based access control (RBAC)
- Attribute-based access control (ABAC)
Show answer
Answer: B. In DAC the owner of an object decides who gets access. MAC relies on labels set by the system, RBAC grants rights by job role, and ABAC uses policies built on attributes.
For more, the CyberExperts Certification Lab has five public CISSP sample questions and a CISSP 10-question readiness check.
CyberExperts Certification Lab. Free certification practice for 12 cybersecurity exams. No card needed.
Start practicing: CISSP practice Always free
Where CISSP fits with other certifications
Most people get to the CISSP after a technical baseline like Security+ and some hands-on work, often including CySA+. If you are choosing between leadership certs, compare CISSP vs CISM and read our CISM guide. For cloud, see CISSP vs CCSP and the CCSP guide. If you want to stay hands-on, CompTIA SecurityX is the usual alternative. Not ready for the experience requirement yet? ISC2’s Certified in Cybersecurity (CC) is an entry point, and the certification roadmap shows the order most people take them in.
CISSP FAQ
How many questions are on the CISSP exam?
Between 100 and 150. The exam is adaptive, so it ends when it is confident about your result or when you reach 150 questions or 3 hours.
How long is the CISSP exam?
3 hours, per ISC2.
What is the CISSP passing score?
700 out of 1000.
How much does the CISSP exam cost?
US$749 for standard registration in the Americas, as listed on ISC2’s exam pricing page in October 2026. It is EUR 719.04 in EMEA and GBP 606.69 in the UK.
Can I take the CISSP without five years of experience?
Yes. You can sit and pass the exam, then become an Associate of ISC2. You then have six years to earn the five years of experience needed to become a full CISSP.
Is the CISSP exam changing?
Yes. ISC2 says the exam will follow a new exam outline from April 15, 2027. Check the upcoming outline if your exam date is after that.
How long should I study for the CISSP?
Most working security people need about 12 weeks at 8 to 10 hours a week. Newer people often need 16 to 20 weeks.
Sources: ISC2, CISSP Certification Exam Outline and ISC2 Exam Pricing, accessed October 16, 2026.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Blue Team Certifications (2026): CySA+, GCIA, BTL1 and SC-200 Compared
Blue team certifications compared from the issuers' own pages: CompTIA CySA+ V4, GIAC GCIA, BTL1 from Centri (Security Blue Team) and Microsoft...
Digital Forensics Certifications (2026): GCFA, CHFI, EnCE and CCE Compared
Digital forensics certifications compared from the issuers' own pages: GIAC GCFA and GCFE, EC-Council CHFI, OpenText EnCE and ISFCE CCE, with exam...
OT Security Certifications (2026): GICSP, ISA/IEC 62443 and CompTIA SecOT+ Compared
OT and ICS security certifications compared from the issuers' own pages: GIAC GICSP, ISA's ISA/IEC 62443 certificates, CompTIA's upcoming SecOT+ and GIAC...
Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
