All certifications
ISC2CISSP (2024 outline)
CISSP – Certified Information Systems Security Professional
Exam overview, official domain weights and free sample questions. Subscribers get 230 practice questions, 110 flashcards, 11 labs, a study guide and video lessons for this exam.
Exam at a glance
- Exam code
- CISSP (2024 outline)
- Questions
- 100–150 (CAT)
- Time
- 180 minutes
- Question types
- multiple choice, advanced item types
- Passing score
- 700 out of 1000
- Exam fee
- US $749 (Americas, APAC, Middle East, Africa). EUR 719.04 (EMEA). GBP 606.69 (UK)
- Delivery
- ISC2-authorized Pearson VUE test centers
- Prerequisites
- 5 years of cumulative full-time experience in 2+ of the 8 domains (1 year can be waived). Without it, you become an Associate of ISC2
- Renewal
- 120 CPEs over 3 years, plus a US $135 annual maintenance fee
- Version notes
- New exam outline effective April 15, 2027
From the official exam page (checked 2026-11-09). Always confirm details with the vendor: official exam page, official objectives.
Domains and weights
Security and Risk Management16%
- 1.1 Understand, adhere to, and promote professional ethics
- 1.2 Understand and apply security concepts
- 1.3 Evaluate and apply security governance principles
- 1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context
- 1.5 Understand requirements for investigation types
- 1.6 Develop, document, and implement security policy, standards, procedures, and guidelines
- 1.7 Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements
- 1.8 Contribute to and enforce personnel security policies and procedures
- 1.9 Understand and apply risk management concepts
- 1.10 Understand and apply threat modeling concepts and methodologies
- 1.11 Apply Supply Chain Risk Management (SCRM) concepts
- 1.12 Establish and maintain a security awareness, education, and training program
Asset Security10%
- 2.1 Identify and classify information and assets
- 2.2 Establish information and asset handling requirements
- 2.3 Provision information and assets securely
- 2.4 Manage data lifecycle
- 2.5 Ensure appropriate asset retention
- 2.6 Determine data security controls and compliance requirements
Security Architecture and Engineering13%
- 3.1 Research, implement and manage engineering processes using secure design principles
- 3.2 Understand the fundamental concepts of security models
- 3.3 Select controls based upon systems security requirements
- 3.4 Understand security capabilities of Information Systems
- 3.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements
- 3.6 Select and determine cryptographic solutions
- 3.7 Understand methods of cryptanalytic attacks
- 3.8 Apply security principles to site and facility design
- 3.9 Design site and facility security controls
- 3.10 Manage the information system lifecycle
Communication and Network Security13%
- 4.1 Apply secure design principles in network architectures
- 4.2 Secure network components
- 4.3 Implement secure communication channels according to design
Identity and Access Management13%
- 5.1 Control physical and logical access to assets
- 5.2 Design identification and authentication strategy
- 5.3 Federated identity with a third-party service
- 5.4 Implement and manage authorization mechanisms
- 5.5 Manage the identity and access provisioning lifecycle
- 5.6 Implement authentication systems
Security Assessment and Testing12%
- 6.1 Design and validate assessment, test, and audit strategies
- 6.2 Conduct security control testing
- 6.3 Collect security process data
- 6.4 Analyze test output and generate report
- 6.5 Conduct or facilitate security audits
Security Operations13%
- 7.1 Understand and comply with investigations
- 7.2 Conduct logging and monitoring activities
- 7.3 Perform Configuration Management (CM)
- 7.4 Apply foundational security operations concepts
- 7.5 Apply resource protection
- 7.6 Conduct incident management
- 7.7 Operate and maintain detection and preventative measures
- 7.8 Implement and support patch and vulnerability management
- 7.9 Understand and participate in change management processes
- 7.10 Implement recovery strategies
- 7.11 Implement Disaster Recovery (DR) processes
- 7.12 Test Disaster Recovery Plans (DRP)
- 7.13 Participate in Business Continuity (BC) planning and exercises
- 7.14 Implement and manage physical security
- 7.15 Address personnel safety and security concerns
Software Development Security10%
- 8.1 Understand and integrate security in the Software Development Life Cycle (SDLC)
- 8.2 Identify and apply security controls in software development ecosystems
- 8.3 Assess the effectiveness of software security
- 8.4 Assess security impact of acquired software
- 8.5 Define and apply secure coding guidelines and standards
Free sample questions
Original questions in the style of the exam. Pick an answer to see the explanation.
Sample question 1 · Security and Risk Management
After a breach of customer records, the board asks who is ultimately accountable for the protection of that data. What is the BEST answer?
Incorrect — “The CISO”: The CISO is responsible for running the security program, but ultimate accountability stays with senior leadership. Incorrect — “The database administrators”: DBAs are custodians who implement protections on the owner's behalf; they are not ultimately accountable. Incorrect — “The external auditor”: Auditors provide independent assurance; they do not own or protect the data. Correct — “Senior management”: Accountability for protecting information assets rests with senior management; it can delegate responsibility but not accountability.
Sample question 2 · Asset Security
Who should decide the classification level of a new customer analytics database?
Correct — “The data owner”: The data owner, a business manager accountable for the data, sets classification and access requirements. Incorrect — “The data custodian”: Custodians implement and maintain the protections the owner specifies. Incorrect — “The end users of the database”: Users must follow classification rules but do not set them. Incorrect — “The security administrator”: Security administrators configure controls; they do not decide business classification.
Sample question 3 · Security Architecture and Engineering
On a system, a user cleared for Secret can read Confidential files but is blocked from writing to an Unclassified share. Which model enforces this?
Incorrect — “Biba”: Biba protects integrity with no read down and no write up, the opposite direction. Correct — “Bell-LaPadula”: Bell-LaPadula protects confidentiality: no read up (simple security property) and no write down (*-property). Incorrect — “Clark-Wilson”: Clark-Wilson enforces integrity through well-formed transactions and separation of duties, not clearance levels. Incorrect — “Brewer-Nash”: Brewer-Nash prevents conflicts of interest based on what a user has already accessed.
Unlock every question, lab and guide
Full access to all 20 certifications for $4.99/month. Cancel anytime.