- CISSP Exam Overview 2027
- Domain 1: Security and Risk Management (16%)
- Domain 2: Asset Security (10%)
- Domain 3: Security Architecture and Engineering (13%)
- Domain 4: Communication and Network Security (13%)
- Domain 5: Identity and Access Management (13%)
- Domain 6: Security Assessment and Testing (12%)
- Domain 7: Security Operations (13%)
- Domain 8: Software Development Security (10%)
- Understanding Domain Weightings and Study Strategy
- Study Recommendations by Domain
- Frequently Asked Questions
CISSP Exam Overview 2027
The Certified Information Systems Security Professional (CISSP) certification remains one of the most prestigious and challenging credentials in cybersecurity. Governed by ISC2 and administered through Pearson VUE, the CISSP exam tests candidates across eight comprehensive domains that encompass the breadth of information security knowledge required for senior-level positions.
The current exam outline became effective April 15, 2024, and remains valid through 2026. The difficulty of the CISSP exam is legendary in the cybersecurity community, requiring not just theoretical knowledge but practical application of security principles across diverse organizational contexts.
The English version of the CISSP exam uses a computer adaptive testing format, meaning the difficulty of subsequent questions adjusts based on your performance. This format requires thorough preparation across all domains, as you cannot rely on easier questions to boost your score.
Understanding each domain's weight and content is crucial for developing an effective study strategy. With five years of cumulative paid work experience required (or four years with a degree), most CISSP candidates are seasoned professionals who need to bridge knowledge gaps strategically rather than learn everything from scratch.
Domain 1: Security and Risk Management (16%)
As the largest domain by weight, Security and Risk Management forms the foundation of the CISSP body of knowledge. This domain encompasses governance, risk management frameworks, compliance requirements, and the business aspects of information security.
Core Topics in Domain 1
The domain covers confidentiality, integrity, and availability (CIA) concepts, governance principles, organizational roles and responsibilities, and risk management processes. Candidates must understand how to align security initiatives with business objectives and regulatory requirements.
- Risk Management Frameworks: NIST RMF, ISO 27005, OCTAVE
- Governance Structures: Board oversight, security committees, policy development
- Compliance: SOX, HIPAA, GDPR, PCI DSS requirements
- Business Continuity: BCP, DRP, crisis management
- Legal and Ethical Issues: Due care, due diligence, liability
For comprehensive coverage of this critical domain, refer to our detailed CISSP Domain 1 study guide, which provides in-depth analysis of each topic area and practical examples.
Many technical professionals struggle with the business-focused aspects of Domain 1. Pay special attention to risk management methodologies, legal frameworks, and governance concepts that may be outside your day-to-day experience.
Domain 2: Asset Security (10%)
Asset Security focuses on proper handling of information and assets throughout their lifecycle. Despite being the smallest domain by percentage, it contains critical concepts that appear throughout the exam.
Information Classification and Handling
This domain emphasizes data classification schemes, handling requirements, and retention policies. Understanding how different classification levels (Top Secret, Secret, Confidential in government; Restricted, Confidential, Internal, Public in commercial settings) drive handling requirements is essential.
- Data Classification: Military, commercial, and custom schemes
- Asset Handling: Marking, storage, transmission, destruction
- Data Roles: Owner, custodian, user responsibilities
- Privacy Protection: PII, PHI, data subject rights
- Asset Inventory: Discovery, classification, tracking
The comprehensive Domain 2 guide provides detailed coverage of asset lifecycle management and practical implementation strategies for various organizational contexts.
Domain 3: Security Architecture and Engineering (13%)
Security Architecture and Engineering covers the design and implementation of secure systems. This domain bridges theoretical security principles with practical system design and evaluation.
Secure Design Principles
Fundamental security design principles form the backbone of this domain. Understanding concepts like defense in depth, fail-safe defaults, least privilege, and separation of duties is crucial for both the exam and real-world security architecture.
- Security Models: Bell-LaPadula, Biba, Clark-Wilson, Chinese Wall
- System Architecture: Reference monitors, security kernels, TCB
- Security Capabilities: Cryptography, PKI, key management
- Physical Security: Facility design, environmental controls
- Secure System Design: Threat modeling, attack surface analysis
Focus on understanding the "why" behind security models and architectures rather than memorizing details. The exam tests your ability to apply these concepts to new scenarios, not just recall facts.
Our detailed Domain 3 study guide breaks down complex architectural concepts into manageable sections with practical examples and implementation guidance.
Domain 4: Communication and Network Security (13%)
Communication and Network Security encompasses network protocols, secure communications, and network-based security controls. This domain requires both theoretical protocol knowledge and practical understanding of network security implementation.
Network Security Fundamentals
The domain covers OSI and TCP/IP models, routing and switching concepts, and various network security technologies. Understanding how different layers interact and where security controls can be implemented is essential.
| OSI Layer | Protocols | Security Controls |
|---|---|---|
| Application (7) | HTTP, SMTP, DNS | WAF, Application Firewalls |
| Presentation (6) | TLS, SSL | Encryption, Compression |
| Session (5) | NetBIOS, RPC | Session Management |
| Transport (4) | TCP, UDP | Stateful Firewalls |
| Network (3) | IP, ICMP, IPSec | Routers, Packet Filters |
| Data Link (2) | Ethernet, PPP | VLANs, MAC Filtering |
| Physical (1) | Cables, Wireless | Physical Access Controls |
- Network Protocols: TCP/IP suite, routing protocols, VPN technologies
- Network Security: Firewalls, IDS/IPS, network segmentation
- Secure Communications: VPNs, secure email, voice security
- Wireless Security: 802.11 standards, WPA/WPA2/WPA3
- Network Attacks: Common attack vectors and countermeasures
The Domain 4 comprehensive guide provides detailed protocol analysis and security implementation strategies for various network environments.
Domain 5: Identity and Access Management (13%)
Identity and Access Management (IAM) covers user identity lifecycle, authentication mechanisms, authorization models, and access control systems. This domain is increasingly important as organizations adopt cloud services and remote work models.
Access Control Models
Understanding different access control models and when to apply them is crucial. Each model serves different organizational needs and security requirements.
- Authentication: Multi-factor authentication, biometrics, single sign-on
- Authorization: RBAC, ABAC, DAC, MAC models
- Identity Management: Provisioning, deprovisioning, lifecycle management
- Federated Identity: SAML, OAuth, OpenID Connect
- Privileged Access: PAM solutions, just-in-time access
Modern IAM extends beyond traditional network boundaries. Cloud identity, zero trust architectures, and identity-centric security models are increasingly emphasized in the current exam version.
For detailed coverage of identity and access concepts, consult our Domain 5 study guide which includes practical implementation scenarios and technology comparisons.
Domain 6: Security Assessment and Testing (12%)
Security Assessment and Testing focuses on evaluating security controls, conducting security assessments, and managing vulnerability testing programs. This domain requires understanding of various testing methodologies and their appropriate applications.
Assessment and Testing Methodologies
The domain covers different types of security testing, from automated vulnerability scans to comprehensive penetration testing programs. Understanding when and how to apply each methodology is key to exam success.
- Vulnerability Assessment: Scanning tools, methodologies, remediation
- Penetration Testing: Black box, white box, gray box approaches
- Security Auditing: Compliance audits, internal assessments
- Test Results: Analysis, reporting, remediation tracking
- Continuous Monitoring: Ongoing assessment programs
The comprehensive Domain 6 guide provides detailed methodologies and best practices for implementing effective security assessment programs.
Domain 7: Security Operations (13%)
Security Operations encompasses the day-to-day activities required to maintain an organization's security posture. This domain covers incident response, logging and monitoring, disaster recovery, and operational security practices.
Incident Response and Management
Effective incident response requires structured processes, proper tools, and well-trained teams. The domain emphasizes the incident lifecycle from detection through lessons learned.
- Incident Response: NIST framework, playbooks, team structures
- Logging and Monitoring: SIEM, log analysis, alerting
- Disaster Recovery: Recovery strategies, testing, documentation
- Business Continuity: Continuity planning, alternate sites
- Evidence Handling: Chain of custody, forensic procedures
Our Domain 7 study guide provides practical frameworks for implementing effective security operations programs in various organizational contexts.
Domain 8: Software Development Security (10%)
Software Development Security addresses secure software development practices, application security testing, and software security throughout the development lifecycle. This domain is crucial as organizations increasingly rely on custom applications and DevSecOps practices.
Secure Development Lifecycle
The domain emphasizes integrating security throughout the software development process, from requirements gathering through deployment and maintenance.
- Secure Coding: Common vulnerabilities, secure programming practices
- Application Security: OWASP Top 10, web application security
- Software Testing: Static analysis, dynamic testing, code review
- Database Security: Access controls, encryption, injection attacks
- DevSecOps: Continuous security, automated testing
While this is the smallest domain by weight, software security concepts appear throughout the exam. Pay particular attention to secure coding practices and application security testing methodologies.
Understanding Domain Weightings and Study Strategy
The domain weightings provide guidance on exam emphasis, but successful candidates must demonstrate competency across all domains. The Computer Adaptive Testing format means you cannot predict which domains will be emphasized in your specific exam session.
When developing your study plan, consider both the domain weights and your existing knowledge. Many candidates benefit from starting with their strongest domains to build confidence before tackling areas requiring more intensive study.
Study Recommendations by Domain
Effective CISSP preparation requires a strategic approach that accounts for domain interconnections. Concepts from one domain frequently appear in questions from other domains, reflecting the integrated nature of information security.
High-Priority Study Areas
Based on domain weights and typical candidate feedback, prioritize these areas for intensive study:
- Domain 1 (Security and Risk Management): Focus on risk management frameworks, governance concepts, and legal/regulatory requirements
- Domains 3, 4, 5, 7: These equally-weighted domains require balanced attention across technical and managerial concepts
- Cross-cutting Concepts: Cryptography, access controls, and incident response appear across multiple domains
Regular practice with realistic exam questions is essential for success. Our practice test platform provides domain-specific questions and comprehensive explanations to reinforce your understanding of key concepts.
Don't study domains in isolation. Look for connections between domains and understand how security controls work together to create comprehensive protection. This integrated approach mirrors how the exam tests your knowledge.
For a complete preparation strategy that covers all domains effectively, consult our comprehensive CISSP study guide, which provides detailed timelines and resource recommendations for different candidate backgrounds.
Consider supplementing your domain studies with targeted practice questions to identify knowledge gaps and reinforce learning. The adaptive nature of the exam requires thorough preparation across all domains to ensure success.
Understanding the total investment required for CISSP certification helps you plan your preparation timeline and resource allocation effectively. With proper preparation and strategic studying, the significant investment can yield substantial career benefits.
In your final weeks before the exam, focus on reviewing domain interconnections and practicing with full-length exams. Use our comprehensive practice tests to simulate the actual exam experience and build confidence in your preparation.
Domain 1: Security and Risk Management carries the highest weight at 16% of the exam. This domain covers governance, risk management, compliance, and business aspects of information security.
While you should be competent in all domains, you can allocate study time based on domain weights and your existing knowledge. However, the CAT format means you cannot predict which domains will be emphasized in your specific exam session.
Domain weights are approximate percentages, not exact question counts. The Computer Adaptive Testing format adjusts based on your performance, so you might see varying emphasis on different domains during your exam.
Domain 1 (Security and Risk Management) often challenges technical professionals due to its business and governance focus, while Domain 3 (Security Architecture and Engineering) can be difficult due to complex security models and mathematical concepts.
ISC2 periodically updates the CISSP exam outline based on job task analysis studies. The current outline became effective April 15, 2024, and domain weights typically remain stable for several years between major revisions.
Ready to Start Practicing?
Master all 8 CISSP domains with our comprehensive practice tests. Get detailed explanations, track your progress by domain, and build the confidence you need to pass on your first attempt.
Start Free Practice Test