Skip to content
CertGPS
Study guide

CISSP Study Guide: The Adaptive Exam, the Five-Year Rule and a Realistic Plan

CISSP in late 2026: the $749 adaptive exam of 100 to 150 items, the 2024 outline and its AI guidance, the five-year experience rule, a study plan and upkeep.

TW
Thomas Wilson
Network Security Specialist
Published
Updated
Read time
7 min
On this page

Related certifications

Topics

CISSP Study Guide: The Adaptive Exam, the Five-Year Rule and a Realistic Plan

The Certified Information Systems Security Professional (CISSP) is ISC2's credential for people who design and run a security program rather than a single control. The exam is the smaller hurdle. To hold the certification you need five years of full-time work in at least two of its eight domains, endorsed by another ISC2 member, and you can pass the exam years before you have them.

Who should sit the CISSP

The credential suits security engineers moving into architecture, security managers, consultants and anyone heading for a chief information security officer (CISO) track, typically five or more years into a security career. It's also approved under the US Defense Department's DoDM 8140.03 manual, which matters for government and contractor roles.

If you're short on experience, the exam is still open to you. Passing without the five years makes you an Associate of ISC2, with six years to earn them. If your work is deep in one area, a narrower credential may serve you better: CCSP for cloud, or SSCP if you run controls rather than set policy. People whose job is governance and reporting to a board might prefer ISACA's CISM.

The exam in one table

FormatComputerized adaptive testing (CAT) in every language; multiple choice and advanced item types
Questions100 to 150, including 25 unscored pretest items
Time3 hours, breaks included
Passing standard700 out of 1000; results are pass or fail, without a score
Price$749 standard registration in the Americas and Asia Pacific
DeliveryPearson VUE test centers in English, Chinese, German, Japanese or Spanish; Chinese only in March, June, September and December
ExperienceFive years cumulative, full-time, in two or more domains; a degree or an approved credential can waive one year
Maintenance$135 annual fee and 120 CPE credits per three-year cycle
Retakes30, 60, then 90 test-free days; at most four attempts in 12 months

Eight domains, weighted almost evenly

The outline in force took effect on April 15, 2024:

  • Security and Risk Management, 16%
  • Asset Security, 10%
  • Security Architecture and Engineering, 13%
  • Communication and Network Security, 13%
  • Identity and Access Management (IAM), 13%
  • Security Assessment and Testing, 12%
  • Security Operations, 13%
  • Software Development Security, 10%

Domain 1 is the heaviest and the broadest, covering ethics, governance, law, investigations, business continuity, personnel security, threat modeling, supply chain risk and awareness programs. Everything else falls between 10% and 13%, which means a weak domain can't hide. The 2024 outline brought in secure access service edge (SASE), quantum key distribution and cybersecurity insurance as a risk treatment.

In April 2026 ISC2 published Exam Guidance for Artificial Intelligence, updated in September, and added a section to the CISSP outline page on how AI runs through all eight domains. Within the existing domains, it names AI-specific tasks: training data and model weights as assets to classify, prompt injection as an input-validation problem, AI agents as identities that need least privilege, model drift as something operations must monitor, and code written by large language models as a software supply chain risk. ISC2 has now published a successor effective April 15, 2027. The current outline remains the reference for sittings before that date; use the upcoming PDF for later appointments.

The adaptive format shapes how the exam feels. Each question is chosen so that you have about a 50% chance of answering it correctly, you can't return to an earlier item, and the test ends as soon as the algorithm is 95% confident about your result. ISC2 itself warns that candidates often feel they did poorly, because everyone answers only about half the items correctly. Read each question as an adviser to management would: several options may be technically right, and you're asked for the best one for the organization.

The announced April 2027 change

ISC2's upcoming PDF keeps the adaptive format, 100 to 150 items, three-hour limit and 700-of-1000 passing standard. It changes the domain weights: Security Governance and Risk Management and Identity and Access Management each become 13.6%; Asset Security becomes 12%; architecture, networks and operations each become 12.8%; assessment/testing and software development each become 11.2%.

The upcoming outline explicitly names passwordless authentication with FIDO, WebAuthn and passkeys, risk-adaptable access control, post-quantum cryptographic methods and AI threats including model poisoning and deepfake attacks. These are examples from the published objectives, not a complete change list or proof that related knowledge could not be tested before. The CISSP 2027 update compares both outlines.

Choose preparation according to the exam date. An existing book can remain useful, but compare it with the applicable PDF and fill gaps rather than assuming its edition guarantees coverage. Do not rush an unready attempt simply to sit before the changeover.

How to prepare

Plan on three to five months if you study around a full-time job, with more time for the domains your career hasn't touched.

The materials to build on:

  • ISC2 CISSP Official Study Guide, 10th edition, by Mike Chapple, James Michael Stewart and Darril Gibson (Wiley, 2024), written to the 2024 outline.
  • ISC2 CISSP Official Practice Tests, 4th edition, by Mike Chapple and David Seidl (Wiley, 2024), with questions by domain and four full practice exams.
  • Destination CISSP, 2nd edition (Destination Certification, 2024), a shorter guide built around diagrams, plus the same company's free MindMap videos.
  • ISC2's own online self-paced, online instructor-led and classroom courses, which come with a free retake of the course if you fail on the first attempt.

Begin with a diagnostic practice test so you know which domains are new to you. Spend the first half of your time reading the study guide in domain order and the second half on mixed questions, reviewing every wrong answer until you can say why the right one is better. If you come from engineering, expect Domains 1 and 6 to need extra hours. If you come from management, it's more likely Domains 3 and 4, where cryptography, security models such as Bell-LaPadula and Biba, and network design live. In the final weeks, sit timed sets of 150 questions in three hours and answer each one once, as the real exam requires.

Endorsement, maintenance and what comes next

After you pass, you have nine months to submit the endorsement application. An active ISC2 credential holder who knows your work attests to your experience, and ISC2 will act as endorser if you don't know one. A relevant bachelor's or master's degree, or a credential on ISC2's approved list (Security+, CySA+, CCNA and CISM among them), counts for one year, and only one year can be waived. Part-time work and internships count too.

Keeping the certification costs $135 a year, the single annual maintenance fee that covers every ISC2 certification you hold. You also need 120 continuing professional education (CPE) credits per three-year cycle, at least 90 in Group A; ISC2 suggests 40 a year. Miss either requirement and there's a 90-day grace period, then suspension.

Natural next steps:

  • CCSP if your organization's systems are moving to the cloud.
  • CISA if you work alongside audit or want to move into it.
  • CISM if you're heading toward running a security program rather than designing it.

Our view

CISSP's reputation comes from its experience gate and its breadth. We read it as evidence that someone has done security work for years and can talk to auditors, engineers and executives in their own terms, and the endorsement step gives that claim more weight than a pass result alone.

The criticism is fair too. The exam is broad and shallow by design, and the managerial framing rewards knowing ISC2's preferred answer over knowing how to configure anything. It proves breadth of judgment, and you'll still need a specialist credential to prove depth.

At $749 plus $135 a year, it's worth it once you're within reach of the five years and want management, architecture or consulting roles. If you're two years in, the money buys an associate designation and a long wait.

Sources

CISSP and ISC2 are trademarks of their respective owner. CertGPS is an independent resource and is not affiliated with, endorsed by, or sponsored by ISC2.