CISSP Certification Guide: Domains, Experience, and the Adaptive Exam

Step 1: Check the experience requirement

Full CISSP certification needs at least five years of cumulative, paid, full-time experience in two or more of the eight domains. A relevant degree, or one credential from ISC2's approved list such as Security+, CCNA, or CISM, can waive one year, but only one year in total. Part-time work counts if it is 20 to 34 hours per week, and documented internships count. If you pass without enough experience, you become an Associate of ISC2 and have six years to gain it.

Step 2: Learn the exam format

ISC2 lists the English exam as computerized adaptive testing with 100 to 150 questions in three hours, a passing score of 700 out of 1000, and multiple choice plus advanced item types. It is delivered at Pearson testing centers in English, Chinese, German, Japanese, and Spanish, with Chinese offered in set windows. The adaptive test ends when the system is confident of your result, so you cannot tell your progress from the question count. ISC2's pages did not show the exam fee, so check the registration page, where the voucher is valid for 365 days.

Step 3: Know the eight domains

The current outline, in effect since April 15, 2024, weights the domains as below. A new outline takes effect April 15, 2027, so confirm which one applies to your test date.

1. Security and Risk Management                  16%
2. Asset Security                                10%
3. Security Architecture and Engineering         13%
4. Communication and Network Security            13%
5. Identity and Access Management (IAM)          13%
6. Security Assessment and Testing               12%
7. Security Operations                           13%
8. Software Development Security                 10%

Step 4: Think like a security manager

CISSP questions are about risk-based decisions, not tool commands. The best answer usually protects human life and safety first, follows policy and law, balances cost against risk, involves the right stakeholders, and prefers governance and process before technical fixes. Ask what a senior advisor would do first. This mindset is the biggest difference from technical exams.

Step 5: Build a study plan

Most candidates study three to six months. Read an up-to-date official or well-reviewed study guide, learn one domain at a time with notes, and use practice questions in every session. Reinforce abstract topics with simple labs, such as configuring role-based access, encrypting a file, or reading firewall logs. In the last month, do mixed practice sets and at least one full-length timed practice exam.

Step 6: Maintain the credential

CISSP holders earn continuing professional education credits and pay an annual maintenance fee, and they follow the ISC2 Code of Ethics, which you must agree to. ISC2's pages read for this guide did not list the exact credit and fee amounts, so confirm them on isc2.org before you commit.