CISSP Domains Explained: All 8 Domains, Weights and How the Exam Works
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
The CISSP exam covers eight domains, led by Security and Risk Management at 16%, and is delivered as a computerized adaptive test of 100 to 150 items over 3 hours with a passing score of 700 out of 1000. This guide covers what each domain includes, how the adaptive exam works, ISC2's five-year experience requirement and the Associate of ISC2 path, and the new exam outline that takes effect on April 15, 2027. All exam facts come from ISC2's published pages, and the domain summaries are our own wording of the outline.
The Eight CISSP Domains and Their Weights
ISC2's current CISSP exam outline took effect on April 15, 2024. It has eight domains with average weights that add up to 100%. Domain 1, Security and Risk Management, is the largest at 16%, while Asset Security and Software Development Security are the smallest at 10% each.
| Domain | Name | Weight | What it covers |
|---|---|---|---|
| 1 | Security and Risk Management | 16% | Security concepts and governance, compliance and legal and regulatory issues, ethics, security policies and standards, business continuity requirements, personnel security, risk management, threat modeling and security awareness |
| 2 | Asset Security | 10% | Identifying and classifying information and assets, ownership, privacy, data retention, and choosing controls to handle data securely through its life |
| 3 | Security Architecture and Engineering | 13% | Secure design principles, security models, cryptography, secure system and facility design, and weaknesses in architectures and systems |
| 4 | Communication and Network Security | 13% | Network models and secure network design, network components, secure communication channels, wireless and VPN technologies |
| 5 | Identity and Access Management (IAM) | 13% | Physical and logical access control, identification and authentication, federated identity, authorization mechanisms and the identity and access provisioning lifecycle |
| 6 | Security Assessment and Testing | 12% | Assessment and test strategies, security control testing, collecting security process data, analyzing test output, and internal, external and third-party audits |
| 7 | Security Operations | 13% | Investigations, logging and monitoring, configuration and change management, incident management, disaster recovery, resource protection and physical security operations |
| 8 | Software Development Security | 10% | The software development lifecycle, security controls in development environments, secure coding, assessing software security and the risks of acquired software |
The weights are averages, so the share of questions from each domain on your particular exam can vary. The summaries above are our own wording, and ISC2's outline is the authoritative source for the exact topics.
How the CISSP Exam Works
The CISSP uses computerized adaptive testing (CAT), which means the exam adjusts to your answers and its length varies. According to ISC2, the exam has 100 to 150 items, a time limit of 3 hours, multiple-choice and advanced item types, and a passing score of 700 out of 1000 points. It is offered in Chinese, English, German, Japanese and Spanish at ISC2-authorized Pearson testing centers, and Chinese-language exams are offered only during select windows.
| Exam fact | CISSP |
|---|---|
| Format | Computerized adaptive testing (CAT) |
| Items | 100 to 150 |
| Time limit | 3 hours |
| Passing score | 700 out of 1000 |
| Item types | Multiple choice and advanced item types |
| Languages | Chinese, English, German, Japanese, Spanish |
Because the test is adaptive, you cannot skip ahead or return to earlier questions the way you can on a fixed-form exam, so pacing and a steady answer-by-answer approach matter.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Experience Requirements and the Associate Path
ISC2 requires a minimum of five years of cumulative, full-time work experience in at least two of the eight CISSP domains. A four-year bachelor's or master's degree in computer science, information technology or a related field, or a credential from ISC2's approved list, can satisfy up to one year of the requirement.
If you pass the exam without the required experience, you can become an Associate of ISC2 and then have six years to earn the five years of experience. This makes the exam reachable earlier in a career, but the credential is not the full CISSP until the experience requirement is met.
What Changes on April 15, 2027
ISC2 says the CISSP exam will move to a new outline on April 15, 2027. ISC2's page links to the new outline but does not list its domains or weights in the page text, so read the new outline PDF on ISC2's site for the exact changes. If you plan to take the exam before that date, study the current outline. If you plan to test after it, study the new one. Confirm which outline applies to your test date on ISC2's site before you start.
How to Approach CISSP Study
The CISSP is a management-level exam, and widely shared advice from successful candidates is to answer as a risk-focused manager would, choosing the response that best serves the organization and its business objectives, not the most technical option. Treat that as a study heuristic, not an official ISC2 statement.
Study by domain, weighted by size
Give Domain 1 the most attention at 16%, then spread time across the 12% to 13% domains, and keep the two 10% domains in rotation so they do not fade.
Practice with scenarios, not definitions
Management-level questions ask for the best or most appropriate action in a situation, so practice choosing between several plausible answers and explaining why the others are worse.
Space your review over weeks
A widely cited review of learning techniques rated practice testing and spaced practice as high utility. Return to each domain several times instead of studying it once.
Simulate the adaptive format
Practice in long sessions of 100 or more questions so you are used to sustained focus over up to 3 hours with no going back.
CISSP Compared With Security+
Security+ is a foundational exam with a fixed form of up to 90 questions in 90 minutes, and CompTIA's V8 page recommends two years as a security administrator. The CISSP is a senior-level exam with a five-year experience requirement, an adaptive 100 to 150 item format over 3 hours, and a management and risk emphasis. Many people take Security+ early in a security career and the CISSP after several years of experience. See our guide to which CompTIA certification to take first for the CompTIA side of that path, and our CISSP vs CISM vs CEH comparison for how the CISSP stacks up against other senior credentials.
Studying With DD Academy
DD Academy includes CISSP flashcards and practice exams organized by the eight domains, with an AI tutor that explains why each option is right or wrong. It is free to start on iPhone and the web.
The bottom line
Know the eight domains and weight your study by size, practice with scenario questions that reward management-level judgment, and rehearse the adaptive format with long sessions. Confirm which outline applies to your test date, since the exam changes on April 15, 2027, and check ISC2's experience rules before you plan your timeline.
Frequently asked questions
How many domains are on the CISSP exam?
Eight: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security.
What are the CISSP domain weights?
Under the outline effective April 15, 2024: Security and Risk Management 16%, Asset Security 10%, Security Architecture and Engineering 13%, Communication and Network Security 13%, Identity and Access Management 13%, Security Assessment and Testing 12%, Security Operations 13%, and Software Development Security 10%.
How many questions are on the CISSP exam?
The CISSP uses computerized adaptive testing with 100 to 150 items in a 3 hour time limit. The number of questions you see depends on how the adaptive engine evaluates your answers.
What is the passing score for the CISSP?
ISC2 lists a passing score of 700 out of 1000 points. Because the exam is adaptive, the scoring works differently from a fixed-form exam, and ISC2's exam information explains the details.
How much experience do you need for the CISSP?
ISC2 requires five years of cumulative, full-time experience in at least two of the eight domains. A relevant degree or an approved credential can satisfy up to one year. You can pass the exam without the experience and become an Associate of ISC2, then earn the experience within six years.
When does the CISSP exam outline change?
ISC2 says the exam moves to a new outline on April 15, 2027. The current outline took effect on April 15, 2024. Check ISC2's exam outline page to see which outline applies to your test date.
Is the CISSP harder than Security+?
They are aimed at different levels. Security+ is foundational with a fixed 90 minute exam, while the CISSP is senior-level with five years of required experience, an adaptive exam of up to 3 hours and a management emphasis. ISC2 and CompTIA do not publish difficulty comparisons.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
