CISSP Certification Guide: Domains, Requirements and Preparation

Many CISSP candidates prepare from outdated material, misjudge the experience rule or let the credential lapse in its first cycle, even though the rules are published. This guide sets out what ISC2 itself publishes about the Certified Information Systems Security Professional: the computerised adaptive exam, the eight domains of the April 2024 outline, the five-year experience requirement and the Associate route, endorsement, fees and the continuing education cycle. It adds a phased preparation plan and career context, for practitioners deciding whether and when to sit the exam and for managers who fund or require it. Fees and rules are as published by ISC2, checked October 2026; ISC2 changes them, so confirm on the linked ISC2 pages before you book.

Key takeaways

• It is a programme-level credential. ISC2 positions the CISSP as proof that you can design, implement and manage a cybersecurity programme, so the exam rewards judgement across all eight domains rather than depth in one tool or technology.
• The exam is adaptive and shorter than it used to be. ISC2 delivers the CISSP in Computerized Adaptive Testing (CAT) format in every language, with 100 to 150 items in a maximum of three hours, down from 250 items and six hours in the old linear exam.
• Experience is the real gate. Full certification needs five years of qualifying work experience and an endorsement; you can pass first and become an Associate of ISC2 while you earn the experience, with up to six years to complete it.
• Deadlines decide whether a pass becomes a certificate. You have nine months from your exam date to complete the application and endorsement, and the experience waiver rules changed on 1 April 2026.
• Maintenance is a three-year commitment. Holders pay an annual maintenance fee of USD 135 and earn 120 CPE credits per three-year cycle (ISC2 suggests 40 a year); missing either leads to suspension after a 90-day grace period.

Who the certification is for

ISC2 describes the CISSP as evidence that the holder can effectively design, implement and manage a security programme. The CISSP is accredited by ANAB against ISO/IEC 17024, the international standard for bodies that certify people, and certified holders become members of ISC2.

• Good fit: practitioners with several years across more than one area of security (for example identity, network and operations) who are moving into lead, architect, consultant, audit or management roles where breadth and risk judgement matter more than tool depth.
• Good fit with the Associate route: people with strong knowledge but fewer than five years of qualifying experience who want to prove the knowledge now and complete the experience later.
• Weaker fit: early-career staff who need hands-on skills first, and specialists whose employers value a technical or vendor credential in their niche more than a broad one. See the Cybersecurity Certifications Guide for alternatives at each level.
• Where employers require it: ISC2 lists the CISSP as approved by the US Department of Defense under DoDM 8140.03, the manual for the DoD cyber workforce qualification programme. Check the DoD's own qualification guidance for the specific work roles and proficiency levels it satisfies.

Exam format and domains

Format

Two practical points follow. The exam can stop anywhere between 100 and 150 items, so do not read the number of items you see as a sign of how you did. And pacing matters: three hours for up to 150 scenario questions leaves little more than a minute per item. ISC2 changed the domain weightings from 15 April 2024; take the current percentages from ISC2's own exam outline document rather than from figures quoted elsewhere, many of which predate the change.

The eight domains

The domain names below are as listed on ISC2's exam outline page. The third column is our revision suggestion, not part of the outline: practitioner guides that cover the working reality of each domain.

Where identity fits: Domain 5 is dedicated to identity and access management, and identity runs through the other domains too: privileged access in operations, service accounts and API keys in software development, and account lifecycle in asset security. Revise human and machine identity together: who or what holds a credential, and how it is issued, reviewed and revoked.

Prerequisites and experience

ISC2's CISSP page lists five years as the required work experience. ISC2's experience requirements page explains how the five years are counted, which security domains are eligible, how part-time work and internships count, and the one-year waivers. ISC2 updated the waiver rules with effect from 1 April 2026, so read the current experience page before relying on a degree or another credential to shorten the requirement; guidance written before that date may be wrong.

Choosing a route

Endorsement

• Who endorses: another ISC2 certified professional in good standing, who confirms your experience. You need the endorser's member ID and surname for the application.
• No endorser available: ISC2 can act as endorser, but only with proof of employment, so collect role descriptions and employer letters early.
• Timing: you have nine months from the exam date to complete the application. You can start a draft before the exam, but it can only be submitted after the pass notice.

Preparation plan

ISC2 offers official self-paced and instructor-led training and bundles that combine training access (60, 90 or 180 days, depending on the bundle) with an exam voucher. The exam-only voucher gives a 365-day window and one attempt; Peace of Mind Protection gives two attempts within 180 days of purchase, with a waiting period between attempts set by ISC2's retake policy. The plan below works with or without official training.

1. Confirm eligibility first (week 0): map your roles against the eligible domains on ISC2's experience page and decide between the full and Associate routes. Identify your endorser now.
2. Baseline (week 1): take a timed diagnostic against all eight domains using material written for the April 2024 outline. Record a score per domain; this is your gap list.
3. Close the widest gaps (weeks 2 to 8): study the weakest two or three domains first, using the official outline as the checklist. For each topic, write down the decision a manager would make, not only the definition; CISSP questions ask what you should do first or what is best.
4. Integrate (weeks 9 to 11): work mixed-domain scenario sets. Practise reading the question for the role you are playing (adviser, manager, engineer) and for qualifiers such as first, most and best.
5. Rehearse under exam conditions (week 12): sit at least two full mock exams of 150 items in three hours. If you finish with time spare, slow down; if you run out, practise moving on from items you cannot answer.
6. Book the exam: choose a Pearson VUE slot within your voucher window, leaving room for a second attempt if you bought Peace of Mind Protection.
7. After the exam: submit the application and endorsement promptly, not in month eight of nine.

Small vs large employers: in a small team, one candidate may need to cover gaps (such as software development security) with reading and labs because the work is not in their role; budget more time for those domains. Large organisations can pair candidates with internal specialists for each domain and form a study group with a shared question bank and a fixed exam date.

Measuring readiness

• Domain coverage: per-domain practice score, tracked weekly; aim for no domain trailing the others by a wide margin before booking.
• Timed performance: full mocks completed in three hours or less at your target score.
• Application readiness: endorser confirmed and employment evidence gathered before exam day.
• After certification: CPE credits logged against the suggested 40 a year, and AMF paid on each anniversary.

Cost, renewal and continuing education

ISC2's Certification Maintenance Policy (version 7.0 at the time of checking) and its member policies page are the authority for which activities count as Group A or Group B. ISC2 also published an update on what is new in CPE credits in June 2026, so read the current policy rather than older summaries.

Common failure patterns

• Studying from pre-2024 material: books and question banks written for older outlines use outdated domain weightings and the 250-item linear format. Check that every resource names the 15 April 2024 outline.
• Assuming a waiver still applies: candidates relying on a credential or degree waiver described in an older blog post can find it no longer counts after the 1 April 2026 update, and discover this only at application stage.
• Missing the nine-month window: a pass without a completed application and endorsement within nine months does not become a certification. Line up the endorser before the exam.
• Back-loading CPE: leaving 120 credits to the final year risks a scramble for Group A credits and suspension if the grace period is missed. Log credits as you earn them.
• Letting the AMF lapse: the fee is due every anniversary, not once per cycle; an expired card or a changed employer reimbursement process is a common cause of suspension.
• Treating it as a technical exam: strong engineers often pick the best technical fix when the question asks what a manager should do first, such as confirming scope or risk ownership.

Where it fits on the career path

The CISSP usually comes after the first technical and operational roles and before or during the move to lead, architect or management positions.

• Before the CISSP: operational experience across at least two areas is more valuable than an extra entry-level certificate. Analysts can follow the SOC Analyst Career Guide to build the security operations depth that Domain 7 assumes.
• Alongside it: a cloud, audit or identity specialism shows depth to balance the CISSP's breadth. See the Cybersecurity Certifications Guide for how certifications compare by level and specialism.
• After it: holders moving into leadership use the risk and governance content of Domain 1 directly. See the CISO Guide: First 90 Days for what that role demands in practice.
• Public sector and defence: where DoDM 8140.03 applies, confirm the exact work role mapping with the hiring organisation before relying on the CISSP to meet a qualification requirement.

ISC2 does not publish pass rates or salary figures on the pages checked for this guide, and we do not quote third-party estimates. For role options and progression, see the Cybersecurity Careers Guide.

Practitioner checklist

• Read ISC2's current experience requirements page and confirm whether the 1 April 2026 waiver changes affect you.
• Decide between the full route and the Associate of ISC2 route before booking.
• Download the current CISSP exam outline (effective 15 April 2024) and use it as your revision checklist and source of domain weightings.
• Run a timed baseline across all eight domains and study the weakest domains first.
• Sit at least two full mocks of 150 items in three hours before exam day.
• Choose exam-only (365-day window, one attempt) or Peace of Mind Protection (two attempts within 180 days) to match your timeline.
• Line up your endorser and employment evidence before the exam, and submit within nine months.
• Diarise the AMF anniversary and log CPE credits as you earn them, aiming for about 40 a year.

Standards and references

• ISC2: CISSP Certified Information Systems Security Professional
• ISC2: CISSP Certification Exam Outline
• ISC2: Computerized Adaptive Testing for CISSP Examinations in All Languages
• ISC2: Computerized Adaptive Testing Examination Format Updates
• ISC2: CISSP Experience Requirements
• ISC2: Endorsement
• ISC2: Exam Pricing
• ISC2: Member Policies and Certification Maintenance

Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Cybersecurity Careers Guide · SOC Analyst Career Guide · IAM and IGA Basics · CISO Guide: First 90 Days