Most CISSP candidates who stall do not lack material, they lack a schedule that matches study time to how the exam is actually weighted. This template is a 12-week, week-by-week study plan built on the eight domains and weightings of the ISC2 CISSP Detailed Content Outline effective 15 April 2024, with a domain tracker, a mock exam log and a readiness gate you can copy and fill in. It is for working practitioners studying part-time, and for managers who sponsor a cohort. It does not repeat exam format, fees, experience rules or endorsement: those are in the CISSP Certification Guide, and if you are still choosing between credentials, read CISSP vs CISM first. Domain weightings are as published by ISC2, checked November 2026; confirm them on ISC2's outline page before you start.
How to use this template
- Copy the sections below into your own document or spreadsheet and replace text in square brackets, such as [Candidate], [exam date] and [hours], with your own details.
- Hours are illustrative. The plan assumes about [8 to 10] hours a week; if you have fewer, stretch it to [16] weeks by repeating weeks 2 to 9 at half pace, not by cutting the mock exam weeks.
- Work from the official outline as your checklist. Each week lists the outline sub-objective numbers (for example 5.4 Authorization mechanisms) so you can tick them off against ISC2's document.
- Book the exam for the end of week 12 or 13 before you start. A fixed date is the strongest single control on drift.
- Run section 4 (the tracker) every Sunday. Rearrange later weeks if one domain falls behind; do not just carry on.
1. Purpose and candidate profile
This plan prepares [Candidate] to sit the ISC2 CISSP exam on [exam date], using [official ISC2 training / self-study / study group].
| Item | [Candidate] value |
|---|---|
| Target exam date and test centre | [date], [Pearson VUE centre] |
| Route | [full certification / Associate of ISC2]; endorser identified: [yes, name / no] |
| Weekly hours available | [weekday hours] + [weekend hours] |
| Strongest domains from experience | [for example 5 IAM, 7 Security Operations] |
| Weakest domains from experience | [for example 3 Architecture and Engineering, 8 Software Development Security] |
| Study resources | [official outline]; [primary textbook written for the April 2024 outline]; [question bank]; [ISC2 flash cards] |
| Sponsor and study group | [manager]; [group members and meeting slot] |
2. Domain weighting and time budget
ISC2's 2024 Detailed Content Outline sets the weightings below. The hours column spreads [96] study hours across domains roughly in proportion to weight, before you adjust for your own strengths. Move hours from your strongest domain to your weakest, but never take a domain below about two thirds of its share: the exam samples every domain.
| Domain | Name | Weight (ISC2, April 2024) | Outline sub-objectives | Baseline hours [of 96] | Your adjusted hours |
|---|---|---|---|---|---|
| 1 | Security and Risk Management | 16% | 1.1 to 1.12 | [15] | [ ] |
| 2 | Asset Security | 10% | 2.1 to 2.6 | [10] | [ ] |
| 3 | Security Architecture and Engineering | 13% | 3.1 to 3.10 | [13] | [ ] |
| 4 | Communication and Network Security | 13% | 4.1 to 4.3 | [12] | [ ] |
| 5 | Identity and Access Management (IAM) | 13% | 5.1 to 5.6 | [12] | [ ] |
| 6 | Security Assessment and Testing | 12% | 6.1 to 6.5 | [12] | [ ] |
| 7 | Security Operations | 13% | 7.1 to 7.15 | [13] | [ ] |
| 8 | Software Development Security | 10% | 8.1 to 8.5 | [9] | [ ] |
The remaining weekly time in weeks 11 and 12 goes to mixed practice and full mock exams, which are not counted against any one domain.
3. The 12-week schedule
Each content week follows the same rhythm: read and annotate the outline sub-objectives (about 40% of the week), make notes in your own words with the decision a manager would take (20%), answer domain questions and review every wrong and every guessed answer (30%), and revisit the previous week's flash cards (10%).
| Week | Focus | Outline sub-objectives to tick off | End-of-week output |
|---|---|---|---|
| 0 (before start) | Set-up | Download the current outline; confirm route and endorser in the CISSP Certification Guide | Exam booked; this template filled in |
| 1 | Baseline and Domain 1 part 1 | Timed diagnostic across all domains; 1.1 Professional ethics to 1.6 Security policies and procedures | Diagnostic score per domain recorded in section 4 |
| 2 | Domain 1 part 2 | 1.7 Business continuity requirements to 1.12 Awareness and training, including 1.9 Risk management and 1.10 Threat modelling | One-page risk terminology sheet; 1.x questions at target |
| 3 | Domain 2 | 2.1 Classification to 2.6 Data security controls and compliance | Data life cycle diagram from creation to destruction |
| 4 | Domain 3 part 1 | 3.1 Secure design principles to 3.5 Architecture vulnerabilities, including 3.2 Security models | Table of security models with one-line purpose each |
| 5 | Domain 3 part 2 | 3.6 Cryptographic solutions, 3.7 Cryptanalytic attacks, 3.8 to 3.9 Site and facility, 3.10 System life cycle | Cryptography summary: symmetric, asymmetric, hashing, PKI, with when to use each |
| 6 | Domain 4 | 4.1 Network architecture design, 4.2 Network component security, 4.3 Secure communication channels | Layered model sheet mapping protocols and controls to layers |
| 7 | Domain 5 | 5.1 Physical and logical access to 5.6 Authentication systems, including 5.3 Federated identity and 5.5 Provisioning life cycle | Access control models compared; federation flow sketched |
| 8 | Domain 6 | 6.1 Assessment, test and audit strategies to 6.5 Security audits | Assessment types table: who runs it, what it proves |
| 9 | Domain 7 part 1 | 7.1 Investigations to 7.9 Change management, including 7.6 Incident management and 7.8 Patch and vulnerability management | Incident response phases with the manager's decision at each |
| 10 | Domain 7 part 2 and Domain 8 | 7.10 Recovery strategies to 7.15 Personnel safety; 8.1 Security in the SDLC to 8.5 Secure coding guidelines | Recovery site and test types table; SDLC security touchpoints list |
| 11 | Integration | Mixed-domain scenario sets; re-study the two lowest domains from section 4 | First full mock exam logged in section 5 |
| 12 | Rehearsal | Second and third full mocks under exam conditions; light review only in the last two days | Readiness gate in section 6 passed or exam moved |
Domain 7 has the most sub-objectives (15) and Domain 1 the highest weight (16%), which is why each gets two weeks. Domain 4 has only three sub-objectives but each is broad; do not read the low count as a short domain.
4. Weekly domain tracker
Fill in one row per domain every Sunday. Use questions written for the April 2024 outline and record the percentage correct on questions you had not seen before.
| Domain | Diagnostic (week 1) | After its study week | Week 11 mixed | Week 12 mocks | Hours spent | Status |
|---|---|---|---|---|---|---|
| 1 Security and Risk Management | [%] | [%] | [%] | [%] | [h] | [on track / behind] |
| 2 Asset Security | [%] | [%] | [%] | [%] | [h] | [ ] |
| 3 Security Architecture and Engineering | [%] | [%] | [%] | [%] | [h] | [ ] |
| 4 Communication and Network Security | [%] | [%] | [%] | [%] | [h] | [ ] |
| 5 Identity and Access Management | [%] | [%] | [%] | [%] | [h] | [ ] |
| 6 Security Assessment and Testing | [%] | [%] | [%] | [%] | [h] | [ ] |
| 7 Security Operations | [%] | [%] | [%] | [%] | [h] | [ ] |
| 8 Software Development Security | [%] | [%] | [%] | [%] | [h] | [ ] |
Rule: if any domain sits more than [10] points below your average two weeks running, take [3] hours from your strongest domain and give them to it the following week.
5. Mock exam log
ISC2 delivers the CISSP as a computerised adaptive test of 100 to 150 items in a maximum of three hours, so rehearse the full length and time even though the real exam may stop sooner.
| Mock | Date | Items | Time used | Score | Weakest two domains | Pattern in wrong answers |
|---|---|---|---|---|---|---|
| 1 (week 11) | [date] | [150] | [h:mm] | [%] | [ ] | [for example: chose the technical fix, not the first management step] |
| 2 (week 12) | [date] | [150] | [h:mm] | [%] | [ ] | [ ] |
| 3 (week 12) | [date] | [150] | [h:mm] | [%] | [ ] | [ ] |
Pace check: three hours for 150 items is 72 seconds per item. If you finish mocks with a large margin, you are probably not reading the qualifiers (first, best, most) carefully enough.
6. Readiness gate
Sit the exam on the booked date only if all of these are true at the end of week 12. If not, move the date by [two to four] weeks and repeat weeks 11 and 12 for the failing items.
- Every outline sub-objective in section 3 is ticked.
- No domain in section 4 is marked behind.
- Two full mocks completed within three hours at or above [your target score, set from the question bank's guidance].
- Wrong-answer patterns from section 5 have been reviewed and the most common one has a written counter-rule.
- Endorser confirmed and employment evidence gathered, so the application can be submitted soon after a pass.
- Logistics confirmed: identification, route to the test centre, arrival time.
7. Roles in a sponsored cohort
| Role | Responsibility |
|---|---|
| Candidate | Follows the schedule, updates sections 4 and 5 weekly, raises slippage early |
| Study group lead [name] | Runs a weekly [60]-minute session on that week's domain, rotating presenters |
| Domain mentors [names] | Internal specialists for weak domains, for example an application security engineer for Domain 8 |
| Sponsor [manager] | Protects study hours, funds training and vouchers, reviews the readiness gate |
Implementation guidance
- Check every resource names the 15 April 2024 outline: books and question banks for older outlines use different weightings and the old linear format. The tracker is only as useful as the questions behind it.
- Study for the role, not the tool: ISC2 positions the CISSP as evidence that you can design, implement and manage a security programme. For every topic, write the decision a security manager would make first, not only the definition.
- Turn experience into an advantage carefully: practitioners often answer from how their own organisation works. When an answer feels obvious from your job, re-read the question for the role and the qualifier it asks about.
- Use the identity domain as a bridge: Domain 5 links to provisioning in Domain 2, privileged operations in Domain 7 and secure design in Domain 3. Revising human and machine identities together, including service accounts and API keys, strengthens several domains at once. See the IAM and IGA Basics.
- Small teams and large teams: a lone candidate should budget extra hours for domains outside their day job and use the official ISC2 flash cards and quizzes for spaced review. A larger organisation can run a cohort with a shared exam window, domain mentors and a common question bank, which also makes the sponsor's readiness review straightforward.
- After the exam: submit the application and endorsement promptly, and set up a log for continuing professional education from day one, as described in the CISSP Certification Guide.
Standards and references
- ISC2: CISSP Detailed Content Outline with Weights 2024
- ISC2: CISSP Certification Exam Outline
- ISC2: CISSP Certified Information Systems Security Professional
- ISC2: Computerized Adaptive Testing examination format updates
- ISC2: Computerized Adaptive Testing
- ISC2: CISSP Exam Refresh FAQ
Related NHI Mgmt Group resources: CISSP Certification Guide · CISSP vs CISM · CISSP vs CCSP · ISC2 CISSP Concentrations Guide · Cybersecurity Certifications Guide