CISSP — Certified Information Systems Security Professional Guide

The CISSP is the gold standard in cybersecurity certification. It validates your ability to design, implement, and manage a best-in-class cybersecurity program. Required or preferred for most senior security roles worldwide.

Exam Overview

Detail	Value
Provider	ISC2
Questions	100–150 (Computerized Adaptive Testing)
Length	3 hours (up to 4 hours for non-English)
Passing Score	700 (on a scale of 100–1000)
Validity	3 years
Price	~$749 USD
Prerequisites	5 years of paid security experience in 2+ domains

The Eight Domains

Domain	Weight	New for 2024
Security and Risk Management	16%	—
Asset Security	10%	—
Security Architecture and Engineering	13%	—
Communication and Network Security	13%	—
Identity and Access Management (IAM)	13%	—
Security Assessment and Testing	12%	—
Security Operations	13%	—
Software Development Security	10%	—

Domain Deep Dives

Domain 1: Security and Risk Management (16%)

CIA Triad — Confidentiality, Integrity, Availability
Governance — Policies, standards, procedures, guidelines
Risk Management — NIST SP 800-37, ISO 31000, FAIR, risk assessment (qualitative/quantitative)
Legal & Compliance — GDPR, HIPAA, PCI DSS, SOX, DMCA, Computer Fraud and Abuse Act
Ethics — ISC2 Code of Ethics (Protect society, Act honorably, Provide diligent service, Advance the profession)
Business Continuity — BCP, DRP, BIA, RTO, RPO, MTD
Security Awareness — Training, phishing simulations, culture

Domain 2: Asset Security (10%)

Data Classification — Public, Internal, Confidential, Restricted / Top Secret, Secret, Confidential
Data Lifecycle — Create → Store → Use → Share → Archive → Destroy
Data Ownership — Data owner, data steward, data custodian, data user
Protection Mechanisms — DLP, encryption (at rest/in transit), tokenization, masking, obfuscation
Retention Policies — Legal hold, retention schedules, secure disposal (shredding, degaussing)

Domain 3: Security Architecture and Engineering (13%)

Security Models — Bell-LaPadula (confidentiality), Biba (integrity), Clark-Wilson (integrity), Brewer-Nash (Chinese Wall)
System Architecture — Ring model, TCB, reference monitor, security kernel, TPM, HSM
Cryptography — Symmetric (AES, 3DES), Asymmetric (RSA, ECC), Hash (SHA-2/3), PKI, digital signatures, certificates
Physical Security — Locks, fences, bollards, biometrics, mantrap, CCTV, safes

Domain 4: Communication and Network Security (13%)

OSI Model — Understand all 7 layers and their security implications
Network Protocols — TCP/IP, UDP, DNS, DHCP, ARP, ICMP, HTTP/HTTPS, TLS, IPsec, SSH
Network Architecture — DMZ, VLAN, VPN, NAC, segmentation, micro-segmentation, zero trust
Secure Protocols — TLS 1.3, IPsec, SSH, SFTP, HTTPS, DNSSEC
Network Attacks — DDoS, MITM, spoofing, session hijacking, DNS poisoning, ARP poisoning

Domain 5: Identity and Access Management (13%)

Identity Management — Provisioning, deprovisioning, SSO, federated identity, SAML, OAuth, OpenID Connect
Authentication Factors — Something you know (password), have (token), are (biometrics), do (signature)
Authentication Methods — PAP, CHAP, Kerberos, RADIUS, TACACS+, LDAP
Access Control Models — DAC, MAC, RBAC, ABAC
Privilege Management — Least privilege, separation of duties, need-to-know, privilege creep

Domain 6: Security Assessment and Testing (12%)

Assessment Techniques — Vulnerability scanning, penetration testing (black/gray/white box)
Logging and Monitoring — SIEM, log review, audit trails, chain of custody
Testing Types — SAST (static analysis), DAST (dynamic analysis), IAST, RASP
Auditing — Internal vs external audits, compliance audits, SOC 2, SOX, PCI DSS
Penetration Testing Standards — PTES, OSSTMM, OWASP Testing Guide

Domain 7: Security Operations (13%)

Incident Response — Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned (NIST)
Disaster Recovery — Hot site, warm site, cold site, mobile site, cloud site
Forensics — Evidence collection (order of volatility), chain of custody, forensic imaging
Backup Strategies — Full, incremental, differential, grandfather-father-son (GFS) rotation
Resource Protection — Asset management, configuration management, change management

Domain 8: Software Development Security (10%)

SDLC Security — Secure SDLC, DevSecOps, shift-left security
Development Models — Waterfall, Agile, Scrum, DevOps, spiral
OWASP Top 10 — SQL injection, XSS, broken authentication, sensitive data exposure
Security in the Pipeline — CI/CD security, SAST, DAST, dependency scanning, container scanning
Cloud Security — Shared responsibility model, IaaS/PaaS/SaaS, CASB, CWPP, CSPM

Study Tips

Think like a manager — The CISSP is a management-level cert. Answers are about what's best for the organization long-term, not the quickest technical fix
Understand concepts, not memorization — Don't memorize port numbers; understand why Kerberos is used
Know the "best answer" — Many questions have multiple technically correct answers; pick the best one
Learn the models — Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash are frequently tested
Understand cryptography differences — Symmetric (fast, key distribution problem) vs Asymmetric (slower, key pairs)
Study the BCP/DR lifecycle — BIA → Strategy → Plan → Test → Maintain

Practice Questions

Test your knowledge with our CISSP practice questions — 50+ questions covering all eight domains with detailed explanations.

Start Practice →

Career Impact

CISSP opens doors to senior cybersecurity roles:

Chief Information Security Officer (CISO) — $180k–$300k+
Security Director / Manager — $140k–$200k
Security Architect — $130k–$180k
Security Consultant — $120k–$170k
Security Auditor — $110k–$160k

Beyond CISSP

After CISSP, consider:

ISSAP — Architecture Professional (concentration)
ISSEP — Engineering Professional (concentration)
ISSMP — Management Professional (concentration)
CISM — Certified Information Security Manager (ISACA)
CISA — Certified Information Systems Auditor (ISACA)

CISSP Exam Guide — Certified Information Systems Security Professional