CompTIA SecurityX (CASP+) Guide: Domains, Requirements and Preparation

CompTIA SecurityX is the renamed CASP+, and much of what is written about it still describes the old CAS-004 exam, its domain weightings and its name. This guide sets out what CompTIA itself publishes about SecurityX: the CAS-005 exam format, the four domains and how their weightings changed from CASP+ V4, the recommended experience, the retake rules and the three-year continuing education cycle. It adds a phased preparation plan for experienced engineers, guidance on whether SecurityX is the right next step, and where it sits beside other senior credentials. It is written for senior security engineers and architects, and for managers deciding which advanced certification to fund. All facts are as published on comptia.org, checked October 2026; CompTIA changes them, so confirm on the linked pages before you book.

Key takeaways

• CASP+ became SecurityX. CompTIA released exam version V5 (CAS-005) on 17 December 2024 under the SecurityX name, as part of its Xpert series; the change did not affect the status of existing CASP+ holders or the continuing education programme.
• It is a hands-on exam for practitioners, not managers. CompTIA describes SecurityX as performance-based and aimed at security architects and senior security engineers.
• The scoring is pass/fail. The exam has a maximum of 90 multiple-choice and performance-based questions in a maximum of 165 minutes, with no scaled score reported.
• Engineering and architecture dominate. Security engineering (31%) and security architecture (27%) make up more than half of CAS-005; security operations fell from 30% in V4 to 22%.
• The current version has a horizon. CompTIA estimates CAS-005 retirement in 2027, usually three years after launch, and holders renew with 75 CEUs and a $150 CE fee per three-year cycle.

Who the certification is for

CompTIA's launch announcement describes SecurityX as a vendor-neutral, expert-level certification for security architects and senior security engineers who lead efforts to improve an enterprise's cybersecurity readiness, and as a performance-based certification for advanced practitioners rather than managers. The Xpert series, which SecurityX joined, is aimed at IT professionals with multiple years of work experience.

• Good fit: engineers with a decade in IT who design and implement controls across cloud, network, endpoint and identity, and who want a credential that tests doing rather than managing.
• Good fit for employers: a technical benchmark for lead engineer and architect roles that sits alongside, rather than replaces, management credentials.
• Weaker fit: people moving into management or governance roles, where a programme-level credential such as the one covered in the CISSP Certification Guide or the CISM Certification Guide matches the work more closely; and early-career staff, for whom the CompTIA Security+ Guide is the starting point.
• Public sector and defence: CompTIA's SecurityX page lists NICE and DoD 8140 work roles including security architect, systems requirements planner, security control assessor and research and development specialist, and its launch release states that SecurityX maps to DCWF work roles used under DoD 8140.03M. Confirm the mapping for your exact role and proficiency level with the hiring organisation.

Exam format and domains

Format

The pass/fail scoring changes how you use a failed attempt: there is no scaled score to tell you how close you came, so your own per-domain tracking during preparation matters more than it does for Security+. With up to 90 questions in 165 minutes you have nearly two minutes per item, but performance-based scenarios at this level are long, often involving several artefacts such as configuration snippets, logs and architecture diagrams.

The four domains: V5 compared with CASP+ V4

Weights are from CompTIA's SecurityX page and its rebrand announcement, which gives the V4 equivalents. The last column is our revision suggestion, not CompTIA content. The shift matters for anyone holding CASP+ V4 study material: governance, risk and compliance and engineering each gained five points, while operations lost eight. Use CompTIA's official CAS-005 exam objectives as your checklist; do not rely on a CAS-004 book with a new cover.

Where identity fits: architecture and engineering questions at this level routinely involve identity design: federation, privileged access, certificate and key management, and the service accounts, workload identities and API credentials that connect cloud and on-premises systems. Architects who cannot reason about machine identities will struggle with modern scenarios. See the NHI Authentication Guide and the Secrets Management Guide.

Prerequisites and experience

CompTIA does not make experience a mandatory prerequisite, but its recommendation is demanding: a minimum of ten years of general hands-on IT experience, including five years of hands-on security, with Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge. That list describes breadth across networking, operations, cloud and offensive testing, not five certificates you must hold.

Exam delivery: CompTIA offers online testing through Pearson OnVUE remote proctoring, which requires a system test on the same computer and network you will use, ID, and a cleared room; it is not available in some countries. Long performance-based scenarios are less forgiving of an unstable connection, so consider a test centre if your home set-up is unreliable.

Preparation plan

The plan assumes an experienced engineer studying about eight hours a week for twelve weeks. Shorten it if your experience is broad; extend it if one domain is new to you.

1. Confirm the target (week 0): download the CAS-005 objectives. Check the expected retirement window on CompTIA's page so that a possible retake still falls before it.
2. Self-assess by objective (week 1): rate yourself against each of the 23 objectives as "do this at work", "understand it" or "new". The "new" list is your plan.
3. Close domain gaps (weeks 2 to 7): engineers from operations usually need GRC (regulations, risk treatment, third-party risk) and cryptography; architects from network backgrounds usually need cloud, application security and automation.
4. Build scenarios (weeks 4 to 9, overlapping): practise in a lab: design a segmented hybrid network, write and review cloud identity policies, configure certificate-based authentication, analyse logs from a simulated intrusion, and justify each design choice in writing.
5. Mixed practice (weeks 9 to 11): work long, multi-artefact questions under time pressure. For each, state the requirement, the constraint and the trade-off before choosing an answer.
6. Rehearse (week 12): sit at least one full-length mock of 90 questions in 165 minutes, and track per-domain results yourself, because the real exam will not give you a scaled score.

If you fail: CompTIA's retake policy allows a second attempt with no waiting period but requires at least 14 calendar days before a third or later attempt, and each attempt costs the full exam price.

Small vs large employers: in a small organisation a candidate may never have seen formal GRC work, so allow extra time for domain 1 and use public frameworks as study material. Large organisations can pair candidates with their own architecture review board, risk team and SOC, so that each domain is studied against real internal artefacts.

Measuring readiness

• Objective coverage: share of the 23 objectives rated "do this at work" or "understand it", aiming for all of them before booking.
• Per-domain practice scores: tracked weekly and weighted by the domain percentages.
• Scenario timing: average time per multi-artefact question in practice, well inside the 165-minute budget.
• Written justifications: number of lab designs you can defend in writing against a requirement and a constraint.
• After certification: CEUs logged against the 75 required, reviewed annually.

Cost, renewal and continuing education

Common failure patterns

• Studying CAS-004 material: V4 had 28 objectives and weighted operations at 30%; CAS-005 has 23 objectives and different weights. Check every resource names CAS-005.
• Treating it as a management exam: candidates who prepare from governance-heavy material underestimate the engineering and architecture content, which is 58% of the exam.
• Neglecting GRC: the opposite mistake for pure engineers, now that governance, risk and compliance is 20%.
• Booking too close to retirement: CompTIA estimates CAS-005 retirement in 2027; a late first attempt can leave no room to retake on the same version.
• Relying on the score report: pass/fail scoring gives no scaled score, so candidates without their own domain tracking cannot tell what to fix after a fail.
• Missing CE deadlines: 75 CEUs is half as many again as Security+; leaving them to the last year risks expiry.

Where it fits on the career path

SecurityX sits at the top of CompTIA's security path and is aimed at people already working as senior engineers or architects.

• Before it: the knowledge CompTIA lists (Network+, Security+, CySA+, Cloud+, PenTest+ or equivalent). See the CompTIA Security+ Guide, CompTIA CySA+ Guide and CompTIA PenTest+ Guide.
• Alongside it: a cloud or identity specialism adds depth. See the AWS Certified Security Specialty Guide and the Identity Certifications Guide.
• Role routes: the Security Architect Career Guide and Security Engineer Career Guide describe the roles SecurityX is built for.
• Towards leadership: holders who later move into management usually add a programme-level credential; compare options in the Cybersecurity Certifications Guide.

CompTIA does not publish pass rates or salary figures on the pages checked for this guide, and we do not quote third-party estimates.

Practitioner checklist

• Confirm you are preparing for CAS-005 and that every resource names that exam code.
• Check CompTIA's current retirement estimate for CAS-005 and leave room for a retake before it.
• Rate yourself against all 23 CAS-005 objectives and plan study around the gaps.
• Weight study time by domain: engineering 31%, architecture 27%, operations 22%, GRC 20%.
• Build lab scenarios that combine cloud, network, identity and cryptography, and justify each design choice in writing.
• Track your own per-domain results, since the exam reports only pass or fail.
• If testing online, run the OnVUE system test on the same computer and network.
• Check the exam price for your country in the CompTIA store and budget for full price on any retake.
• After passing, diarise the three-year expiry and plan 75 CEUs across the cycle; CASP+ holders download the SecurityX badge and certificate.

Standards and references

• CompTIA: SecurityX Certification
• CompTIA: Introducing CompTIA SecurityX
• CompTIA: Xpert Series Expands with SecurityX Professional Certification
• CompTIA: Earn Continuing Education Units (CEUs)
• CompTIA: Continuing Education Renewal Fees
• CompTIA: Certification Retake Policy
• CompTIA Help Center: How Can I Take a CompTIA Test Online

Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CompTIA Security+ Guide · Security Architect Career Guide · Security Engineer Career Guide · CISSP Certification Guide