ISC2 Certification

CISSP

Certified Information Systems Security Professional

ISC2 | 8 domains · 84 lessons and reviews | Free Preview

CISSP is a widely recognized, experience-based information security certification covering eight domains. This track emphasizes the broad technical and managerial judgment the exam measures, including connections among governance, architecture, engineering, operations, and software security.

Exam Details

CISSP exam details
Detail CISSP
Format CAT adaptive, 100–150 questions
Time 3 hours
Standard Exam Fee (USD; verify regional price) $749 USD
Passing Score 700 out of 1000
Experience 5 years of cumulative qualifying experience in at least 2 of the 8 domains. A relevant bachelor’s or master’s degree, or an ISC2-approved credential, can satisfy up to 1 year; qualifying part-time work and internships may count
Renewal 120 CPE credits per 3-year cycle; annual AMF $135

Source and Scope Note

Track scope checked August 24, 2026. The reference was the ISC2 CISSP Certification Exam Outline, effective April 15, 2024.

This note records the outline used for the track; it does not mean ISC2 reviewed or endorsed the lessons. The practice material is original and does not reproduce live exam items. Report a content issue.

What You’ll Learn

  • Develop the managerial thinking ISC2 expects for security decisions
  • Build breadth across all eight CISSP domains without sacrificing depth
  • Prepare for the CAT exam format with targeted strategy
  • Use domain evidence and a limited Domain 6 objective check to identify study gaps
Start a Free Lesson →
Domain 1 — Security and Risk Management (16%)

Professional ethics, security governance principles, legal and regulatory compliance, business continuity, risk management concepts, threat modeling, supply chain risk, and security awareness programs.

Section A — Governance and Legal

  1. 1 Professional Ethics and ISC2 Code Free Free Preview
  2. 2 Core Security Concepts Full Access
  3. 3 Security Governance Principles Full Access
  4. 4 Legal, Regulatory, and Compliance Full Access
  5. 5 Investigation Types Full Access
  6. 6 Security Policy Development and Implementation Full Access
  7. ✓ Section A Review: Governance and Legal Full Access

Section B — Risk and Continuity

  1. 7 Business Continuity Requirements and BIA Full Access
  2. 8 Personnel Security Policies Full Access
  3. 9 Risk Management Concepts and Frameworks Full Access
  4. 10 Threat Modeling Methodologies Full Access
  5. 11 Supply Chain Risk Management Full Access
  6. 12 Security Awareness and Training Programs Full Access
  7. ✓ Section B Review: Risk and Continuity Full Access

Domain 1 Review

  1. ★ Capstone Review: SECURITY AND RISK MANAGEMENT Full Access
Domain 2 — Asset Security (10%)

Information and asset classification, handling requirements, secure provisioning, data lifecycle management, asset retention, and data security controls and compliance.

Section A — Classification and Provisioning

  1. 13 Information and Asset Classification Free Free Preview
  2. 14 Asset Handling Requirements Full Access
  3. 15 Secure Asset Provisioning and Inventory Full Access
  4. ✓ Section A Review: Classification and Provisioning Full Access

Section B — Data Lifecycle and Controls

  1. 16 Data Lifecycle Management Full Access
  2. 17 Asset Retention Full Access
  3. 18 Data Security Controls and Compliance Full Access
  4. ✓ Section B Review: Data Lifecycle and Controls Full Access

Domain 2 Review

  1. ★ Capstone Review: ASSET SECURITY Full Access
Domain 3 — Security Architecture and Engineering (13%)

Secure design principles, security models, control selection, system security capabilities, vulnerability mitigation, cryptographic solutions, cryptanalytic attacks, site and facility security, and information system lifecycle.

Section A — Design Principles and Models

  1. 19 Secure Design Principles Free Free Preview
  2. 20 Security Models Full Access
  3. 21 Security Requirements and Control Selection Full Access
  4. 22 Information System Security Capabilities Full Access
  5. ✓ Section A Review: Design Principles and Models Full Access

Section B — Vulnerabilities and Cryptography

  1. 23 Vulnerability Mitigation Full Access
  2. 24 Cryptographic Solutions and Lifecycle Full Access
  3. 25 Cryptanalytic Attacks Full Access
  4. ✓ Section B Review: Vulnerabilities and Cryptography Full Access

Section C — Physical Security and System Lifecycle

  1. 26 Site and Facility Security Principles Full Access
  2. 27 Facility Design Controls Full Access
  3. 28 Information System Lifecycle Management Full Access
  4. ✓ Section C Review: Physical Security and System Lifecycle Full Access

Domain 3 Review

  1. ★ Capstone Review: SECURITY ARCHITECTURE AND ENGINEERING Full Access
Domain 4 — Communication and Network Security (13%)

Secure network architecture design, secure network component implementation, and secure communication channels.

Section A — Network Architecture and Security

  1. 29 Secure Network Architecture Design Free Free Preview
  2. 30 Secure Network Component Implementation Full Access
  3. 31 Secure Communication Channel Implementation Full Access
  4. ✓ Section A Review: Network Architecture and Security Full Access

Domain 4 Review

  1. ★ Capstone Review: COMMUNICATION AND NETWORK SECURITY Full Access
Domain 5 — Identity and Access Management (13%)

Physical and logical access control, identification and authentication strategy, federated identity, authorization mechanisms, access provisioning lifecycle, and authentication systems.

Section A — Identity and Authentication

  1. 32 Physical and Logical Access Control Free Free Preview
  2. 33 Authentication Strategy Design Full Access
  3. 34 Federated Identity with Third Parties Full Access
  4. ✓ Section A Review: Identity and Authentication Full Access

Section B — Authorization and Lifecycle

  1. 35 Authorization Mechanisms Full Access
  2. 36 Identity and Access Provisioning Lifecycle Full Access
  3. 37 Authentication Systems Implementation Full Access
  4. ✓ Section B Review: Authorization and Lifecycle Full Access

Domain 5 Review

  1. ★ Capstone Review: IDENTITY AND ACCESS MANAGEMENT Full Access
Domain 6 — Security Assessment and Testing (12%)

Assessment and audit strategy design, security control testing, security process data collection, test output analysis and reporting, and security audit facilitation.

Section A — Assessments and Testing

  1. 38 Assessment and Audit Strategy Design Free Free Preview
  2. 39 Security Control Testing Methods Full Access
  3. 40 Security Process Data Collection Full Access
  4. 41 Test Output Analysis and Reporting Full Access
  5. 42 Security Audits Facilitation Full Access
  6. ✓ Section A Review: Assessments and Testing Full Access

Domain 6 Review

  1. ★ Capstone Review: SECURITY ASSESSMENT AND TESTING Full Access
Domain 7 — Security Operations (13%)

Investigations and evidence handling, logging and monitoring, configuration management, incident management, detection and prevention, patch and vulnerability management, recovery strategies, disaster recovery, business continuity, and physical security.

Section A — Investigations and Monitoring

  1. 43 Investigation Compliance and Evidence Handling Free Free Preview
  2. 44 Logging and Monitoring Activities Full Access
  3. 45 Configuration Management Full Access
  4. 46 Foundational Security Operations Concepts Full Access
  5. 47 Resource Protection Full Access
  6. 48 Incident Management Lifecycle Full Access
  7. 49 Detection and Preventative Measures Full Access
  8. ✓ Section A Review: Investigations and Monitoring Full Access

Section B — Recovery and Continuity

  1. 50 Patch and Vulnerability Management Full Access
  2. 51 Change Management Full Access
  3. 52 Recovery Strategies Full Access
  4. 53 Disaster Recovery Processes Full Access
  5. 54 Disaster Recovery Plan Testing Full Access
  6. 55 Business Continuity Planning Full Access
  7. 56 Physical Security Implementation Full Access
  8. 57 Personnel Safety and Security Full Access
  9. ✓ Section B Review: Recovery and Continuity Full Access

Domain 7 Review

  1. ★ Capstone Review: SECURITY OPERATIONS Full Access
Domain 8 — Software Development Security (10%)

Security integration in the SDLC, security controls in development ecosystems, software security effectiveness assessment, acquired software security impact, and secure coding guidelines and standards.

Section A — Secure Development

  1. 58 SDLC Security Integration Free Free Preview
  2. 59 Security Controls in Development Ecosystems Full Access
  3. 60 Software Security Effectiveness Assessment Full Access
  4. 61 Acquired Software Security Impact Full Access
  5. 62 Secure Coding Guidelines and Standards Full Access
  6. ✓ Section A Review: Secure Development Full Access

Domain 8 Review

  1. ★ Capstone Review: SOFTWARE DEVELOPMENT SECURITY Full Access

Career Benefits

  • Relevant to senior security engineering, architecture, consulting, and leadership roles
  • Listed as a qualification option for certain DoD 8140 work roles; verify the current matrix for a specific position
  • Covers a broad security body of knowledge used across many industries
  • May be requested or valued for senior security architecture, consulting, and leadership roles

How It Compares

CISSP provides broad coverage across eight security domains, while CISM focuses specifically on security-program management. CySA+ V4 (CS0-004) occupies a different part of the path: it concentrates on analyst operations, vulnerability management, incident response, and reporting across four domains. CompTIA recommends approximately four years of relevant hands-on analyst experience for CySA+ but does not impose an experience prerequisite.

Choose CySA+ when you want focused operational-analysis depth; choose CISSP when your qualifying experience and goals span a broader set of technical and managerial domains. CySA+ is neither a prerequisite for CISSP nor a substitute for CISSP’s experience requirement. See the full comparison →

Head-to-head comparisons: CISSP vs CISM · CRISC vs CISSP · Security+ vs CISSP