Table of Contents

CISSP covers eight security domains and requires qualifying experience for certification. Check the current ISC2 exam outline and experience rules before applying or booking. Exam format and policies change.

Return to the Cybersecurity Career Playbook .

Check Eligibility

ISC2 requires five years of cumulative qualifying experience in at least two of the eight domains. Certain approved degrees or credentials satisfy up to one year of that requirement. Qualifying part-time work and internships also count under ISC2’s published rules. Document dates, duties, and endorsers. If you pass the exam before meeting the experience requirement, ISC2 offers the Associate of ISC2 route while you gain the remaining experience. Do not list yourself as CISSP certified until ISC2 grants that status.

Use the Current Exam Outline

The published CISSP exam uses computer adaptive testing with 100 to 150 items over three hours and a passing grade of 700 out of 1,000. Confirm these details on the official outline before booking. The domains are Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security.

Work through the CISSP course and map each official objective to a lesson, a workplace example, or a study gap. Practice choosing a justified risk treatment, owner, and verification method in addition to recognizing terms. Avoid memorized answers without understanding scope and business impact.

Build a Review Record

For one synthetic organization, write an asset inventory, a risk register entry, a control choice, a test plan, and an incident decision record. Identify assumptions and who approves each decision. Ask a peer to explain your reasoning back to you. If they cannot reconstruct the decision from your evidence, improve the record.

Use the CISSP practice test to find recall gaps. Follow the ISC2 exam policies for registration and approved study material. A practice result alone does not establish qualification or operational skill.