ISC2 has announced that the CISSP exam will use a new outline from April 15, 2027, and has published the upcoming PDF. As of October 2026, that replaces speculation about whether a refresh will happen. The April 2024 outline still governs current sittings, so the first preparation decision is which outline applies to your intended exam date.
The date comes from an explicit issuer notice
The official CISSP outline page now links both the current and upcoming documents. Its notice gives the effective date directly. A prediction based on a refresh cycle or a job task analysis workshop is no longer needed to establish when the change occurs.
For an appointment before the changeover, continue checking your preparation against the current outline. For one on or after the changeover, use the upcoming PDF as the reference. We would save the relevant document with the exam plan and check the issuer page again when booking or changing an appointment.
Do not move an exam solely to avoid a different outline. Compare your actual readiness and available preparation time first. An earlier sitting is useful only when you can prepare adequately; a later sitting needs a deliberate review of the new objectives.
The domain weights change
The table compares ISC2's current April 2024 PDF with its published April 2027 PDF. The domain names remain recognizable, although Domain 1 adds Governance to its title.
| Domain | Current outline | April 2027 outline |
|---|---|---|
| Security Governance and Risk Management | 16% | 13.6% |
| Asset Security | 10% | 12% |
| Security Architecture and Engineering | 13% | 12.8% |
| Communication and Network Security | 13% | 12.8% |
| Identity and Access Management | 13% | 13.6% |
| Security Assessment and Testing | 12% | 11.2% |
| Security Operations | 13% | 12.8% |
| Software Development Security | 10% | 11.2% |
Use these as the issuer's average exam weights, not a guaranteed number of questions in an adaptive sitting. A smaller percentage does not make a domain optional. A study plan should address weaknesses across the outline rather than simply allocate time in proportion to the table.
Explicit additions deserve a comparison with your notes
The upcoming PDF names passwordless authentication including FIDO, WebAuthn and passkeys, and adds risk-adaptable access control under authorization. Its architecture section explicitly includes post-quantum cryptographic methods and AI threats such as model poisoning and deepfake attacks.
Those are examples of published wording, not a complete change log or a claim that related knowledge was previously untestable. Compare the objectives directly. A topic appearing more explicitly in a new outline does not establish that every earlier course omitted it or that every future question will use that exact term.
For identity preparation, explain how a passwordless design changes authentication while authorization and account lifecycle responsibilities remain. For cryptography, connect the named methods with key management and implementation decisions. These are suggested exercises for understanding the scope, rather than predictions of specific exam questions.
The published exam format remains familiar
The upcoming PDF retains adaptive testing, 100–150 items, three hours and a 700-of-1000 passing standard. Its experience section still requires five years across at least two domains, with only one year available through an eligible substitution. The outline change does not remove the certification experience requirement.
Keep exam preparation separate from proving that experience. Candidates taking the exam early should follow the Associate of ISC2 route and its authorized designation. A new outline does not create a separate associate certification.
Update materials against the exam date
We would make a gap list from the applicable PDF, the study materials already owned and topics needing another source or exercise. Retain useful explanations from existing books while checking the changed wording directly. A publisher's edition number alone is not evidence that every objective is covered.
For a late-2026 sitting, the current CISSP update explains the separate AI guidance. For the broader experience and maintenance rules, use the CISSP guide. The useful next step is a preparation plan tied to the announced date and published outline, with any remaining uncertainty resolved through ISC2.
Sources
- ISC2 CISSP outline page: explicit April 15, 2027 notice and current/upcoming PDFs, checked October 2026
- ISC2 upcoming CISSP outline: 2027 weights, named topics, format and experience, checked October 2026
- ISC2 current CISSP outline: current weights and April 2024 effective date, checked October 2026