The CISSP exam today: format, outline and eligibility

The Certified Information Systems Security Professional credential, almost always called the CISSP, is one of the most requested certifications in cybersecurity job postings. Employers use it as shorthand for a security professional who understands the whole field, from governance and risk to networks, identity, operations and software, and who can advise a business rather than only configure a product. This course is the last step in the CISSP track. The eight earlier courses taught the content of the eight domains: CISSP-110 security and risk management, CISSP-111 asset security, CISSP-112 security architecture and engineering, CISSP-113 communication and network security, CISSP-114 identity and access management, CISSP-115 security assessment and testing, CISSP-116 security operations and CISSP-117 software development security. CISSP-160 turns that knowledge into a passing exam result.

The course has four parts. Lessons 1 to 4 explain the exam itself: what it covers, the manager's mindset it rewards, how its adaptive engine chooses questions and how to read a question so that you answer what is asked. Lessons 5 to 8 work through the eight domains in pairs, with original practice questions written in the CISSP style and the reasoning behind every answer. Lessons 9 and 10 cover two areas that cut across all domains: professional ethics and the small set of calculations the exam expects. Lessons 11 and 12 cover practice exams, error logs, the final two weeks, exam day and what happens after you pass.

We return to Ridgeline Payments, the invented payments company of about 400 people headquartered in Denver that CISSP-117 followed. Ridgeline's board has asked for at least three CISSP holders on the security team before its next round of bank partnerships, because several partner banks ask for named, certified security leaders in their vendor questionnaires. Two people volunteer for the first study group. Hannah Cho leads governance, risk and compliance (GRC) and has eight years of experience in policy, audits and vendor risk. Tomás Reyes is a security engineer with six years in network security, cloud operations and incident response. Ridgeline's chief information security officer (CISO), Priya Raman, sponsors the plan and has agreed to endorse both of them once they pass. We follow Hannah and Tomás through the whole course.

The two learners start from opposite ends. Hannah is strong in Domains 1 and 2 and in anything involving policy, law and contracts, but she has never configured a firewall and worries about cryptography and network questions. Tomás is strong in Domains 3, 4 and 7, but he tends to answer as an engineer who wants to fix the problem himself, which, as lesson 2 shows, is often the wrong instinct on this exam. Between them they cover the common profiles of CISSP candidates, and their mistakes will probably look familiar.

The exam format

In English, the CISSP is delivered as a computerized adaptive test, usually shortened to CAT. A candidate sees between 100 and 150 items and has a maximum of three hours. The exam ends when the testing engine is confident, to a statistical standard, that the candidate's ability is above or below the passing standard, or when the candidate reaches 150 items, or when time runs out. Some candidates finish after 100 items and others see all 150; the length on its own tells you nothing about whether you passed.

Every item is answered in order, and once you confirm an answer you cannot go back to it. There is no review screen and no flagging. That one rule changes how you prepare, because the habit many people learn on school exams, skipping a hard question and returning to it later, is simply not available. Each item has to be decided on the spot, with whatever reasoning you can bring to it in a minute or two. Lesson 3 explains why the adaptive engine works this way and lesson 4 builds a routine for deciding under that pressure.

Among the first 100 items are 25 pretest items that ISC2 is trying out for future exams. They do not count toward your result, and nothing on the screen tells you which ones they are. Treat every item as if it counts. The remaining items are scored. Published summaries of the rules also note that a candidate who runs out of time before answering the minimum number of items fails automatically, which is one reason pacing matters even on an exam that can end early.

Results are reported on a scale of 0 to 1,000, and the passing standard is 700. This is a scaled score, not a percentage, and not a count of correct answers. Because each candidate sees a different set of items with different difficulties, two people with the same number of correct answers can have different results. Candidates who do not pass receive a report that ranks their performance by domain. It does not give a percentage for each domain, but it shows where the next round of study should go.

Exams in some other languages have been offered in a fixed-form, linear format with more items and more time. If you plan to sit in a language other than English, check the current format on the ISC2 website, because the strategy in this course assumes the adaptive English exam. Most candidates take the exam at a Pearson VUE test center. ISC2 has piloted and offered online delivery for some exams in some regions; whether it applies to the CISSP in your country, and under which conditions, is something to confirm when you book rather than assume.

The eight domains and their weights

ISC2 publishes an exam outline that lists the eight domains, the sub-domains inside each and the average weight of each domain. The outline in force for exams taken in 2026 took effect on 15 April 2024. Its weights are averages, which means any one candidate's exam may lean slightly toward one domain or another. They still tell you where most of the questions come from and how to divide study time.

ISC2 has also announced and published a new outline that takes effect on 15 April 2027. Published summaries describe it as an evolution rather than a rewrite. The weights move closer together: Domain 1 falls from 16 % to about 13.6 %, and Domains 2 and 8 rise. Named additions include passwordless authentication such as passkeys and the FIDO standards in Domain 5, risk-adaptive access control, post-quantum cryptography and threats to AI systems such as model poisoning and synthetic media in Domain 3. The format, the passing standard and the experience requirement stay the same. If you sit before 15 April 2027, the 2024 outline applies; after that date, the new one does. Always check which outline applies on the day you book.

In 2026 ISC2 also published guidance on how artificial intelligence fits into the existing domains. It is not a ninth domain. Instead, AI topics appear where they belong: governance of AI use in Domain 1, data used to train models in Domain 2, threats to models such as prompt injection and poisoning in Domain 3, and so on. The earlier courses in this track touched on AI where it fitted; lessons 5 to 8 include a few practice items that use AI scenarios, because that is how the exam is likely to present them.

Who can become a CISSP

Passing the exam is necessary but not sufficient. To be certified, a candidate needs at least five years of cumulative, paid, full-time work experience in two or more of the eight domains. Part-time work counts in proportion: published guides describe 2,080 hours as one year and 1,040 hours as six months. Paid internships can count, and the experience does not have to be in a job titled 'security', provided the work itself falls within the domains.

One year of the five can be waived. A candidate can use either a relevant four-year degree, or a regional equivalent, or one credential from the list ISC2 approves, but not both together to waive two years. On 1 April 2026 ISC2 revised that list. Published summaries report that several well-known certifications were removed from it, while others remain; the list now favors credentials with a public exam outline, accredited delivery and substantial overlap with at least two CISSP domains. Anyone planning to use a waiver should check the current list on the ISC2 website rather than rely on an older study guide.

Candidates who pass without enough experience can become an Associate of ISC2. An Associate then has six years to gain the five years of experience, or four if the waiver applies, and applies for full certification when they have it. Associates pay a smaller annual maintenance fee and earn a smaller number of continuing education credits each year. This route is popular with graduates and career changers, and it lets an employer see that the knowledge is already in place.

Endorsement, maintenance and cost

After passing, a candidate applies for certification through an endorsement process. Another ISC2-certified member in good standing reviews the application and confirms the experience claimed; ISC2 can endorse directly when no such member is available. The application has to be completed within a set period after the exam, which published guides give as nine months. Hannah and Tomás will both be endorsed by Priya Raman, their CISO, who holds the CISSP and has worked with both of them for several years.

Certification runs in three-year cycles. Over each cycle, a CISSP must earn 120 continuing professional education (CPE) credits, of which at least 90 must be Group A, meaning directly related to the domains. Published guides suggest about 40 credits a year so that nobody faces a scramble at the end of the cycle. There is also an annual maintenance fee, which ISC2 lists as US$135 for members and US$50 for Associates at the time of writing. Members who hold several ISC2 certifications pay a single fee.

The standard exam registration in the Americas is listed at US$749 at the time of writing, with fees for rescheduling and cancellation. Candidates who do not pass can try again after a waiting period: 30 days after a first attempt, 60 days after a second and 90 days after a third or later, with at most four attempts in twelve months. Each attempt needs a new registration fee unless a training package includes a retake. Lesson 12 covers what to do after either result.

In the United States, employers often pay certification fees, and employer-provided educational assistance of up to $5,250 a year can generally be excluded from an employee's income under section 127 of the Internal Revenue Code when the employer has a qualifying plan. Ridgeline pays the registration and the first year's maintenance fee for both candidates as part of its training budget. People who pay for themselves should keep receipts and check current IRS guidance before claiming any education credit or deduction.

How much preparation the CISSP needs

Published study guides and training providers commonly describe three to six months of preparation for candidates with solid experience, often 150 to 250 hours in total. Candidates who have completed the eight content courses in this track have already covered the outline in depth. Their remaining work is different: recalling details quickly, recognizing what each question is really asking, choosing between two plausible answers and keeping a steady pace for three hours. That is what this course practices.

Hannah and Tomás plan ten weeks at about eight hours a week. Each of them takes a 100-item diagnostic set in week 1 and records accuracy by domain. Their study time is then divided according to two numbers: the weight of each domain and how far their accuracy sits below a target of about 75 %. A weak domain with a high weight comes first; a strong domain with a low weight gets light review.

# Rank CISSP domains for study using weight x gap to target accuracy
weights = {1: 16, 2: 10, 3: 13, 4: 13, 5: 13, 6: 12, 7: 13, 8: 10}  # April 2024 outline, percent
scores = {1: 58, 2: 62, 3: 78, 4: 82, 5: 70, 6: 65, 7: 80, 8: 60}   # Tomas, diagnostic, percent
target = 75
priority = {}
for d in weights:
    gap = max(0, target - scores[d])
    priority[d] = gap * weights[d]
for d in sorted(priority, key=priority.get, reverse=True):
    label = "study first" if priority[d] >= 140 else ("study" if priority[d] > 0 else "light review")
    print(f"Domain {d}: score {scores[d]:>3} %  gap {max(0, target - scores[d]):>2}  priority {priority[d]:>4}  {label}")

Domain 1: score  58 %  gap 17  priority  272  study first
Domain 8: score  60 %  gap 15  priority  150  study first
Domain 2: score  62 %  gap 13  priority  130  study
Domain 6: score  65 %  gap 10  priority  120  study
Domain 5: score  70 %  gap  5  priority   65  study
Domain 3: score  78 %  gap  0  priority    0  light review
Domain 4: score  82 %  gap  0  priority    0  light review
Domain 7: score  80 %  gap  0  priority    0  light review

The program confirms the worked example and makes the method easy to rerun after each practice exam. Hannah's diagnostic gives almost the mirror image: her top priorities are Domains 3 and 4, with Domain 1 needing only light review. The weights matter as much as the scores. A ten-point gap in Domain 1 is worth more study time than the same gap in Domain 2 or 8, at least until the 2027 outline brings the weights closer together.