Topic starter
24/06/2026 9:16 pm
TL;DR: ISC2 refreshed the CISSP blueprint on April 15, 2024, with updated emphasis across IAM, zero trust, SASE, privacy laws, cryptography, and lifecycle topics, while keeping domain weights broadly stable and the exam format unchanged according to Netwrix. The change matters because it shows which identity and security concepts are now table stakes for practitioners, not just exam candidates.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “CISSP Exam Changes 2024”.
Key questions
Q: What does the CISSP 2024 blueprint change mean for IAM programmes?
A: It shows that IAM now spans services, policy enforcement, and modern access patterns, not only human authentication.
Q: Why do SASE and zero trust appear in identity-related certification content?
A: Because access control is increasingly shaped by context, policy, and continuous verification rather than a fixed network perimeter.
Q: How should teams respond when privacy laws become part of identity governance scope?
A: They should treat identity logs, authentication data, and access records as regulated information, not just operational telemetry.
Practitioner guidance
- Map services into the identity inventory Treat service accounts, application identities, and automation credentials as governed identities with named owners, defined scope, and lifecycle review dates.
- Review authorization design for policy enforcement Check whether access decisions depend on static entitlements or on explicit policy decision and enforcement points that reflect context.
- Update identity governance to include privacy obligations Align identity logs, authentication artefacts, and access records with retention, minimisation, and regulatory handling requirements.
Bottom line: The 2024 CISSP refresh is less about exam mechanics than about which identity and security concepts are now treated as baseline professional knowledge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:23 am
Services are now first-class identities in enterprise access governance. The CISSP update is important because it normalises a control reality many programmes still understate: services are not just technical dependencies, they are governed actors with access scope, ownership, and lifecycle. Once services are inside the IAM scope, the boundary between workforce identity and non-human identity becomes operational rather than conceptual. Practitioners should treat service access as part of the identity estate, not as an exception.
A question worth separating out:
Q: What is the difference between service access control and workforce IAM?
A: Workforce IAM focuses on people, while service access control governs non-human identities that authenticate, request resources, and carry delegated privileges. The practical difference is lifecycle: service access needs ownership, scope, and offboarding discipline just as much as human accounts do.
👉 Read our full editorial: CISSP exam changes 2024 sharpen IAM, SASE and privacy topics