CISSP study guide · 2026

The 8 CISSP domains, explained

8 domains and 62 official sub-objectives. Security and Risk Management carries the most weight at 16%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
100–150 (Computerized Adaptive Testing)
Time
3 hours
Passing score
700 out of 1000 scaled points
Outline
CISSP Exam Outline (Detailed Content Outline), effective April 15, 2024 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 16%
  2. 2 10%
  3. 3 13%
  4. 4 13%
  5. 5 13%
  6. 6 12%
  7. 7 13%
  8. 8 10%
  1. 1 Security and Risk Management
  2. 2 Asset Security
  3. 3 Security Architecture and Engineering
  4. 4 Communication and Network Security
  5. 5 Identity and Access Management (IAM)
  6. 6 Security Assessment and Testing
  7. 7 Security Operations
  8. 8 Software Development Security

All 8 domains

62 official sub-objectives 220–280 hrs suggested study

  1. Domain 01 16%

    Security and Risk Management

    The heaviest CISSP domain at 16%, and the one that teaches the manager's mindset the whole exam rewards: governance before technology, risk decisions owned by senior management, and ethics that settle conflicts.

    Inside this domain

    • Understand, adhere to, and promote professional ethics
    • Understand and apply security concepts
    • Evaluate, apply, and sustain security governance principles
    • Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context
    • and 8 more sub-objectives

    Watch for Fixing it yourself

    Sub-objectives
    12
    Questions est.
    16–24
    Study time est.
    35–45 hrs
  2. Domain 02 10%

    Asset Security

    A compact 10% domain that decides who owns data, how it is labeled and handled, and how it is destroyed. Get the data roles right and many questions in other domains become easier.

    Inside this domain

    • Identify and classify information and assets
    • Establish information and asset handling requirements
    • Provision information and assets securely
    • Manage data lifecycle
    • and 2 more sub-objectives

    Watch for The administrator decides

    Sub-objectives
    6
    Questions est.
    10–15
    Study time est.
    20–30 hrs
  3. Domain 03 13%

    Security Architecture and Engineering

    The most technically dense CISSP domain at 13%: secure design principles, formal security models, cryptography and its attacks, and physical facility design. It rewards understanding why a mechanism works, not memorizing its name.

    Inside this domain

    • Research, implement, and manage engineering processes using secure design principles
    • Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)
    • Select controls based upon systems security requirements
    • Understand security capabilities of Information Systems (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)
    • and 6 more sub-objectives

    Watch for Wrong model for the property

    Sub-objectives
    10
    Questions est.
    13–20
    Study time est.
    30–35 hrs
  4. Domain 04 13%

    Communication and Network Security

    Only three sub-objectives, but 13% of the exam and a long list of protocols, architectures and components underneath them. The exam wants you to design and defend networks, not configure routers.

    Inside this domain

    • Apply secure design principles in network architectures
    • Secure network components
    • Implement secure communication channels according to design

    Watch for Perimeter for internal threats

    Sub-objectives
    3
    Questions est.
    13–20
    Study time est.
    30–35 hrs
  5. Domain 05 13%

    Identity and Access Management (IAM)

    Identity is the new perimeter, and this 13% domain tests how people, devices and services prove who they are and what they may do, from MFA and federation to access models and deprovisioning.

    Inside this domain

    • Control physical and logical access to assets
    • Design identification and authentication strategy (e.g., people, devices, and services)
    • Federated identity with a third-party service
    • Implement and manage authorization mechanisms
    • and 2 more sub-objectives

    Watch for Same-type MFA

    Sub-objectives
    6
    Questions est.
    13–20
    Study time est.
    30–35 hrs
  6. Domain 06 12%

    Security Assessment and Testing

    A 12% domain about proving that controls work. It tests how to plan assessments, choose the right test, read the results and report them so management can act.

    Inside this domain

    • Design and validate assessment, test, and audit strategies
    • Conduct security controls testing
    • Collect security process data (e.g., technical, and administrative)
    • Analyze test output and generate report
    • and 1 more sub-objectives

    Watch for Test now, authorize later

    Sub-objectives
    5
    Questions est.
    12–18
    Study time est.
    25–35 hrs
  7. Domain 07 13%

    Security Operations

    With 15 sub-objectives, Security Operations has the most objectives of any CISSP domain. It covers running security day to day: investigations, monitoring, incident response, patching and change, recovery, and keeping people safe.

    Inside this domain

    • Understand and comply with investigations
    • Conduct logging and monitoring activities
    • Perform configuration management (CM) (e.g., provisioning, baselining, automation)
    • Apply foundational security operations concepts
    • and 11 more sub-objectives

    Watch for Restore first

    Sub-objectives
    15
    Questions est.
    13–20
    Study time est.
    30–35 hrs
  8. Domain 08 10%

    Software Development Security

    A 10% domain that asks security leaders to build security into software rather than inspect it in at the end, covering the SDLC, development ecosystems, testing tools, acquired software and secure coding.

    Inside this domain

    • Understand and integrate security in the Software Development Life Cycle (SDLC)
    • Identify and apply security controls in software development ecosystems
    • Assess the effectiveness of software security
    • Assess security impact of acquired software
    • and 1 more sub-objectives

    Watch for Test security in at the end

    Sub-objectives
    5
    Questions est.
    10–15
    Study time est.
    20–30 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 220–280 hrs of study.

  1. 1 Security and Risk Management 16% · 35–45 hrs
  2. 3 Security Architecture and Engineering 13% · 30–35 hrs
  3. 4 Communication and Network Security 13% · 30–35 hrs
  4. 5 Identity and Access Management (IAM) 13% · 30–35 hrs
  5. 7 Security Operations 13% · 30–35 hrs
  6. 6 Security Assessment and Testing 12% · 25–35 hrs
  7. 2 Asset Security 10% · 20–30 hrs
  8. 8 Software Development Security 10% · 20–30 hrs

Try one

Practice questionDomain 1: Security and Risk Management

A server worth $400,000 faces a flood risk estimated at once every 20 years, with 50% of its value lost per event. A flood-proofing control costs $6,000 per year and would cut the annual rate to once every 100 years. What is the control's annual value?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Fixing it yourself

    Clue The scenario involves a business owner, an exception, or no active attack in progress.

  • Domain 2

    The administrator decides

    Clue The question asks who should determine, approve or be accountable.

  • Domain 3

    Wrong model for the property

    Clue Words such as corrupt, modify, tamper or trustworthy data.

  • Domain 4

    Perimeter for internal threats

    Clue Compromise spreads between internal servers or virtual machines.

  • Domain 5

    Same-type MFA

    Clue Check the factor type of each element, not the number of steps.

  • Domain 6

    Test now, authorize later

    Clue The question asks what must happen FIRST before testing.

  • Domain 7

    Restore first

    Clue The incident is ongoing or its source is unknown.

  • Domain 8

    Test security in at the end

    Clue The question asks where security is MOST effective or how to reduce recurring late findings.

Other Cybersecurity certifications

Study guides for exams that overlap with CISSP.

Practise what you read

CISSP domains: common questions

How many domains are in the CISSP exam?

CISSP has 8 domains with 62 official sub-objectives between them: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), Security Assessment and Testing, Security Operations and Software Development Security.

Which CISSP domain carries the most weight?

Security and Risk Management is the heaviest at 16%, followed by Security Architecture and Engineering (13%). The lightest is Software Development Security (10%). Weights come from ISC2's official outline.

What is the CISSP exam format?

Questions: 100–150 (Computerized Adaptive Testing). Time allowed: 3 hours. Passing score: 700 out of 1000 scaled points.

How long should I study for CISSP?

Our planning estimate is 220–280 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Security and Risk Management, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CISSP Exam Outline (Detailed Content Outline), effective April 15, 2024 (current), published by ISC2. It was last reviewed in October 2026.

Domain names, weights and sub-objectives come from ISC2's official outline (CISSP Exam Outline (Detailed Content Outline), effective April 15, 2024 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.