During a building fire, what is the HIGHEST priority for the security professional?
Domain 1
Answer: B · whyHuman life and safety always come first.
ISC2 · Security Management & Architecture
CISSP - Certified Information Systems Security Professional
Security managers, architects, engineers, consultants, auditors and GRC leads who need broad, management-level security knowledge across eight domains. Widely required for senior security roles in the Gulf and globally.
Overview
- Prerequisites
- 5 years cumulative, full-time paid experience in 2 or more of the 8 domains. A relevant bachelor's/master's degree or an ISC2-approved credential can waive 1 year (maximum 1 year). Candidates without the experience can pass and become an Associate of ISC2, then have 6 years to earn it. Endorsement by an ISC2 member is required after passing.
- Maintenance
- Earn 120 CPE credits per 3-year cycle (90 Group A + 30 Group A or B; ISC2 suggests about 40 a year) and pay the US$135 annual maintenance fee. Follow the ISC2 Code of Ethics.
- Outline in effect
- 15 Apr 2024
Exam facts
- Questions
- 100-150 items
- Duration
- 3 hours
- Question types
- Multiple choice and advanced item types (e.g., drag-and-drop, hotspot)
- Passing score
- 700 out of 1000
- Format
- Computerized Adaptive Testing (CAT) in all languages
- Delivery
- ISC2-authorised Pearson VUE test centres
- Languages
- English, Chinese, German, Japanese, Spanish (Chinese in set windows only)
Cost
- Exam fee
- US$749 (Americas, Asia-Pacific, Middle East, Africa); EUR 719.04 (EMEA); GBP 606.69 (UK)
- Notes
- Taxes vary by exam location. Reschedule US$50; cancellation US$100. After certification: US$135 ISC2 annual maintenance fee (one fee covers all ISC2 certifications).
Domains & weights
- 1. Security and Risk Management16%
- 2. Asset Security10%
- 3. Security Architecture and Engineering13%
- 4. Communication and Network Security13%
- 5. Identity and Access Management (IAM)13%
- 6. Security Assessment and Testing12%
- 7. Security Operations13%
- 8. Software Development Security10%
Upcoming changes
- New CISSP exam outline effective 15 Apr 2027 (Domain 1 becomes 'Security Governance and Risk Management'; weights rebalanced).
New outline from 15 Apr 2027
- 1. Security Governance and Risk Management13.6%
- 2. Asset Security12%
- 3. Security Architecture and Engineering12.8%
- 4. Communication and Network Security12.8%
- 5. Identity and Access Management (IAM)13.6%
- 6. Security Assessment and Testing11.2%
- 7. Security Operations12.8%
- 8. Software Development Security11.2%
Same CAT format (3 hours, 100-150 items, 700/1000). Domain 1 renamed; weights rebalanced.
Study plan
- Week 1
Domain 1 (part 1)
- Read the exam outline for YOUR exam date (2024 outline until 14 Apr 2027).
- Ethics (ISC2 Code), CIA/authenticity/non-repudiation, governance, due care vs due diligence.
- Diagnostic 100 questions.
- Week 2
Domain 1 (part 2)
- Legal/regulatory (GDPR, privacy, IP, transborder flows), policies, BC requirements and BIA, personnel security.
- Risk concepts, control types, supply chain risk, awareness programmes.
- Week 3
Domain 2 - Asset Security
- Classification, ownership, data roles (owner, controller, custodian, processor), data life cycle, remanence and destruction, scoping/tailoring, DLP/CASB/DRM.
- Week 4
Domain 3 (part 1)
- Secure design principles (least privilege, defence in depth, zero trust, privacy by design), security models (Bell-LaPadula, Biba, Clark-Wilson).
- Vulnerabilities of cloud, IoT, ICS, containers, serverless.
- Week 5
Domain 3 (part 2)
- Cryptography: symmetric vs asymmetric, hashing, PKI, key life cycle, cryptanalytic attacks.
- Site and facility security, fire suppression, power.
- Week 6
Domain 4
- OSI/TCP-IP, IPv6, secure protocols (TLS, IPSec, SSH), segmentation and micro-segmentation, wireless, CDN, SDN, VPC.
- Secure communication channels and remote access.
- Week 7
Domain 5 - IAM
- Identification/authentication/authorisation, MFA, passwordless, federation (SAML/OIDC), SSO, JIT.
- Access control models: DAC, MAC, RBAC, ABAC, risk-based; provisioning life cycle and access reviews.
- Week 8
Domain 6
- Assessment and audit strategies, vulnerability scanning vs penetration testing, log review, synthetic transactions, code review, BAS.
- KPIs/KRIs, reporting, exception handling.
- Week 9
Domain 7 (part 1)
- Investigations and evidence, logging/SIEM/UEBA, threat intel, configuration management, foundational ops concepts.
- Incident management steps; detective/preventive tools.
- Week 10
Domain 7 (part 2) + Domain 8
- Patch/change management, recovery strategies, DR processes and test types, BC exercises, physical and personnel safety.
- SDLC and DevSecOps, maturity models (CMM, SAMM), CI/CD security, SAST/DAST/SCA, acquired software risk, API security.
- Week 11
Full-length practice
- Two timed CAT-style practice exams; analyse misses by domain.
- Revisit 'think like a manager' scenarios.
- Week 12
Final review
- Light revision with summary notes and a short-video exam cram; rest the day before the exam.
Exam tips
- CAT exams do not let you go back or skip: answer each item, then move on. Do not panic if questions feel hard - that usually means you are performing well.
- You need 700/1000 on the scaled score; the exam can end anywhere between the minimum and maximum number of items.
- Pace yourself: with up to 150 items in 3 hours you have just over a minute per item; schedule a short break if offered.
- Book at a Pearson VUE centre well in advance and bring the IDs required by ISC2's exam policies.
- Think like a risk adviser/manager: human safety first, then business objectives; pick the answer that addresses root cause and policy before technology.
- If two answers seem right, choose the one that is broader, earlier in the process, or involves management decision-making.
Common pitfalls
- Going too deep into technical detail and too shallow on governance and risk.
- Not practising CAT-style questions where you cannot go back.
- Mixing up data roles: owner (accountable) vs custodian (implements protection).
- Studying the 2027 outline weights before 15 Apr 2027 - make sure your materials match your exam date.
Resources & official links
Official
- CISSP Certification Exam Outline (current) and 2027 outline
- ISC2 CISSP Official Study Guide and Official Practice Tests (Sybex)
- ISC2 Official CISSP Training (self-paced / instructor-led)
- ISC2 supplementary references list
Also widely used
- Destination CISSP (Rob Witcher) mind-map videos
- Pete Zerger CISSP exam cram (Inside Cloud and Security)
- Mike Chapple's CISSP course and practice tests
- Eleventh Hour CISSP for final review
- Reddit r/cissp study reports
Sources
- ISC2 CISSP exam outline page (format, weights, experience, 2027 notice)
- ISC2 CISSP Exam Outline effective 15 April 2027 (PDF)
- ISC2 exam pricing
- ISC2 Annual Maintenance Fees overview
- ISC2 Certification Maintenance (CPE) Handbook
- ISC2: CAT format updates for CC, SSCP, CCSP (14 May 2025)
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Due care is BEST described as:
Domain 1
Answer: B · whyDue diligence is investigating; due care is acting responsibly on what you know.
Who is ultimately accountable for classifying a dataset?
Domain 2
Answer: B · whyThe data owner decides classification; custodians implement the required protection.
Which method gives the MOST assurance that data on a decommissioned SSD cannot be recovered?
Domain 2
Answer: C · whyPhysical destruction or crypto-erase addresses SSD wear-levelling remanence.
Which rule belongs to the Biba integrity model?
Domain 3
Answer: B · whyBiba protects integrity: a subject must not write to a higher integrity level (star integrity) or read from a lower one (simple integrity). 'No read up' and 'no write down' are Bell-LaPadula confidentiality rules.
Which provides integrity and non-repudiation for a message?
Domain 3
Answer: B · whySigning with the sender's private key proves origin and integrity.
An administrator needs encrypted, authenticated remote command-line access to Linux servers. Which protocol fits BEST?
Domain 4
Answer: B · whySSH encrypts the session and authenticates the server and user; Telnet, FTP and SNMPv1 send data in clear text.
Which access control model grants access based on attributes of the user, resource and environment?
Domain 5
Answer: C · whyAttribute-based access control evaluates policies over multiple attributes.
A user moves departments and keeps old permissions. Which process BEST prevents this?
Domain 5
Answer: B · whyTransfers should trigger deprovisioning of old rights and periodic reviews catch creep.
What is the MAIN difference between a vulnerability scan and a penetration test?
Domain 6
Answer: B · whyPen tests go further by exploiting vulnerabilities; both require authorisation.
Which DR test runs critical systems at the alternate site WITHOUT stopping production?
Domain 7
Answer: B · whyA parallel test activates the recovery site while production keeps running.
Software composition analysis (SCA) is mainly used to:
Domain 8
Answer: A · whySCA inventories third-party libraries and flags known vulnerabilities and licence issues.