ISC2
CISSP
Certified Information Systems Security Professional
The gold-standard certification for senior security practitioners and managers, covering eight domains from risk management to software security. Frequently required for security leadership and US DoD 8570/8140 roles.
Full program: 8 decks, 865 cards.
What's on the exam
CISSP Exam Outline (effective April 2024)
Security and Risk Management
16%Security governance and the CIA triad · Compliance and legal/regulatory issues · Risk management concepts · Security policies and awareness · Business continuity requirements
Asset Security
10%Data and asset classification · Asset handling and retention · Data lifecycle and roles · Data security controls (DLP, DRM)
Security Architecture and Engineering
13%Security models and design principles · Cryptography · Vulnerabilities of system architectures · Site and facility security · Security capabilities of information systems
Communication and Network Security
13%Secure network design · OSI and TCP/IP models · Secure protocols · Network components and segmentation · Secure communication channels
Identity and Access Management (IAM)
13%Identification and authentication · Federated identity and SSO · Authorization mechanisms · Identity lifecycle management · Access control models
Security Assessment and Testing
12%Vulnerability assessments · Penetration testing · Security audits · Log review and test output analysis · Security control testing strategies
Security Operations
13%Incident management · Logging and monitoring (SIEM) · Disaster recovery · Investigations and digital forensics · Patch and change management
Software Development Security
10%Security in the SDLC · Secure coding guidelines · Software security testing · Development environment security · Risk of acquired software
Frequently asked questions
How much does the CISSP cost?
The CISSP costs $749. Plus ISC2 annual maintenance fee after certification.
How long is the CISSP and how many questions does it have?
100–150 items (English CAT) — Up to 3 hours (English CAT).
What do you need to pass the CISSP?
Scaled score of 700 out of 1000.
Can you retake the CISSP?
30 days after first attempt; longer waits for subsequent attempts (max 4 per 12 months).
What is the best way to study for the CISSP?
Start from the official outline and your primary study materials: the exam is weighted by domain (Security and Risk Management 16%, Asset Security 10%, Security Architecture and Engineering 13%, Communication and Network Security 13%, Identity and Access Management (IAM) 13%, Security Assessment and Testing 12%, Security Operations 13%, Software Development Security 10%). Once you've learned the material, spaced-repetition flashcards organized by those domains are an efficient way to retain it and refresh it before test day.
Ready to prepare?
Our CISSP program is organized by this outline's domains and scheduled by spaced repetition, with a path from first card to test day.
Flashcards are a memory tool. Learn the material first, then use NoReread to retain it and refresh what you already know. It doesn't replace studying the subject.