A 90-Day CISSP Study Plan: Week-by-Week Roadmap for Working Professionals

The most common failure in CISSP preparation is not intellectual; it is logistical. Most candidates are mid-career cybersecurity practitioners, systems engineers, or IT managers balancing 45-hour workweeks, family commitments, and demanding on-call rotations. When confronted with a 1,200-page official textbook, they either attempt to cram in a frantic four-week sprint (resulting in shallow memorization) or stretch their studies across twelve months (resulting in forgetting the early domains by the time they finish the later ones).

Ninety days (12 weeks) is the empirical sweet spot. It is long enough to deeply internalize the managerial decision-making mindset and cover all eight domains with rigorous question analysis, yet short enough to maintain cognitive momentum and prevent knowledge decay.

This roadmap is engineered specifically for working professionals. It assumes a sustainable commitment of 15 to 18 hours per week: two hours per weekday (one hour before work, one hour in the evening) and five to six hours across the weekend, with one full rest day every week to prevent burnout.

The Four Phases of the 90-Day Roadmap

Phase 1: Foundations, Assets & Architecture (Weeks 1–4)

Week 1: Domain 1 — Security Governance, Ethics & Compliance

Begin with the bedrock of the CBK. Cross-reference your syllabus against the official ISC2 CISSP Exam Outline, then study the ISC2 Code of Ethics (the preamble and four mandatory canons). Understand the legal distinctions between criminal, civil, and regulatory law, with special attention to intellectual property protections (patents, copyrights, trademarks, trade secrets). Learn the fundamental difference between Due Diligence (investigative verification) and Due Care (acting responsibly).

Week 2: Domain 1 — Risk Management & Business Continuity Planning

Master the quantitative risk formulas outlined in our CISSP risk management guide: $SLE = AV \times EF$, $ALE = SLE \times ARO$, and how to calculate the net cost-benefit of security countermeasures. Understand the steps of Business Continuity Planning (BCP): project initiation, Business Impact Analysis (BIA), recovery strategy selection, and plan approval.

Week 3: Domain 2 — Asset Security & Data Governance

Analyze data classification models across military and commercial standards. Memorize data destruction terminology: clearing (overwriting with non-sensitive data), purging (degaussing or cryptographic erasure that prevents recovery even with lab equipment), and physical destruction (incineration, shredding). Distinguish clearly between the Data Owner (fiduciary accountability) and Data Custodian (operational administration).

Week 4: Domain 3 — Security Architecture, Models & Cryptography

Demystify security models: Bell-LaPadula ("Simple Security: no read up; *-Property: no write down") for confidentiality, and Biba ("Simple Integrity: no read down; *-Property: no write up") for integrity. Review symmetric vs. asymmetric cryptographic primitives as detailed in our guide on what to understand in CISSP cryptography, emphasizing key management lifecycles and PKI certificate revocation (CRL vs. OCSP).

“End of Phase 1 Checkpoint: Complete a 50-question diagnostic quiz covering Domains 1, 2, and 3. Do not proceed until you can explain why senior management owns risk and why human safety overrides all technical countermeasures.”

Phase 2: Networks, Identity & Assurance (Weeks 5–8)

Week 5: Domain 4 — Network Architecture & Secure Protocols

Review the OSI 7-layer stack, focusing on the attack vectors and security controls native to each layer. Understand IPsec in depth: Authentication Header (AH) for integrity/authentication without confidentiality vs. Encapsulating Security Payload (ESP) for encryption. Compare transport mode (host-to-host) with tunnel mode (gateway-to-gateway). Review software-defined networking (SDN) and Zero Trust micro-segmentation.

Week 6: Domain 5 — Identity and Access Management (IAM)

Study the IAAA model: Identification, Authentication, Authorization, and Accountability. Compare Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC). Study federation protocols: SAML (XML-based web SSO), OAuth 2.0 (delegated authorization), and OpenID Connect (identity layer on top of OAuth). Review our dedicated analysis of IAM architecture for CISSP.

Week 7: The Mid-Point Plateau & Domain 6 (Security Assessment)

Week 7 is when cognitive fatigue typically sets in. Acknowledge the fatigue and shift your study method to high-engagement practical questions. In Domain 6, study vulnerability assessments vs. penetration testing (black-box vs. white-box vs. gray-box). Understand code review approaches: Static Application Security Testing (SAST) vs. Dynamic Application Security Testing (DAST).

Week 8: Mid-Term Comprehensive Review

Do not introduce new material this week. Revisit all flashcards, notes, and error logs from Domains 1 through 6. Complete two timed 50-question mixed quizzes. Identify your lowest-scoring domain and spend three targeted hours re-reading the corresponding chapters.

Phase 3: Operations, Software & Incident Response (Weeks 9–10)

Week 9: Domain 7 — Security Operations & Incident Management

Study the incident response lifecycle: Detection, Containment, Eradication, Recovery, and Lessons Learned. Master digital forensics principles: the Order of Volatility (CPU registers/cache, routing tables/ARP cache/RAM, temporary files, disk drives, remote logs, archival backup media) and chain of custody documentation. Understand disaster recovery sites: cold (empty shell), warm (hardware present, data missing), and hot (fully synchronized live replica).

Week 10: Domain 8 — Software Development Security

Understand the shift from Waterfall to Agile and DevSecOps. Learn how to secure the continuous integration/continuous deployment (CI/CD) pipeline. Review the OWASP Top 10 vulnerabilities (Injection, Broken Authentication, Sensitive Data Exposure, XML External Entities, Broken Access Control, Security Misconfiguration, Cross-Site Scripting). Study software maturity models and third-party software supply chain risk management.

Phase 4: Full Synthesis, CAT Pacing & Taper (Weeks 11–12)

Week 11: Full-Length Mocks & Distractor Analysis

Take your first full-length 125-question mixed-domain practice exam under strict exam conditions: no notes, no phone, 3-hour timer. As emphasized in our guide on using practice questions effectively, spend twice as much time reviewing the post-mortem of your test as you did taking it. Categorize every error into knowledge deficits, reading errors, or technical mindset traps.

Week 12: Taper Week & Mental Preparation

The final week is about cognitive consolidation and physical rest, not cramming.

• Monday & Tuesday: Review only high-yield governance summary sheets: BCP steps, quantitative risk formulas, incident response sequences, and security models.
• Wednesday: Complete one light 30-question warm-up quiz to keep your reading rhythm sharp. Re-read our guide on reading scenario questions.
• Thursday: Review test-center logistics: verify two valid forms of government ID, locate the Pearson VUE test center, and plan your commute.
• Friday (Day Before Exam): Put books away by 2:00 PM. Take a long walk, eat a balanced dinner, stay hydrated, and sleep for at least 8 hours. No last-minute cramming.
• Saturday (Exam Day): Arrive at the test center 30 minutes early, trust your 90 days of disciplined preparation, and execute the CISO decision-making process. Read our full checklist on what to expect on exam day.

Consistency beats intensity. Two focused hours every morning will compound into invincible confidence over 90 days. Start today with Domain 1, track your errors faithfully, and take ownership of your journey toward CISSP certification.